Versions Compared

Old Version 3

changes.mady.by.user Former user

Saved on

compared with

New Version Current

changes.mady.by.user Juan Tomás Alonso Nieto

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Expand
titleCheck source tables

  • box.win_nxlog.dhcp

  • ddi.infoblox.dhcp.dhcpd

  • dhcp.bluecat.dhcpd

  • dhcp.infoblox.stdout

  • dhcp.isc.stdout

  • dhcp.microsoft.ip4

  • dhcp.microsoft.ip6

  • dhcp.unix.stdout

  • firewall.paloalto.system

Table structure

This is the set of columns displayed by this union table, which is the result of the collection of columns present in all source tables: 

Note

Extra columns

Fields marked as Extra in the table below are not shown by default in data tables and need to be explicitly requested in the query. You can find them marked as Extra when you perform a query so they can be easily identified. Learn more about this in Selecting unrevealed columns.

Field

Data type

Type

Source field name

Extra fields

eventdate

timestamp

-

 

source

str

-srcIp

 

signature

str

-

 

source_ip

str

 

source_ipv4

ip4

-

srcIp

srcHost

source_hostname

str

-

srcHost

destMac

source_mac

str

-

srcMac

srcMac

destination_mac

str

-

destMac

description

str

-

 

leaseIpAddress

lease_ip

str

-

leaseIpAddress

leaseHardwareAddress

lease_mac

str

-

leaseHardwareAddress

message

str

-

 

rawTagged

str

-

 

rawMessage

str

-

 

hostchain

str

 

✓

tag

str

 

✓

Field transformations

Even though all source tables have several features in common, they have some particularities that make it necessary to undergo a set of transformations to harmonize them for the union table. The most common transformations comprise changes in the data type or the application of rules when several columns in the source table feed a single column in the union table. You can find below the detailed list of transformations in each source table. 

leaseIpAddress
Rw ui tabs macro
Rw tab
titleTables 1-35

[ box.win_nxlog.dhcp ] [ ddi.infoblox.dhcp.dhcpd ] [ dhcp.bluecat.dhcpd ] [ dhcp.infoblox.stdout ] [dhcp.microsoft.ip4]

Anchor

ddi

box.

infoblox

win_nxlog.dhcp

.dhcpd

ddi

box.

infoblox

win_nxlog.dhcp

.dhcpd

ddi

box.

infoblox

win_nxlog.dhcp

.dhcpd

Field in union table

Field in source table

Field transformation

Data type

Type

Extra fields

eventdate

eventdate

 

timestamp

source

-

Code Block
'
ddi
box.
infoblox
win_nxlog.dhcp
.dhcpd
'

str

signature

message_type

Category

 

str

source_ip

IPAddress_ip4

Code Block
str(IPAddress_ip4)

str

source_ipv4

source_ipv4

 

ip4

source_hostname

source_hostname

 

str

source_mac

source_mac

 

str

destination_mac

destination_mac

 

str

description

BndStatus

 

str

lease_ip

lease_ip

 

str

lease_mac

lease_mac

 

str

message

Message

 

str

srcIp

rawSource

-

Code Block
null(
ip4(
'
0.0.0.0
')
)
ip4
str
srcHost
rawTagged
-
 Code Block
null('')
str
rawMessage
rawMessage
 
str
hostchain
hostchain
 
str
✓
tag
tag
 
str
destMac
 Anchor
ddi.infoblox.dhcp.dhcpd
ddi.infoblox.dhcp.dhcpd
ddi.infoblox.dhcp.dhcpd
Field in union table
Field in source table
Field transformation
Type
Extra fields
eventdate
eventdate
 
timestamp
source
-
 Code Block
null('')
'ddi.infoblox.dhcp.dhcpd'
str
signature
message_type
 
str
srcMac
source_ip
-
 Code Block
null('')
str
source_ipv4
source_ipv4
 
ip4
source_hostname
source_hostname
 
str
source_mac
source_mac
 
str
destination_mac
destination_mac
 
str
description
-
 Code Block
null('')
str
leaseIpAddress
lease_ip
lease_ip
 
str
leaseHardwareAddress
leaseHardwareAddress
lease_mac
lease_mac
 
str
message
message
 
str
rawSource
rawMessage
 
str
rawTagged
tag
rawMessage
tag
 Code Block
tag + ": " + rawMessage
str
rawMessage
rawMessage
 
str
hostchain
hostchain
 
str
✓
tag
tag
 
str
✓
 Anchor
dhcp.bluecat.dhcpd
dhcp.bluecat.dhcpd
dhcp.bluecat.dhcpd
Field in union table
Field in source table
Field transformation
Data type Code Blocknull('')
Type
Extra fields
eventdate
eventdate
 
timestamp
source
-
 Code Block
'dhcp.bluecat.dhcpd'
str
signature
signature
 
str
source_ip
srcIp
 Code Block
str(srcIp)
str
source_ipv4
source_ipv4
 
ip4
srcHost
-
source_hostname
source_hostname
 
str
destMac
destMac
source_mac
source_mac
 
str
srcMac
srcMac
leaseHardwareAddress
-
 Code Block
null('')
destination_mac
destination_mac
 
str
description
-
 Code Block
null('')
str
leaseIpAddress
-
 Code Block
null('')
str
lease_ip
lease_ip
 
str
lease_mac
lease_mac
 
str
message
message
 
str
rawSource
rawSource
 
str
rawTagged
rawTagged
 
str
rawMessage
rawMessage
 
str
hostchain
hostchain
 
str
✓
tag
tag
 
str
✓
 Anchor
dhcp.infoblox.stdout
dhcp.infoblox.stdout
dhcp.infoblox.stdout
Field in union table
Field in source table
Field transformation
Data type
Type
Extra fields
eventdate
eventdate
 
timestamp
source
-
 Code Block
'dhcp.infoblox.stdout'
str
signature
packet
 
str
srcIp
source_ip
-
 Code Block
null
(ip4
('
0.0.0.0'))
ip4
srcHost
')
str
source_ipv4
source_ipv4
 
ip4
source_hostname
source_hostname
 
str
source_mac
source_mac
 
str
destination_mac
destination_mac
 
str
description
-
 Code Block
null('')
str
lease_ip
lease_ip
 
str
lease_mac
lease_mac
 
str
message
message
 
str
rawSource
rawSource
 
str
rawTagged
rawTagged
 
str
rawMessage
rawMessage
 
str
hostchain
hostchain
 
str
✓
tag
tag
 
str
destMac
✓
 Anchor
dhcp.isc.stdout
dhcp.isc.stdout
 dhcp.isc.stdout
Field in union table
Field in source table
Field transformation
Type
Extra fields
eventdate
eventdate
 
timestamp
source
-
 Code Block
null(
'
')
str
srcMac
-
 Code Blocknull('')
dhcp.isc.stdout'
str
signature
packet
 
str
source_ip
ofAddress
 
str
source_ipv4
source_ipv4
 
ip4
source_hostname
source_hostname
 
str
source_mac
source_mac
 
str
destination_mac
destination_mac
 
str
description
-
 Code Block
null('')
str
leaseIpAddress
leaseIpAddress
lease_ip
lease_ip
 
str
leaseHardwareAddress
leaseHardwareAddress
lease_mac
lease_mac
 
str
message
message
 
str
rawSource
rawSource
 
str
rawTagged
rawTagged
 
str
rawMessage
rawMessage
rawSource
 
str
hostchain
hostchain
 
str
✓
tag
tag
 
str
✓
 Rw tab
titleTables 46-69
[ dhcp.microsoft.ip4 ] [ dhcp.microsoft.ip6 ] [ dhcp.unix.stdout ] [ firewall.paloalto.system ]
 Anchor
dhcp.microsoft.ip4
dhcp.microsoft.ip4
dhcp.microsoft.ip4
Field in union table
Field in source table
Field transformation
Data type
Type
Extra fields
eventdate
eventdate
 
timestamp
source
-
 Code Block
'dhcp.infoblox.ip4'
str
signature
-
 Code Block
null('')
str
source_ip
srcIp
 Code Block
str(srcIp)
str
source_ipv4
source_ipv4
 
ip4
srcHost
srcHost Code Blocknull('')
source_hostname
source_hostname
 
str
destMac
-
source_mac
source_mac
 
str
srcMac
srcMac Code Blocknull('')
destination_mac
destination_mac
 
str
description
description
 
str
leaseIpAddress
-
 Code Blocknull('')
lease_ip
lease_ip
 
str
leaseHardwareAddress
-
lease_mac
lease_mac
 
str
message
-
 Code Block
null('')
str
rawSource
-
 Code Block
null('')
str
rawTagged
rawTagged
 
str
rawMessage
rawMessage
 
str
hostchain
hostchain
 
str
✓
tag
tag
 
str
✓
 Anchor
dhcp.microsoft.ip6
dhcp.microsoft.ip6
dhcp.microsoft.ip6
Field in union table
Field in source table
Field transformation
Data type
Type
Extra fields
eventdate
eventdate
 
timestamp
source
-
 Code Block
'dhcp.infoblox.ip6'
str
signature
-
 Code Block
null('')
str
srcIp
source_ip
srcIp6
 Code Blockip4(srcIp6) Code Blocknull('')
 
str
source_ipv4
source_ipv4
 
ip4
srcHost
-
srcMac
-
 Code Block
null('')
source_hostname
source_hostname
 
str
destMac
-
 Code Block
null('')
str
 Code Blocknull('')
source_mac
source_mac
 
str
destination_mac
destination_mac
 
str
description
description
 
str
leaseIpAddress
-
 Code Blocknull('')
lease_ip
lease_ip
 
str
leaseHardwareAddress
-
lease_mac
lease_mac
 
str
message
-
 Code Block
null('')
str
rawSource
rawSource
 
str
rawTagged
rawTagged
 
str
rawMessage
rawSource
 
str
hostchain
hostchain
 
str
✓
tag
tag
 
str
✓
 Anchor
dhcp.unix.stdout
dhcp.unix.stdout
dhcp.unix.stdout
Field in union table
Field in source table
Field transformation
Data type
Type
Extra fields
eventdate
eventdate
 
timestamp
source
-
 Code Block
'dhcp.unix.stdout'
str
signature
dhcpMessageType
 
str
source_ip
-
 Code Block
null('')
str
srcIp
source_ipv4
source_ipv4
 
ip4
source_hostname
source_hostname
 
str
source_mac
source_mac
 
str
destination_mac
destination_mac
 
str
description
-
 Code Block
null
(ip4
('
0.0.0.0'))
ip4
srcHost
')
str
lease_ip
lease_ip
 
str
lease_mac
lease_mac
 
str
message
-
 Code Block
null('')
str
destMac
rawSource
rawSource
 
str
rawTagged
rawTagged
 
str
rawMessage
rawSource
 
str
hostchain
hostchain
 
str
✓
tag
tag
 
str
✓
 Anchor
firewall.paloalto.system
firewall.paloalto.system
firewall.paloalto.system
Field in union table
Field in source table
Field transformation
Type
Extra fields
eventdate
eventdate
 
timestamp
source
-
 Code Block
null(
'firewall.paloalto.system'
)
str
srcMac
signature
-
 Code Block
null('')
str
description
-
source_ip
client_ip
 Code Block
null(''
str(client_ip)
str
leaseIpAddress
leaseIpAddress
source_ipv4
source_ipv4
 
ip4
source_hostname
source_hostname
 
str
source_mac
source_mac
 
str
destination_mac
destination_mac
 
str
description
description
 
str
lease_ip
lease_ip
 
str
leaseHardwareAddress
leaseHardwareAddress
lease_mac
lease_mac
 
str
message
-
 Code Block
null('')
str
rawSource
rawSource 
rawMessage
 
str
rawTagged
rawTagged
tag
rawMessage
 Code Block
tag + ": " + rawMessage
str
rawMessage
rawSource
rawMessage
 
str
hostchain
hostchain
 
str
✓
tag
tag
 
str
✓