monitor.threatstack

Introduction

The tags beginning with monitor.threatstack identify events generated by Threat Stack.

The full tag must have at least three levels. The first two are fixed as monitor.threatstack. The third level identifies the type of events sent.

These are the valid tags and corresponding data tables that will receive the parsers' data:

Product / Service	Tags	Data tables
Threat Stack	monitor.threatstack.alerts.active	monitor.threatstack.alerts
	monitor.threatstack.alerts	monitor.threatstack.alerts
	monitor.threatstack.audit	monitor.threatstack.audit
	monitor.threatstack.cve	monitor.threatstack.cve
	monitor.threatstack.ec2	monitor.threatstack.ec2
	monitor.threatstack.events	monitor.threatstack.events

For more information, read more about Devo tags.

These are the fields displayed in these tables:

Field	Type	Extra field	Field transformation	Source field name
eventdate	`timestamp`
hostname	`str`
id	`str`
userEmail	`str`
userId	`str`
organizationId	`str`
result	`str`
crud	`str`
action	`str`
source	`str`
description	`str`
eventTime	`timestamp`
context__url	`str`
context__params__from	`timestamp`		parsedate(context__params__from_str, dateformat("YYYY-MM-DD[T]HH:mm", "UTC"))	context__params__from_str
context__originIp	`ip4`
context__httpMethod	`str`
context__responseCode	`int4`
context__responseSize	`int8`
godMode	`bool`
hostchain	`str`	✓
tag	`str`	✓
rawMessage	`str`

Field	Type	Extra field	Field transformation	Source field name
eventdate	`timestamp`
hostname	`str`
cveNumber	`str`
reportedPackage	`str`
systemPackage	`str`
vectorType	`str`
isSuppressed	`bool`
severity	`str`
securityNotices__securityNoticeId_str	`str`		join(securityNotices__securityNoticeId, ',')	securityNotices__securityNoticeId
securityNotices__source_str	`str`		join(securityNotices__source, ',')	securityNotices__source
securityNotices__url_str	`str`		join(securityNotices__url, ',')	securityNotices__url
agents__hostname_str	`str`		join(agents__hostname, ',')	agents__hostname
agents__agentId_str	`str`		join(agents__agentId, ',')	agents__agentId
hostchain	`str`	✓
tag	`str`	✓
rawMessage	`str`

Field	Type	Extra field	Field transformation	Source field name
eventdate	`timestamp`
hostname	`str`
id	`str`
kernelId	`str`
instanceType	`str`
privateDnsName	`str`
privateIpAddress	`str`
groups__id_str	`str`		join(groups__id, ',')	groups__id
groups__name_str	`str`		join(groups__name, ',')	groups__name
subnetId	`str`
keyName	`str`
region	`str`
launchTime	`str`
imageId	`str`
architecture	`str`
publicDnsName	`str`
publicIpAddress	`str`
vpcId	`str`
awsProfile__id_str	`str`		join(awsProfile__id, ',')	awsProfile__id
awsProfile__organizationName_str	`str`		join(awsProfile__organizationName, ',')	awsProfile__organizationName
awsProfile__description_str	`str`		join(awsProfile__description, ',')	awsProfile__description
monitored	`bool`
tags__key_str	`str`		join(tags__key, ',')	tags__key
tags__value_str	`str`		join(tags__value, ',')	tags__value
tags__source_str	`str`		join(tags__source, ',')	tags__source
hostchain	`str`	✓
tag	`str`	✓
rawMessage	`str`