Update descriptions.py

descriptions.py

@@ -1,437 +1,437 @@
-from api.format_input import (
-    detect_log_type,
-)
-def detecting_types(chaine):
-    types = []
-    lignes = chaine.splitlines()
-    for l in lignes:
-        types.append(detect_log_type(l))
-    print ('available types!')
-    print ('TYPES!!! ',types)
-    return types
-
-# log_type = detect_log_type(log_input)
-def descriptions (log_input):
-    for log_type in detecting_types(log_input):
-        if log_type == "sophos":
-            description += """ the columns from Sophos logs with their descriptions:
-        sourcetype: The type of source that generated the log entry.
-        _raw: The raw log message as received.
-        action: The action taken by the firewall.
-        app: The application associated with the session.
-        app_category: Category of the application.
-        app_is_cloud: Indicates if the application is cloud-based.
-        app_name: Name of the application.
-        app_resolved_by: Method by which the application was identified.
-        app_risk: Risk level of the application.
-        app_technology: Technology type of the application.
-        bytes: Total number of bytes transferred.
-        bytes_in: Number of bytes received.
-        bytes_out: Number of bytes sent.
-        con_id: Connection ID.
-        dest: Destination IP address.
-        dest_mac: Destination MAC address.
-        dest_port: Destination port.
-        dest_zone: Destination zone.
-        device_model: Model of the device.
-        device_name: Name of the device.
-        device_serial_id: Serial ID of the device.
-        dst_country: Destination country.
-        duration: Duration of the session.
-        dvc: Device name.
-        ether_type: Ethernet type.
-        fw_rule_id: Firewall rule ID.
-        fw_rule_type: Type of firewall rule.
-        hb_status: Heartbeat status.
-        host: Host IP address.
-        in_display_interface: Display interface name.
-        in_interface: Ingress interface.
-        log_component: Log component.
-        log_id: Log ID.
-        log_occurrence: Number of occurrences of the log entry.
-        log_subtype: Subtype of the log.
-        log_type: Type of log.
-        log_version: Version of the log format.
-        nat_rule_id: NAT rule ID.
-        packets: Total number of packets transferred.
-        packets_in: Number of packets received.
-        packets_out: Number of packets sent.
-        protocol: Protocol used in the session.
-        qualifier: Qualifier for the log entry.
-        severity: Severity level of the event.
-        src: Source IP address.
-        src_country: Source country.
-        src_interface: Source interface.
-        src_mac: Source MAC address.
-        src_port: Source port.
-        src_zone: Source zone.
-        timeendpos: End position of the timestamp in the raw log.
-        timestamp: Timestamp of the event.
-        timestartpos: Start position of the timestamp in the raw log.
-        transport: Transport protocol used.
-        _bkt: Bucket name where the event is stored in Splunk.
-        _cd: Composite ID of the event.
-        _indextime: Epoch time when the event was indexed.
-        _kv: Key-value extraction indicator.
-        _serial: Sequence number of the event.
-        _si: Splunk indexer and index information.
-        _sourcetype: Source type of the event data.
-        _time: Timestamp when the event occurred.
-        """
-        elif log_type == "azure-sign-in":
-            description += """ the columns from Azure-sign-in logs with their descriptions:
-        Source Type:
-        Type or category of the log.
-
-        Application Information:
-        - appDisplayName: The application name displayed in the Azure Portal.
-        - appId: The application identifier in Azure Active Directory.
-        - clientAppUsed: The legacy client used for sign-in activity.
-        - conditionalAccessStatus: The status of the conditional access policy triggered.
-        - correlationId: The identifier sent from the client when sign-in is initiated.
-        - createdDateTime: The date and time the sign-in was initiated in UTC.
-
-        Device Details:
-        - deviceDetail.browser: Browser details.
-        - deviceDetail.deviceId: Device ID.
-        - deviceDetail.displayName: Device display name.
-        - deviceDetail.isCompliant: Compliance status.
-        - deviceDetail.isManaged: Managed status.
-        - deviceDetail.operatingSystem: Operating system details.
-        - deviceDetail.trustType: Trust type.
-
-        Host Information:
-        - host: Tenant identifier.
-        - id: Sign-in activity identifier.
-        - ipAddress: Client IP address.
-        - isInteractive: Indicates whether a sign-in is interactive.
-
-        Location:
-        - location.city: City.
-        - location.countryOrRegion: Country or region.
-        - location.geoCoordinates.altitude: Altitude.
-        - location.geoCoordinates.latitude: Latitude.
-        - location.geoCoordinates.longitude: Longitude.
-        - location.state: State.
-
-        Resource Information:
-        - resourceDisplayName: Resource display name.
-        - resourceId: Resource identifier.
-
-        Risk Information:
-        - riskDetail: Reason behind the risk state.
-        - riskLevelAggregated: Aggregated risk level.
-        - riskLevelDuringSignIn: Risk level during sign-in.
-        - riskState: Risk state.
-
-        Sign-In Status Details:
-        - status.additionalDetails: Additional status details.
-        - status.errorCode: Error code.
-        - status.failureReason: Failure reason.
-
-        User Information:
-        - userDisplayName: User display name.
-        - userId: User identifier.
-        - userPrincipalName: User principal name.
-
-        Splunk Fields:
-        - timestartpos: Byte position where the timestamp starts.
-        - timeendpos: Byte position where the timestamp ends.
-
-        Audit Logs:
-
-        General Information:
-        - sourcetype: Audit
-        - host: Host name.
-        - id: Unique activity identifier.
-        - category: Category value.
-        - loggedByService: Service that logged the event.
-
-        Activity Information:
-        - activityDateTime: Date and time the activity occurred.
-        - activityDisplayName: Human-readable name for the activity.
-        - Level: Message type.
-
-        Actor Information:
-        - Actor: Name of the actor performing the operation.
-        - initiatedBy: Details of the initiator (app or user).
-
-        Operation Information:
-        - Command: Description of the operation performed.
-        - operationType: Type of operation.
-        - result: Result of the activity.
-        - ResultStatus: Result status.
-        - resultReason: Cause of failure or timeout results.
-
-        Target Information:
-        - Target_DisplayName: Activity or operation name.
-        - Target_ObjectID: Unique identifier for the target object.
-        - Target_userPrincipalName: UPN of the target user.
-        - targetResources: Details about the target resources.
-
-        Additional Details:
-        - additionalDetails: Key-value pairs of additional details.
-
-        New and Old Values:
-        - newValue: Value after the operation.
-        - oldValue: Value before the operation.
-        - modified_values: Difference between new and old value.
-
-        Splunk-Specific Information:
-        - timeendpos: Byte position where the timestamp ends.
-        - timestartpos: Byte position where the timestamp starts.
-        - value: Logged value.
-        - _bkt: Bucket ID in Splunk.
-        - _cd: Splunk internal ID.
-        - _indextime: Epoch time when the log was indexed.
-        - _serial: Serial number for the log entry.
-        - _si: Splunk indexer information.
-        - _sourcetype: Splunk sourcetype.
-        - _subsecond: Subsecond part of the timestamp.
-        - _time: Time the log was generated."""
-        elif log_type == "palo-alto":
-            description += """  the columns from Palo-alto logs with their descriptions:
-        - Receive Time: {Receive Time}
-        - Serial Number: {Serial Number}
-        - Type: SYSTEM
-        - Subtype: {Subtype}
-        - Generated Time: {Generated Time}
-        - Virtual System: {Virtual System}
-        - Event ID: {Event ID}
-        - Module: {Module} (only if Subtype is general)
-        - Severity: {Severity}
-        - Description: {Description}
-        - Sequence Number: {Sequence Number}
-        - Action Flags: {Action Flags}
-        - Device Group Hierarchy Levels: {Device Group Hierarchy Levels}
-        - Virtual System Name: {Virtual System Name}
-        - Device Name: {Device Name}
-        - Receive Time: {Receive Time}
-        - Serial Number: {Serial Number}
-        - Type: USERID
-        - Subtype: {Subtype} (login, logout, register-tag, unregister-tag)
-        - Generated Time: {Generated Time}
-        - Virtual System: {Virtual System}
-        - Command: {Command}
-        - User: {User}
-        - Source IP: {Source IP}
-        - Data Source Name: {Data Source Name}
-        - Event ID: {Event ID}
-        - Repeat Count: {Repeat Count}
-        - Timeout: {Timeout}
-        - Source Port: {Source Port}
-        - Destination Port: {Destination Port}
-        - Sequence Number: {Sequence Number}
-        - Action Flags: {Action Flags}
-        - Device Group Hierarchy Levels: {Device Group Hierarchy Levels}
-        - Virtual System Name: {Virtual System Name}
-        - Device Name: {Device Name}
-        - Virtual System ID: {Virtual System ID}
-        - sourcetype: {sourcetype}
-        - _raw: {raw log data}
-        - action: {action}
-        - action_flags: {action_flags}
-        - action_source: {action_source}
-        - app: {app}
-        - bytes: {bytes}
-        - bytes_in: {bytes_in}
-        - bytes_out: {bytes_out}
-        - client_ip: {client_ip}
-        - dest_ip: {dest_ip}
-        - dest_port: {dest_port}
-        - dest_translated_ip: {dest_translated_ip}
-        - dest_translated_port: {dest_translated_port}
-        - dest_zone: {dest_zone}
-        - duration: {duration}
-        - protocol: {protocol}
-        - receive_time: {receive_time}
-        - rule: {rule}
-        - sequence_number: {sequence_number}
-        - src_ip: {src_ip}
-        - src_port: {src_port}
-        - src_translated_ip: {src_translated_ip}
-        - src_translated_port: {src_translated_port}
-        - src_zone: {src_zone}
-        - start_time: {start_time}
-        - Receive Time: {Receive Time}
-        - Serial Number: {Serial Number}
-        - Threat/Content Type: {Threat/Content Type}
-        - Generate Time: {Generate Time}
-        - Source Address: {Source Address}
-        - Destination Address: {Destination Address}
-        - NAT Source IP: {NAT Source IP}
-        - NAT Destination IP: {NAT Destination IP}
-        - Rule Name: {Rule Name}
-        - Source User: {Source User}
-        - Destination User: {Destination User}
-        - Application: {Application}
-        - Virtual System: {Virtual System}
-        - Source Zone: {Source Zone}
-        - Destination Zone: {Destination Zone}
-        - Inbound Interface: {Inbound Interface}
-        - Outbound Interface: {Outbound Interface}
-        - Log Action: {Log Action}
-        - Session ID: {Session ID}
-        - Repeat Count: {Repeat Count}
-        - Source Port: {Source Port}
-        - Destination Port: {Destination Port}
-        - NAT Source Port: {NAT Source Port}
-        - NAT Destination Port: {NAT Destination Port}
-        - Flags: {Flags}
-        - IP Protocol: {IP Protocol}
-        - Action: {Action}
-        - URL/Filename: {URL/Filename}
-        - Threat/Content Name: {Threat/Content Name}
-        - Category: {Category}
-        - Severity: {Severity}
-        - Direction: {Direction}
-        - Sequence Number: {Sequence Number}
-        - Action Flags: {Action Flags}
-        - Source Country: {Source Country}
-        - Destination Country: {Destination Country}
-        - Content Type: {Content Type}
-        - PCAP ID: {PCAP ID}
-        - File Digest: {File Digest}
-        - Cloud: {Cloud}
-        - URL Index: {URL Index}
-        - User Agent: {User Agent}
-        - File Type: {File Type}
-        - X-Forwarded-For: {X-Forwarded-For}
-        - Referer: {Referer}
-        - Sender: {Sender}
-        - Subject: {Subject}
-        - Recipient: {Recipient}
-        - Report ID: {Report ID}
-        - Device Group Hierarchy: {Device Group Hierarchy}
-        - Virtual System Name: {Virtual System Name}
-        - Device Name: {Device Name}
-        - Source VM UUID: {Source VM UUID}
-        - Destination VM UUID: {Destination VM UUID}
-        - HTTP Method: {HTTP Method}
-        - Tunnel ID/IMSI: {Tunnel ID/IMSI}
-        - Monitor Tag/IMEI: {Monitor Tag/IMEI}
-        - Parent Session ID: {Parent Session ID}
-        - Parent Session Start Time: {Parent Session Start Time}
-        - Tunnel Type: {Tunnel Type}
-        - Threat Category: {Threat Category}
-        - Content Version: {Content Version}
-        - SCTP Association ID: {SCTP Association ID}
-        - Payload Protocol ID: {Payload Protocol ID}
-        - HTTP Headers: {HTTP Headers}
-        - URL Category List: {URL Category List}
-        - Rule UUID: {Rule UUID}
-        - HTTP/2 Connection: {HTTP/2 Connection}
-        - Dynamic User Group Name: {Dynamic User Group Name}
-        - XFF Address: {XFF Address}
-        - Source Device Category: {Source Device Category}
-        - Source Device Profile: {Source Device Profile}
-        - Source Device Model: {Source Device Model}
-        - Source Device Vendor: {Source Device Vendor}
-        - Source Device OS Family: {Source Device OS Family}
-        - Source Device OS Version: {Source Device OS Version}
-        - Source Hostname: {Source Hostname}
-        - Source MAC Address: {Source MAC Address}
-        - Destination Device Category: {Destination Device Category}
-        - Destination Device Profile: {Destination Device Profile}
-        """
-
-        elif log_type == "office365":
-            description += """ the columns from Microsoft 365 logs with their descriptions:
-
-        Sourcetype: The type or category of the log source, indicating the origin or format of the log data.
-
-        _raw: The raw log message as received by the logging system, containing the complete unprocessed log entry.
-
-        ChatThreadId: The unique identifier of a chat thread, used to group messages within the same conversation.
-
-        CommunicationType: The type of communication, such as chat, call, or meeting.
-
-        CreationTime: The timestamp when the log entry or event was created.
-
-        Id: A unique identifier for the log entry or event.
-
-        ItemName: The name of the item involved in the event, such as a message or file.
-
-        MessageId: The unique identifier of a specific message.
-
-        MessageVersion: The version of the message, indicating updates or edits.
-
-        MessageVisibilityTime: The time when the message became visible to users.
-
-        Operation: The specific operation or action that was performed (e.g., send, delete).
-
-        OrganizationId: The unique identifier of the organization to which the event is related.
-
-        ParticipantInfo.HasForeignTenantUsers: Indicates if the chat or communication includes users from foreign tenants.
-
-        ParticipantInfo.HasGuestUsers: Indicates if the chat includes guest users.
-
-        ParticipantInfo.HasOtherGuestUsers: Indicates if there are other guest users involved.
-
-        ParticipantInfo.HasUnauthenticatedUsers: Indicates if there are unauthenticated users participating.
-
-        ParticipantInfo.ParticipatingTenantIds{}: The IDs of tenants participating in the communication.
-
-        RecordType: The type of record, often indicating the category of the log (e.g., message, call).
-
-        ResourceTenantId: The tenant ID associated with the resource being accessed or modified.
-
-        UserId: The unique identifier of the user involved in the event.
-
-        UserKey: A key associated with the user, often used for authentication or identification.
-
-        UserType: The type of user (e.g., member, guest).
-
-        Version: The version of the log schema or format.
-
-        Workload: The specific Microsoft service or workload related to the event (e.g., Teams, Exchange).
-
-        App: The application involved in the event.
-
-        Authentication_service: The authentication service used for the event.
-
-        Command: The specific command executed as part of the event.
-
-        Dest: The destination involved in the event.
-
-        Dest_name: The name of the destination.
-
-        Dvc: Device information related to the event.
-
-        Host: The host or server where the event occurred.
-
-        Record_type: Another field indicating the type of record.
-
-        Result: The outcome or result of the operation (e.g., success, failure).
-
-        Signature: A signature related to the event, often for verification purposes.
-
-        Status: The status of the event or operation (e.g., completed, pending).
-
-        Tenant_id: The unique identifier of the tenant where the event occurred.
-
-        Timeendpos: The end time position of the event.
-
-        Timestartpos: The start time position of the event.
-
-        User: General information about the user involved in the event.
-
-        User_id: The unique identifier of the user.
-
-        User_type: The type of user (similar to UserType).
-
-        Vendor_account: The account associated with the vendor.
-
-        Vendor_product: The product associated with the vendor.
-
-        _bkt: The bucket where the log data is stored.
-
-        _cd: The cluster ID in a distributed system.
-
-        _indextime: The time when the log entry was indexed.
-
-        _serial: A serial number or sequence identifier for the log entry.
-
-        _si: An array containing additional internal identifiers."""
-            
+from format_input import (
+    detect_log_type,
+)
+def detecting_types(chaine):
+    types = []
+    lignes = chaine.splitlines()
+    for l in lignes:
+        types.append(detect_log_type(l))
+    print ('available types!')
+    print ('TYPES!!! ',types)
+    return types
+
+# log_type = detect_log_type(log_input)
+def descriptions (log_input):
+    for log_type in detecting_types(log_input):
+        if log_type == "sophos":
+            description += """ the columns from Sophos logs with their descriptions:
+        sourcetype: The type of source that generated the log entry.
+        _raw: The raw log message as received.
+        action: The action taken by the firewall.
+        app: The application associated with the session.
+        app_category: Category of the application.
+        app_is_cloud: Indicates if the application is cloud-based.
+        app_name: Name of the application.
+        app_resolved_by: Method by which the application was identified.
+        app_risk: Risk level of the application.
+        app_technology: Technology type of the application.
+        bytes: Total number of bytes transferred.
+        bytes_in: Number of bytes received.
+        bytes_out: Number of bytes sent.
+        con_id: Connection ID.
+        dest: Destination IP address.
+        dest_mac: Destination MAC address.
+        dest_port: Destination port.
+        dest_zone: Destination zone.
+        device_model: Model of the device.
+        device_name: Name of the device.
+        device_serial_id: Serial ID of the device.
+        dst_country: Destination country.
+        duration: Duration of the session.
+        dvc: Device name.
+        ether_type: Ethernet type.
+        fw_rule_id: Firewall rule ID.
+        fw_rule_type: Type of firewall rule.
+        hb_status: Heartbeat status.
+        host: Host IP address.
+        in_display_interface: Display interface name.
+        in_interface: Ingress interface.
+        log_component: Log component.
+        log_id: Log ID.
+        log_occurrence: Number of occurrences of the log entry.
+        log_subtype: Subtype of the log.
+        log_type: Type of log.
+        log_version: Version of the log format.
+        nat_rule_id: NAT rule ID.
+        packets: Total number of packets transferred.
+        packets_in: Number of packets received.
+        packets_out: Number of packets sent.
+        protocol: Protocol used in the session.
+        qualifier: Qualifier for the log entry.
+        severity: Severity level of the event.
+        src: Source IP address.
+        src_country: Source country.
+        src_interface: Source interface.
+        src_mac: Source MAC address.
+        src_port: Source port.
+        src_zone: Source zone.
+        timeendpos: End position of the timestamp in the raw log.
+        timestamp: Timestamp of the event.
+        timestartpos: Start position of the timestamp in the raw log.
+        transport: Transport protocol used.
+        _bkt: Bucket name where the event is stored in Splunk.
+        _cd: Composite ID of the event.
+        _indextime: Epoch time when the event was indexed.
+        _kv: Key-value extraction indicator.
+        _serial: Sequence number of the event.
+        _si: Splunk indexer and index information.
+        _sourcetype: Source type of the event data.
+        _time: Timestamp when the event occurred.
+        """
+        elif log_type == "azure-sign-in":
+            description += """ the columns from Azure-sign-in logs with their descriptions:
+        Source Type:
+        Type or category of the log.
+
+        Application Information:
+        - appDisplayName: The application name displayed in the Azure Portal.
+        - appId: The application identifier in Azure Active Directory.
+        - clientAppUsed: The legacy client used for sign-in activity.
+        - conditionalAccessStatus: The status of the conditional access policy triggered.
+        - correlationId: The identifier sent from the client when sign-in is initiated.
+        - createdDateTime: The date and time the sign-in was initiated in UTC.
+
+        Device Details:
+        - deviceDetail.browser: Browser details.
+        - deviceDetail.deviceId: Device ID.
+        - deviceDetail.displayName: Device display name.
+        - deviceDetail.isCompliant: Compliance status.
+        - deviceDetail.isManaged: Managed status.
+        - deviceDetail.operatingSystem: Operating system details.
+        - deviceDetail.trustType: Trust type.
+
+        Host Information:
+        - host: Tenant identifier.
+        - id: Sign-in activity identifier.
+        - ipAddress: Client IP address.
+        - isInteractive: Indicates whether a sign-in is interactive.
+
+        Location:
+        - location.city: City.
+        - location.countryOrRegion: Country or region.
+        - location.geoCoordinates.altitude: Altitude.
+        - location.geoCoordinates.latitude: Latitude.
+        - location.geoCoordinates.longitude: Longitude.
+        - location.state: State.
+
+        Resource Information:
+        - resourceDisplayName: Resource display name.
+        - resourceId: Resource identifier.
+
+        Risk Information:
+        - riskDetail: Reason behind the risk state.
+        - riskLevelAggregated: Aggregated risk level.
+        - riskLevelDuringSignIn: Risk level during sign-in.
+        - riskState: Risk state.
+
+        Sign-In Status Details:
+        - status.additionalDetails: Additional status details.
+        - status.errorCode: Error code.
+        - status.failureReason: Failure reason.
+
+        User Information:
+        - userDisplayName: User display name.
+        - userId: User identifier.
+        - userPrincipalName: User principal name.
+
+        Splunk Fields:
+        - timestartpos: Byte position where the timestamp starts.
+        - timeendpos: Byte position where the timestamp ends.
+
+        Audit Logs:
+
+        General Information:
+        - sourcetype: Audit
+        - host: Host name.
+        - id: Unique activity identifier.
+        - category: Category value.
+        - loggedByService: Service that logged the event.
+
+        Activity Information:
+        - activityDateTime: Date and time the activity occurred.
+        - activityDisplayName: Human-readable name for the activity.
+        - Level: Message type.
+
+        Actor Information:
+        - Actor: Name of the actor performing the operation.
+        - initiatedBy: Details of the initiator (app or user).
+
+        Operation Information:
+        - Command: Description of the operation performed.
+        - operationType: Type of operation.
+        - result: Result of the activity.
+        - ResultStatus: Result status.
+        - resultReason: Cause of failure or timeout results.
+
+        Target Information:
+        - Target_DisplayName: Activity or operation name.
+        - Target_ObjectID: Unique identifier for the target object.
+        - Target_userPrincipalName: UPN of the target user.
+        - targetResources: Details about the target resources.
+
+        Additional Details:
+        - additionalDetails: Key-value pairs of additional details.
+
+        New and Old Values:
+        - newValue: Value after the operation.
+        - oldValue: Value before the operation.
+        - modified_values: Difference between new and old value.
+
+        Splunk-Specific Information:
+        - timeendpos: Byte position where the timestamp ends.
+        - timestartpos: Byte position where the timestamp starts.
+        - value: Logged value.
+        - _bkt: Bucket ID in Splunk.
+        - _cd: Splunk internal ID.
+        - _indextime: Epoch time when the log was indexed.
+        - _serial: Serial number for the log entry.
+        - _si: Splunk indexer information.
+        - _sourcetype: Splunk sourcetype.
+        - _subsecond: Subsecond part of the timestamp.
+        - _time: Time the log was generated."""
+        elif log_type == "palo-alto":
+            description += """  the columns from Palo-alto logs with their descriptions:
+        - Receive Time: {Receive Time}
+        - Serial Number: {Serial Number}
+        - Type: SYSTEM
+        - Subtype: {Subtype}
+        - Generated Time: {Generated Time}
+        - Virtual System: {Virtual System}
+        - Event ID: {Event ID}
+        - Module: {Module} (only if Subtype is general)
+        - Severity: {Severity}
+        - Description: {Description}
+        - Sequence Number: {Sequence Number}
+        - Action Flags: {Action Flags}
+        - Device Group Hierarchy Levels: {Device Group Hierarchy Levels}
+        - Virtual System Name: {Virtual System Name}
+        - Device Name: {Device Name}
+        - Receive Time: {Receive Time}
+        - Serial Number: {Serial Number}
+        - Type: USERID
+        - Subtype: {Subtype} (login, logout, register-tag, unregister-tag)
+        - Generated Time: {Generated Time}
+        - Virtual System: {Virtual System}
+        - Command: {Command}
+        - User: {User}
+        - Source IP: {Source IP}
+        - Data Source Name: {Data Source Name}
+        - Event ID: {Event ID}
+        - Repeat Count: {Repeat Count}
+        - Timeout: {Timeout}
+        - Source Port: {Source Port}
+        - Destination Port: {Destination Port}
+        - Sequence Number: {Sequence Number}
+        - Action Flags: {Action Flags}
+        - Device Group Hierarchy Levels: {Device Group Hierarchy Levels}
+        - Virtual System Name: {Virtual System Name}
+        - Device Name: {Device Name}
+        - Virtual System ID: {Virtual System ID}
+        - sourcetype: {sourcetype}
+        - _raw: {raw log data}
+        - action: {action}
+        - action_flags: {action_flags}
+        - action_source: {action_source}
+        - app: {app}
+        - bytes: {bytes}
+        - bytes_in: {bytes_in}
+        - bytes_out: {bytes_out}
+        - client_ip: {client_ip}
+        - dest_ip: {dest_ip}
+        - dest_port: {dest_port}
+        - dest_translated_ip: {dest_translated_ip}
+        - dest_translated_port: {dest_translated_port}
+        - dest_zone: {dest_zone}
+        - duration: {duration}
+        - protocol: {protocol}
+        - receive_time: {receive_time}
+        - rule: {rule}
+        - sequence_number: {sequence_number}
+        - src_ip: {src_ip}
+        - src_port: {src_port}
+        - src_translated_ip: {src_translated_ip}
+        - src_translated_port: {src_translated_port}
+        - src_zone: {src_zone}
+        - start_time: {start_time}
+        - Receive Time: {Receive Time}
+        - Serial Number: {Serial Number}
+        - Threat/Content Type: {Threat/Content Type}
+        - Generate Time: {Generate Time}
+        - Source Address: {Source Address}
+        - Destination Address: {Destination Address}
+        - NAT Source IP: {NAT Source IP}
+        - NAT Destination IP: {NAT Destination IP}
+        - Rule Name: {Rule Name}
+        - Source User: {Source User}
+        - Destination User: {Destination User}
+        - Application: {Application}
+        - Virtual System: {Virtual System}
+        - Source Zone: {Source Zone}
+        - Destination Zone: {Destination Zone}
+        - Inbound Interface: {Inbound Interface}
+        - Outbound Interface: {Outbound Interface}
+        - Log Action: {Log Action}
+        - Session ID: {Session ID}
+        - Repeat Count: {Repeat Count}
+        - Source Port: {Source Port}
+        - Destination Port: {Destination Port}
+        - NAT Source Port: {NAT Source Port}
+        - NAT Destination Port: {NAT Destination Port}
+        - Flags: {Flags}
+        - IP Protocol: {IP Protocol}
+        - Action: {Action}
+        - URL/Filename: {URL/Filename}
+        - Threat/Content Name: {Threat/Content Name}
+        - Category: {Category}
+        - Severity: {Severity}
+        - Direction: {Direction}
+        - Sequence Number: {Sequence Number}
+        - Action Flags: {Action Flags}
+        - Source Country: {Source Country}
+        - Destination Country: {Destination Country}
+        - Content Type: {Content Type}
+        - PCAP ID: {PCAP ID}
+        - File Digest: {File Digest}
+        - Cloud: {Cloud}
+        - URL Index: {URL Index}
+        - User Agent: {User Agent}
+        - File Type: {File Type}
+        - X-Forwarded-For: {X-Forwarded-For}
+        - Referer: {Referer}
+        - Sender: {Sender}
+        - Subject: {Subject}
+        - Recipient: {Recipient}
+        - Report ID: {Report ID}
+        - Device Group Hierarchy: {Device Group Hierarchy}
+        - Virtual System Name: {Virtual System Name}
+        - Device Name: {Device Name}
+        - Source VM UUID: {Source VM UUID}
+        - Destination VM UUID: {Destination VM UUID}
+        - HTTP Method: {HTTP Method}
+        - Tunnel ID/IMSI: {Tunnel ID/IMSI}
+        - Monitor Tag/IMEI: {Monitor Tag/IMEI}
+        - Parent Session ID: {Parent Session ID}
+        - Parent Session Start Time: {Parent Session Start Time}
+        - Tunnel Type: {Tunnel Type}
+        - Threat Category: {Threat Category}
+        - Content Version: {Content Version}
+        - SCTP Association ID: {SCTP Association ID}
+        - Payload Protocol ID: {Payload Protocol ID}
+        - HTTP Headers: {HTTP Headers}
+        - URL Category List: {URL Category List}
+        - Rule UUID: {Rule UUID}
+        - HTTP/2 Connection: {HTTP/2 Connection}
+        - Dynamic User Group Name: {Dynamic User Group Name}
+        - XFF Address: {XFF Address}
+        - Source Device Category: {Source Device Category}
+        - Source Device Profile: {Source Device Profile}
+        - Source Device Model: {Source Device Model}
+        - Source Device Vendor: {Source Device Vendor}
+        - Source Device OS Family: {Source Device OS Family}
+        - Source Device OS Version: {Source Device OS Version}
+        - Source Hostname: {Source Hostname}
+        - Source MAC Address: {Source MAC Address}
+        - Destination Device Category: {Destination Device Category}
+        - Destination Device Profile: {Destination Device Profile}
+        """
+
+        elif log_type == "office365":
+            description += """ the columns from Microsoft 365 logs with their descriptions:
+
+        Sourcetype: The type or category of the log source, indicating the origin or format of the log data.
+
+        _raw: The raw log message as received by the logging system, containing the complete unprocessed log entry.
+
+        ChatThreadId: The unique identifier of a chat thread, used to group messages within the same conversation.
+
+        CommunicationType: The type of communication, such as chat, call, or meeting.
+
+        CreationTime: The timestamp when the log entry or event was created.
+
+        Id: A unique identifier for the log entry or event.
+
+        ItemName: The name of the item involved in the event, such as a message or file.
+
+        MessageId: The unique identifier of a specific message.
+
+        MessageVersion: The version of the message, indicating updates or edits.
+
+        MessageVisibilityTime: The time when the message became visible to users.
+
+        Operation: The specific operation or action that was performed (e.g., send, delete).
+
+        OrganizationId: The unique identifier of the organization to which the event is related.
+
+        ParticipantInfo.HasForeignTenantUsers: Indicates if the chat or communication includes users from foreign tenants.
+
+        ParticipantInfo.HasGuestUsers: Indicates if the chat includes guest users.
+
+        ParticipantInfo.HasOtherGuestUsers: Indicates if there are other guest users involved.
+
+        ParticipantInfo.HasUnauthenticatedUsers: Indicates if there are unauthenticated users participating.
+
+        ParticipantInfo.ParticipatingTenantIds{}: The IDs of tenants participating in the communication.
+
+        RecordType: The type of record, often indicating the category of the log (e.g., message, call).
+
+        ResourceTenantId: The tenant ID associated with the resource being accessed or modified.
+
+        UserId: The unique identifier of the user involved in the event.
+
+        UserKey: A key associated with the user, often used for authentication or identification.
+
+        UserType: The type of user (e.g., member, guest).
+
+        Version: The version of the log schema or format.
+
+        Workload: The specific Microsoft service or workload related to the event (e.g., Teams, Exchange).
+
+        App: The application involved in the event.
+
+        Authentication_service: The authentication service used for the event.
+
+        Command: The specific command executed as part of the event.
+
+        Dest: The destination involved in the event.
+
+        Dest_name: The name of the destination.
+
+        Dvc: Device information related to the event.
+
+        Host: The host or server where the event occurred.
+
+        Record_type: Another field indicating the type of record.
+
+        Result: The outcome or result of the operation (e.g., success, failure).
+
+        Signature: A signature related to the event, often for verification purposes.
+
+        Status: The status of the event or operation (e.g., completed, pending).
+
+        Tenant_id: The unique identifier of the tenant where the event occurred.
+
+        Timeendpos: The end time position of the event.
+
+        Timestartpos: The start time position of the event.
+
+        User: General information about the user involved in the event.
+
+        User_id: The unique identifier of the user.
+
+        User_type: The type of user (similar to UserType).
+
+        Vendor_account: The account associated with the vendor.
+
+        Vendor_product: The product associated with the vendor.
+
+        _bkt: The bucket where the log data is stored.
+
+        _cd: The cluster ID in a distributed system.
+
+        _indextime: The time when the log entry was indexed.
+
+        _serial: A serial number or sequence identifier for the log entry.
+
+        _si: An array containing additional internal identifiers."""
+            
     return list(set(description))