On a log sample that comes in JSON type, we can proceed by selecting the patterns as below and assigning them to the fields we want.
Event Mapping
We need to get reference from the link below about the mapping part.
When you select Static under Mapping, the EventMap.Context, EventMap.Type and EventMap.SubType values you write there are added to all logs.
However, when we select File and upload a JSON file with the appropriate structure using the Select JSON File button, we can make more comprehensive mapping.
First of all, we need to select the value that can be mapped in the log and assign that value as a field. This field is then chosen as the Event Key.
In this scenario, the field we will use for our mapping is Event.Category.
We need to create a JSON file on our computer (in this example eventmap.json) and write the data that can come in the Event.Category we have specified in it.
Log samples;
Scan Activity >
{"timestamp":"2024-10-30T10:01","source_ip":"1.1.1.44","category":"Scan Activity","process":"sapd_123123","process_id":8634,"event_code":33312,"severity":"NOTI","source":"AP Logsign-Turkey@1.1.1.77 sapd","device_type":"ap","zone":"zone0","message_type":"ERROR","destination_ip":"10.10.0.10","tunnel":"none","error_code":"RC_ERROR_IKEP1"}
Web Access Allow >
{"timestamp":"2024-10-30T15:45","source_ip":"2.2.2.55","category":"Web Access Allow","process":"httpd_456789","process_id":4321,"event_code":54321,"severity":"INFO","source":"AP WebServer@2.2.2.55 httpd","device_type":"firewall","zone":"zone1","message_type":"ALLOW","destination_ip":"192.168.1.100","tunnel":"vpn0","error_code":"NO_ERROR"}
In this case, a mapping file can be prepared as follows.
{
"Scan Activity": {
"EventMap.Context": "Security",
"EventMap.Type": "Scan",
"EventMap.SubType": "Info"
},
"Web Access Allow": {
"EventMap.Context": "Network",
"EventMap.Type": "Session",
"EventMap.SubType": "Allow"
}
}
In the log that comes in the form of Scan Activity in this prepared file, it will make mapping as follows.
When I change the log and test again, you can see that the mapping has changed.
The only thing to be considered in the mapping section is to write the values that can appear in the field you selected as the Event Key into your mapping file. The file name is up to you (eventmap.json is only an example), but the file must have the .json extension. Inside each entry, only the EventMap.Context, EventMap.Type, EventMap.SubType, Event.VendorID, Event.Info and Severity.Name keys are accepted. A file that uses any other key is rejected with the message "Please use allowed field names."
If a log contains a value that is not in your mapping file, the values entered under Default Mapping are used. If Default Mapping is not set, these logs are mapped as System / Operation / Info.
While making these assignments, you need to reference the excel named Log Message List.