Versions Compared

Old Version 5

changes.mady.by.user Juan Tomás Alonso Nieto

Saved on

compared with

New Version Current

changes.mady.by.user Juan Tomás Alonso Nieto

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Expand
titleCheck source tables

  • box.win_nxlog.dhcp

  • ddi.infoblox.dhcp.dhcpd

  • dhcp.bluecat.dhcpd

  • dhcp.infoblox.stdout

  • dhcp.isc.stdout

  • dhcp.microsoft.ip4

  • dhcp.microsoft.ip6

  • dhcp.unix.stdout

  • firewall.paloalto.system

...

Note

Extra columns

Fields marked as Extra in the table below are not shown by default in data tables and need to be explicitly requested in the query. You can find them marked as Extra when you perform a query so they can be easily identified. Learn more about this in Selecting unrevealed columns.

Field

Type

Source field name

Extra fields

eventdate

timestamp

 

source

str

 

signature

str

srcIp

 

source_ip

str

 

source_ipv4

ip4

srcHost

srcIp

source_hostname

str

srcHost

destMac

source_mac

str

srcMac

destination_mac

str

destMac

description

str

 

lease_ip

str

leaseIpAddress

lease_mac

str

leaseHardwareAddress

str

message

str

 

rawTagged

str

 

rawMessage

str

✓

 

hostchain

str

 

✓

tag

str

 

✓

Field transformations

Even though all source tables have several features in common, they have some particularities that make it necessary to undergo a set of transformations to harmonize them for the union table. The most common transformations comprise changes in the data type or the application of rules when several columns in the source table feed a single column in the union table. You can find below the detailed list of transformations in each source table. 

Rw ui tabs macro
Rw tab
titleTables 1-35

[ box.win_nxlog.dhcp ] [ ddi.infoblox.dhcp.dhcpd ] [ dhcp.bluecat.dhcpd ] [ dhcp.infoblox.stdout ] [dhcp.microsoft.ip4]

Anchor
box.win_nxlog.dhcp
box.win_nxlog.dhcp
box.win_nxlog.dhcp

Field in union table

Field in source table

Field transformation

Type

Extra fields

eventdate

eventdate

 

timestamp

source

-

Code Block
'box.win_nxlog.dhcp'

str

signature

Category

 

str

source_ip

IPAddress_ip4

Code Block
str(IPAddress_ip4)

str

source_ipv4

source_ipv4

 

ip4

source_hostname

source_hostname

 

str

source_mac

source_mac

 

str

destination_mac

destination_mac

 

str

description

BndStatus

 

str

lease_ip

lease_ip

 

str

lease_mac

lease_mac

 

str

message

Message

 

str

rawSource

-

Code Block
null('')

str

rawTagged

-

Code Block
null('')

str

rawMessage

rawMessage

 

str

hostchain

hostchain

 

str

✓

tag

tag

 

str

Anchor
ddi.infoblox.dhcp.dhcpd
ddi.infoblox.dhcp.dhcpd
ddi.infoblox.dhcp.dhcpd

Field in union table

Field in source table

Field transformation

Data type

Type

Extra fields

eventdate

eventdate

 

timestamp

source

-

Code Block
'ddi.infoblox.dhcp.dhcpd'

str

signature

message_type

 

str

source_ip

-

Code Block
null(
ip4(
'
0.0.0.0'))
')

str

source_ipv4

source_ipv4

 

ip4

source_hostname

-

source_hostname

Code Block
null('')

 

str

destination

source_mac

-

Code Blocknull('')

source_mac

 

str

source

destination_mac

-

destination_mac

Code Block
null('')

 

str

description

-

Code Block
null('')

str

lease_ip

leaseIpAddress

lease_ip

 

str

lease_mac

leaseHardwareAddress

lease_mac

 

str

message

message

 

str

rawSource

rawMessage

 

str

rawTagged

tag

rawMessage

tag

Code Block
tag + ": " + rawMessage

str

rawMessage

rawMessage

 

str

hostchain

hostchain

 

str

✓

tag

tag

 

str

✓

Anchor
dhcp.bluecat.dhcpd
dhcp.bluecat.dhcpd
dhcp.bluecat.dhcpd

Field in union table

Field in source table

Field transformation

Data type

Type

Extra fields

eventdate

eventdate

 

timestamp

source

-

Code Block
'dhcp.bluecat.dhcpd'

str

signature

signature

 

str

source_ip

srcIp

Code Block
str(srcIp)

str

source_ipv4

source_ipv4

 

ip4

source_hostname

-

source_hostname

Code Block
null('')

 

str

destination

source_mac

destMac

source_mac

 

str

source

destination_mac

srcMac Code Blocknull('')

destination_mac

 

str

description

-

Code Block
null('')

str

lease_ip

-

lease_ip

 

str

lease_mac

-

lease_mac

Code Block
null('')

 

str

message

message

 

str

rawSource

rawSource

 

str

rawTagged

rawTagged

 

str

rawMessage

rawMessage

 

str

hostchain

hostchain

 

str

✓

tag

tag

 

str

✓

Anchor
dhcp.infoblox.stdout
dhcp.infoblox.stdout
dhcp.infoblox.stdout

Field in union table

Field in source table

Field transformation

Data type

Type

Extra fields

eventdate

eventdate

 

timestamp

source

-

Code Block
'dhcp.infoblox.stdout'

str

signature

packet

 

str

source_ip

-

Code Block
null
(ip4
('
0.0.0.0'))
')

str

source_ipv4

source_ipv4

 

ip4

source_hostname

source_hostname

 

str

source_mac

source_mac

 

str

destination_mac

destination_mac

 

str

description

-

Code Block
null('')

str

lease_ip

lease_ip

 

str

destination_mac

lease_mac

lease_mac

 

str

message

message

 

str

rawSource

rawSource

 

str

rawTagged

rawTagged

 

str

rawMessage

rawMessage

 

str

hostchain

hostchain

 

str

✓

tag

tag

 

str

✓

Anchor
dhcp.isc.stdout
dhcp.isc.stdout
dhcp.isc.stdout

Field in union table

Field in source table

Field transformation

Type

Extra fields

eventdate

eventdate

 

timestamp

source

-

Code Block
null(
'
')
dhcp.isc.stdout'

str

signature

packet

 

str

source_ip

ofAddress

 

str

source_ipv4

source_ipv4

 

ip4

source_hostname

source_hostname

 

str

source_mac

-

Code Blocknull('')

source_mac

 

str

destination_mac

destination_mac

 

str

description

-

Code Block
null('')

str

lease_ip

leaseIpAddress

lease_ip

 

str

lease_mac

leaseHardwareAddress

lease_mac

 

str

message

message

 

str

rawSource

rawSource

 

str

rawTagged

rawTagged

 

str

rawMessage

rawMessage

rawSource

 

str

hostchain

hostchain

 

str

✓

tag

tag

 

str

✓

Rw tab
titleTables 46-79

[ dhcp.microsoft.ip4 ] [ dhcp.microsoft.ip6 ] [ dhcp.unix.stdout ] [ firewall.paloalto.system ]

Anchor
dhcp.microsoft.ip4
dhcp.microsoft.ip4
dhcp.microsoft.ip4

Field in union table

Field in source table

Field transformation

Data type

Type

Extra fields

eventdate

eventdate

 

timestamp

source

-

Code Block
'dhcp.infoblox.ip4'

str

signature

-

Code Block
null('')

str

source_ip

srcIp

Code Block
str(srcIp)

str

source_ipv4

source_ipv4

 

ip4

source_hostname

srcHost

source_hostname

 

str

destination

source_mac

-

source_mac

Code Block
null('')

 

str

source

destination_mac

srcMac

destination_mac

 

str

description

description

 

str

lease_ip

-

lease_ip

Code Block
null('')

 

str

lease_mac

-

lease_mac

Code Block
null('')

 

str

message

-

Code Block
null('')

str

rawSource

-

Code Block
null('')

str

rawTagged

rawTagged

 

str

rawMessage

rawMessage

 

str

hostchain

hostchain

 

str

✓

tag

tag

 

str

✓

Anchor
dhcp.microsoft.ip6
dhcp.microsoft.ip6
dhcp.microsoft.ip6

Field in union table

Field in source table

Field transformation

Data type

Type

Extra fields

eventdate

eventdate

 

timestamp

source

-

Code Block
'dhcp.infoblox.ip6'

str

signature

-

Code Block
null('')

str

source_ip

srcIp6

Code Blockip4(srcIp6)

 

str

source_ipv4

source_ipv4

 

ip4

source_hostname

-

source_hostname

Code Block
null('')

 

str

destination

source_mac

-

source_mac

Code Block
null('')

 

str

source

destination_mac

-

destination_mac

Code Block
null('')

 

str

description

description

 

str

lease_ip

-

lease_ip

Code Block
null('')

 

str

lease_mac

-

lease_mac

Code Block
null('')

 

str

message

-

Code Block
null('')

str

rawSource

rawSource

 

str

rawTagged

rawTagged

 

str

rawMessage

rawSource

 

str

hostchain

hostchain

 

str

✓

tag

tag

 

str

✓

Anchor
dhcp.unix.stdout
dhcp.unix.stdout
dhcp.unix.stdout

Field in union table

Field in source table

Field transformation

Data type

Type

Extra fields

eventdate

eventdate

 

timestamp

source

-

Code Block
'dhcp.unix.stdout'

str

signature

-

Code Blocknull('')

dhcpMessageType

 

str

source_ip

-

Code Block
null(
ip4(
'
0.0.0.0'))
')

str

source_ipv4

source_ipv4

 

ip4

source_hostname

-

Code Blocknull('')

source_hostname

 

str

destination

source_mac

-

source_mac

Code Block
null('')

 

str

source

destination_mac

-

destination_mac

Code Block
null('')

 

str

description

-

Code Block
null('')

str

lease_ip

leaseIpAddress

lease_ip

 

str

lease_mac

leaseHardwareAddress

lease_mac

 

str

message

-

Code Block
null('')

str

rawSource

rawSource

 

str

rawTagged

rawTagged

 

str

rawMessage

rawSource

 

str

hostchain

hostchain

 

str

✓

tag

tag

 

str

✓

Anchor
firewall.paloalto.system
firewall.paloalto.system
firewall.paloalto.system

Field in union table

Field in source table

Field transformation

Data type 

Type

Extra fields

eventdate

eventdate

 

timestamp

source

-

Code Block
'firewall.paloalto.system'

str

signature

serial

-

Code Block
null('')

str

srcIp

source_ip

client_ip

Code Block
ifthenelse(isnotnull
str(client_ip)
, client_ip, null(ip4('0.0.0.0')))

ip4

srcHost

src_host

srcMac

-

Code Blocknull('')
str
source_ipv4
source_ipv4
 
ip4
source_hostname
source_hostname
 
str
destMac
-
 Code Block
null('')
str
source_mac
source_mac
 
str
destination_mac
destination_mac
 
str
description
description
 
str
leaseIpAddress
lease_ip
lease_ip
_address
 
str
leaseHardwareAddress
lease_mac
lease_
hardware_address
mac
 
str
message
-
 Code Block
null('')
str
rawSource
rawMessage
 
str
rawTagged
tag
-
rawMessage
 Code Block
null('')
tag + ": " + rawMessage
str
rawMessage
rawMessage
 
str
hostchain
hostchain
 
str
✓
tag
tag
 
str
✓