Anthropic Claude Modeling Rule

Details

Rules (XIF)

[MODEL: dataset="anthropic_claude_raw"]
alter
    get_actor_type               = json_extract_scalar(actor, "$.type"),
    get_status                   = to_integer(status_code)
| alter
    xdm.event.id                 = id,
    xdm.event.original_event_type = type,
    xdm.network.http.url         = url,
    xdm.observer.type            = "anthropic",
    xdm.source.ipv4              = json_extract_scalar(actor, "$.ip_address"),
    xdm.source.user_agent        = json_extract_scalar(actor, "$.user_agent"),
    xdm.source.user.identifier   = json_extract_scalar(actor, "$.api_key_id"),
    xdm.source.user.user_type    = if(get_actor_type = "api_actor", XDM_CONST.USER_TYPE_SERVICE_ACCOUNT, null),
    xdm.event.outcome            = if(get_status >= 200 and get_status < 300, XDM_CONST.OUTCOME_SUCCESS,
                                      get_status = null, XDM_CONST.OUTCOME_UNKNOWN,
                                      XDM_CONST.OUTCOME_FAILED),
    xdm.network.http.response_code = if(
        get_status = 200, XDM_CONST.HTTP_RSP_CODE_OK,
        get_status = 201, XDM_CONST.HTTP_RSP_CODE_CREATED,
        get_status = 202, XDM_CONST.HTTP_RSP_CODE_ACCEPTED,
        get_status = 204, XDM_CONST.HTTP_RSP_CODE_NO_CONTENT,
        get_status = 301, XDM_CONST.HTTP_RSP_CODE_MOVED_PERMANENTLY,
        get_status = 302, XDM_CONST.HTTP_RSP_CODE_FOUND,
        get_status = 304, XDM_CONST.HTTP_RSP_CODE_NOT_MODIFIED,
        get_status = 400, XDM_CONST.HTTP_RSP_CODE_BAD_REQUEST,
        get_status = 401, XDM_CONST.HTTP_RSP_CODE_UNAUTHORIZED,
        get_status = 403, XDM_CONST.HTTP_RSP_CODE_FORBIDDEN,
        get_status = 404, XDM_CONST.HTTP_RSP_CODE_NOT_FOUND,
        get_status = 409, XDM_CONST.HTTP_RSP_CODE_CONFLICT,
        get_status = 429, XDM_CONST.HTTP_RSP_CODE_TOO_MANY_REQUESTS,
        get_status = 500, XDM_CONST.HTTP_RSP_CODE_INTERNAL_SERVER_ERROR,
        get_status = 502, XDM_CONST.HTTP_RSP_CODE_BAD_GATEWAY,
        get_status = 503, XDM_CONST.HTTP_RSP_CODE_SERVICE_UNAVAILABLE,
        get_status = 504, XDM_CONST.HTTP_RSP_CODE_GATEWAY_TIMEOUT,
        null),
    xdm.network.http.method      = if(
        request_method = "GET",     XDM_CONST.HTTP_METHOD_GET,
        request_method = "POST",    XDM_CONST.HTTP_METHOD_POST,
        request_method = "PUT",     XDM_CONST.HTTP_METHOD_PUT,
        request_method = "DELETE",  XDM_CONST.HTTP_METHOD_DELETE,
        request_method = "PATCH",   XDM_CONST.HTTP_METHOD_PATCH,
        request_method = "HEAD",    XDM_CONST.HTTP_METHOD_HEAD,
        request_method = "OPTIONS", XDM_CONST.HTTP_METHOD_OPTIONS,
        request_method = null,      null,
        request_method);

Schema

anthropic_claude_raw

{
    "anthropic_claude_raw": {
        "id": {
            "type": "string",
            "is_array": false
        },
        "type": {
            "type": "string",
            "is_array": false
        },
        "url": {
            "type": "string",
            "is_array": false
        },
        "actor": {
            "type": "string",
            "is_array": false
        },
        "status_code": {
            "type": "string",
            "is_array": false
        },
        "request_method": {
            "type": "string",
            "is_array": false
        },
        "request_id": {
            "type": "string",
            "is_array": false
        },
        "created_at": {
            "type": "string",
            "is_array": false
        }
    }
}