System Fields Entity Fields

[s_t]

Hello ,

What is the difference between system fields and entity fields in the mapping area for specific connector?

Thanks

[Yair_Stern]

Generally speaking, System fields relate to the event as a whole while entity fields describe what types (and relations) of entities are defined in the event.

For example, SourceUserName is an entity field, as it describes an entity in the event. The entity is of type UserName and is a "Source" of a relation (actor). However, "Name" is a system field describing the event. For example, windows events have both EventId and EventName that describes them. You can choose what most suits you for the display of the event.

System fields usually appear in the event table on the alert overview while the entity fields are simply the entities we create that represent the event.

Some of the system fields, however, are a little different and its a bit more complex to go into details. Just an example, the Domain fields can influence the Identifier of Hostname/Username entities by appending the @domain suffix for example (that way you kinda concatenate two fields for the username). To be more specific with the example, my email address, yairms@google.com, might not appear directly as a single field, rather as a user:yairms and domain:google.com. So, you map the SourceUserName to yairms and the SourceDnsDomain to google.com and the system will create an entity of type user with the identifier 'yairms@google.com'

Hope that helps!