# What field are used to populate the entire SIEM APP

**URL:** <https://discuss.elastic.co/t/what-field-are-used-to-populate-the-entire-siem-app/209263>\
**Category:** SIEM\
**Tags:** ecs-elastic-common-schema\
**Created:** [November 25, 2019, 9:31am UTC](https://discuss.elastic.co/t/what-field-are-used-to-populate-the-entire-siem-app/209263 "2019-11-25T09:31:58Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Vishnu\_mk](https://avatars.discourse-cdn.com/v4/letter/v/71c47a/32.png) [@Vishnu\_mk](https://discuss.elastic.co/u/Vishnu_mk)\
**Post date:** [November 25, 2019, 9:31am UTC](https://discuss.elastic.co/t/what-field-are-used-to-populate-the-entire-siem-app/209263/1 "2019-11-25T09:31:58Z")

</div>

Hii Everyone,  
I am trying to map the fields used in my index to the ECS fields so that it gets populated in the SIEM APP. I have mapped fields like username , hostname and event action with the ECS fields and its getting populated in the SIEM App.

Basically I want all the fields used in the SIEM APP , So that I can map and populate my fields in SIEM APP.

---

<div class="post-metadata">

**Author:** ![webmat](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/webmat/32/46191_2.png) [@webmat](https://discuss.elastic.co/u/webmat)\
**Post date:** [November 29, 2019, 1:57pm UTC](https://discuss.elastic.co/t/what-field-are-used-to-populate-the-entire-siem-app/209263/2 "2019-11-29T13:57:10Z")

</div>

Hi! Your best bet there is to populate as many of the ECS fields as possible.

Note that you can also use the inspect button in the SIEM app to figure out more data sources that you could start monitoring.

---

<div class="post-metadata">

**Author:** ![Vishnu\_mk](https://avatars.discourse-cdn.com/v4/letter/v/71c47a/32.png) [@Vishnu\_mk](https://discuss.elastic.co/u/Vishnu_mk)\
**Post date:** [December 3, 2019, 9:42am UTC](https://discuss.elastic.co/t/what-field-are-used-to-populate-the-entire-siem-app/209263/3 "2019-12-03T09:42:01Z")

</div>

Thanks @webmat

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 31, 2019, 9:42am UTC](https://discuss.elastic.co/t/what-field-are-used-to-populate-the-entire-siem-app/209263/4 "2019-12-31T09:42:03Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.