Test Data Model Rules ↗

After writing data model rules, test them to ensure the rules work as expected.

There are two ways to test the modeling rules:

• Use an XQL query in the Cortex XSIAM UI.
• Create a data model test configuration and execute the test using demisto-sdk.

Example JSON and data modeling rules

Use the sample JSON and data model rules as described in Create data model rules.

The JSON file represents the ingested events:

[  
  {
    "id": "1234",    
    "message": "New user added 'root2'",    
    "type": "audit",    
    "op": "add",    
    "result": "success",    
    "host_info": {      
      "host": "prod-01",      
      "os": "Windows"    
    },    
    "created": "1676764803"  
   },  
   {    
    "id": "1235",    
    "message": "User 'root2' delete failed, permission denied",    
    "type": "audit",    
    "op": "delete",    
    "result": "failed",    
    "host_info": {      
      "host": "prod-01",      
      "os": "Windows"    
    },    
    "created": "1676764823"  
    }
]

The following are sample data model rules:

[MODEL: dataset="MyVendor_MyProduct_raw"]
ALTER  
  xdm.event.id = id,  
  xdm.event.description = message,  
  xdm.event.type = type,  
  xdm.event.operation = if(
    op = "add", XDM_CONST.OPERATION_TYPE_CREATE,    
    op = "delete", XDM_CONST.OPERATION_TYPE_MODIFY,    
    op = "login", XDM_CONST.OPERATION_TYPE_LOGIN,    
    op = null, null, to_string(op)  
  ),  
  xdm.event.outcome = if(    
    result = "success", XDM_CONST.OUTCOME_SUCCESS,    
    result = "failed", XDM_CONST.OUTCOME_FAILED,    
    result = null, null, to_string(result)  
  ),  
  xdm.event.is_completed = if(result != pending),  
  xdm.source.hostname = json_extract_scalar(host_info, "$.host"),  
  xdm.source.os_family = if(    
    json_extract_scalar(host_info, "$.os") = "Windows", XDM_CONST.OS_FAMILY_WINDOWS,
    json_extract_scalar(host_info, "$.os") = null, null, to_string(json_extract_scalar(host_info, "$.os"))
  )

Test data model rules using the Cortex XSIAM UI

After creating the XDM rules and ensuring no errors were raised, construct a new XQL query with the fields mapped in the data model. Using the data model above, the query looks like this:

datamodel dataset in("MyVendor_MyProduct_raw") |

FIELDS

xdm.event.id,

xdm.event.description,

xdm.event.type,

xdm.event.outcome,

xdm.event.operation,

xdm.event.is_completed,

xdm.source.hostname,

xdm.source.os_family

Tip

Only select fields are mapped in the data model to make it easier to review the actual and expected results.