Field mappings
A Sigma rule names fields such as CommandLine, ParentImage or Image.
Your SIEM or log store may call them something else: process.command_line
in Elastic, process in Splunk's CIM, CommandLine in raw Sysmon JSON. A
field mapping tells Huntbase what each Sigma field is called in one store,
so a deployment searches columns that really exist.
Each connection has its own mapping. A mapping can also be specific to one dataset, index or table on that connection.
Templates
A mapping starts from a template for the way the store holds its events:
| Template | Store | For |
|---|---|---|
| Sysmon on Axiom | Axiom (APL) | Raw Windows and Sysmon events in one Axiom dataset |
| Splunk CIM | Splunk (SPL) | Data normalised to the Splunk Common Information Model: Endpoint, Network Traffic, Network Resolution and Web |
| Sentinel ASIM | Microsoft Sentinel (KQL) | The ASIM parsers for process, file, registry, network, DNS and web events |
| Defender | Microsoft Defender XDR (KQL) | The advanced hunting tables |
| Elastic ECS | Elastic (ES|QL) | Winlogbeat or Elastic Agent Windows events in ECS |
Each template is built from the vendor's own documentation. Huntbase checks it against the columns it found in your store, tries known alternative names for a field, and records any field it can't find.
A content pack can ship a mapping, for example a Splunk CIM mapping pack. Enabling the pack applies the mapping to your matching connections.
"Can't run here"
When a rule needs a field your store doesn't have, Huntbase doesn't save a query that would fail or quietly match nothing. The deployment shows Can't run here with the reason instead:
| Reason | What it means |
|---|---|
| missing ParentImage | The store has no column for this field. |
| the store's language can't express … | Part of the rule has no equivalent in the store's query language. |
| Huntbase can't convert rules to … yet | There is no converter for this store's language yet. |
The same reasons appear in Coverage as Can't run: missing X, and under Can't run on on a watcher's Deploy tab. A store column with no mapping at all reads No field mapping yet.
To fix it, send the missing field to that store, or deploy the rule somewhere that has it. When the mapping changes, Huntbase checks again by itself.
Re-checking what the store returns
When every field the rule reads maps cleanly, Huntbase renames each row the store returns back to the rule's own fields and checks it against the rule again before raising a detection. A row the rule doesn't really match is dropped.
Some fields can't be mapped back exactly, for example when the store keeps a value in a different form. Then the store's match is taken as the verdict, and the detection is marked Store verdict. See One detection, many stores.
Overrides
Your store may use its own name for a field, for example cmd for the
command line. An override maps that one field and sits on top of the
template, so it survives a template update.
Changing a mapping gives it a new version. Every deployment that uses it shows Behind for a short time, then converts again with the new mapping. A deployment that couldn't run is checked again too.
Editing mappings and overrides isn't in the app yet. An administrator can set them through the Huntbase API. They need permission to update the connection.