In VAST, a schema is a collection of type aliases. Users can write their own schemas to define type relationships and describe event layouts.
VAST uses a Zeek-inspired syntax to define a schema. Consider this example:
This schema defines two types: a type alias
foo with a
skip attribute and a
bar with three fields, where the first field
x contains the
previously defined type.
Records support nesting:
flow record type contains a field
id that is also a record type.
VAST ships with several schemas for common events, such as Zeek or Suricata
logs. Schemas reside in
PREFIX/share/vast/schema, and additional search paths
for user-provided schemas can be set in the configuration file
We will provide an exhaustive schema reference in the future.