Chainsaw: the mapping file is part of the export

The mapping chooses columns

A hunt that applies rules uses a mapping so rule fields can be read from event XML. The columns you see are what that mapping extracted for that group. A different mapping file can print a different set of columns for the same events.

The mapping path is usually in the command or the job note, not repeated on every row. If it was not saved, the export’s headers are unexplained. Write “mapping not recorded.”

Two exports can disagree because of the mapping

If one CSV has an account column and another of the same events does not, check the mapping before you say the account was missing from the log. The blank-column lesson still applies inside one export. Across two exports, the mapping is the first difference to write down.

Do not “fix” the narrower export by copying a column from the wider one without saying which mapping produced it.

What to file

File the mapping path, the group name, and the headers. When you compare two runs, file both mapping paths. Cite an event field from the log when the export you have does not contain it, and say the mapping did not extract it.

Worked case: an account that was a mapping gap

Run A uses mapping sigma-event-logs-all.yml and its service group includes an account column. Run B uses a smaller mapping and the same group has no account column. A draft says the lab image lost account data between the runs. The EVTX files were the same copy.

The note quotes both mapping paths and both header lists. The account was not extracted in run B. It was not deleted from the log. The account string, if the finding needs it, comes from the System event, with the mapping gap stated.

events: the same EVTX copy
run A mapping: sigma-event-logs-all.yml  account column: present
run B mapping: a smaller file  account column: absent
write: run B did not extract the account
not: the log lost the field