Enterprise Security: For each ES rule to work, which CIM tags and fields are required and which fields are optional?

[laurie_gellatly]

The CIM model shows which tags are required for that model's ES rules to be active but I still need to ensure that the fields required by each rule are also provided. At present I have to look at the rule's search to determine which fields it requires.
Is there any documentation that shows for ES rule X, tag y and fields a, b and c are required while fields e and f are optional?

i.e. "Access - Excessive Failed Logins - Rule" requires a tag of "authentication", field 'action' must be set to 'failure', 'user' and 'dest' must be set to something useful. 'app' and 'src' are optional.
Looking at these requirements I can see what my own extraction needs to provide for this rule to be active.

Thanks ...Laurie:{)

[mcronkrite]

Take a look at this section of the ES Documentation - Mapping Data Sources section that shows what data is needed for each dashboard and has troubleshooting searches to find missing data. Access and the rest are listed.

And then also look at this Dashboard Requirements Matrix for a quick reference as to the fields needed. Any non-mapped fields will have "unknown" as the value.