name: siem-network-traffic
backend: ELK
description: Network traffic logs

fields:
  - name: "@timestamp"
    type: date
    description: Event time
    is_key_field: false

  - name: event.dataset
    type: keyword
    description: Dataset (network)
    is_key_field: false

  - name: event.module
    type: keyword
    description: Module (firewall)
    is_key_field: false

  - name: event.category
    type: keyword
    description: Event category (network_traffic)
    is_key_field: true

  - name: event.type
    type: keyword
    description: Event type (connection)
    is_key_field: false

  - name: event.action
    type: keyword
    description: Action (allow/deny)
    is_key_field: true

  - name: event.outcome
    type: keyword
    description: Outcome (success/failure)
    is_key_field: true

  - name: network.protocol
    type: keyword
    description: Protocol (tcp/udp)
    is_key_field: true

  - name: network.direction
    type: keyword
    description: Direction (egress/ingress)
    is_key_field: false

  - name: network.bytes_in
    type: long
    description: Bytes in
    is_key_field: false

  - name: network.bytes_out
    type: long
    description: Bytes out
    is_key_field: false

  - name: network.packets
    type: long
    description: Packet count
    is_key_field: false

  - name: network.duration
    type: long
    description: Duration in ms
    is_key_field: false

  - name: source.ip
    type: ip
    description: Source IP
    is_key_field: true

  - name: source.port
    type: long
    description: Source port
    is_key_field: false

  - name: source.mac
    type: keyword
    description: Source MAC address
    is_key_field: false

  - name: destination.ip
    type: ip
    description: Destination IP
    is_key_field: true

  - name: destination.port
    type: long
    description: Destination port
    is_key_field: true

  - name: destination.service
    type: keyword
    description: Destination service (https/http/ssh/rdp/mysql/postgresql/redis/dns)
    is_key_field: true

  - name: host.name
    type: keyword
    description: Host name
    is_key_field: true

  - name: host.ip
    type: ip
    description: Host IP (source IP)
    is_key_field: false

  - name: process.pid
    type: long
    description: Process ID
    is_key_field: false

  - name: process.name
    type: keyword
    description: Process name
    is_key_field: false

  - name: user.name
    type: keyword
    description: User name
    is_key_field: true

  - name: user.id
    type: keyword
    description: User ID
    is_key_field: false

  - name: firewall.rule_id
    type: keyword
    description: Firewall rule ID
    is_key_field: true

  - name: firewall.rule_name
    type: keyword
    description: Firewall rule name
    is_key_field: false

  - name: log.level
    type: keyword
    description: Log level (info)
    is_key_field: false
