version
(0,
required)0
). Its purpose is to allow backwards compatibility with future versions of the log schema.fastmatch
(FastmatchParser{}
): Use fastmatch
parserregex
(RegexParser{}
): Use regex
parsercsv
(CSVParser{}
): Use csv
parserfastmatch
, regex
, and csv
in the tabs below.fastmatch
fieldsmatch
(required, []string
): One or more patterns to match log lines against. This field cannot be empty.emptyValues
([]string
): Values to consider as null
.expandFields
(map[string]string
): Additional fields to be injected by expanding text templates.trimSpace
(bool
): Trim space surrounding each value.regex
fieldsmatch
(required, []string
): A pattern to match log lines against (can be split it into parts for documentation purposes). This field cannot be empty.patternDefinitions
(map[string]string
): Additional named patterns to use in match pattern.emptyValues
([]string
): Values to consider as null
.expandFields
(map[string]string
): Additional fields to be injected by expanding text templates.trimSpace
(bool
): Trim space surrounding each value.csv
delimiter
(required, string): A character to use as field delimiter.hasHeader
(bool): Use first row to derive column names (unless columns
is set also in which case the header is just skipped).columns
([]string
, required(without hasHeader)
, non-empty
): Names for each column in the CSV file. If not set, the first row is used as a header.emptyValues
([]string
): Values to consider as null
.trimSpace
(bool
): Trim space surrounding each value.expandFields
(map[string]string
): Additional fields to be injected by expanding text templates.name
(required, String
) required
(Boolean
) description
(String
) ValueSchema
defines a value and how it should be processed. Each ValueSchema
has a type
field that can be of the following values:string
int
-2147483648
, 2147483647
smallint
-32768
, 32767
bigint
-9223372036854775808
, 9223372036854775807
float
boolean
true
/ false
timestamp
array
object
json
ValueSchema
depend on the value of the type
.object
fields
(required)FieldSpec
objects describing the fields of the object.timestamp
isEventTime
Boolean
timestamp
isExpiration
Boolean
type
field to timestamp
and specifying the timestamp format using the timeFormat
field. Timestamp formats can be one of the built-in timestamp formats:rfc3339
unix
unix_ms
unix_us
unix_ns
isEventTime: true
to tell Panther that it should use this timestamp as the p_event_time
field. It is possible to set isEventTime
on multiple fields. This covers the cases where some logs have optional or mutually exclusive fields holding event time information. Since there can only be a single p_event_time
for every Log Event, the priority is defined using the order of fields in the schema.isExpiration: true
. This is used to tell the Panther Rules Engine to ignore new data if the current time is after this timestamp. These can be useful to "time bound" alerts to independent indicators of compromise (IOCs) added via Lookup Tables, which make for richer alert context.string
type can be used as indicators. In order to mark a field as an indicator, you must set the indicators
field to an array of indicator scanner names. This will instruct Panther to parse the string and store any indicator values it finds to the relevant field. For example:indicators
field (more than one may be used):string
type can be further restricted by declaring a list of values to allow
or deny
. This allows to have different log types that have common overlapping fields but differ on values of those fields.string
type can be restricted to match well-known formats. Currently, Panther supports the ip
and cidr
formats to require that a string value be a valid IP address or CIDR range. Note that the ip
and cidr
validation types can be combined with allow
or deny
rules but it is somewhat redundant, for example, if you allow two IP addresses, then adding an ip
validation will simply ensure that your validation will not include false positives if the IP addresses in your list are not valid.isEmbeddedJSON: true
flag. This flag is valid for values of type object
, array
and json
.message
as: