Configuration reference

This page lists every component you can put in agent.yaml, and every setting each one accepts. It is generated from the agent itself, so it always matches the version you are running.

Each component is written as a list entry with a type, a name you choose, and a params block:

sources:
  - type: wel
    name: security-log
    params:
      batch_size: "500"

Values in params are written as strings. Quoting numbers and true/false is optional but harmless, and it avoids surprises with values such as on or no, which YAML would otherwise read as booleans.

Some components also take a structured block — a richer, nested section that sits beside params rather than inside it, because its shape is more than a flat list of values. Filter and mask rules, parser settings, aggregation windows and file-integrity watch lists all work this way. Where a component has one, it is noted below and shown in full on Configuration examples.

Settings marked Advanced have sensible defaults and are collapsed behind Advanced settings in the console. You rarely need to change them.

For where the file lives, how changes are applied and what the top-level sections mean, see How DPLens is configured.

Sources

A source collects events. Every source needs a unique name; add enabled: false to keep one in the file without running it.

syslog

Receive RFC 3164/5424 syslog from network devices (UDP/TCP)

Advanced settings

netflow

Receive NetFlow v5 / IPFIX (v10) flow export (UDP; IPFIX also TCP), decoded in-source.

Advanced settings

wel

Windows Event Log channels.

Advanced settings

This component also takes a structured block. See Configuration examples for a worked one.

file-tail

Tail a set of log files by glob.

Advanced settings

fim

File-integrity monitoring (scheduled scans)

Advanced settings

This component also takes a structured block. See Configuration examples for a worked one.

Destinations

A destination delivers events to your SIEM or collector. Every destination has its own disk cache, so an outage queues events rather than losing them.

tcp

TCP stream delivery.

Advanced settings

udp

UDP datagram delivery.

Advanced settings

tls

TLS (TCP) delivery.

Advanced settings

splunk-s2s

Splunk cooked S2S delivery.

Advanced settings

This component also takes a structured block. See Configuration examples for a worked one.

Accepted rendering values: classic, xml.

splunk-hec

Splunk HEC delivery (HTTP Event Collector)

Advanced settings

This component also takes a structured block. See Configuration examples for a worked one.

Accepted rendering values: classic, xml.

Processing stages

Stages run in the order you list them inside a pipeline's stages. Masking always runs before anything is written to disk or sent.

tag

Add a single static key/value tag.

filter

Keep/drop events by an AND/OR/NOT rule tree.

This component takes no params settings.

This component also takes a structured block. See Configuration examples for a worked one.

Accepted action values: keep, drop.

Accepted op values: eq, ne, contains, regex, gt, ge, lt, le, in, cidr.

static-tags

Add a map of static tags.

This component takes no params settings.

This component also takes a structured block. See Configuration examples for a worked one.

system-fields

Enrich with host/OS/agent/network facts.

Advanced settings

This component also takes a structured block. See Configuration examples for a worked one.

Accepted fields values: host_name, host_fqdn, domain, os_name, os_version, os_build, agent_id, agent_version, local_ipv4, local_ipv6, mac, logged_on_user, timezone.

public-ip

Enrich with the agent's public IP (HTTPS lookup)

Advanced settings

parse-json

Parse a JSON record into fields.

This component takes no params settings.

This component also takes a structured block. See Configuration examples for a worked one.

parse-syslog

Parse a syslog record into fields.

This component takes no params settings.

This component also takes a structured block. See Configuration examples for a worked one.

parse-delimited

Parse a delimited record (CSV/TSV/…)

This component takes no params settings.

This component also takes a structured block. See Configuration examples for a worked one.

parse-kv

Parse key=value pairs into fields.

This component takes no params settings.

This component also takes a structured block. See Configuration examples for a worked one.

parse-regex

Parse with a named-capture regex.

This component takes no params settings.

This component also takes a structured block. See Configuration examples for a worked one.

normalise

Map fields onto an OCSF/CIM schema, or apply custom field remaps (rename/copy/drop) with an optional pack; emit: remapped keeps only the fields the stage writes.

This component takes no params settings.

This component also takes a structured block. See Configuration examples for a worked one.

Accepted action values: set, copy, rename, cast, default, drop.

Accepted cast.to values: str, int, uint, bool, ip, ts.

Accepted emit values: all, remapped.

Accepted map.cim values: windows-security, file-fallback.

Accepted map.ocsf values: windows-security.

Accepted schema values: ocsf, cim.

mask

Detect and mask sensitive data.

This component takes no params settings.

This component also takes a structured block. See Configuration examples for a worked one.

Accepted action values: redact, partial, token, hmac.

Accepted detector values: luhn, email, ipv4, ipv6, us-ssn, uk-ni, phone, regex.

aggregate

Windowed aggregation of similar events.

This component takes no params settings.

This component also takes a structured block. See Configuration examples for a worked one.

Accepted op values: eq, ne, contains, regex, gt, ge, lt, le, in, cidr.

Accepted representative values: first, last, none.

prune

Drop fields whose value carries no forensic meaning — a placeholder such as -, N/A, null or 0x0.

This component takes no params settings.

This component also takes a structured block. See Configuration examples for a worked one.

Accepted values values: , -, N/A, null, none, (null), NULL SID, S-1-0-0, 0x0, ?, --.

rate-control

Token-bucket rate limiting / smoothing.

This component takes no params settings.

This component also takes a structured block. See Configuration examples for a worked one.

Accepted policy values: drop_newest, drop_priority, sample.