You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/sentinel/normalization-common-fields.md
+10-9Lines changed: 10 additions & 9 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -18,7 +18,7 @@ Some fields are common to all ASIM schemas. Each schema might add guidelines for
18
18
19
19
## Standard Log Analytics fields
20
20
21
-
The following fields are generated by Log Analytics, in most cases, for each record. They can be overridden when you [create a custom connector](create-custom-connector.md).
21
+
Log Analytics generates the following fields, in most cases, for each record. They can be overridden when you [create a custom connector](create-custom-connector.md).
| <aname="eventmessage"></a>**EventMessage**| Optional | String | A general message or description, either included in or generated from the record. |
42
42
| <aname="eventcount"></a>**EventCount**| Mandatory | Integer | The number of events described by the record. <br><br>This value is used when the source supports aggregation, and a single record might represent multiple events. <br><br>For other sources, set to `1`. |
43
-
| <aname="eventstarttime"></a>**EventStartTime**| Mandatory | Date/time | The time in which the event started. If the source supports aggregation and the record represents multiple events, the time that the first event was generated. If not provided by the source record, this field aliases the [TimeGenerated](#timegenerated) field. |
44
-
| <aname="eventendtime"></a>**EventEndTime**| Mandatory | Date/time | The time in which the event ended. If the source supports aggregation and the record represents multiple events, the time that the last event was generated. If not provided by the source record, this field aliases the [TimeGenerated](#timegenerated) field. |
43
+
| <aname="eventstarttime"></a>**EventStartTime**| Mandatory | Date/time | The time when the event started. If the source supports aggregation and the record represents multiple events, the time that the first event was generated. If not provided by the source record, this field aliases the [TimeGenerated](#timegenerated) field. |
44
+
| <aname="eventendtime"></a>**EventEndTime**| Mandatory | Date/time | The time when the event ended. If the source supports aggregation and the record represents multiple events, the time that the last event was generated. If not provided by the source record, this field aliases the [TimeGenerated](#timegenerated) field. |
45
45
| <aname="eventtype"></a>**EventType**| Mandatory | Enumerated | Describes the operation reported by the record. Each schema documents the list of values valid for this field. The original, source specific, value is stored in the [EventOriginalType](#eventoriginaltype) field. |
46
46
| <aname="eventsubtype"></a>**EventSubType**| Optional | Enumerated | Describes a subdivision of the operation reported in the [EventType](#eventtype) field. Each schema documents the list of values valid for this field. The original, source specific, value is stored in the [EventOriginalSubType](#eventoriginalsubtype) field. |
47
47
| <aname="eventresult"></a>**EventResult**| Mandatory | Enumerated | One of the following values: **Success**, **Partial**, **Failure**, **NA** (Not Applicable).<br> <br>The value might be provided in the source record by using different terms, which should be normalized to these values. Alternatively, the source might provide only the [EventResultDetails](#eventresultdetails) field, which should be analyzed to derive the EventResult value.<br><br>Example: `Success`|
@@ -72,7 +72,7 @@ Each schema document specifies the role of the device for the schema.
| <aname="dvc"></a>**Dvc**| Alias | String | A unique identifier of the device on which the event occurred or which reported the event, depending on the schema. <br><br>This field might alias the [DvcFQDN](#dvcfqdn), [DvcId](#dvcid), [DvcHostname](#dvchostname), or [DvcIpAddr](#dvcipaddr) fields. For cloud sources, for which there is no apparent device, use the same value as the [Event Product](#eventproduct) field. |
75
+
| <aname="dvc"></a>**Dvc**| Alias | String | A unique identifier of the device on which the event occurred or which reported the event, depending on the schema. <br><br>This field might alias the [DvcFQDN](#dvcfqdn), [DvcId](#dvcid), [DvcHostname](#dvchostname), or [DvcIpAddr](#dvcipaddr) fields. For cloud sources, for which there's no apparent device, use the same value as the [Event Product](#eventproduct) field. |
76
76
| <aname ="dvcipaddr"></a>**DvcIpAddr**| Recommended | IP address | The IP address of the device on which the event occurred or which reported the event, depending on the schema. <br><br>Example: `45.21.42.12`|
77
77
| <aname ="dvchostname"></a>**DvcHostname**| Recommended | Hostname | The hostname of the device on which the event occurred or which reported the event, depending on the schema. <br><br>Example: `ContosoDc`|
78
78
| <aname="dvcdomain"></a>**DvcDomain**| Recommended | Domain (String) | The domain of the device on which the event occurred or which reported the event, depending on the schema.<br><br>Example: `Contoso`|
@@ -95,12 +95,12 @@ Each schema document specifies the role of the device for the schema.
| <aname="additionalfields"></a>**AdditionalFields**| Optional | Dynamic | If your source provides additional information worth preserving, either keep it with the original field names or create the dynamic **AdditionalFields** field, and add to it the extra information as key/value pairs. |
98
+
| <aname="additionalfields"></a>**AdditionalFields**| Optional | Dynamic | If your source provides additional information worth preserving, either keep it with the original field names or create the dynamic **AdditionalFields** field, and add the extra information as key/value pairs. |
99
99
100
100
### Schema updates
101
101
102
-
- The `EventOwner` field has been added to the common fields on Dec 1, 2022, and therefore to all of the schemas.
103
-
- The `EventUid` field has been added to the common fields on Dec 26, 2022, and therefore to all of the schemas.
102
+
- The `EventOwner` field was added to the common fields on December 1, 2022, and therefore to all of the schemas.
103
+
- The `EventUid` field was added to the common fields on December 26, 2022, and therefore to all of the schemas.
104
104
105
105
## Vendors and products
106
106
@@ -114,10 +114,11 @@ The currently supported list of vendors and products used in the [EventVendor](#
0 commit comments