Fields Remapping
- 1 Overview
- 2 How Fields Remapping Works
Overview
The Snare Reflector in Snare Central plays a pivotal role in managing event log data from multiple diverse sources. Its primary function is to receive, parse, and store this data before sending it to both internal and external destinations, such as SIEM systems, syslog servers, or log aggregation platforms. During this process, event log data can be filtered, enriched, edited, and even transformed into different formats before reaching its target destination.
When sending data to HTTP-based destination format like Splunk HEC or Microsoft Sentinel, an additional layer of transformation is available through Fields Remapping starting from Snare Central v8.7.0, and as of v8.8.0, field remapping is also now supported for some JSON-based destination formats like Syslog 5424 JSON and Syslog JSON. This feature allows Snare log fields to be further refined and mapped to the specific schema expected by the target platform, ensuring compatibility and usability within the receiving system.
Field remapping ensures that log data forwarded from Snare Reflector is correctly understood, searchable, and actionable by the receiving system. This is especially important when forwarding to platforms that require specific schemas or follow normalization models.
This user guide provides a walk-through of how field remapping works in Snare Reflector, focusing on configuring rules that translate Snare-native fields (e.g., SYSTEM, EVENTID, SNAREDATAMAP:System/Provider/Name) into destination-specific field names and formats (e.g., Computer, EventID, Provider).
How Fields Remapping Works
Fields Remapping in Snare Reflector enables users to transform Snare-native log fields into the specific schema required by the destination platform. This is achieved by defining a remapping template that translates fields from the original Snare format—such as DATETIME, SYSTEM, EVENTID, or key-value pairs under SNAREDATAMAP—into target-compatible field names like time, host, or EventCode for Splunk HEC, or TimeGenerated, Computer, and EventID for Microsoft Sentinel.
To use this feature, users can navigate to the Fields Remapping page in the Snare Reflector interface and select Add Fields Remapping. Here, user can define custom remapping rules based on the destination’s expected field structure or load and edit from pre-defined Fields Remapping Default Template. Templates are flexible and can be tailored to meet the requirements of specific platforms or use cases.
Once a remapping template is created and saved, it becomes available when configuring Splunk HEC, Microsoft Sentinel, Syslog 5424 JSON or Syslog JSON. During destination setup, users simply select the desired Remapping Template from the available list to apply the defined transformations automatically.
This seamless field remapping process ensures that logs are sent in the correct format for the target system, minimizing or even eliminating the need for post-ingestion transformation. The result is faster integration, improved compatibility, and enhanced log usability for searching, alerting, and dash-boarding.
Add Fields Remapping
Navigate to Reflector UI and open Fields Remapping page then select +Add Fields Remapping tab.
This page will allow you to define custom remapping rules based on the destination’s expected field structure or load and edit from pre-defined Fields Remapping Default Template.
Fields Remapping Details
Define the following fields remapping details:
Select Destination Format - Target destination format of the fields remapping.
Name - User-readable friendly name of the fields remapping, to identify the created fields remapping during the destination configuration.
Description - Additional information and details for the fields remapping, used for display purposes only.
Field Remapping Rules
Add field remapping rules for a Snare log type.
Click the (+) Icon for "Add Field Remapping for New Log Type" - Located in the right side of "Field Remapping Rules". This will add the field remapping template for a Snare log type.
Select Snare Log Type - Target Snare log type for fields remapping. Choose the Snare log type you want to apply field remapping to. (Note: Only log types that have already been received by Snare Central will appear in this list. If your desired log type is not listed, you must first send at least one event of that log type to Snare Central before it becomes available for selection).
Do not Send Unmapped Fields or Send Unmapped Fields - This flag indicates whether the event fields that are not included in this Fields Remapping should be sent to the destination as is (if it was set On) or skipped (if it was set Off.)
Fields Remapping
Add field remapping definition of Snare fields to target destination field.
Click the (+) Icon for "Add Field Remapping" - Located in the right side of "Select Snare Log Type". This will add the field remapping definition for the selected Snare log type.
Select Remapping Function - Select the remapping function to be used in remapping and define the corresponding field remapping parameters.
DirectSourceFieldMapping - Remapping function to directly map the Source Snare Field Name value to the defined Destination Field Name.
Source Snare Field Name - Name of the source Snare field name.
Select Destination Field Data Type - Data type expected by the destination for this field (int, float, boolean, raw, string).
Destination Field Name - The target destination field name.
StaticValueMapping - Remapping function to use static value instead of a Snare Field Name value to the defined Destination Field Name.
Static Value - Value to be put in the destination field name.
Select Destination Field Data Type - Data type expected by the destination for this field (int, float, boolean, raw, string).
Destination Field Name - The target destination field name.
SnareDateTimeFieldMapping - Remapping function to automatically derive Date and Time information in RFC3339 format from Snare’s DATETIME field (if available) or DATE and TIME field combination to the target Destination Field Name (if the target destination is Splunk HEC then it will automatically reformat the time destination field to HEC standard time format).
Select Destination Field Data Type - Data type expected by the destination for this field (int, float, boolean, raw, string).
Destination Field Name - The target destination field name.
SnareDataMapFieldMapping - Remapping function to extract value of the defined Source Snare Data Map Key Name.
Source Snare Data Map Key Name - The source SNAREDATAMAP key name e.g. System/Keyword.
Select Destination Field Data Type - Data type expected by the destination for this field (int, float, boolean, raw, string).
Destination Field Name - The target destination field name.
AddStaticPrefixToFieldMapping - Remapping function to add static prefix to the Source Snare Field Name value.
Static Prefix Value - Static string to add as prefix to the defined Source Field Name.
Source Field Name - Name of the source Snare field name.
Select Destination Field Data Type - Data type expected by the destination for this field (int, float, boolean, raw, string).
Destination Field Name - The target destination field name.
RegexExtract - Remapping function to extract data from the specified Snare Source Field Name, based on the configured Regular Expression (Regex).
Regex - RE2 syntax regular expression to retrieve data from the specified Snare Source Field. It uses a 1:1 mapping logic, retrieving either the first capture group or the full match if no groups are defined.
Source Field Name - Name of the source Snare field name.
Select Destination Field Data Type - Data type expected by the destination for this field (int, float, boolean, raw, string).
Destination Field Name - The target destination field name.
Click the “ADD FIELDS REMAPPING” button - Once done setting up the Field Remapping Rules, just click the "ADD FIELDS REMAPPING" then it will now be available for use in the Configure Destination for HTTP-based destination format.
Fields Remapping Default Template
While the Add Fields Remapping page allows you to define custom remapping rules from scratch. Alternatively, you can choose to start with a pre-defined Fields Remapping Default Template to get you started quickly then you can further customize and refine it to suit your destination’s requirements.
Select the "Field Remapping Default Template" checkbox - This will enable and display the Select Fields Remapping Default Template list located on the right side.
Choose a pre-defined template from "Select Fields Remapping Default Template" list - This will auto-populate the Add Fields Remapping page based on the selected template.
Modify details and fields remapping then "ADD FIELDS REMAPPING" - Once the Fields Remapping page were auto-populated, you can now Add/Edit/Delete fields to fit your requirements, once done you just have to click "ADD FIELDS REMAPPING" button to save the changes and create a new Fields Remapping that you can use later in the Configure Destination. (Note: Any changes made will be saved as a new field remapping that you can find in the Fields Remapping tab and this will not overwrite the original template).
Templates Definition
Microsoft Sentinel Windows Event Remapping Template - Remapping template for general Windows event log data received in SNARE format (MSWinEventLog, WinApplication, WinSecurity, WinSystem) and SNARE V2 format (MSWinEventLog2) to Azure Monitor WindowsEvent table.
Microsoft Sentinel Security Event Remapping Template - Remapping template for Windows security event log data recevied in SNARE V2 format (MSWinEventLog2) to Azure Monitor SecurityEvent table.
Microsoft Sentinel Syslog Remapping Template - Remapping template for Snare Linux agents and Syslog log data to Azure Monitor Syslog table.
Splunk HEC Windows Event Remapping Template - Remapping template for general Windows event log data received in SNARE format (MSWinEventLog, WinApplication, WinSecurity, WinSystem) and SNARE V2 format (MSWinEventLog2) to Splunk HEC - CIM format.
It is recommended to utilize Filters in the configured destination together with these remapping, to further refine the event log data sent to Azure Monitor tables and reduce ingestion volume. e.g. For destination targeting the SecurityEvent table, you may use filter to include only MSWinEventLog2 log type with Event ID related to Security Events like Logon/Logoff Events - ("EVENTID".*:.*?"4624")|("EVENTID".*:.*?"4625")|("EVENTID".*:.*?"4634")|("EVENTID".*:.*?"4648") etc.