Add a mapping

1. Select the log type in the dropdown menu.
2. Define a filter query. Only logs that match the specified filter query are remapped. All logs, regardless of whether they do or do not match the filter query, are sent to the next step in the pipeline.
3. Review the sample source log and the resulting OCSF output.
4. Click Save Mapping.

Library mappings

These are the library mappings available:

When you set up a custom mapping, if you try to close or exit the modal, you are prompted to export your mapping. Datadog recommends that you export your mapping to save what you have set up so far. The exported mapping is saved as a JSON file.

To set up a custom mapping:

1. Optionally, add a name for the mapping. The default name is Custom Authentication.
2. Define a filter query. Only logs that match the specified filter query are remapped. All logs, regardless of whether they match the filter query, are sent to the next step in the pipeline.
3. Select the OCSF event category from the dropdown menu.
4. Select the OCSF event class from the dropdown menu.
5. Enter a log sample so that you can reference it when you add fields.
6. Click Continue.
7. Select any OCSF profiles that you want to add. See OCSF Schema Browser for more information.
8. All required fields are shown. Enter the required Source Logs Fields and Fallback Values for them. If you want to manually add additional fields, click + Field. Click the trash can icon to delete a field. Note: Required fields cannot be deleted.
   • The fallback value is used for the OCSF field if the log doesn’t have the source log field.
   • You can add multiple fields for Source Log Fields. For example, Okta’s user.system.start logs have either the eventType or legacyEventType field. You can map both fields to the same OCSF field.
   • If you have your own OCSF mappings in JSON or saved a previous mapping that you want to use, click Import Configuration File. See Custom Mapping Configuration Format for more information.
9. Click Continue.
10. Some log source values must be mapped to OCSF values. For example, the values of a source log’s severity field that is mapped to the OCSF’s severity_id field, must be mapped to the OCSF severity_id’s values. See severity_id in Authentication [3002] for a list of OCSF values. An example of mapping severity values:

    Log source value	OCSF value
    INFO	Informational
    WARN	Medium
    ERROR	High

11. All values that are required to be mapped to an OCSF value are listed. Click + Add Row if you want to map additional values.
12. Click Save Mapping.