Definition of the taxomony
- When a raw event encompasses a datetime, parse this information with a stage date and set the result in the field
event.kindaccording to the event categorization fields
- If possible, define
- If possible, define observer information in
- For events collected from cloud services, provide cloud information in
cloud.*(The cloud account id must land in
- The name of an action must be hosted in
- The reason of the event must be hosted in
- Error code and error message must land in
- As documented in the ECS specification,
host.hostnamemust contain the hostname as return by the command hostname on the host.
host.nameis more permissive
When a valuable information is present in the raw event, and no ECS fields is suitable to host the information, a custom field may be defined.
The custom taxonomy is defined in the directory
_meta/fields.yml in the format. The document is written in JSON dialect.
Please ensure that no field from the ECS taxonomy is suitable before creating a new field.
A custom field consists of three elements:
- name: The name of the field. It corresponds to the path (dot-notation) of the field in the structured event.
We recommend prefixing the field with the vendor and the name of the product (e.g for AWS cloud trail, custom taxonomy is prefixing with
type: The type of the field.
Available types are:
keywordfor textual values
booleanfor boolean values
longfor integer and long values
floatfor float values
description: a short description to understand the value of the field
See AWS CloudTrail.