Alibaba Modeling Rule

Details

Rules (XIF)

[MODEL: dataset=alibaba_action_trail_raw]
filter
    event_eventtype in("ApiCall","ConsoleOperation","AliyunServiceEvent","PasswordReset")
| alter
    xdm.event.type = event_eventtype,
    xdm.target.cloud.region = event_acsregion,
    xdm.event.id = event_eventid,
    xdm.event.operation = event_eventname,
    xdm.target.resource.name = event_resourcename,
    xdm.target.resource.type = event_resourcetype,
    xdm.source.ipv4 = event_sourceipaddress,
    xdm.source.user.user_type = if(event_useridentity_type in("root-account","cloudsso-user","saml-user","alibaba-cloud-account"),XDM_CONST.USER_TYPE_REGULAR, event_useridentity_type in("ram-user","assumed-role"),XDM_CONST.USER_TYPE_SERVICE_ACCOUNT ,to_string(event_useridentity_type)),
    xdm.source.user.identifier = event_useridentity_principalid,
    xdm.source.user.username = event_useridentity_username,
    xdm.event.description=event_errormessage,
    xdm.observer.vendor=_vendor,
    xdm.observer.product=_product;

filter
    event_eventtype in("ConsoleSignin","ConsoleSignout")
| alter
    xdm.source.location.region = event_acsregion,
    xdm.event.id = event_eventid,
    xdm.event.operation = event_eventname,
    xdm.source.ipv4 = event_sourceipaddress,
    xdm.source.user.user_type = if(event_useridentity_type in("root-account","cloudsso-user","saml-user","alibaba-cloud-account"),XDM_CONST.USER_TYPE_REGULAR, event_useridentity_type in("ram-user","assumed-role"),XDM_CONST.USER_TYPE_SERVICE_ACCOUNT ,to_string(event_useridentity_type)),
    xdm.source.user.identifier = event_useridentity_principalid,
    xdm.source.user.username = event_useridentity_username,
    xdm.session_context_id=event_useridentity_accesskeyid,
    xdm.event.description=event_errormessage,
    xdm.observer.vendor=_vendor,
    xdm.observer.product=_product;

Schema

alibaba_action_trail_raw

{
    "alibaba_action_trail_raw": {
        "_vendor": {
            "type": "string",
            "is_array": false
        },
        "_product": {
            "type": "string",
            "is_array": false
        },
        "event_acsregion": {
            "type": "string",
            "is_array": false
        },
        "event_eventid": {
            "type": "string",
            "is_array": false
        },
        "event_eventname": {
            "type": "string",
            "is_array": false
        },
        "event_eventtype": {
            "type": "string",
            "is_array": false
        },
        "event_resourcename": {
            "type": "string",
            "is_array": false
        },
        "event_resourcetype": {
            "type": "string",
            "is_array": false
        },
        "event_sourceipaddress": {
            "type": "string",
            "is_array": false
        },
        "event_useridentity_type": {
            "type": "string",
            "is_array": false
        },
        "event_useridentity_principalid": {
            "type": "string",
            "is_array": false
        },
        "event_errormessage": {
            "type": "string",
            "is_array": false
        },
        "event_useridentity_username": {
            "type": "string",
            "is_array": false
        },
        "event_useridentity_accesskeyid": {
            "type": "string",
            "is_array": false
        },
        "__time__": {
            "type": "string",
            "is_array": false
        }
    }
}