@@ -6331,6 +6331,7 @@ components:
63316331 - $ref: '#/components/schemas/LogsSpanRemapper'
63326332 - $ref: '#/components/schemas/LogsArrayProcessor'
63336333 - $ref: '#/components/schemas/LogsDecoderProcessor'
6334+ - $ref: '#/components/schemas/LogsSchemaProcessor'
63346335 LogsQueryCompute:
63356336 description: Define computation for a log query.
63366337 properties:
@@ -6392,6 +6393,243 @@ components:
63926393 periods.
63936394 type: string
63946395 type: object
6396+ LogsSchemaCategoryMapper:
6397+ description: "Use the Schema Category Mapper to categorize log event into enum
6398+ fields.\nIn the case of OCSF, they can be used to map sibling fields which
6399+ are composed of an ID and a name.\n\n**Notes**:\n\n- The syntax of the query
6400+ is the one of Logs Explorer search bar.\n The query can be done on any log
6401+ attribute or tag, whether it is a facet or not.\n Wildcards can also be used
6402+ inside your query.\n- Categories are executed in order and processing stops
6403+ at the first match.\n Make sure categories are properly ordered in case a
6404+ log could match multiple queries.\n- Sibling fields always have a numerical
6405+ ID field and a human-readable string name.\n- A fallback section handles cases
6406+ where the name or ID value matches a specific value.\n If the name matches
6407+ \"Other\" or the ID matches 99, the value of the sibling name field will be
6408+ pulled from a source field from the original log."
6409+ properties:
6410+ categories:
6411+ description: 'Array of filters to match or not a log and their
6412+
6413+ corresponding `name` to assign a custom value to the log.'
6414+ example:
6415+ - filter:
6416+ query: '@eventName:(ConsoleLogin OR ExternalIdPDirectoryLogin OR UserAuthentication
6417+ OR Authenticate)'
6418+ id: 1
6419+ name: Logon
6420+ - filter:
6421+ query: '@eventName:*'
6422+ id: 99
6423+ name: Other
6424+ items:
6425+ $ref: '#/components/schemas/LogsSchemaCategoryMapperCategory'
6426+ type: array
6427+ fallback:
6428+ $ref: '#/components/schemas/LogsSchemaCategoryMapperFallback'
6429+ name:
6430+ description: Name of the logs schema category mapper.
6431+ example: activity_id and activity_name
6432+ type: string
6433+ targets:
6434+ $ref: '#/components/schemas/LogsSchemaCategoryMapperTargets'
6435+ type:
6436+ $ref: '#/components/schemas/LogsSchemaCategoryMapperType'
6437+ required:
6438+ - categories
6439+ - targets
6440+ - type
6441+ - name
6442+ type: object
6443+ LogsSchemaCategoryMapperCategory:
6444+ description: Object describing the logs filter with corresponding category ID
6445+ and name assignment.
6446+ properties:
6447+ filter:
6448+ $ref: '#/components/schemas/LogsFilter'
6449+ id:
6450+ description: ID to inject into the category.
6451+ example: 1
6452+ format: int64
6453+ type: integer
6454+ name:
6455+ description: Value to assign to target schema field.
6456+ example: Password Change
6457+ type: string
6458+ required:
6459+ - filter
6460+ - id
6461+ - name
6462+ type: object
6463+ LogsSchemaCategoryMapperFallback:
6464+ description: Used to override hardcoded category values with a value pulled
6465+ from a source attribute on the log.
6466+ properties:
6467+ sources:
6468+ additionalProperties:
6469+ items:
6470+ type: string
6471+ type: array
6472+ description: Fallback sources used to populate value of field.
6473+ example: {}
6474+ type: object
6475+ values:
6476+ additionalProperties:
6477+ type: string
6478+ description: Values that define when the fallback is used.
6479+ example: {}
6480+ type: object
6481+ type: object
6482+ LogsSchemaCategoryMapperTargets:
6483+ description: Name of the target attributes which value is defined by the matching
6484+ category.
6485+ properties:
6486+ id:
6487+ description: ID of the field to map log attributes to.
6488+ example: ocsf.activity_id
6489+ type: string
6490+ name:
6491+ description: Name of the field to map log attributes to.
6492+ example: ocsf.activity_name
6493+ type: string
6494+ type: object
6495+ LogsSchemaCategoryMapperType:
6496+ description: Type of logs schema category mapper.
6497+ enum:
6498+ - schema-category-mapper
6499+ example: schema-category-mapper
6500+ type: string
6501+ x-enum-varnames:
6502+ - SCHEMA_CATEGORY_MAPPER
6503+ LogsSchemaData:
6504+ description: Configuration of the schema data to use.
6505+ properties:
6506+ class_name:
6507+ description: Class name of the schema to use.
6508+ example: Account Change
6509+ type: string
6510+ class_uid:
6511+ description: Class UID of the schema to use.
6512+ example: 3001
6513+ format: int64
6514+ type: integer
6515+ profiles:
6516+ description: Optional list of profiles to modify the schema.
6517+ example:
6518+ - security_control
6519+ - host
6520+ items:
6521+ type: string
6522+ type: array
6523+ schema_type:
6524+ description: Type of schema to use.
6525+ example: ocsf
6526+ type: string
6527+ version:
6528+ description: Version of the schema to use.
6529+ example: 1.5.0
6530+ type: string
6531+ required:
6532+ - schema_type
6533+ - version
6534+ - class_uid
6535+ - class_name
6536+ type: object
6537+ LogsSchemaMapper:
6538+ description: Configuration of the schema processor mapper to use.
6539+ oneOf:
6540+ - $ref: '#/components/schemas/LogsSchemaRemapper'
6541+ - $ref: '#/components/schemas/LogsSchemaCategoryMapper'
6542+ LogsSchemaProcessor:
6543+ description: A processor that has additional validations and checks for a given
6544+ schema. Currently supported schema types include OCSF.
6545+ properties:
6546+ is_enabled:
6547+ default: false
6548+ description: Whether or not the processor is enabled.
6549+ type: boolean
6550+ mappers:
6551+ description: The `LogsSchemaProcessor` `mappers`.
6552+ example:
6553+ - name: Map userIdentity to ocsf.user.uid
6554+ sources:
6555+ - userIdentity.principalId
6556+ target: ocsf.user.uid
6557+ type: schema-remapper
6558+ items:
6559+ $ref: '#/components/schemas/LogsSchemaMapper'
6560+ type: array
6561+ name:
6562+ description: Name of the processor.
6563+ example: Map additionalEventData.LoginTo to ocsf.dst_endpoint.svc_name
6564+ type: string
6565+ schema:
6566+ $ref: '#/components/schemas/LogsSchemaData'
6567+ type:
6568+ $ref: '#/components/schemas/LogsSchemaProcessorType'
6569+ required:
6570+ - name
6571+ - mappers
6572+ - type
6573+ - schema
6574+ type: object
6575+ LogsSchemaProcessorType:
6576+ default: schema-processor
6577+ description: Type of logs schema processor.
6578+ enum:
6579+ - schema-processor
6580+ example: schema-processor
6581+ type: string
6582+ x-enum-varnames:
6583+ - SCHEMA_PROCESSOR
6584+ LogsSchemaRemapper:
6585+ description: The schema remapper maps source log fields to their correct fields.
6586+ properties:
6587+ name:
6588+ description: Name of the logs schema remapper.
6589+ example: Map userIdentity.principalId, responseElements.role.roleId, responseElements.user.userId
6590+ to ocsf.user.uid
6591+ type: string
6592+ override_on_conflict:
6593+ default: false
6594+ description: Override or not the target element if already set.
6595+ type: boolean
6596+ preserve_source:
6597+ default: false
6598+ description: Remove or preserve the remapped source element.
6599+ type: boolean
6600+ sources:
6601+ description: Array of source attributes.
6602+ example:
6603+ - userIdentity.principalId
6604+ - responseElements.role.roleId
6605+ - responseElements.user.userId
6606+ items:
6607+ description: Attribute used as a source to remap its value to the target
6608+ attribute.
6609+ type: string
6610+ type: array
6611+ target:
6612+ description: Target field to map log source field to.
6613+ example: ocsf.user.uid
6614+ type: string
6615+ target_format:
6616+ $ref: '#/components/schemas/TargetFormatType'
6617+ type:
6618+ $ref: '#/components/schemas/LogsSchemaRemapperType'
6619+ required:
6620+ - name
6621+ - sources
6622+ - target
6623+ - type
6624+ type: object
6625+ LogsSchemaRemapperType:
6626+ description: Type of logs schema remapper.
6627+ enum:
6628+ - schema-remapper
6629+ example: schema-remapper
6630+ type: string
6631+ x-enum-varnames:
6632+ - SCHEMA_REMAPPER
63956633 LogsServiceRemapper:
63966634 description: 'Use this processor if you want to assign one or more attributes
63976635 as the official service.
0 commit comments