Cloud SIEM Schema
This guide has information about Cloud SIEM schemas. In this section, we'll introduce the following concepts:
Record Processing Pipeline
Learn how Cloud SIEM transforms incoming raw messages into records.
Cloud SIEM Schema Attributes
Learn about Cloud SIEM schema attributes.
Mappable Attributes
Learn what Cloud SIEM schema attributes you can map to records.
Record Types
Learn about the record types to which you can map schema attributes.
Parsing Language Reference
Parsing is the first step in the Cloud SIEM record processing pipeline.
Log Mapping
Learn how to create a log mapping for structured messages.
Normalized Classification
Set up schema fields with an enforced, Cloud SIEM-defined output.
Field Mappings
Set up field mappings for messages that you want to be processed by Cloud SIEM's normalized threat rules.
Parser Editor
Learn how to use the Parser Editor to configure and test a custom parser.
Username and Hostname Normalization
Learn how to import YARA rules from GitHub into Cloud SIEM.
Parser Troubleshooting
Learn how to troubleshoot problems with parsers.