# Cylance module in filebeat docs are mixed with RSA
**URL:** https://discuss.elastic.co/t/cylance-module-in-filebeat-docs-are-mixed-with-rsa/248754
**Category:** Beats
**Tags:** filebeat
**Created:** [September 16, 2020, 1:15am UTC](https://discuss.elastic.co/t/cylance-module-in-filebeat-docs-are-mixed-with-rsa/248754 "2020-09-16T01:15:19Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@jessvin.thomas](https://discuss.elastic.co/u/jessvin.thomas)
#### Post date: [September 16, 2020, 1:15am UTC](https://discuss.elastic.co/t/cylance-module-in-filebeat-docs-are-mixed-with-rsa/248754/1 "2020-09-16T01:15:19Z")
The documentation for the cylance module in filebeats looks mixed up with RSA Netwitness.
In this documentation:
> **[Cylance module | Filebeat Reference \[7.9\] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-cylance.html)**
RSA fields are referenced: **`var.rsa_fields`**
And the link to exported fields also are mainly RSA fields, not cylance fields:
> **[CylanceProtect fields | Filebeat Reference \[7.9\] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/exported-fields-cylance.html)**
I wanted to confirm if others see the same thing and I wasn't sure where to post a documentation bug.
---
### Author:  [@mtojek](https://discuss.elastic.co/u/mtojek)
#### Post date: [September 16, 2020, 9:53am UTC](https://discuss.elastic.co/t/cylance-module-in-filebeat-docs-are-mixed-with-rsa/248754/2 "2020-09-16T09:53:59Z")
I agree it looks a bit weird, but currently there are not cylance fields defined, so indeed you can see only RSA fields. Feel free to open an enhancement issue for Beats. Thanks!
---
### Author:  [@jessvin.thomas](https://discuss.elastic.co/u/jessvin.thomas)
#### Post date: [September 16, 2020, 1:50pm UTC](https://discuss.elastic.co/t/cylance-module-in-filebeat-docs-are-mixed-with-rsa/248754/3 "2020-09-16T13:50:07Z")
I have cylance and we're loading it into elastic. Is there a way I can be helpful in proposing the schema for cylance based on our data? I'm not too familiar with beats code, is there a place where there is a mapping table or regex (or grok) and I can compare it with our data?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 14, 2020, 3:50pm UTC](https://discuss.elastic.co/t/cylance-module-in-filebeat-docs-are-mixed-with-rsa/248754/4 "2020-10-14T15:50:12Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.