AppSentinels AppSentinels Modeling Rule

Details

Rules (XIF)

[MODEL: dataset="appsentinels_appsentinels_raw"]
alter
    xdm.event.id = to_string(id),
    xdm.event.original_event_type = action,
    xdm.event.description = description,
    xdm.event.operation = if(
        action = "create", XDM_CONST.OPERATION_TYPE_CREATE, 
        action = "modify", XDM_CONST.OPERATION_TYPE_UPDATE, 
        action = "delete", XDM_CONST.OPERATION_TYPE_DELETE, 
        action = "read", XDM_CONST.OPERATION_TYPE_READ, 
        null
    ),    
    xdm.alert.category = category,
    xdm.target.application.name = application,
    xdm.source.user.identifier = rbac_id,
    xdm.source.user.username = arrayindex(split(username, "@"), 0),
    xdm.source.user.upn = username,
    xdm.source.user.user_type = if(
        type = "user", XDM_CONST.USER_TYPE_REGULAR, 
        type = "service", XDM_CONST.USER_TYPE_SERVICE_ACCOUNT, 
        null
    );

Schema

appsentinels_appsentinels_raw

{
    "appsentinels_appsentinels_raw": {
        "id": {
            "type": "string",
            "is_array": false
        },
        "action": {
            "type": "string",
            "is_array": false
        },
        "application": {
            "type": "string",
            "is_array": false
        },
        "category": {
            "type": "string",
            "is_array": false
        },
        "description": {
            "type": "string",
            "is_array": false
        },
        "rbac_id": {
            "type": "string",
            "is_array": false
        },
        "type": {
            "type": "string",
            "is_array": false
        },
        "user_info": {
            "type": "string",
            "is_array": false
        },
        "username": {
            "type": "string",
            "is_array": false
        }
    }
}