Versions Compared

Old Version 4

changes.mady.by.user Juan Tomás Alonso Nieto

Saved on

compared with

New Version Current

changes.mady.by.user Juan Tomás Alonso Nieto

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Expand
titleCheck source tables

  • box.win_nxlog.dhcp

  • ddi.infoblox.dhcp.dhcpd

  • dhcp.bluecat.dhcpd

  • dhcp.infoblox.stdout

  • dhcp.isc.stdout

  • dhcp.microsoft.ip4

  • dhcp.microsoft.ip6

  • dhcp.unix.stdout

  • firewall.paloalto.system

Table structure

This is the set of columns displayed by this union table, which is the result of the collection of columns present in all source tables: 

Note

Extra columns

Fields marked as Extra in the table below are not shown by default in data tables and need to be explicitly requested in the query. You can find them marked as Extra when you perform a query so they can be easily identified. Learn more about this in Selecting unrevealed columns.

Field

Data type

Type

Source field name

Extra fields

eventdate

timestamp

-

 

source

str

-

 

signature

str

-

 

source_ip

str

 

source_ipv4

ip4

-

srcIp

source_hostname

str

-

srcHost

destination

source_mac

str

-

srcMac

source

destination_mac

str

-

destMac

description

str

-

 

lease_ip

str

-

leaseIpAddress

lease_mac

str

-

leaseHardwareAddress

message

str

-

 

rawTagged

str

-

 

rawMessage

str

-

 

hostchain

str

 

✓

tag

str

 

✓

Field transformations

Even though all source tables have several features in common, they have some particularities that make it necessary to undergo a set of transformations to harmonize them for the union table. The most common transformations comprise changes in the data type or the application of rules when several columns in the source table feed a single column in the union table. You can find below the detailed list of transformations in each source table. 

Rw ui tabs macro
Rw tab
titleTables 1-35

[ box.win_nxlog.dhcp ] [ ddi.infoblox.dhcp.dhcpd ] [ dhcp.bluecat.dhcpd ] [ dhcp.infoblox.stdout ] [dhcp.microsoft.ip4]

Anchor
box.win_nxlog.dhcp
box.win_nxlog.dhcp
box.win_nxlog.dhcp

Field in union table

Field in source table

Field transformation

Type

Extra fields

eventdate

eventdate

 

timestamp

source

-

Code Block
'box.win_nxlog.dhcp'

str

signature

Category

 

str

source_ip

IPAddress_ip4

Code Block
str(IPAddress_ip4)

str

source_ipv4

source_ipv4

 

ip4

source_hostname

source_hostname

 

str

source_mac

source_mac

 

str

destination_mac

destination_mac

 

str

description

BndStatus

 

str

lease_ip

lease_ip

 

str

lease_mac

lease_mac

 

str

message

Message

 

str

rawSource

-

Code Block
null('')

str

rawTagged

-

Code Block
null('')

str

rawMessage

rawMessage

 

str

hostchain

hostchain

 

str

✓

tag

tag

 

str

Anchor
ddi.infoblox.dhcp.dhcpd
ddi.infoblox.dhcp.dhcpd
ddi.infoblox.dhcp.dhcpd

Field in union table

Field in source table

Field transformation

Data type

Type

Extra fields

eventdate

eventdate

 

timestamp

source

-

Code Block
'ddi.infoblox.dhcp.dhcpd'

str

signature

message_type

 

str

source_ip

-

Code Block
null(
ip4(
'
0.0.0.0'))
')

str

source_ipv4

source_ipv4

 

ip4

source_hostname

-

source_hostname

Code Block
null('')

 

str

destination

source_mac

-

Code Blocknull('')

source_mac

 

str

source

destination_mac

-

destination_mac

Code Block
null('')

 

str

description

-

Code Block
null('')

str

lease_ip

leaseIpAddress

lease_ip

 

str

lease_mac

leaseHardwareAddress

lease_mac

 

str

message

message

 

str

rawSource

rawMessage

 

str

rawTagged

tag

rawMessage

tag

Code Block
tag + ": " + rawMessage

str

rawMessage

rawMessage

 

str

hostchain

hostchain

 

str

✓

tag

tag

 

str

✓

Anchor
dhcp.bluecat.dhcpd
dhcp.bluecat.dhcpd
dhcp.bluecat.dhcpd

Field in union table

Field in source table

Field transformation

Data type

Type

Extra fields

eventdate

eventdate

 

timestamp

source

-

Code Block
'dhcp.bluecat.dhcpd'

str

signature

signature

 

str

source_ip

srcIp

Code Block
str(srcIp)

str

source_ipv4

source_ipv4

 

ip4

source_hostname

-

source_hostname

Code Block
null('')

 

str

destination

source_mac

destMac

source_mac

 

str

source

destination_mac

srcMac Code Blocknull('')

destination_mac

 

str

description

-

Code Block
null('')

str

lease_ip

-

Code Blocknull('')

lease_ip

 

str

lease_mac

-

lease_mac

 

str

message

message

 

str

rawSource

rawSource

 

str

rawTagged

rawTagged

 

str

rawMessage

rawMessage

 

str

hostchain

hostchain

 

str

✓

tag

tag

 

str

✓

Anchor
dhcp.infoblox.stdout
dhcp.infoblox.stdout
dhcp.infoblox.stdout

Field in union table

Field in source table

Field transformation

Data type

Type

Extra fields

eventdate

eventdate

 

timestamp

source

-

Code Block
'dhcp.infoblox.stdout'

str

signature

packet

 

str

source_ip

-

Code Block
null
(ip4
('
0.0.0.0'))
')

str

source_ipv4

source_ipv4

 

ip4

source_hostname

source_hostname

 

str

source_mac

source_mac

 

str

destination_mac

destination_mac

 

str

description

-

Code Block
null('')

str

destination_mac

lease_ip

lease_ip

 

str

lease_mac

lease_mac

 

str

message

message

 

str

rawSource

rawSource

 

str

rawTagged

rawTagged

 

str

rawMessage

rawMessage

 

str

hostchain

hostchain

 

str

✓

tag

tag

 

str

✓

Anchor
dhcp.isc.stdout
dhcp.isc.stdout
dhcp.isc.stdout

Field in union table

Field in source table

Field transformation

Type

Extra fields

eventdate

eventdate

 

timestamp

source

-

Code Block
null(
'
')
dhcp.isc.stdout'

str

signature

packet

 

str

source_ip

ofAddress

 

str

source_ipv4

source_ipv4

 

ip4

source_hostname

source_hostname

 

str

source_mac

-

Code Blocknull('')

source_mac

 

str

destination_mac

destination_mac

 

str

description

-

Code Block
null('')

str

lease_ip

leaseIpAddress

lease_ip

 

str

lease_mac

leaseHardwareAddress

lease_mac

 

str

message

message

 

str

rawSource

rawSource

 

str

rawTagged

rawTagged

 

str

rawMessage

rawMessage

rawSource

 

str

hostchain

hostchain

 

str

✓

tag

tag

 

str

✓

Rw tab
titleTables 46-69

[ dhcp.microsoft.ip4 ] [ dhcp.microsoft.ip6 ] [ dhcp.unix.stdout ] [ firewall.paloalto.system ]

Anchor
dhcp.microsoft.ip4
dhcp.microsoft.ip4
dhcp.microsoft.ip4

Field in union table

Field in source table

Field transformation

Data type

Type

Extra fields

eventdate

eventdate

 

timestamp

source

-

Code Block
'dhcp.infoblox.ip4'

str

signature

-

Code Block
null('')

str

source_ip

srcIp

Code Block
str(srcIp)

str

source_ipv4

source_ipv4

 

ip4

source_hostname

srcHost

source_hostname

 

str

destination

source_mac

-

source_mac

Code Block
null('')

 

str

source

destination_mac

srcMac

destination_mac

 

str

description

description

 

str

lease_ip

-

lease_ip

Code Block
null('')

 

str

lease_mac

-

lease_mac

Code Block
null('')

 

str

message

-

Code Block
null('')

str

rawSource

-

Code Block
null('')

str

rawTagged

rawTagged

 

str

rawMessage

rawMessage

 

str

hostchain

hostchain

 

str

✓

tag

tag

 

str

✓

Anchor
dhcp.microsoft.ip6
dhcp.microsoft.ip6
dhcp.microsoft.ip6

Field in union table

Field in source table

Field transformation

Data type

Type

Extra fields

eventdate

eventdate

 

timestamp

source

-

Code Block
'dhcp.infoblox.ip6'

str

signature

-

Code Block
null('')

str

source_ip

srcIp6

Code Blockip4(srcIp6)

 

str

source_ipv4

source_ipv4

 

ip4

source_hostname

-

Code Blocknull('')

source_hostname

 

str

destination

source_mac

-

source_mac

Code Block
null('')

 

str

source

destination_mac

-

destination_mac

Code Block
null('')

 

str

description

description

 

str

lease_ip

-

lease_ip

Code Block
null('')

 

str

lease_mac

-

lease_mac

Code Block
null('')

 

str

message

-

Code Block
null('')

str

rawSource

rawSource

 

str

rawTagged

rawTagged

 

str

rawMessage

rawSource

 

str

hostchain

hostchain

 

str

✓

tag

tag

 

str

✓

Anchor
dhcp.unix.stdout
dhcp.unix.stdout
dhcp.unix.stdout

Field in union table

Field in source table

Field transformation

Data type

Type

Extra fields

eventdate

eventdate

 

timestamp

source

-

Code Block
'dhcp.unix.stdout'

str

signature

dhcpMessageType

 

str

source_ip

-

Code Block
null('')

str

source_

ip

ipv4

-

source_ipv4

code

 

null(

ip4

('0.0.0.0'))ip4

source_hostname

source_hostname

 

str

source_mac

source_mac

 

str

destination_mac

destination_mac

 

str

description

-

Code Block
null('')

str

lease_ip

lease_ip

 

str

lease_mac

destination

lease_mac

 

str

message

-

Code Block
null('')

str

rawSource

rawSource

 

str

rawTagged

source_mac

rawTagged

 

str

rawMessage

rawSource

 

str

hostchain

hostchain

 

str

✓

tag

tag

 

str

✓

Anchor
firewall.paloalto.system
firewall.paloalto.system
firewall.paloalto.system

Field in union table

Field in source table

Field transformation

Type

Extra fields

eventdate

eventdate

 

timestamp

source

-

Code Block
null(
'firewall.paloalto.system'
)
str
description
signature
-
 Code Block
null('')
str
source_ip
client_ip
 Code Block
str(client_ip)
str
source_ipv4
source_ipv4
 
ip4
source_hostname
source_hostname
 
str
source_mac
source_mac
 
str
destination_mac
destination_mac
 
str
description
description
 
str
lease_ip
leaseIpAddress
lease_ip
 
str
lease_mac
leaseHardwareAddress
lease_mac
 
str
message
-
 Code Block
null('')
str
rawSource
rawSource 
rawMessage
 
str
rawTagged
tag
rawTagged
rawMessage
 Code Block
tag + ": " + rawMessage
str
rawMessage
rawSource
rawMessage
 
str
hostchain
hostchain
 
str
✓
tag
tag
 
str
✓