dt-obs-log-semantic-mapping

Provide a raw vendor log payload and the Skill runs Workflow A: it inventories content fields, maps them to SD fields in priority order, and outputs a mapping table with transforms, a gap summary, and an OpenPipeline extraction sketch. Phase 2 produces a fully mapped sample record after approval.

Paste an ingested log event for static validation (Workflow B1), or provide a log.source value for runtime validation (Workflow B2), which fetches live records via DQL and then applies the same validation rules. Both produce a diff-highlighted table and discrepancy report.

Burial occurs when fields in the raw content payload could be promoted to top-level semantic attributes but are not. The Skill inventories buried versus promoted fields, scores the gaps, and proposes OpenPipeline parseJson and fieldsAdd rules to fix them.

Mapped samples cover CyberArk, Okta, Azure SignInLogs, Sonatype, GitHub Advanced Security, and Akamai SIEM. Supported log classes are authentication, authorization, user_action, and HTTP, each with its own required semantic fields.

All classes require timestamp, log.source, content, and loglevel. Audit classes additionally require audit.action and audit.identity, while the HTTP class requires http.request.method, http.response.status_code, and url.path. Sparse mappings meeting only the minimum are valid at medium confidence.

OpenPipeline processors use DQL functions such as parseJson, fieldsAdd, and splitString; non-DQL syntax produces invalid rules. The Skill requires loading the dt-dql-essentials skill before proposing processor rules to ensure valid DQL syntax.