Log Schema

[dwebb-byte]

Version

3.3.0

Installation Method

Security Onion ISO image

Description

other (please provide detail below)

Installation Type

Distributed

Location

on-prem with Internet access

Hardware Specs

Meets minimum requirements

CPU

4

RAM

16

Storage for /

200

Storage for /nsm

100

Network Traffic Collection

span port

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Do you have a document that provides the log schema for the different types of logs generated by Security Onion? I found in the documentation that you try to follow Elastic Common Schema wherever possible. I was just wondering if there is a comprehensive list for the schema you are using for Security Onion specifically. Thanks for the help in advance.

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[Arthur031221]

The official Data Fields page is the right starting point, but it is an index rather than one exhaustive schema: it describes ECS alignment, links separate Alert, ElastAlert, and Zeek field references, and points to templates on the node. For Zeek, the field page says the remaining fields vary by log type and directs you to that log's ingest parser.

For the fields and types enabled in your distributed 3.3.0 grid, run these on an Elasticsearch node where the utility is installed; it queries localhost:9200:

sudo so-elasticsearch-query '_data_stream?pretty'
sudo so-elasticsearch-query '<stream-name>/_mapping?pretty'

Replace <stream-name> with a name from the first command. The query utility accepts Elasticsearch paths; the mapping API returns a data stream's backing-index mappings.