CSE Schema

In this section, we'll introduce the following concepts:

📄️ Record Processing Pipeline

How CSE transforms incoming raw messages into Records.

Learn about CSE schema attributes.

Learn what CSE schema attributes you can map to Records.

Learn about the Record types to which you can map schema attributes.

Parsing is the first step in the Cloud SIEM Enterprise (CSE) Record processing pipeline

Learn how to create a log mapping for structured messages.

Learn about CSE's Normalized Classification Fields, schema fields that have an enforced output defined by CSE.

Learn how to set up field mappings for messages that you want to be processed by CSE's normalized threat rules.

Learn how to use the Parser Editor to configure and test a custom parser.

Learn about how CSE normalizes usernames and hostnames during mapping and parsing.

Learn how to troubleshoot problems with parsers.