This integration is powered by Elastic Agent. Elastic Agent is a single, unified way to add monitoring for logs, metrics, and other types of data to a host. It can also protect hosts from security threats, query data from operating systems, forward data from remote services or hardware, and more. Refer to our documentation for a detailed comparison between Beats and Elastic Agent.
Prefer to use Beats for this use case? See Filebeat modules for logs or Metricbeat modules for metrics.
See the integrations quick start guides to get started:
Overview
The azure logs integration retrieves activity, platform, sign-in, audit, and Spring Cloud data from Azure.
Use the Azure Logs integration to collect logs from Azure. Then visualize that data in Kibana, create alerts to notify you if something goes wrong, and reference data when troubleshooting an issue.
For example, if you wanted to detect possible brute force sign-in attacks, you could install the Azure Logs integration to send Azure sign-in logs to Elastic. Then, set up a new rule in the Elastic Observability Logs app to alert you when the number of failed sign-in attempts exceeds a certain threshold. Or, perhaps you want to better plan your Azure capacity. Send Azure activity logs to Elastic to track and visualize when your virtual machines fail to start due to an exceed quota limit.
Data streams
The Azure Logs integration collects logs.
Logs help you keep a record of events that happen on your machine. Log data streams collected by the Azure Logs integration include activity, platform, sign-in, audit, and Spring Cloud logs. See more details in the Logs reference.
Requirements
You need Elasticsearch for storing and searching your data and Kibana for visualizing and managing it. You can use our hosted Elasticsearch Service on Elastic Cloud, which is recommended, or self-manage the Elastic Stack on your own hardware.
Setup
Before adding the integration, you must complete the following tasks as logs are read from Azure Event Hubs:
- Your logs have to first be exported to the Event Hub
- To export activity logs to event hubs, follow the steps in Microsoft's Legacy collection methods documentation
- To export audit and sign-in logs to event hubs, follow the steps in Microsoft's Stream Azure Active Directory logs to an Azure Event Hub tutorial
Settings
Use the following settings to configure the Azure Logs integration when you add it to Fleet.
eventhub
:
string
A fully managed, real-time data ingestion service. Elastic recommends using only letters, numbers, and the hyphen (-) character for Event Hub names to maximize compatibility. You can use existing Event Hubs having underscores (_) in the Event Hub name; in this case, the integration will replace underscores with hyphens (-) when it uses the Event Hub name to create dependent Azure resources behind the scenes (e.g., the storage account container to store Event Hub consumer offsets). Elastic also recommends using a separate event hub for each log type as the field mappings of each log type differ.
Default value insights-operational-logs
.
consumer_group
:
string
Enable the publish/subscribe mechanism of Event Hubs with consumer groups. A consumer group is a view (state, position, or offset) of an entire event hub. Consumer groups enable multiple consuming applications to each have a separate view of the event stream, and to read the stream independently at their own pace and with their own offsets.
Default value: $Default
connection_string
:
string
The connection string required to communicate with Event Hubs. See Get an Event Hubs connection string for more information.
A Blob Storage account is required to store/retrieve/update the offset or state of the Event Hub messages. This allows the integration to start back up at the spot that it stopped processing messages.
storage_account
:
string
The name of the storage account that the state/offsets will be stored and updated.
storage_account_key
:
string
The storage account key. Used to authorize access to data in your storage account.
resource_manager_endpoint
:
string
Optional. By default, the integration uses the Azure public environment. To override this and use a different Azure environment, users can provide a specific resource manager endpoint
Examples:
- Azure ChinaCloud:
https://management.chinacloudapi.cn/
- Azure GermanCloud:
https://management.microsoftazure.de/
- Azure PublicCloud:
https://management.azure.com/
- Azure USGovernmentCloud:
https://management.usgovcloudapi.net/
This setting can also be used to define your own endpoints, like for hybrid cloud models.
Logs reference
Activity logs
Retrieves Azure activity logs. Activity logs provide insight into the operations that were performed on resources in your subscription.
An example event for activitylogs
looks as following:
{
"log": {
"level": "Information"
},
"cloud": {
"provider": "azure"
},
"@timestamp": "2020-11-02T08:51:36.997Z",
"ecs": {
"version": "1.5.0"
},
"data_stream": {
"namespace": "default",
"type": "logs",
"dataset": "azure.activitylogs"
},
"event": {
"duration": 0,
"ingested": "2020-10-30T20:47:48.123859400Z",
"kind": "event",
"action": "MICROSOFT.RESOURCES/DEPLOYMENTS/WRITE",
"dataset": "azure.activitylogs",
"outcome": "success"
},
"azure": {
"subscription_id": "3f041b6d-fc31-41d8-8ff6-e5f16e6747ff",
"resource": {
"provider": "MICROSOFT.RESOURCES/DEPLOYMENTS",
"name": "NOMARKETPLACE",
"id": "/SUBSCRIPTIONS/3f041b6d-fc31-41d8-8ff6-e5f16e6747ff/RESOURCEGROUPS/OBS-TEST/PROVIDERS/MICROSOFT.RESOURCES/DEPLOYMENTS/NOMARKETPLACE",
"group": "OBS-TEST"
},
"correlation_id": "876190b4-5b99-4a39-b725-4f5644911cf0",
"activitylogs": {
"operation_name": "MICROSOFT.RESOURCES/DEPLOYMENTS/WRITE",
"result_type": "Success",
"identity": {
"authorization": {
"evidence": {
"role_definition_id": "8e3af657a8ff443ca75c2fe8c4bcb635",
"role": "Owner",
"role_assignment_scope": "/providers/Microsoft.Management/managementGroups/5341238b-665c-4eb4-b259-b250371ae430",
"role_assignment_id": "7f06f09dd6764b44930adbec3f10e92b",
"principal_type": "User",
"principal_id": "68b1adf93eb744b08eb8ce96522a08d3"
},
"scope": "/subscriptions/3f041b6d-fc31-41d8-8ff6-e5f16e6747ff/resourceGroups/obs-test/providers/Microsoft.Resources/deployments/NoMarketplace",
"action": "Microsoft.Resources/deployments/write"
},
"claims": {
"xms_tcdt": "1469565974",
"aio": "ATQAy/8RAAAAsL67UQMOHZv3izTDRJfvJN5UyON9ktUszzPj08K8aURsbhxhR0niz9s1Pxm9U1lI",
"iss": "https://sts.windows.net/4fa94b7d-a743-486f-abcc-6c276c44cf4b/",
"http://schemas_xmlsoap_org/ws/2005/05/identity/claims/nameidentifier": "a9L2WR3XZN5ANzAqwLx_4aamU49JG6kqaE5JZkXdeNs",
"http://schemas_xmlsoap_org/ws/2005/05/identity/claims/surname": "Doe",
"http://schemas_microsoft_com/identity/claims/scope": "user_impersonation",
"http://schemas_microsoft_com/identity/claims/tenantid": "4fa94b7d-a743-486f-abcc-6c276c44cf4b",
"puid": "1003200045B17AD4",
"wids": "5d6b6bb7-de71-4623-b4af-96380a352509",
"http://schemas_microsoft_com/claims/authnclassreference": "1",
"exp": "1604310019",
"ipaddr": "77.170.179.229",
"iat": "1604306119",
"http://schemas_microsoft_com/identity/claims/objectidentifier": "68b1adf9-3eb7-44b0-8eb8-ce96522a08d3",
"http://schemas_microsoft_com/claims/authnmethodsreferences": "pwd",
"ver": "1.0",
"groups": "644c6686-9ef1-4b69-9410-107664a9e1f0,9ed1993c-ce9c-4915-a04d-58c6f5f7ee12",
"uti": "rqr63RW_Kk6ztuomENMQAA",
"http://schemas_xmlsoap_org/ws/2005/05/identity/claims/upn": "john@gmail.com",
"aud": "https://management.core.windows.net/",
"nbf": "1604306119",
"appidacr": "2",
"rh": "0.AAAAfUupT0Onb0irzGwnbETPS4NAS8SwO8FJtH2XTlPL3zxRAA8.",
"appid": "c44b4083-3bb0-49c1-b47d-974e53cbdf3c",
"http://schemas_xmlsoap_org/ws/2005/05/identity/claims/givenname": "John",
"http://schemas_xmlsoap_org/ws/2005/05/identity/claims/name": "john@gmail.com"
},
"claims_initiated_by_user": {
"schema": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims"
}
},
"category": "Administrative",
"event_category": "Administrative",
"result_signature": "Succeeded."
}
}
}
Exported fields
Field | Description | Type |
---|---|---|
@timestamp | Event timestamp. | date |
azure.activitylogs.category | Category | keyword |
azure.activitylogs.event_category | Event Category | keyword |
azure.activitylogs.identity.authorization.action | Action | keyword |
azure.activitylogs.identity.authorization.evidence.principal_id | Principal ID | keyword |
azure.activitylogs.identity.authorization.evidence.principal_type | Principal type | keyword |
azure.activitylogs.identity.authorization.evidence.role | Role | keyword |
azure.activitylogs.identity.authorization.evidence.role_assignment_id | Role assignment ID | keyword |
azure.activitylogs.identity.authorization.evidence.role_assignment_scope | Role assignment scope | keyword |
azure.activitylogs.identity.authorization.evidence.role_definition_id | Role definition ID | keyword |
azure.activitylogs.identity.authorization.scope | Scope | keyword |
azure.activitylogs.identity.claims.* | Claims | object |
azure.activitylogs.identity.claims_initiated_by_user.fullname | Fullname | keyword |
azure.activitylogs.identity.claims_initiated_by_user.givenname | Givenname | keyword |
azure.activitylogs.identity.claims_initiated_by_user.name | Name | keyword |
azure.activitylogs.identity.claims_initiated_by_user.schema | Schema | keyword |
azure.activitylogs.identity.claims_initiated_by_user.surname | Surname | keyword |
azure.activitylogs.identity_name | identity name | keyword |
azure.activitylogs.level | Level | long |
azure.activitylogs.operation_name | Operation name | keyword |
azure.activitylogs.operation_version | Operation version | keyword |
azure.activitylogs.properties | Event properties | flattened |
azure.activitylogs.result_signature | Result signature | keyword |
azure.activitylogs.result_type | Result type | keyword |
azure.activitylogs.tenant_id | Tenant ID | keyword |
azure.correlation_id | Correlation ID | keyword |
azure.resource.authorization_rule | Authorization rule | keyword |
azure.resource.group | Resource group | keyword |
azure.resource.id | Resource ID | keyword |
azure.resource.name | Name | keyword |
azure.resource.namespace | Resource type/namespace | keyword |
azure.resource.provider | Resource type/namespace | keyword |
azure.subscription_id | Azure subscription ID | keyword |
azure.tenant_id | tenant ID | keyword |
client.ip | IP address of the client (IPv4 or IPv6). | ip |
cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword |
cloud.availability_zone | Availability zone in which this host, resource, or service is located. | keyword |
cloud.image.id | Image ID for the cloud instance. | keyword |
cloud.instance.id | Instance ID of the host machine. | keyword |
cloud.instance.name | Instance name of the host machine. | keyword |
cloud.machine.type | Machine type of the host machine. | keyword |
cloud.project.id | The cloud project identifier. Examples: Google Cloud Project id, Azure Project id. | keyword |
cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword |
cloud.region | Region in which this host, resource, or service is located. | keyword |
container.id | Unique container id. | keyword |
container.image.name | Name of the image the container was built on. | keyword |
container.labels | Image labels. | object |
container.name | Container name. | keyword |
data_stream.dataset | Data stream dataset name. | constant_keyword |
data_stream.namespace | Data stream namespace. | constant_keyword |
data_stream.type | Data stream type. | constant_keyword |
destination.address | Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the .address field. Then it should be duplicated to .ip or .domain , depending on which one it is. | keyword |
destination.as.number | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | long |
destination.as.organization.name | Organization name. | keyword |
destination.as.organization.name.text | Multi-field of destination.as.organization.name . | match_only_text |
destination.geo.city_name | City name. | keyword |
destination.geo.continent_name | Name of the continent. | keyword |
destination.geo.country_iso_code | Country ISO code. | keyword |
destination.geo.country_name | Country name. | keyword |
destination.geo.location | Longitude and latitude. | geo_point |
destination.geo.name | User-defined description of a location, at the level of granularity they care about. Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. Not typically used in automated geolocation. | keyword |
destination.geo.region_iso_code | Region ISO code. | keyword |
destination.geo.region_name | Region name. | keyword |
destination.ip | IP address of the destination (IPv4 or IPv6). | ip |
destination.port | Port of the destination. | long |
ecs.version | ECS version this event conforms to. ecs.version is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword |
event.action | The action captured by the event. This describes the information in the event. It is more specific than event.category . Examples are group-add , process-started , file-created . The value is normally defined by the implementer. | keyword |
event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. event.category represents the "big buckets" of ECS categories. For example, filtering on event.category:process yields all events relating to process activity. This field is closely related to event.type , which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword |
event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date |
event.dataset | Event dataset | constant_keyword |
event.duration | Duration of the event in nanoseconds. If event.start and event.end are known this value should be the difference between the end and start time. | long |
event.id | Unique ID to describe the event. | keyword |
event.ingested | Timestamp when an event arrived in the central data store. This is different from @timestamp , which is when the event originally occurred. It's also different from event.created , which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: @timestamp < event.created < event.ingested . | date |
event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. event.kind gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword |
event.module | Event module | constant_keyword |
event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. event.type represents a categorization "sub-bucket" that, when used along with the event.category field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword |
file.mime_type | MIME type should identify the format of the file or stream of bytes using https://www.iana.org/assignments/media-types/media-types.xhtml[IANA official types], where possible. When more than one type is applicable, the most specific type should be used. | keyword |
file.size | File size in bytes. Only relevant when file.type is "file". | long |
geo.city_name | City name. | keyword |
geo.continent_name | Name of the continent. | keyword |
geo.country_iso_code | Country ISO code. | keyword |
geo.country_name | Country name. | keyword |
geo.location | Longitude and latitude. | geo_point |
geo.name | User-defined description of a location, at the level of granularity they care about. Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. Not typically used in automated geolocation. | keyword |
geo.region_iso_code | Region ISO code. | keyword |
geo.region_name | Region name. | keyword |
host.architecture | Operating system architecture. | keyword |
host.containerized | If the host is a container. | boolean |
host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword |
host.hostname | Hostname of the host. It normally contains what the hostname command returns on the host machine. | keyword |
host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of beat.name . | keyword |
host.ip | Host ip addresses. | ip |
host.mac | Host MAC addresses. The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | keyword |
host.name | Name of the host. It can contain what hostname returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword |
host.os.build | OS build information. | keyword |
host.os.codename | OS codename, if any. | keyword |
host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword |
host.os.kernel | Operating system kernel version as a raw string. | keyword |
host.os.name | Operating system name, without the version. | keyword |
host.os.name.text | Multi-field of host.os.name . | match_only_text |
host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword |
host.os.version | Operating system version as a raw string. | keyword |
host.type | Type of host. For Cloud providers this can be the machine type like t2.medium . If vm, this could be the container, for example, or other information meaningful in your environment. | keyword |
log.level | Original log level of the log event. If the source of the event provides a log level or textual severity, this is the one that goes in log.level . If your source doesn't specify one, you may put your event transport's severity here (e.g. Syslog severity). Some examples are warn , err , i , informational . | keyword |
message | For log events the message field contains the log message, optimized for viewing in a log viewer. For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. If multiple messages exist, they can be combined into one message. | match_only_text |
network.community_id | A hash of source and destination IPs and ports, as well as the protocol used in a communication. This is a tool-agnostic standard to identify flows. Learn more at https://github.com/corelight/community-id-spec. | keyword |
related.ip | All of the IPs seen on your event. | ip |
related.user | All the user names or other user identifiers seen on the event. | keyword |
source.address | Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the .address field. Then it should be duplicated to .ip or .domain , depending on which one it is. | keyword |
source.as.number | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | long |
source.as.organization.name | Organization name. | keyword |
source.as.organization.name.text | Multi-field of source.as.organization.name . | match_only_text |
source.geo.city_name | City name. | keyword |
source.geo.continent_name | Name of the continent. | keyword |
source.geo.country_iso_code | Country ISO code. | keyword |
source.geo.country_name | Country name. | keyword |
source.geo.location | Longitude and latitude. | geo_point |
source.geo.name | User-defined description of a location, at the level of granularity they care about. Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. Not typically used in automated geolocation. | keyword |
source.geo.region_iso_code | Region ISO code. | keyword |
source.geo.region_name | Region name. | keyword |
source.ip | IP address of the source (IPv4 or IPv6). | ip |
tags | List of keywords used to tag each event. | keyword |
user.domain | Name of the directory the user is a member of. For example, an LDAP or Active Directory domain name. | keyword |
user.full_name | User's full name, if available. | keyword |
user.full_name.text | Multi-field of user.full_name . | match_only_text |
user.id | Unique identifier of the user. | keyword |
user.name | Short name or login of the user. | keyword |
user.name.text | Multi-field of user.name . | match_only_text |
Platform logs
Retrieves Azure platform logs. Platform logs provide detailed diagnostic and auditing information for Azure resources and the Azure platform they depend on.
An example event for platformlogs
looks as following:
{
"agent": {
"hostname": "DESKTOP-RFOOE09",
"name": "DESKTOP-RFOOE09",
"id": "c1118415-bcb7-4cf9-b64d-a6c6e8ebcfac",
"type": "filebeat",
"ephemeral_id": "d3c4d56c-e7c7-489e-9d25-683452d16ec9",
"version": "7.10.0"
},
"elastic_agent": {
"id": "02f4e39d-8a1b-4506-a531-b45d0f492ee7",
"version": "7.10.0",
"snapshot": false
},
"cloud": {
"provider": "azure",
"region": "West Europe"
},
"@timestamp": "2020-11-05T14:07:32.000Z",
"ecs": {
"version": "1.5.0"
},
"data_stream": {
"namespace": "default",
"type": "logs",
"dataset": "azure.platformlogs"
},
"host": {
"name": "DESKTOP-RFOOE09"
},
"event": {
"ingested": "2020-11-01T12:02:34.237205200Z",
"kind": "event",
"action": "Retreive Namespace",
"dataset": "azure.platformlogs",
"outcome": "succeeded"
},
"azure": {
"subscription_id": "7657426D-C4C3-44AC-88A2-3B2CD59E6DBA",
"platformlogs": {
"Caller": "Portal",
"ActivityId": "5890c6fc-fc6b-47cd-971a-2366a1641d99",
"EventTimeString": "11/5/2020 2:07:32 PM +00:00",
"Environment": "PROD",
"category": "OperationalLogs",
"event_category": "Administrative",
"ScaleUnit": "PROD-AM3-AZ501",
"properties": {
"SubscriptionId": "7657426d-c4c3-44ac-88a2-3b2cd59e6dba",
"TrackingId": "5890c6fc-fc6b-47cd-971a-2366a1641d99_M8CH3_M8CH3_G8S3",
"Namespace": "obstesteventhubs",
"Via": "https://obstesteventhubs.servicebus.windows.net/$Resources/eventhubs?api-version=2017-04\u0026$skip=0\u0026$top=100"
}
},
"resource": {
"provider": "MICROSOFT.EVENTHUB/NAMESPACES",
"name": "OBSTESTEVENTHUBS",
"id": "/SUBSCRIPTIONS/7657426D-C4C3-44AC-88A2-3B2CD59E6DBA/RESOURCEGROUPS/OBS-TEST/PROVIDERS/MICROSOFT.EVENTHUB/NAMESPACES/OBSTESTEVENTHUBS",
"group": "OBS-TEST"
}
}
}
Exported fields
Field | Description | Type |
---|---|---|
@timestamp | Event timestamp. | date |
azure.correlation_id | Correlation ID | keyword |
azure.platformlogs.ActivityId | ActivityId | keyword |
azure.platformlogs.Caller | Caller | keyword |
azure.platformlogs.Cloud | Cloud | keyword |
azure.platformlogs.Environment | Environment | keyword |
azure.platformlogs.EventTimeString | EventTimeString | keyword |
azure.platformlogs.ScaleUnit | ScaleUnit | keyword |
azure.platformlogs.category | Category | keyword |
azure.platformlogs.ccpNamespace | ccpNamespace | keyword |
azure.platformlogs.event_category | Event Category | keyword |
azure.platformlogs.operation_name | Operation name | keyword |
azure.platformlogs.properties | Event properties | flattened |
azure.platformlogs.result_description | Result description | keyword |
azure.platformlogs.result_signature | Result signature | keyword |
azure.platformlogs.result_type | Result type | keyword |
azure.platformlogs.status | Status | keyword |
azure.resource.authorization_rule | Authorization rule | keyword |
azure.resource.group | Resource group | keyword |
azure.resource.id | Resource ID | keyword |
azure.resource.name | Name | keyword |
azure.resource.namespace | Resource type/namespace | keyword |
azure.resource.provider | Resource type/namespace | keyword |
azure.subscription_id | Azure subscription ID | keyword |
azure.tenant_id | tenant ID | keyword |
client.ip | IP address of the client (IPv4 or IPv6). | ip |
cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword |
cloud.availability_zone | Availability zone in which this host, resource, or service is located. | keyword |
cloud.image.id | Image ID for the cloud instance. | keyword |
cloud.instance.id | Instance ID of the host machine. | keyword |
cloud.instance.name | Instance name of the host machine. | keyword |
cloud.machine.type | Machine type of the host machine. | keyword |
cloud.project.id | The cloud project identifier. Examples: Google Cloud Project id, Azure Project id. | keyword |
cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword |
cloud.region | Region in which this host, resource, or service is located. | keyword |
container.id | Unique container id. | keyword |
container.image.name | Name of the image the container was built on. | keyword |
container.labels | Image labels. | object |
container.name | Container name. | keyword |
data_stream.dataset | Data stream dataset name. | constant_keyword |
data_stream.namespace | Data stream namespace. | constant_keyword |
data_stream.type | Data stream type. | constant_keyword |
destination.address | Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the .address field. Then it should be duplicated to .ip or .domain , depending on which one it is. | keyword |
destination.as.number | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | long |
destination.as.organization.name | Organization name. | keyword |
destination.as.organization.name.text | Multi-field of destination.as.organization.name . | match_only_text |
destination.geo.city_name | City name. | keyword |
destination.geo.continent_name | Name of the continent. | keyword |
destination.geo.country_iso_code | Country ISO code. | keyword |
destination.geo.country_name | Country name. | keyword |
destination.geo.location | Longitude and latitude. | geo_point |
destination.geo.name | User-defined description of a location, at the level of granularity they care about. Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. Not typically used in automated geolocation. | keyword |
destination.geo.region_iso_code | Region ISO code. | keyword |
destination.geo.region_name | Region name. | keyword |
destination.ip | IP address of the destination (IPv4 or IPv6). | ip |
destination.port | Port of the destination. | long |
ecs.version | ECS version this event conforms to. ecs.version is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword |
event.action | The action captured by the event. This describes the information in the event. It is more specific than event.category . Examples are group-add , process-started , file-created . The value is normally defined by the implementer. | keyword |
event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. event.category represents the "big buckets" of ECS categories. For example, filtering on event.category:process yields all events relating to process activity. This field is closely related to event.type , which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword |
event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date |
event.dataset | Event dataset | constant_keyword |
event.duration | Duration of the event in nanoseconds. If event.start and event.end are known this value should be the difference between the end and start time. | long |
event.id | Unique ID to describe the event. | keyword |
event.ingested | Timestamp when an event arrived in the central data store. This is different from @timestamp , which is when the event originally occurred. It's also different from event.created , which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: @timestamp < event.created < event.ingested . | date |
event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. event.kind gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword |
event.module | Event module | constant_keyword |
event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. event.type represents a categorization "sub-bucket" that, when used along with the event.category field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword |
file.mime_type | MIME type should identify the format of the file or stream of bytes using https://www.iana.org/assignments/media-types/media-types.xhtml[IANA official types], where possible. When more than one type is applicable, the most specific type should be used. | keyword |
file.size | File size in bytes. Only relevant when file.type is "file". | long |
geo.city_name | City name. | keyword |
geo.continent_name | Name of the continent. | keyword |
geo.country_iso_code | Country ISO code. | keyword |
geo.country_name | Country name. | keyword |
geo.location | Longitude and latitude. | geo_point |
geo.name | User-defined description of a location, at the level of granularity they care about. Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. Not typically used in automated geolocation. | keyword |
host.architecture | Operating system architecture. | keyword |
host.containerized | If the host is a container. | boolean |
host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword |
host.hostname | Hostname of the host. It normally contains what the hostname command returns on the host machine. | keyword |
host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of beat.name . | keyword |
host.ip | Host ip addresses. | ip |
host.mac | Host MAC addresses. The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | keyword |
host.name | Name of the host. It can contain what hostname returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword |
host.os.build | OS build information. | keyword |
host.os.codename | OS codename, if any. | keyword |
host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword |
host.os.kernel | Operating system kernel version as a raw string. | keyword |
host.os.name | Operating system name, without the version. | keyword |
host.os.name.text | Multi-field of host.os.name . | match_only_text |
host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword |
host.os.version | Operating system version as a raw string. | keyword |
host.type | Type of host. For Cloud providers this can be the machine type like t2.medium . If vm, this could be the container, for example, or other information meaningful in your environment. | keyword |
log.level | Original log level of the log event. If the source of the event provides a log level or textual severity, this is the one that goes in log.level . If your source doesn't specify one, you may put your event transport's severity here (e.g. Syslog severity). Some examples are warn , err , i , informational . | keyword |
message | For log events the message field contains the log message, optimized for viewing in a log viewer. For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. If multiple messages exist, they can be combined into one message. | match_only_text |
network.community_id | A hash of source and destination IPs and ports, as well as the protocol used in a communication. This is a tool-agnostic standard to identify flows. Learn more at https://github.com/corelight/community-id-spec. | keyword |
related.ip | All of the IPs seen on your event. | ip |
related.user | All the user names or other user identifiers seen on the event. | keyword |
source.address | Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the .address field. Then it should be duplicated to .ip or .domain , depending on which one it is. | keyword |
source.as.number | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | long |
source.as.organization.name | Organization name. | keyword |
source.as.organization.name.text | Multi-field of source.as.organization.name . | match_only_text |
source.geo.city_name | City name. | keyword |
source.geo.continent_name | Name of the continent. | keyword |
source.geo.country_iso_code | Country ISO code. | keyword |
source.geo.country_name | Country name. | keyword |
source.geo.location | Longitude and latitude. | geo_point |
source.geo.name | User-defined description of a location, at the level of granularity they care about. Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. Not typically used in automated geolocation. | keyword |
source.geo.region_iso_code | Region ISO code. | keyword |
source.geo.region_name | Region name. | keyword |
source.ip | IP address of the source (IPv4 or IPv6). | ip |
tags | List of keywords used to tag each event. | keyword |
user.domain | Name of the directory the user is a member of. For example, an LDAP or Active Directory domain name. | keyword |
user.full_name | User's full name, if available. | keyword |
user.full_name.text | Multi-field of user.full_name . | match_only_text |
user.id | Unique identifier of the user. | keyword |
user.name | Short name or login of the user. | keyword |
user.name.text | Multi-field of user.name . | match_only_text |
Sign-in logs
Retrieves Azure Active Directory sign-in logs. The sign-ins report provides information about the usage of managed applications and user sign-in activities.
An example event for signinlogs
looks as following:
{
"log": {
"level": "4"
},
"source": {
"geo": {
"continent_name": "Oceania",
"country_name": "Australia",
"location": {
"lon": 143.2104,
"lat": -33.494
},
"country_iso_code": "AU"
},
"as": {
"number": 13335,
"organization": {
"name": "Cloudflare, Inc."
}
},
"address": "1.1.1.1",
"ip": "1.1.1.1"
},
"message": "This error occurred due to 'Keep me signed in' interrupt when the user was signing-in.",
"tags": [
"preserve_original_event"
],
"geo": {
"country_name": "Seine-Et-Marne",
"city_name": "Champs-Sur-Marne",
"location": {
"lon": 2.12341234,
"lat": 48.12341234
},
"country_iso_code": "FR"
},
"cloud": {
"provider": "azure"
},
"@timestamp": "2019-10-18T09:45:48.072Z",
"ecs": {
"version": "1.11.0"
},
"related": {
"ip": [
"1.1.1.1"
]
},
"client": {
"ip": "1.1.1.1"
},
"event": {
"duration": 0,
"ingested": "2021-09-14T17:20:47.736433526Z",
"original": "{\"Level\":\"4\",\"callerIpAddress\":\"1.1.1.1\",\"category\":\"SignInLogs\",\"correlationId\":\"8a4de8b5-095c-47d0-a96f-a75130c61d53\",\"durationMs\":0,\"identity\":\"Test LTest\",\"location\":\"FR\",\"operationName\":\"Sign-in activity\",\"operationVersion\":\"1.0\",\"properties\":{\"appDisplayName\":\"Office 365\",\"appId\":\"8a4de8b5-095c-47d0-a96f-a75130c61d53\",\"clientAppUsed\":\"Browser\",\"conditionalAccessStatus\":\"notApplied\",\"correlationId\":\"8a4de8b5-095c-47d0-a96f-a75130c61d53\",\"createdDateTime\":\"2019-10-18T04:45:48.0729893-05:00\",\"deviceDetail\":{\"browser\":\"Chrome 77.0.3865\",\"deviceId\":\"\",\"operatingSystem\":\"MacOs\"},\"id\":\"8a4de8b5-095c-47d0-a96f-a75130c61d53\",\"ipAddress\":\"1.1.1.1\",\"isInteractive\":false,\"location\":{\"city\":\"Champs-Sur-Marne\",\"countryOrRegion\":\"FR\",\"geoCoordinates\":{\"latitude\":48.12341234,\"longitude\":2.12341234},\"state\":\"Seine-Et-Marne\"},\"originalRequestId\":\"8a4de8b5-095c-47d0-a96f-a75130c61d53\",\"processingTimeInMilliseconds\":239,\"riskDetail\":\"none\",\"riskLevelAggregated\":\"none\",\"riskLevelDuringSignIn\":\"none\",\"riskState\":\"none\",\"servicePrincipalId\":\"\",\"status\":{\"errorCode\":50140,\"failureReason\":\"This error occurred due to 'Keep me signed in' interrupt when the user was signing-in.\"},\"tokenIssuerName\":\"\",\"tokenIssuerType\":\"AzureAD\",\"userDisplayName\":\"Test LTest\",\"userId\":\"8a4de8b5-095c-47d0-a96f-a75130c61d53\",\"userPrincipalName\":\"test@elastic.co\"},\"resourceId\":\"/tenants/8a4de8b5-095c-47d0-a96f-a75130c61d53/providers/Microsoft.aadiam\",\"resultDescription\":\"This error occurred due to 'Keep me signed in' interrupt when the user was signing-in.\",\"resultSignature\":\"None\",\"resultType\":\"50140\",\"tenantId\":\"8a4de8b5-095c-47d0-a96f-a75130c61d53\",\"time\":\"2019-10-18T09:45:48.0729893Z\"}",
"kind": "event",
"action": "Sign-in activity",
"id": "8a4de8b5-095c-47d0-a96f-a75130c61d53",
"category": [
"authentication"
],
"type": [
"info"
],
"outcome": "failure"
},
"user": {
"name": "test",
"full_name": "Test LTest",
"id": "8a4de8b5-095c-47d0-a96f-a75130c61d53",
"domain": "elastic.co"
},
"azure": {
"tenant_id": "8a4de8b5-095c-47d0-a96f-a75130c61d53",
"correlation_id": "8a4de8b5-095c-47d0-a96f-a75130c61d53",
"signinlogs": {
"operation_name": "Sign-in activity",
"result_description": "This error occurred due to 'Keep me signed in' interrupt when the user was signing-in.",
"result_type": "50140",
"operation_version": "1.0",
"identity": "Test LTest",
"result_signature": "None",
"category": "SignInLogs",
"properties": {
"risk_level_aggregated": "none",
"client_app_used": "Browser",
"is_interactive": false,
"service_principal_id": "",
"app_display_name": "Office 365",
"created_at": "2019-10-18T04:45:48.0729893-05:00",
"risk_level_during_signin": "none",
"device_detail": {
"device_id": "",
"operating_system": "MacOs",
"browser": "Chrome 77.0.3865"
},
"risk_detail": "none",
"token_issuer_name": "",
"risk_state": "none",
"user_principal_name": "test@elastic.co",
"token_issuer_type": "AzureAD",
"processing_time_ms": 239,
"original_request_id": "8a4de8b5-095c-47d0-a96f-a75130c61d53",
"user_id": "8a4de8b5-095c-47d0-a96f-a75130c61d53",
"conditional_access_status": "notApplied",
"correlation_id": "8a4de8b5-095c-47d0-a96f-a75130c61d53",
"id": "8a4de8b5-095c-47d0-a96f-a75130c61d53",
"user_display_name": "Test LTest",
"app_id": "8a4de8b5-095c-47d0-a96f-a75130c61d53",
"status": {
"error_code": 50140
}
}
},
"resource": {
"provider": "Microsoft.aadiam",
"id": "/tenants/8a4de8b5-095c-47d0-a96f-a75130c61d53/providers/Microsoft.aadiam"
}
}
}
Exported fields
Field | Description | Type |
---|---|---|
@timestamp | Event timestamp. | date |
azure.correlation_id | Correlation ID | keyword |
azure.resource.authorization_rule | Authorization rule | keyword |
azure.resource.group | Resource group | keyword |
azure.resource.id | Resource ID | keyword |
azure.resource.name | Name | keyword |
azure.resource.namespace | Resource type/namespace | keyword |
azure.resource.provider | Resource type/namespace | keyword |
azure.signinlogs.category | Category | keyword |
azure.signinlogs.identity | Identity | keyword |
azure.signinlogs.operation_name | The operation name | keyword |
azure.signinlogs.operation_version | The operation version | keyword |
azure.signinlogs.properties.app_display_name | App display name | keyword |
azure.signinlogs.properties.app_id | App ID | keyword |
azure.signinlogs.properties.applied_conditional_access_policies | A list of conditional access policies that are triggered by the corresponding sign-in activity. | array |
azure.signinlogs.properties.authentication_details | The result of the authentication attempt and additional details on the authentication method. | array |
azure.signinlogs.properties.authentication_processing_details | Additional authentication processing details, such as the agent name in case of PTA/PHS or Server/farm name in case of federated authentication. | flattened |
azure.signinlogs.properties.authentication_protocol | Authentication protocol type. | keyword |
azure.signinlogs.properties.authentication_requirement | This holds the highest level of authentication needed through all the sign-in steps, for sign-in to succeed. | keyword |
azure.signinlogs.properties.authentication_requirement_policies | Set of CA policies that apply to this sign-in, each as CA: policy name, and/or MFA: Per-user | flattened |
azure.signinlogs.properties.autonomous_system_number | Autonomous system number. | long |
azure.signinlogs.properties.client_app_used | Client app used | keyword |
azure.signinlogs.properties.conditional_access_status | Conditional access status | keyword |
azure.signinlogs.properties.correlation_id | Correlation ID | keyword |
azure.signinlogs.properties.created_at | Date and time (UTC) the sign-in was initiated. | date |
azure.signinlogs.properties.cross_tenant_access_type | keyword | |
azure.signinlogs.properties.device_detail.browser | Browser | keyword |
azure.signinlogs.properties.device_detail.device_id | Device ID | keyword |
azure.signinlogs.properties.device_detail.display_name | Display name | keyword |
azure.signinlogs.properties.device_detail.is_compliant | If the device is compliant | boolean |
azure.signinlogs.properties.device_detail.is_managed | If the device is managed | boolean |
azure.signinlogs.properties.device_detail.operating_system | Operating system | keyword |
azure.signinlogs.properties.device_detail.trust_type | Trust type | keyword |
azure.signinlogs.properties.flagged_for_review | boolean | |
azure.signinlogs.properties.home_tenant_id | keyword | |
azure.signinlogs.properties.id | Unique ID representing the sign-in activity. | keyword |
azure.signinlogs.properties.incoming_token_type | Incoming token type. | keyword |
azure.signinlogs.properties.is_interactive | Is interactive | boolean |
azure.signinlogs.properties.is_tenant_restricted | boolean | |
azure.signinlogs.properties.network_location_details | The network location details including the type of network used and its names. | array |
azure.signinlogs.properties.original_request_id | Original request ID | keyword |
azure.signinlogs.properties.processing_time_ms | Processing time in milliseconds | float |
azure.signinlogs.properties.resource_display_name | Resource display name | keyword |
azure.signinlogs.properties.resource_id | The identifier of the resource that the user signed in to. | keyword |
azure.signinlogs.properties.resource_tenant_id | keyword | |
azure.signinlogs.properties.risk_detail | Risk detail | keyword |
azure.signinlogs.properties.risk_event_types | The list of risk event types associated with the sign-in. Possible values: unlikelyTravel, anonymizedIPAddress, maliciousIPAddress, unfamiliarFeatures, malwareInfectedIPAddress, suspiciousIPAddress, leakedCredentials, investigationsThreatIntelligence, generic, or unknownFutureValue. | keyword |
azure.signinlogs.properties.risk_event_types_v2 | The list of risk event types associated with the sign-in. Possible values: unlikelyTravel, anonymizedIPAddress, maliciousIPAddress, unfamiliarFeatures, malwareInfectedIPAddress, suspiciousIPAddress, leakedCredentials, investigationsThreatIntelligence, generic, or unknownFutureValue. | keyword |
azure.signinlogs.properties.risk_level_aggregated | Risk level aggregated | keyword |
azure.signinlogs.properties.risk_level_during_signin | Risk level during signIn | keyword |
azure.signinlogs.properties.risk_state | Risk state | keyword |
azure.signinlogs.properties.service_principal_credential_key_id | Key id of the service principal that initiated the sign-in. | keyword |
azure.signinlogs.properties.service_principal_id | The application identifier used for sign-in. This field is populated when you are signing in using an application. | keyword |
azure.signinlogs.properties.service_principal_name | The application name used for sign-in. This field is populated when you are signing in using an application. | keyword |
azure.signinlogs.properties.sso_extension_version | keyword | |
azure.signinlogs.properties.status.error_code | Error code | long |
azure.signinlogs.properties.token_issuer_name | Token issuer name | keyword |
azure.signinlogs.properties.token_issuer_type | Token issuer type | keyword |
azure.signinlogs.properties.unique_token_identifier | Unique token identifier for the request. | keyword |
azure.signinlogs.properties.user_display_name | User display name | keyword |
azure.signinlogs.properties.user_id | User ID | keyword |
azure.signinlogs.properties.user_principal_name | User principal name | keyword |
azure.signinlogs.properties.user_type | keyword | |
azure.signinlogs.result_description | Result description | keyword |
azure.signinlogs.result_signature | Result signature | keyword |
azure.signinlogs.result_type | Result type | keyword |
azure.signinlogs.tenant_id | Tenant ID | keyword |
azure.subscription_id | Azure subscription ID | keyword |
azure.tenant_id | tenant ID | keyword |
client.ip | IP address of the client (IPv4 or IPv6). | ip |
cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword |
cloud.availability_zone | Availability zone in which this host, resource, or service is located. | keyword |
cloud.image.id | Image ID for the cloud instance. | keyword |
cloud.instance.id | Instance ID of the host machine. | keyword |
cloud.instance.name | Instance name of the host machine. | keyword |
cloud.machine.type | Machine type of the host machine. | keyword |
cloud.project.id | The cloud project identifier. Examples: Google Cloud Project id, Azure Project id. | keyword |
cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword |
cloud.region | Region in which this host, resource, or service is located. | keyword |
container.id | Unique container id. | keyword |
container.image.name | Name of the image the container was built on. | keyword |
container.labels | Image labels. | object |
container.name | Container name. | keyword |
data_stream.dataset | Data stream dataset name. | constant_keyword |
data_stream.namespace | Data stream namespace. | constant_keyword |
data_stream.type | Data stream type. | constant_keyword |
destination.address | Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the .address field. Then it should be duplicated to .ip or .domain , depending on which one it is. | keyword |
destination.as.number | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | long |
destination.as.organization.name | Organization name. | keyword |
destination.as.organization.name.text | Multi-field of destination.as.organization.name . | match_only_text |
destination.geo.city_name | City name. | keyword |
destination.geo.continent_name | Name of the continent. | keyword |
destination.geo.country_iso_code | Country ISO code. | keyword |
destination.geo.country_name | Country name. | keyword |
destination.geo.location | Longitude and latitude. | geo_point |
destination.geo.name | User-defined description of a location, at the level of granularity they care about. Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. Not typically used in automated geolocation. | keyword |
destination.geo.region_iso_code | Region ISO code. | keyword |
destination.geo.region_name | Region name. | keyword |
destination.ip | IP address of the destination (IPv4 or IPv6). | ip |
destination.port | Port of the destination. | long |
ecs.version | ECS version this event conforms to. ecs.version is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword |
event.action | The action captured by the event. This describes the information in the event. It is more specific than event.category . Examples are group-add , process-started , file-created . The value is normally defined by the implementer. | keyword |
event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. event.category represents the "big buckets" of ECS categories. For example, filtering on event.category:process yields all events relating to process activity. This field is closely related to event.type , which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword |
event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date |
event.dataset | Event dataset | constant_keyword |
event.duration | Duration of the event in nanoseconds. If event.start and event.end are known this value should be the difference between the end and start time. | long |
event.id | Unique ID to describe the event. | keyword |
event.ingested | Timestamp when an event arrived in the central data store. This is different from @timestamp , which is when the event originally occurred. It's also different from event.created , which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: @timestamp < event.created < event.ingested . | date |
event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. event.kind gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword |
event.module | Event module | constant_keyword |
event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. event.type represents a categorization "sub-bucket" that, when used along with the event.category field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword |
file.mime_type | MIME type should identify the format of the file or stream of bytes using https://www.iana.org/assignments/media-types/media-types.xhtml[IANA official types], where possible. When more than one type is applicable, the most specific type should be used. | keyword |
file.size | File size in bytes. Only relevant when file.type is "file". | long |
geo.city_name | City name. | keyword |
geo.continent_name | Name of the continent. | keyword |
geo.country_iso_code | Country ISO code. | keyword |
geo.country_name | Country name. | keyword |
geo.location | Longitude and latitude. | geo_point |
host.architecture | Operating system architecture. | keyword |
host.containerized | If the host is a container. | boolean |
host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword |
host.hostname | Hostname of the host. It normally contains what the hostname command returns on the host machine. | keyword |
host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of beat.name . | keyword |
host.ip | Host ip addresses. | ip |
host.mac | Host MAC addresses. The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | keyword |
host.name | Name of the host. It can contain what hostname returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword |
host.os.build | OS build information. | keyword |
host.os.codename | OS codename, if any. | keyword |
host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword |
host.os.kernel | Operating system kernel version as a raw string. | keyword |
host.os.name | Operating system name, without the version. | keyword |
host.os.name.text | Multi-field of host.os.name . | match_only_text |
host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword |
host.os.version | Operating system version as a raw string. | keyword |
host.type | Type of host. For Cloud providers this can be the machine type like t2.medium . If vm, this could be the container, for example, or other information meaningful in your environment. | keyword |
log.level | Original log level of the log event. If the source of the event provides a log level or textual severity, this is the one that goes in log.level . If your source doesn't specify one, you may put your event transport's severity here (e.g. Syslog severity). Some examples are warn , err , i , informational . | keyword |
message | For log events the message field contains the log message, optimized for viewing in a log viewer. For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. If multiple messages exist, they can be combined into one message. | match_only_text |
network.community_id | A hash of source and destination IPs and ports, as well as the protocol used in a communication. This is a tool-agnostic standard to identify flows. Learn more at https://github.com/corelight/community-id-spec. | keyword |
related.ip | All of the IPs seen on your event. | ip |
related.user | All the user names or other user identifiers seen on the event. | keyword |
source.address | Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the .address field. Then it should be duplicated to .ip or .domain , depending on which one it is. | keyword |
source.as.number | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | long |
source.as.organization.name | Organization name. | keyword |
source.as.organization.name.text | Multi-field of source.as.organization.name . | match_only_text |
source.geo.city_name | City name. | keyword |
source.geo.continent_name | Name of the continent. | keyword |
source.geo.country_iso_code | Country ISO code. | keyword |
source.geo.country_name | Country name. | keyword |
source.geo.location | Longitude and latitude. | geo_point |
source.geo.name | User-defined description of a location, at the level of granularity they care about. Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. Not typically used in automated geolocation. | keyword |
source.geo.region_iso_code | Region ISO code. | keyword |
source.geo.region_name | Region name. | keyword |
source.ip | IP address of the source (IPv4 or IPv6). | ip |
source.port | Port of the source. | long |
tags | List of keywords used to tag each event. | keyword |
user.domain | Name of the directory the user is a member of. For example, an LDAP or Active Directory domain name. | keyword |
user.full_name | User's full name, if available. | keyword |
user.full_name.text | Multi-field of user.full_name . | match_only_text |
user.id | Unique identifier of the user. | keyword |
user.name | Short name or login of the user. | keyword |
user.name.text | Multi-field of user.name . | match_only_text |
user_agent.device.name | Name of the device. | keyword |
user_agent.name | Name of the user agent. | keyword |
user_agent.original | Unparsed user_agent string. | keyword |
user_agent.original.text | Multi-field of user_agent.original . | match_only_text |
user_agent.os.full | Operating system name, including the version or code name. | keyword |
user_agent.os.full.text | Multi-field of user_agent.os.full . | match_only_text |
user_agent.os.name | Operating system name, without the version. | keyword |
user_agent.os.name.text | Multi-field of user_agent.os.name . | match_only_text |
user_agent.os.version | Operating system version as a raw string. | keyword |
user_agent.version | Version of the user agent. | keyword |
Audit logs
Retrieves Azure Active Directory audit logs. The audit logs provide traceability through logs for all changes done by various features within Azure AD. Examples of audit logs include changes made to any resources within Azure AD like adding or removing users, apps, groups, roles and policies.
An example event for auditlogs
looks as following:
{
"log": {
"level": "Information"
},
"cloud": {
"provider": "azure"
},
"@timestamp": "2020-11-02T08:51:36.997Z",
"ecs": {
"version": "1.5.0"
},
"data_stream": {
"namespace": "default",
"type": "logs",
"dataset": "azure.auditlogs"
},
"event": {
"duration": 0,
"ingested": "2020-10-30T20:47:48.123859400Z",
"kind": "event",
"action": "MICROSOFT.RESOURCES/DEPLOYMENTS/WRITE",
"dataset": "azure.auditlogs",
"outcome": "success"
},
"azure.correlation_id": "8a4de8b5-095c-47d0-a96f-a75130c61d53",
"azure.resource.id": "/tenants/8a4de8b5-095c-47d0-a96f-a75130c61d53/providers/Microsoft.aadiam",
"azure.resource.provider": "Microsoft.aadiam",
"azure.tenant_id": "8a4de8b5-095c-47d0-a96f-a75130c61d53",
"azure.auditlogs.category": "AuditLogs",
"azure.auditlogs.identity": "Device Registration Service",
"azure.auditlogs.operation_name": "Update device",
"azure.auditlogs.operation_version": "1.0",
"azure.auditlogs.properties.activity_datetime": "2019-10-18T15:30:51.0273716+00:00",
"azure.auditlogs.properties.activity_display_name": "Update device",
"azure.auditlogs.properties.category": "Device",
"azure.auditlogs.properties.correlation_id": "8a4de8b5-095c-47d0-a96f-a75130c61d53",
"azure.auditlogs.properties.id": "Directory_ESQ",
"azure.auditlogs.properties.initiated_by.app.displayName": "Device Registration Service",
"azure.auditlogs.properties.initiated_by.app.servicePrincipalId": "8a4de8b5-095c-47d0-a96f-a75130c61d53",
"azure.auditlogs.properties.logged_by_service": "Core Directory",
"azure.auditlogs.properties.operation_type": "Update",
"azure.auditlogs.properties.result_reason": "",
"azure.auditlogs.properties.target_resources.0.display_name": "LAPTOP-12",
"azure.auditlogs.properties.target_resources.0.id": "8a4de8b5-095c-47d0-a96f-a75130c61d53",
"azure.auditlogs.properties.target_resources.0.modified_properties.0.new_value": "\"\"",
"azure.auditlogs.properties.target_resources.0.type": "Device",
"azure.auditlogs.result_signature": "None"
}
Exported fields
Field | Description | Type |
---|---|---|
@timestamp | Event timestamp. | date |
azure.auditlogs.category | The category of the operation. Currently, Audit is the only supported value. | keyword |
azure.auditlogs.identity | Identity | keyword |
azure.auditlogs.level | Value for level. | float |
azure.auditlogs.operation_name | The operation name | keyword |
azure.auditlogs.operation_version | The operation version | keyword |
azure.auditlogs.properties.activity_datetime | Activity timestamp | date |
azure.auditlogs.properties.activity_display_name | Activity display name | keyword |
azure.auditlogs.properties.authentication_protocol | Authentication protocol type. | keyword |
azure.auditlogs.properties.category | category | keyword |
azure.auditlogs.properties.correlation_id | Correlation ID | keyword |
azure.auditlogs.properties.id | ID | keyword |
azure.auditlogs.properties.initiated_by.app.appId | App ID | keyword |
azure.auditlogs.properties.initiated_by.app.displayName | Display name | keyword |
azure.auditlogs.properties.initiated_by.app.servicePrincipalId | Service principal ID | keyword |
azure.auditlogs.properties.initiated_by.app.servicePrincipalName | Service principal name | keyword |
azure.auditlogs.properties.initiated_by.user.displayName | Display name | keyword |
azure.auditlogs.properties.initiated_by.user.id | ID | keyword |
azure.auditlogs.properties.initiated_by.user.ipAddress | ip Address | keyword |
azure.auditlogs.properties.initiated_by.user.userPrincipalName | User principal name | keyword |
azure.auditlogs.properties.logged_by_service | Logged by service | keyword |
azure.auditlogs.properties.operation_type | Operation type | keyword |
azure.auditlogs.properties.result | Log result | keyword |
azure.auditlogs.properties.result_reason | Reason for the log result | keyword |
azure.auditlogs.properties.target_resources.*.display_name | Display name | keyword |
azure.auditlogs.properties.target_resources.*.id | ID | keyword |
azure.auditlogs.properties.target_resources.*.ip_address | ip Address | keyword |
azure.auditlogs.properties.target_resources.*.modified_properties.*.display_name | Display value | keyword |
azure.auditlogs.properties.target_resources.*.modified_properties.*.new_value | New value | keyword |
azure.auditlogs.properties.target_resources.*.modified_properties.*.old_value | Old value | keyword |
azure.auditlogs.properties.target_resources.*.type | Type | keyword |
azure.auditlogs.properties.target_resources.*.user_principal_name | User principal name | keyword |
azure.auditlogs.result_signature | Result signature | keyword |
azure.auditlogs.tenant_id | Tenant ID | keyword |
azure.correlation_id | Correlation ID | keyword |
azure.resource.authorization_rule | Authorization rule | keyword |
azure.resource.group | Resource group | keyword |
azure.resource.id | Resource ID | keyword |
azure.resource.name | Name | keyword |
azure.resource.namespace | Resource type/namespace | keyword |
azure.resource.provider | Resource type/namespace | keyword |
azure.subscription_id | Azure subscription ID | keyword |
azure.tenant_id | tenant ID | keyword |
client.ip | IP address of the client (IPv4 or IPv6). | ip |
cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword |
cloud.availability_zone | Availability zone in which this host, resource, or service is located. | keyword |
cloud.image.id | Image ID for the cloud instance. | keyword |
cloud.instance.id | Instance ID of the host machine. | keyword |
cloud.instance.name | Instance name of the host machine. | keyword |
cloud.machine.type | Machine type of the host machine. | keyword |
cloud.project.id | The cloud project identifier. Examples: Google Cloud Project id, Azure Project id. | keyword |
cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword |
cloud.region | Region in which this host, resource, or service is located. | keyword |
container.id | Unique container id. | keyword |
container.image.name | Name of the image the container was built on. | keyword |
container.labels | Image labels. | object |
container.name | Container name. | keyword |
data_stream.dataset | Data stream dataset name. | constant_keyword |
data_stream.namespace | Data stream namespace. | constant_keyword |
data_stream.type | Data stream type. | constant_keyword |
destination.address | Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the .address field. Then it should be duplicated to .ip or .domain , depending on which one it is. | keyword |
destination.as.number | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | long |
destination.as.organization.name | Organization name. | keyword |
destination.as.organization.name.text | Multi-field of destination.as.organization.name . | match_only_text |
destination.geo.city_name | City name. | keyword |
destination.geo.continent_name | Name of the continent. | keyword |
destination.geo.country_iso_code | Country ISO code. | keyword |
destination.geo.country_name | Country name. | keyword |
destination.geo.location | Longitude and latitude. | geo_point |
destination.geo.name | User-defined description of a location, at the level of granularity they care about. Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. Not typically used in automated geolocation. | keyword |
destination.geo.region_iso_code | Region ISO code. | keyword |
destination.geo.region_name | Region name. | keyword |
destination.ip | IP address of the destination (IPv4 or IPv6). | ip |
destination.port | Port of the destination. | long |
ecs.version | ECS version this event conforms to. ecs.version is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword |
event.action | The action captured by the event. This describes the information in the event. It is more specific than event.category . Examples are group-add , process-started , file-created . The value is normally defined by the implementer. | keyword |
event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. event.category represents the "big buckets" of ECS categories. For example, filtering on event.category:process yields all events relating to process activity. This field is closely related to event.type , which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword |
event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date |
event.dataset | Event dataset | constant_keyword |
event.duration | Duration of the event in nanoseconds. If event.start and event.end are known this value should be the difference between the end and start time. | long |
event.id | Unique ID to describe the event. | keyword |
event.ingested | Timestamp when an event arrived in the central data store. This is different from @timestamp , which is when the event originally occurred. It's also different from event.created , which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: @timestamp < event.created < event.ingested . | date |
event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. event.kind gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword |
event.module | Event module | constant_keyword |
event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. event.type represents a categorization "sub-bucket" that, when used along with the event.category field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword |
file.mime_type | MIME type should identify the format of the file or stream of bytes using https://www.iana.org/assignments/media-types/media-types.xhtml[IANA official types], where possible. When more than one type is applicable, the most specific type should be used. | keyword |
file.size | File size in bytes. Only relevant when file.type is "file". | long |
geo.city_name | City name. | keyword |
geo.continent_name | Name of the continent. | keyword |
geo.country_iso_code | Country ISO code. | keyword |
geo.country_name | Country name. | keyword |
geo.location | Longitude and latitude. | geo_point |
host.architecture | Operating system architecture. | keyword |
host.containerized | If the host is a container. | boolean |
host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword |
host.hostname | Hostname of the host. It normally contains what the hostname command returns on the host machine. | keyword |
host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of beat.name . | keyword |
host.ip | Host ip addresses. | ip |
host.mac | Host MAC addresses. The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | keyword |
host.name | Name of the host. It can contain what hostname returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword |
host.os.build | OS build information. | keyword |
host.os.codename | OS codename, if any. | keyword |
host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword |
host.os.kernel | Operating system kernel version as a raw string. | keyword |
host.os.name | Operating system name, without the version. | keyword |
host.os.name.text | Multi-field of host.os.name . | match_only_text |
host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword |
host.os.version | Operating system version as a raw string. | keyword |
host.type | Type of host. For Cloud providers this can be the machine type like t2.medium . If vm, this could be the container, for example, or other information meaningful in your environment. | keyword |
log.level | Original log level of the log event. If the source of the event provides a log level or textual severity, this is the one that goes in log.level . If your source doesn't specify one, you may put your event transport's severity here (e.g. Syslog severity). Some examples are warn , err , i , informational . | keyword |
message | For log events the message field contains the log message, optimized for viewing in a log viewer. For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. If multiple messages exist, they can be combined into one message. | match_only_text |
network.community_id | A hash of source and destination IPs and ports, as well as the protocol used in a communication. This is a tool-agnostic standard to identify flows. Learn more at https://github.com/corelight/community-id-spec. | keyword |
related.ip | All of the IPs seen on your event. | ip |
related.user | All the user names or other user identifiers seen on the event. | keyword |
source.address | Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the .address field. Then it should be duplicated to .ip or .domain , depending on which one it is. | keyword |
source.as.number | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | long |
source.as.organization.name | Organization name. | keyword |
source.as.organization.name.text | Multi-field of source.as.organization.name . | match_only_text |
source.geo.city_name | City name. | keyword |
source.geo.continent_name | Name of the continent. | keyword |
source.geo.country_iso_code | Country ISO code. | keyword |
source.geo.country_name | Country name. | keyword |
source.geo.location | Longitude and latitude. | geo_point |
source.geo.name | User-defined description of a location, at the level of granularity they care about. Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. Not typically used in automated geolocation. | keyword |
source.geo.region_iso_code | Region ISO code. | keyword |
source.geo.region_name | Region name. | keyword |
source.ip | IP address of the source (IPv4 or IPv6). | ip |
tags | List of keywords used to tag each event. | keyword |
user.domain | Name of the directory the user is a member of. For example, an LDAP or Active Directory domain name. | keyword |
user.full_name | User's full name, if available. | keyword |
user.full_name.text | Multi-field of user.full_name . | match_only_text |
user.id | Unique identifier of the user. | keyword |
user.name | Short name or login of the user. | keyword |
user.name.text | Multi-field of user.name . | match_only_text |
Spring Cloud logs
Retrieves Azure Spring Cloud system and application logs.
An example event for springcloudlogs
looks as following:
{
"agent": {
"hostname": "docker-fleet-agent",
"name": "docker-fleet-agent",
"id": "ef999bb2-fe83-4ffa-aa0c-0b54b7598df4",
"type": "filebeat",
"ephemeral_id": "49d0a57c-119c-4a01-878c-d9b06fc81f65",
"version": "7.14.0"
},
"log": {
"level": "Informational"
},
"elastic_agent": {
"id": "ef999bb2-fe83-4ffa-aa0c-0b54b7598df4",
"version": "7.14.0",
"snapshot": true
},
"message": "2021-08-03 15:07:03.354 INFO [helloapp,,,] 1 --- [trap-executor-0] c.n.d.s.r.aws.ConfigClusterResolver : Resolving eureka endpoints via configuration",
"tags": [
"azure-springcloudlogs"
],
"geo": {
"name": "westeurope"
},
"cloud": {
"provider": "azure"
},
"@timestamp": "2021-08-03T15:07:03.354Z",
"ecs": {
"version": "1.10.0"
},
"data_stream": {
"namespace": "default",
"type": "logs",
"dataset": "azure.springcloudlogs"
},
"event": {
"agent_id_status": "verified",
"ingested": "2021-08-03T15:15:14.386889100Z",
"kind": "event",
"action": "Microsoft.AppPlatform/Spring/logs",
"dataset": "azure.springcloudlogs"
},
"azure": {
"subscription_id": "0E073EC1-C22F-4488-ADDE-DA35ED609CCD",
"springcloudlogs": {
"log_format": "RAW",
"operation_name": "Microsoft.AppPlatform/Spring/logs",
"category": "ApplicationConsole",
"event_category": "Administrative",
"logtag": "F",
"properties": {
"app_name": "helloapp",
"instance_name": "helloapp-default-8-56df6b7f56-4vr94",
"stream": "stdout",
"service_name": "obssprincloud",
"service_id": "99070c7524f14eaf970bbdf35f357772"
}
},
"resource": {
"provider": "MICROSOFT.APPPLATFORM/SPRING",
"name": "OBSSPRINCLOUD",
"id": "/SUBSCRIPTIONS/0E073EC1-C22F-4488-ADDE-DA35ED609CCD/RESOURCEGROUPS/TESTM/PROVIDERS/MICROSOFT.APPPLATFORM/SPRING/OBSSPRINCLOUD",
"group": "TESTM"
}
}
}
Exported fields
Field | Description | Type |
---|---|---|
@timestamp | Event timestamp. | date |
azure.correlation_id | Correlation ID | keyword |
azure.resource.authorization_rule | Authorization rule | keyword |
azure.resource.group | Resource group | keyword |
azure.resource.id | Resource ID | keyword |
azure.resource.name | Name | keyword |
azure.resource.namespace | Resource type/namespace | keyword |
azure.resource.provider | Resource type/namespace | keyword |
azure.springcloudlogs.category | Category | keyword |
azure.springcloudlogs.event_category | Event Category | keyword |
azure.springcloudlogs.log_format | ccpNamespace | keyword |
azure.springcloudlogs.logtag | Cloud | keyword |
azure.springcloudlogs.operation_name | Operation name | keyword |
azure.springcloudlogs.properties.app_name | Application name | keyword |
azure.springcloudlogs.properties.instance_name | Instance name | keyword |
azure.springcloudlogs.properties.logger | Logger | keyword |
azure.springcloudlogs.properties.service_id | Service ID | keyword |
azure.springcloudlogs.properties.service_name | Service name | keyword |
azure.springcloudlogs.properties.stack | Stack name | keyword |
azure.springcloudlogs.properties.stream | Stream | keyword |
azure.springcloudlogs.properties.thread | Thread | keyword |
azure.springcloudlogs.properties.type | Type | keyword |
azure.springcloudlogs.status | Status | keyword |
azure.subscription_id | Azure subscription ID | keyword |
azure.tenant_id | tenant ID | keyword |
client.ip | IP address of the client (IPv4 or IPv6). | ip |
cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword |
cloud.availability_zone | Availability zone in which this host, resource, or service is located. | keyword |
cloud.image.id | Image ID for the cloud instance. | keyword |
cloud.instance.id | Instance ID of the host machine. | keyword |
cloud.instance.name | Instance name of the host machine. | keyword |
cloud.machine.type | Machine type of the host machine. | keyword |
cloud.project.id | The cloud project identifier. Examples: Google Cloud Project id, Azure Project id. | keyword |
cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword |
cloud.region | Region in which this host, resource, or service is located. | keyword |
container.id | Unique container id. | keyword |
container.image.name | Name of the image the container was built on. | keyword |
container.labels | Image labels. | object |
container.name | Container name. | keyword |
data_stream.dataset | Data stream dataset name. | constant_keyword |
data_stream.namespace | Data stream namespace. | constant_keyword |
data_stream.type | Data stream type. | constant_keyword |
destination.address | Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the .address field. Then it should be duplicated to .ip or .domain , depending on which one it is. | keyword |
destination.as.number | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | long |
destination.as.organization.name | Organization name. | keyword |
destination.as.organization.name.text | Multi-field of destination.as.organization.name . | match_only_text |
destination.geo.city_name | City name. | keyword |
destination.geo.continent_name | Name of the continent. | keyword |
destination.geo.country_iso_code | Country ISO code. | keyword |
destination.geo.country_name | Country name. | keyword |
destination.geo.location | Longitude and latitude. | geo_point |
destination.geo.name | User-defined description of a location, at the level of granularity they care about. Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. Not typically used in automated geolocation. | keyword |
destination.geo.region_iso_code | Region ISO code. | keyword |
destination.geo.region_name | Region name. | keyword |
destination.ip | IP address of the destination (IPv4 or IPv6). | ip |
destination.port | Port of the destination. | long |
ecs.version | ECS version this event conforms to. ecs.version is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword |
event.action | The action captured by the event. This describes the information in the event. It is more specific than event.category . Examples are group-add , process-started , file-created . The value is normally defined by the implementer. | keyword |
event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. event.category represents the "big buckets" of ECS categories. For example, filtering on event.category:process yields all events relating to process activity. This field is closely related to event.type , which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword |
event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date |
event.dataset | Event dataset | constant_keyword |
event.duration | Duration of the event in nanoseconds. If event.start and event.end are known this value should be the difference between the end and start time. | long |
event.id | Unique ID to describe the event. | keyword |
event.ingested | Timestamp when an event arrived in the central data store. This is different from @timestamp , which is when the event originally occurred. It's also different from event.created , which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: @timestamp < event.created < event.ingested . | date |
event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. event.kind gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword |
event.module | Event module | constant_keyword |
event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. event.type represents a categorization "sub-bucket" that, when used along with the event.category field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword |
file.mime_type | MIME type should identify the format of the file or stream of bytes using https://www.iana.org/assignments/media-types/media-types.xhtml[IANA official types], where possible. When more than one type is applicable, the most specific type should be used. | keyword |
file.size | File size in bytes. Only relevant when file.type is "file". | long |
geo.city_name | City name. | keyword |
geo.continent_name | Name of the continent. | keyword |
geo.country_iso_code | Country ISO code. | keyword |
geo.country_name | Country name. | keyword |
geo.location | Longitude and latitude. | geo_point |
geo.name | User-defined description of a location, at the level of granularity they care about. Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. Not typically used in automated geolocation. | keyword |
host.architecture | Operating system architecture. | keyword |
host.containerized | If the host is a container. | boolean |
host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword |
host.hostname | Hostname of the host. It normally contains what the hostname command returns on the host machine. | keyword |
host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of beat.name . | keyword |
host.ip | Host ip addresses. | ip |
host.mac | Host MAC addresses. The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | keyword |
host.name | Name of the host. It can contain what hostname returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword |
host.os.build | OS build information. | keyword |
host.os.codename | OS codename, if any. | keyword |
host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword |
host.os.kernel | Operating system kernel version as a raw string. | keyword |
host.os.name | Operating system name, without the version. | keyword |
host.os.name.text | Multi-field of host.os.name . | match_only_text |
host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword |
host.os.version | Operating system version as a raw string. | keyword |
host.type | Type of host. For Cloud providers this can be the machine type like t2.medium . If vm, this could be the container, for example, or other information meaningful in your environment. | keyword |
log.level | Original log level of the log event. If the source of the event provides a log level or textual severity, this is the one that goes in log.level . If your source doesn't specify one, you may put your event transport's severity here (e.g. Syslog severity). Some examples are warn , err , i , informational . | keyword |
message | For log events the message field contains the log message, optimized for viewing in a log viewer. For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. If multiple messages exist, they can be combined into one message. | match_only_text |
network.community_id | A hash of source and destination IPs and ports, as well as the protocol used in a communication. This is a tool-agnostic standard to identify flows. Learn more at https://github.com/corelight/community-id-spec. | keyword |
related.ip | All of the IPs seen on your event. | ip |
related.user | All the user names or other user identifiers seen on the event. | keyword |
source.address | Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the .address field. Then it should be duplicated to .ip or .domain , depending on which one it is. | keyword |
source.as.number | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | long |
source.as.organization.name | Organization name. | keyword |
source.as.organization.name.text | Multi-field of source.as.organization.name . | match_only_text |
source.geo.city_name | City name. | keyword |
source.geo.continent_name | Name of the continent. | keyword |
source.geo.country_iso_code | Country ISO code. | keyword |
source.geo.country_name | Country name. | keyword |
source.geo.location | Longitude and latitude. | geo_point |
source.geo.name | User-defined description of a location, at the level of granularity they care about. Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. Not typically used in automated geolocation. | keyword |
source.geo.region_iso_code | Region ISO code. | keyword |
source.geo.region_name | Region name. | keyword |
source.ip | IP address of the source (IPv4 or IPv6). | ip |
tags | List of keywords used to tag each event. | keyword |
user.domain | Name of the directory the user is a member of. For example, an LDAP or Active Directory domain name. | keyword |
user.full_name | User's full name, if available. | keyword |
user.full_name.text | Multi-field of user.full_name . | match_only_text |
user.id | Unique identifier of the user. | keyword |
user.name | Short name or login of the user. | keyword |
user.name.text | Multi-field of user.name . | match_only_text |
Firewall logs
Retrieves Azure Firewall application rule, network rule, and DNS proxy logs.
An example event for firewall
looks as following:
{
"@timestamp": "2022-06-08T16:54:58.849Z",
"azure": {
"firewall": {
"action": "Deny",
"category": "AzureFirewallNetworkRule",
"icmp": {
"request": {
"code": "8"
}
},
"operation_name": "AzureFirewallNetworkRuleLog"
},
"resource": {
"group": "TEST-FW-RG",
"id": "/SUBSCRIPTIONS/23103928-B2CF-472A-8CDB-0146E2849129/RESOURCEGROUPS/TEST-FW-RG/PROVIDERS/MICROSOFT.NETWORK/AZUREFIREWALLS/TEST-FW01",
"name": "TEST-FW01",
"provider": "MICROSOFT.NETWORK/AZUREFIREWALLS"
},
"subscription_id": "23103928-B2CF-472A-8CDB-0146E2849129"
},
"cloud": {
"account": {
"id": "23103928-B2CF-472A-8CDB-0146E2849129"
},
"provider": "azure"
},
"destination": {
"address": "89.160.20.156",
"as": {
"number": 29518,
"organization": {
"name": "Bredband2 AB"
}
},
"geo": {
"city_name": "Linköping",
"continent_name": "Europe",
"country_iso_code": "SE",
"country_name": "Sweden",
"location": {
"lat": 58.4167,
"lon": 15.6167
},
"region_iso_code": "SE-E",
"region_name": "Östergötland County"
},
"ip": "89.160.20.156"
},
"ecs": {
"version": "8.3.0"
},
"event": {
"category": [
"network"
],
"kind": "event",
"original": "{\"category\":\"AzureFirewallNetworkRule\",\"operationName\":\"AzureFirewallNetworkRuleLog\",\"properties\":{\"msg\":\"ICMP Type=8 request from 192.168.0.2 to 89.160.20.156. Action: Deny. \"},\"resourceId\":\"/SUBSCRIPTIONS/23103928-B2CF-472A-8CDB-0146E2849129/RESOURCEGROUPS/TEST-FW-RG/PROVIDERS/MICROSOFT.NETWORK/AZUREFIREWALLS/TEST-FW01\",\"time\":\"2022-06-08T16:54:58.8492560Z\"}",
"type": [
"connection",
"denied"
]
},
"network": {
"transport": "icmp"
},
"observer": {
"name": "TEST-FW01",
"product": "Network Firewall",
"type": "firewall",
"vendor": "Azure"
},
"related": {
"ip": [
"192.168.0.2",
"89.160.20.156"
]
},
"source": {
"address": "192.168.0.2",
"ip": "192.168.0.2"
},
"tags": [
"preserve_original_event"
]
}
Exported fields
Field | Description | Type |
---|---|---|
@timestamp | Event timestamp. | date |
azure.correlation_id | Correlation ID | keyword |
azure.firewall.action | Firewall action taken | keyword |
azure.firewall.category | Category | keyword |
azure.firewall.dnssec_bool_flag | True if DNS request is using DNSSEC | boolean |
azure.firewall.dnssec_buffer_size | Size of the DNSSEC buffer | long |
azure.firewall.duration | Duration of the firewall request | keyword |
azure.firewall.event_original_uid | UID assigned to the logged event | keyword |
azure.firewall.icmp.request.code | ICMP request code | keyword |
azure.firewall.identity_name | identity name | keyword |
azure.firewall.operation_name | Operation name | keyword |
azure.firewall.policy | Name of firewall policy containing the matched rule | keyword |
azure.firewall.rule_collection_group | Name of rule collection group containing the matched rule - name: icmp | keyword |
azure.resource.authorization_rule | Authorization rule | keyword |
azure.resource.group | Resource group | keyword |
azure.resource.id | Resource ID | keyword |
azure.resource.name | Name | keyword |
azure.resource.namespace | Resource type/namespace | keyword |
azure.resource.provider | Resource type/namespace | keyword |
azure.subscription_id | Azure subscription ID | keyword |
azure.tenant_id | tenant ID | keyword |
cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword |
cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword |
data_stream.dataset | Data stream dataset. | constant_keyword |
data_stream.namespace | Data stream namespace. | constant_keyword |
data_stream.type | Data stream type. | constant_keyword |
destination.address | Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the .address field. Then it should be duplicated to .ip or .domain , depending on which one it is. | keyword |
destination.as.number | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | long |
destination.as.organization.name | Organization name. | keyword |
destination.as.organization.name.text | Multi-field of destination.as.organization.name . | match_only_text |
destination.bytes | Bytes sent from the destination to the source. | long |
destination.domain | The domain name of the destination system. This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. | keyword |
destination.geo.city_name | City name. | keyword |
destination.geo.continent_name | Name of the continent. | keyword |
destination.geo.country_iso_code | Country ISO code. | keyword |
destination.geo.country_name | Country name. | keyword |
destination.geo.location | Longitude and latitude. | geo_point |
destination.geo.name | User-defined description of a location, at the level of granularity they care about. Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. Not typically used in automated geolocation. | keyword |
destination.geo.region_iso_code | Region ISO code. | keyword |
destination.geo.region_name | Region name. | keyword |
destination.ip | IP address of the destination (IPv4 or IPv6). | ip |
destination.nat.ip | Translated ip of destination based NAT sessions (e.g. internet to private DMZ) Typically used with load balancers, firewalls, or routers. | ip |
destination.nat.port | Port the source session is translated to by NAT Device. Typically used with load balancers, firewalls, or routers. | long |
destination.port | Port of the destination. | long |
dns.header_flags | Array of 2 letter DNS header flags. Expected values are: AA, TC, RD, RA, AD, CD, DO. | keyword |
dns.question.class | The class of records being queried. | keyword |
dns.question.name | The name being queried. If the name field contains non-printable characters (below 32 or above 126), those characters should be represented as escaped base 10 integers (\DDD). Back slashes and quotes should be escaped. Tabs, carriage returns, and line feeds should be converted to \t, \r, and \n respectively. | keyword |
dns.question.type | The type of record being queried. | keyword |
dns.response_code | ||
ecs.version | ECS version this event conforms to. ecs.version is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword |
event.action | The action captured by the event. This describes the information in the event. It is more specific than event.category . Examples are group-add , process-started , file-created . The value is normally defined by the implementer. | keyword |
event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. event.category represents the "big buckets" of ECS categories. For example, filtering on event.category:process yields all events relating to process activity. This field is closely related to event.type , which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword |
event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date |
event.dataset | Event dataset | constant_keyword |
event.duration | Duration of the event in nanoseconds. If event.start and event.end are known this value should be the difference between the end and start time. | long |
event.id | Unique ID to describe the event. | keyword |
event.ingested | Timestamp when an event arrived in the central data store. This is different from @timestamp , which is when the event originally occurred. It's also different from event.created , which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: @timestamp < event.created < event.ingested . | date |
event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. event.kind gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword |
event.module | Event module | constant_keyword |
event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. event.type represents a categorization "sub-bucket" that, when used along with the event.category field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword |
geo.city_name | City name. | keyword |
geo.continent_name | Name of the continent. | keyword |
geo.country_iso_code | Country ISO code. | keyword |
geo.country_name | Country name. | keyword |
geo.location | Longitude and latitude. | geo_point |
geo.name | User-defined description of a location, at the level of granularity they care about. Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. Not typically used in automated geolocation. | keyword |
geo.region_iso_code | Region ISO code. | keyword |
geo.region_name | Region name. | keyword |
log.level | Original log level of the log event. If the source of the event provides a log level or textual severity, this is the one that goes in log.level . If your source doesn't specify one, you may put your event transport's severity here (e.g. Syslog severity). Some examples are warn , err , i , informational . | keyword |
message | For log events the message field contains the log message, optimized for viewing in a log viewer. For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. If multiple messages exist, they can be combined into one message. | match_only_text |
network.iana_number | IANA Protocol Number (https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml). Standardized list of protocols. This aligns well with NetFlow and sFlow related logs which use the IANA Protocol Number. | keyword |
network.protocol | In the OSI Model this would be the Application Layer protocol. For example, http , dns , or ssh . The field value must be normalized to lowercase for querying. | keyword |
network.transport | Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.) The field value must be normalized to lowercase for querying. | keyword |
observer.name | Custom name of the observer. This is a name that can be given to an observer. This can be helpful for example if multiple firewalls of the same model are used in an organization. If no custom name is needed, the field can be left empty. | keyword |
observer.product | The product name of the observer. | keyword |
observer.type | The type of the observer the data is coming from. There is no predefined list of observer types. Some examples are forwarder , firewall , ids , ips , proxy , poller , sensor , APM server . | keyword |
observer.vendor | Vendor name of the observer. | keyword |
related.hosts | All hostnames or other host identifiers seen on your event. Example identifiers include FQDNs, domain names, workstation names, or aliases. | keyword |
related.ip | All of the IPs seen on your event. | ip |
related.user | All the user names or other user identifiers seen on the event. | keyword |
rule.category | A categorization value keyword used by the entity using the rule for detection of this event. | keyword |
rule.id | A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event. | keyword |
rule.name | The name of the rule or signature generating the event. | keyword |
rule.ruleset | Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member. | keyword |
source.address | Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the .address field. Then it should be duplicated to .ip or .domain , depending on which one it is. | keyword |
source.as.number | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | long |
source.as.organization.name | Organization name. | keyword |
source.as.organization.name.text | Multi-field of source.as.organization.name . | match_only_text |
source.bytes | Bytes sent from the source to the destination. | long |
source.geo.city_name | City name. | keyword |
source.geo.continent_name | Name of the continent. | keyword |
source.geo.country_iso_code | Country ISO code. | keyword |
source.geo.country_name | Country name. | keyword |
source.geo.location | Longitude and latitude. | geo_point |
source.geo.name | User-defined description of a location, at the level of granularity they care about. Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. Not typically used in automated geolocation. | keyword |
source.geo.region_iso_code | Region ISO code. | keyword |
source.geo.region_name | Region name. | keyword |
source.ip | IP address of the source (IPv4 or IPv6). | ip |
source.port | Port of the source. | long |
tags | List of keywords used to tag each event. | keyword |
url.original | Unmodified original url as seen in the event source. Note that in network monitoring, the observed URL may be a full URL, whereas in access logs, the URL is often just represented as a path. This field is meant to represent the URL as it was observed, complete or not. | wildcard |
url.original.text | Multi-field of url.original . | match_only_text |
Changelog
Version | Details |
---|---|
1.3.0 | View pull request Add the possibility to override the default generated storage account container |
1.2.3 | View pull request Update docs with recommended Event Hub configuration |
1.2.2 | View pull request Update package name and description to align with standard wording |
1.2.1 | View pull request Fix Azure Sign-in logs ingest pipeline bug |
1.2.0 | View pull request Support Azure firewall logs |
1.1.11 | View pull request Improve support for event.original field from upstream forwarders. |
1.1.10 | View pull request Update readme with links to Microsoft documentation |
1.1.9 | View pull request Improve handling of IPv6 IP addresses. |
1.1.8 | View pull request Update docs with details about Event Hub name recommendations |
1.1.7 | View pull request Add geo.name and result_description fields in platformlogs |
1.1.6 | View pull request Fix azure.activitylogs.identity with a a concrete value View pull request Add identity_name, tenant_id, level and operation_version into activity logs |
1.1.5 | View pull request Add documentation for multi-fields |
1.1.4 | View pull request Fix event.duration field mapping conflict in all Azure data streams. |
1.1.3 | View pull request Added the forwarded tag by default to all log types. |
1.1.2 | View pull request Add device_detail.is_compliant and device_detail.is_managed fields View pull request Change authentication_requirement_policies to flattened type |
1.1.1 | View pull request Fix field mapping conflict in the auditlogs data stream for client.ip . Changed azure-eventhub.offset and azure-eventhub.sequence_number to longs from keyword in the eventhub data stream. |
1.1.0 | View pull request Support new Azure audit logs and signin logs |
1.0.1 | View pull request Remove beta release tag from data streams |
1.0.0 | View pull request Move azure package to GA |
0.12.3 | View pull request Update to ECS 8.0 |
0.12.2 | View pull request Regenerate test files using the new GeoIP database |
0.12.1 | View pull request Change test public IPs to the supported subset |
0.12.0 | View pull request Release azure package for v8.0.0 |
0.11.0 | View pull request Add azure eventhub input |
0.10.1 | View pull request Uniform with guidelines |
0.10.0 | View pull request signinlogs - Add support for ManagedIdentitySignInLogs, NonInteractiveUserSignInLogs, and ServicePrincipalSignInLogs. |
0.9.2 | View pull request Prevent pipeline script error |
0.9.1 | View pull request Fix logic that checks for the 'forwarded' tag |
0.9.0 | View pull request Update to ECS 1.12.0 |
0.8.6 | View pull request Add ECS client.ip mapping |
0.8.5 | View pull request Update docs and logo |
0.8.4 | View pull request Convert to generated ECS fields |
0.8.3 | View pull request Import geo_points from ECS |
0.8.2 | View pull request Update error message |
0.8.1 | View pull request Add support for springcloud logs inside the platformlogs pipeline |
0.8.0 | View pull request Import ECS field definitions |
0.7.0 | View pull request Add spring cloud logs |
0.6.2 | View pull request update to ECS 1.11.0 |
0.6.1 | View pull request Escape special characters in docs |
0.6.0 | View pull request Update integration description |
0.5.1 | View pull request Re-add pipeline changes for invalid json |
0.5.0 | View pull request Add input groups |
0.4.0 | View pull request Set "event.module" and "event.dataset" |
0.3.1 | View pull request sync package with module changes |
0.3.0 | View pull request update to ECS 1.10.0 and adding event.original options |
0.2.3 | View pull request update to ECS 1.9.0 |
0.2.2 | View pull request Correct sample event file. |
0.2.1 | View pull request Add check for empty configuration options. |
0.2.0 | View pull request Add changes to use ECS 1.8 fields. |
0.0.1 | View pull request initial release |