Link Search Menu Expand Document Documentation Menu
文档

Linux

The linux log type records Linux syslog events.

以下代码片段包含此日志类型的所有 raw_field 和 ecs 映射：

  "mappings": [
    {
      "raw_field":"name",
      "ecs":"user.filesystem.name"
    },
    {
      "raw_field":"a0",
      "ecs":"auditd.log.a0"
    },
    {
      "raw_field":"comm",
      "ecs":"auditd.log.comm"
    },
    {
      "raw_field":"exe",
      "ecs":"auditd.log.exe"
    },
    {
      "raw_field":"uid",
      "ecs":"auditd.log.uid"
    },
    {
      "raw_field":"USER",
      "ecs":"system.auth.user"
    },
    {
      "raw_field":"User",
      "ecs":"system.auth.user"
    },
    {
      "raw_field":"Image",
      "ecs":"process.exe"
    },
    {
      "raw_field":"DestinationHostname",
      "ecs":"rsa.web.remote_domain"
    },
    {
      "raw_field":"CommandLine",
      "ecs":"process.command_line"
    },
    {
      "raw_field":"ParentImage",
      "ecs":"process.parent.executable"
    },
    {
      "raw_field":"CurrentDirectory",
      "ecs":"process.working_directory"
    },
    {
      "raw_field":"LogonId",
      "ecs":"process.real_user.id"
    },
    {
      "raw_field":"creationTime",
      "ecs":"timestamp"
    }
  ]
剩余 350 字符

有问题？。

想贡献？或。