Rules (XIF)
[MODEL: dataset = "msft_azure_flowlogs_raw"]
// --- NSG & VNet Flow Logs ---
filter category in ("NetworkSecurityGroupFlowEvent", "FlowLogFlowEvent")
| alter
get_flowState = if(category = "NetworkSecurityGroupFlowEvent", flowState, category = "FlowLogFlowEvent", deviceAction, null)
| alter
xdm.event.tags = arraycreate(XDM_CONST.EVENT_TAG_CLOUD),
xdm.source.cloud.provider = XDM_CONST.CLOUD_PROVIDER_AZURE,
xdm.target.cloud.provider = XDM_CONST.CLOUD_PROVIDER_AZURE,
xdm.target.resource.id = resourceId,
xdm.event.operation_sub_type = operationName,
xdm.event.original_event_type = if(category = "NetworkSecurityGroupFlowEvent", "Network Security Group Flow Event", category = "FlowLogFlowEvent", "VNet Flow Log Event", null),
xdm.network.rule = nsgRuleName,
xdm.source.ipv4 = arrayindex(regextract(sourceAddress, "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}"), 0),
xdm.source.ipv6 = arrayindex(regextract(sourceAddress, "[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}"), 0),
xdm.target.ipv4 = arrayindex(regextract(destinationAddress, "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}"), 0),
xdm.target.ipv6 = arrayindex(regextract(destinationAddress, "[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}"), 0),
xdm.intermediate.host.mac_addresses = arraycreate(mac),
xdm.source.port = to_integer(sourcePort),
xdm.target.port = to_integer(destinationPort),
xdm.network.ip_protocol = if(
transportProtocol = "T", XDM_CONST.IP_PROTOCOL_TCP,
transportProtocol = "U", XDM_CONST.IP_PROTOCOL_UDP,
transportProtocol = "6", XDM_CONST.IP_PROTOCOL_TCP,
transportProtocol = "17", XDM_CONST.IP_PROTOCOL_UDP,
transportProtocol = "1", XDM_CONST.IP_PROTOCOL_ICMP,
transportProtocol = "58", XDM_CONST.IP_PROTOCOL_IPV6_ICMP,
transportProtocol = null, null, to_string(transportProtocol)
),
xdm.event.outcome = if(
deviceAction in ("A", "B", "C", "E"), XDM_CONST.OUTCOME_SUCCESS,
deviceAction = "D", XDM_CONST.OUTCOME_FAILED,
deviceAction = null, null, to_string(deviceAction)
),
xdm.event.outcome_reason = deviceAction,
xdm.observer.type = if(
get_flowState = "B", "Begin, a flow is created. No statistics are provided",
get_flowState = "C", "Continuing for an ongoing flow. Statistics are provided at five-minute intervals",
get_flowState = "E", "End, when a flow is terminated. Statistics are provided",
get_flowState = "D", "Deny, when a flow is denied",
get_flowState = null, null, to_string(get_flowState)
),
xdm.event.description = if(
deviceDirection = "I", "Inbound",
deviceDirection = "O", "Outbound",
deviceDirection = null, null, to_string(deviceDirection)
),
xdm.source.sent_packets = to_integer(packetsStoD),
xdm.source.sent_bytes = to_integer(bytesStoD),
xdm.target.sent_packets = to_integer(packetsDtoS),
xdm.target.sent_bytes = to_integer(bytesDtoS);
// --- NTA Flow Logs ---
filter _raw_log -> Type = "NTAIpDetails"
| alter
lower_ThreatType = lowercase(_raw_log -> ThreatType),
get_Location = _raw_log -> Location
| alter
xdm.event.tags = arraycreate(XDM_CONST.EVENT_TAG_CLOUD),
xdm.source.cloud.provider = XDM_CONST.CLOUD_PROVIDER_AZURE,
xdm.target.cloud.provider = XDM_CONST.CLOUD_PROVIDER_AZURE,
xdm.event.original_event_type = "NTA IP Details",
xdm.event.type = _raw_log -> SubType,
xdm.alert.subcategory = _raw_log -> FlowType,
xdm.target.ipv4 = arrayindex(regextract(_raw_log -> Ip, "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}"), 0),
xdm.target.ipv6 = arrayindex(regextract(_raw_log -> Ip, "((?:[a-fA-F\d]{0,4}\:){2,7}[a-fA-F\d]{0,4})"), 0),
xdm.event.description = _raw_log -> PublicIpDetails,
xdm.alert.category = if(
lower_ThreatType = "apk", XDM_CONST.THREAT_CATEGORY_APK,
lower_ThreatType = "dmg", XDM_CONST.THREAT_CATEGORY_DMG,
lower_ThreatType = "flash", XDM_CONST.THREAT_CATEGORY_FLASH,
lower_ThreatType = "java-class", XDM_CONST.THREAT_CATEGORY_JAVA_CLASS,
lower_ThreatType = "macho", XDM_CONST.THREAT_CATEGORY_MACHO,
lower_ThreatType = "office", XDM_CONST.THREAT_CATEGORY_OFFICE,
lower_ThreatType = "openoffice", XDM_CONST.THREAT_CATEGORY_OPENOFFICE,
lower_ThreatType = "pdf", XDM_CONST.THREAT_CATEGORY_PDF,
lower_ThreatType = "pe", XDM_CONST.THREAT_CATEGORY_PE,
lower_ThreatType = "pkg", XDM_CONST.THREAT_CATEGORY_PKG,
lower_ThreatType = "adware", XDM_CONST.THREAT_CATEGORY_ADWARE,
lower_ThreatType = "autogen", XDM_CONST.THREAT_CATEGORY_AUTOGEN,
lower_ThreatType = "backdoor", XDM_CONST.THREAT_CATEGORY_BACKDOOR,
lower_ThreatType = "botnet", XDM_CONST.THREAT_CATEGORY_BOTNET,
lower_ThreatType = "browser-hijack", XDM_CONST.THREAT_CATEGORY_BROWSER_HIJACK,
lower_ThreatType = "cryptominer", XDM_CONST.THREAT_CATEGORY_CRYPTOMINER,
lower_ThreatType = "data-theft", XDM_CONST.THREAT_CATEGORY_DATA_THEFT,
lower_ThreatType = "dns", XDM_CONST.THREAT_CATEGORY_DNS,
lower_ThreatType = "dns-security", XDM_CONST.THREAT_CATEGORY_DNS_SECURITY,
lower_ThreatType = "dns-wildfire", XDM_CONST.THREAT_CATEGORY_DNS_WILDFIRE,
lower_ThreatType = "downloader", XDM_CONST.THREAT_CATEGORY_DOWNLOADER,
lower_ThreatType = "fraud", XDM_CONST.THREAT_CATEGORY_FRAUD,
lower_ThreatType = "hacktool", XDM_CONST.THREAT_CATEGORY_HACKTOOL,
lower_ThreatType = "keylogger", XDM_CONST.THREAT_CATEGORY_KEYLOGGER,
lower_ThreatType = "networm", XDM_CONST.THREAT_CATEGORY_NETWORM,
lower_ThreatType = "phishing-kit", XDM_CONST.THREAT_CATEGORY_PHISHING_KIT,
lower_ThreatType = "post-exploitation", XDM_CONST.THREAT_CATEGORY_POST_EXPLOITATION,
lower_ThreatType = "webshell", XDM_CONST.THREAT_CATEGORY_WEBSHELL,
lower_ThreatType = "spyware", XDM_CONST.THREAT_CATEGORY_SPYWARE,
lower_ThreatType = "brute force", XDM_CONST.THREAT_CATEGORY_BRUTE_FORCE,
lower_ThreatType = "code execution", XDM_CONST.THREAT_CATEGORY_CODE_EXECUTION,
lower_ThreatType = "code-obfuscation", XDM_CONST.THREAT_CATEGORY_CODE_OBFUSCATION,
lower_ThreatType = "dos", XDM_CONST.THREAT_CATEGORY_DOS,
lower_ThreatType = "exploit-kit", XDM_CONST.THREAT_CATEGORY_EXPLOIT_KIT,
lower_ThreatType = "info-leak", XDM_CONST.THREAT_CATEGORY_INFO_LEAK,
lower_ThreatType = "insecure-credentials", XDM_CONST.THREAT_CATEGORY_INSECURE_CREDENTIALS,
lower_ThreatType = "overflow", XDM_CONST.THREAT_CATEGORY_OVERFLOW,
lower_ThreatType = "phishing", XDM_CONST.THREAT_CATEGORY_PHISHING,
lower_ThreatType = "protocol-anomaly", XDM_CONST.THREAT_CATEGORY_PROTOCOL_ANOMALY,
lower_ThreatType = "sql-injection", XDM_CONST.THREAT_CATEGORY_SQL_INJECTION,
lower_ThreatType = null, null, to_string(lower_ThreatType)
),
xdm.target.asn.domain = _raw_log -> DNSDomain,
xdm.alert.description = _raw_log -> ThreatDescription,
xdm.target.location.country = if(get_Location ~= "^\S{2}$", get_Location),
xdm.target.location.region = if(get_Location !~= "^\S{2}$", get_Location),
xdm.target.url = _raw_log -> Url,
xdm.target.port = to_integer(_raw_log -> Port);
filter _raw_log -> Type = "NTATopologyDetails"
| alter
get_Access = _raw_log -> Access,
// get_IsVirtualAppliance = _raw_log -> IsVirtualAppliance,
get_Protocol = _raw_log -> Protocol
| alter
xdm.event.tags = arraycreate(XDM_CONST.EVENT_TAG_CLOUD),
xdm.source.cloud.provider = XDM_CONST.CLOUD_PROVIDER_AZURE,
xdm.target.cloud.provider = XDM_CONST.CLOUD_PROVIDER_AZURE,
xdm.event.original_event_type = "NTA Topology Details",
xdm.event.outcome = if(
get_Access = "Allow", XDM_CONST.OUTCOME_SUCCESS,
get_Access = "Deny", XDM_CONST.OUTCOME_FAILED,
get_Access = null, null, to_string(get_Access)
),
xdm.event.outcome_reason = get_Access,
xdm.target.subnet = _raw_log -> Subnetwork,
xdm.event.type = coalesce(_raw_log -> SubType, _raw_log -> ComponentType),
xdm.network.rule = object_create(
"Priority", _raw_log -> Priority,
"Protocol", _raw_log -> Protocol,
"SourcePortRange", _raw_log -> SourcePortRange,
"DestinationPortRange", _raw_log -> DestinationPortRange,
"SourceAddressPrefix", _raw_log -> SourceAddressPrefix,
"DestinationAddressPrefix", _raw_log -> DestinationAddressPrefix,
"Access", _raw_log -> Access,
"Direction", _raw_log -> Direction,
"RuleType", _raw_log -> RuleType,
"Nsg", _raw_log -> Nsg
),
xdm.target.location.region = coalesce(_raw_log -> Region, _raw_log -> DiscoveryRegion),
xdm.target.host.mac_addresses = arraycreate(_raw_log -> MacAddress),
xdm.target.host.hostname = _raw_log -> Name,
xdm.target.host.device_id = _raw_log -> PrivateEndpointResourceId,
xdm.target.host.ipv4_addresses = regextract(_raw_log -> PrivateIpAddresses, "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}"),
xdm.target.host.ipv6_addresses = regextract(_raw_log -> PrivateIpAddresses, "((?:[a-fA-F\d]{0,4}\:){2,7}[a-fA-F\d]{0,4})"),
xdm.network.ip_protocol = if(get_Protocol = "HOPOPT", XDM_CONST.IP_PROTOCOL_HOPOPT, get_Protocol = "ICMP", XDM_CONST.IP_PROTOCOL_ICMP, get_Protocol = "IGMP", XDM_CONST.IP_PROTOCOL_IGMP, get_Protocol = "GGP", XDM_CONST.IP_PROTOCOL_GGP, get_Protocol = "IP", XDM_CONST.IP_PROTOCOL_IP, get_Protocol = "ST", XDM_CONST.IP_PROTOCOL_ST, get_Protocol ~= "[Tt][Cc][Pp]", XDM_CONST.IP_PROTOCOL_TCP, get_Protocol = "CBT", XDM_CONST.IP_PROTOCOL_CBT, get_Protocol = "EGP", XDM_CONST.IP_PROTOCOL_EGP, get_Protocol = "IGP", XDM_CONST.IP_PROTOCOL_IGP, get_Protocol = "BBN_RCC_MON", XDM_CONST.IP_PROTOCOL_BBN_RCC_MON, get_Protocol = "NVP_II", XDM_CONST.IP_PROTOCOL_NVP_II, get_Protocol = "PUP", XDM_CONST.IP_PROTOCOL_PUP, get_Protocol = "ARGUS", XDM_CONST.IP_PROTOCOL_ARGUS, get_Protocol = "EMCON", XDM_CONST.IP_PROTOCOL_EMCON, get_Protocol = "XNET", XDM_CONST.IP_PROTOCOL_XNET, get_Protocol = "CHAOS", XDM_CONST.IP_PROTOCOL_CHAOS, get_Protocol ~= "[Uu][Dd][Pp]", XDM_CONST.IP_PROTOCOL_UDP, get_Protocol = "MUX", XDM_CONST.IP_PROTOCOL_MUX, get_Protocol = "DCN_MEAS", XDM_CONST.IP_PROTOCOL_DCN_MEAS, get_Protocol = "HMP", XDM_CONST.IP_PROTOCOL_HMP, get_Protocol = "PRM", XDM_CONST.IP_PROTOCOL_PRM, get_Protocol = "XNS_IDP", XDM_CONST.IP_PROTOCOL_XNS_IDP, get_Protocol = "TRUNK_1", XDM_CONST.IP_PROTOCOL_TRUNK_1, get_Protocol = "TRUNK_2", XDM_CONST.IP_PROTOCOL_TRUNK_2, get_Protocol = "LEAF_1", XDM_CONST.IP_PROTOCOL_LEAF_1, get_Protocol = "LEAF_2", XDM_CONST.IP_PROTOCOL_LEAF_2, get_Protocol = "RDP", XDM_CONST.IP_PROTOCOL_RDP, get_Protocol = "IRTP", XDM_CONST.IP_PROTOCOL_IRTP, get_Protocol = "ISO_TP4", XDM_CONST.IP_PROTOCOL_ISO_TP4, get_Protocol = "NETBLT", XDM_CONST.IP_PROTOCOL_NETBLT, get_Protocol = "MFE_NSP", XDM_CONST.IP_PROTOCOL_MFE_NSP, get_Protocol = "MERIT_INP", XDM_CONST.IP_PROTOCOL_MERIT_INP, get_Protocol = "DCCP", XDM_CONST.IP_PROTOCOL_DCCP, get_Protocol = "3PC", XDM_CONST.IP_PROTOCOL_3PC, get_Protocol = "IDPR", XDM_CONST.IP_PROTOCOL_IDPR, get_Protocol = "XTP", XDM_CONST.IP_PROTOCOL_XTP, get_Protocol = "DDP", XDM_CONST.IP_PROTOCOL_DDP, get_Protocol = "IDPR_CMTP", XDM_CONST.IP_PROTOCOL_IDPR_CMTP, get_Protocol = "TP", XDM_CONST.IP_PROTOCOL_TP, get_Protocol = "IL", XDM_CONST.IP_PROTOCOL_IL, get_Protocol = "IPV6", XDM_CONST.IP_PROTOCOL_IPV6, get_Protocol = "SDRP", XDM_CONST.IP_PROTOCOL_SDRP, get_Protocol = "IPV6_ROUTE", XDM_CONST.IP_PROTOCOL_IPV6_ROUTE, get_Protocol = "IPV6_FRAG", XDM_CONST.IP_PROTOCOL_IPV6_FRAG, get_Protocol = "IDRP", XDM_CONST.IP_PROTOCOL_IDRP, get_Protocol = "RSVP", XDM_CONST.IP_PROTOCOL_RSVP, get_Protocol = "GRE", XDM_CONST.IP_PROTOCOL_GRE, get_Protocol = "DSR", XDM_CONST.IP_PROTOCOL_DSR, get_Protocol = "BNA", XDM_CONST.IP_PROTOCOL_BNA, get_Protocol = "ESP", XDM_CONST.IP_PROTOCOL_ESP, get_Protocol = "AH", XDM_CONST.IP_PROTOCOL_AH, get_Protocol = "I_NLSP", XDM_CONST.IP_PROTOCOL_I_NLSP, get_Protocol = "SWIPE", XDM_CONST.IP_PROTOCOL_SWIPE, get_Protocol = "NARP", XDM_CONST.IP_PROTOCOL_NARP, get_Protocol = "MOBILE", XDM_CONST.IP_PROTOCOL_MOBILE, get_Protocol = "TLSP", XDM_CONST.IP_PROTOCOL_TLSP, get_Protocol = "SKIP", XDM_CONST.IP_PROTOCOL_SKIP, get_Protocol = "IPV6_ICMP", XDM_CONST.IP_PROTOCOL_IPV6_ICMP, get_Protocol = "IPV6_NONXT", XDM_CONST.IP_PROTOCOL_IPV6_NONXT, get_Protocol = "IPV6_OPTS", XDM_CONST.IP_PROTOCOL_IPV6_OPTS, get_Protocol = "CFTP", XDM_CONST.IP_PROTOCOL_CFTP, get_Protocol = "SAT_EXPAK", XDM_CONST.IP_PROTOCOL_SAT_EXPAK, get_Protocol = "KRYPTOLAN", XDM_CONST.IP_PROTOCOL_KRYPTOLAN, get_Protocol = "RVD", XDM_CONST.IP_PROTOCOL_RVD, get_Protocol = "IPPC", XDM_CONST.IP_PROTOCOL_IPPC, get_Protocol = "SAT_MON", XDM_CONST.IP_PROTOCOL_SAT_MON, get_Protocol = "VISA", XDM_CONST.IP_PROTOCOL_VISA, get_Protocol = "IPCV", XDM_CONST.IP_PROTOCOL_IPCV, get_Protocol = "CPNX", XDM_CONST.IP_PROTOCOL_CPNX, get_Protocol = "CPHB", XDM_CONST.IP_PROTOCOL_CPHB, get_Protocol = "WSN", XDM_CONST.IP_PROTOCOL_WSN, get_Protocol = "PVP", XDM_CONST.IP_PROTOCOL_PVP, get_Protocol = "BR_SAT_MON", XDM_CONST.IP_PROTOCOL_BR_SAT_MON, get_Protocol = "SUN_ND", XDM_CONST.IP_PROTOCOL_SUN_ND, get_Protocol = "WB_MON", XDM_CONST.IP_PROTOCOL_WB_MON, get_Protocol = "WB_EXPAK", XDM_CONST.IP_PROTOCOL_WB_EXPAK, get_Protocol = "ISO_IP", XDM_CONST.IP_PROTOCOL_ISO_IP, get_Protocol = "VMTP", XDM_CONST.IP_PROTOCOL_VMTP, get_Protocol = "SECURE_VMTP", XDM_CONST.IP_PROTOCOL_SECURE_VMTP, get_Protocol = "VINES", XDM_CONST.IP_PROTOCOL_VINES, get_Protocol = "TTP", XDM_CONST.IP_PROTOCOL_TTP, get_Protocol = "NSFNET_IGP", XDM_CONST.IP_PROTOCOL_NSFNET_IGP, get_Protocol = "DGP", XDM_CONST.IP_PROTOCOL_DGP, get_Protocol = "TCF", XDM_CONST.IP_PROTOCOL_TCF, get_Protocol = "EIGRP", XDM_CONST.IP_PROTOCOL_EIGRP, get_Protocol = "OSPFIGP", XDM_CONST.IP_PROTOCOL_OSPFIGP, get_Protocol = "SPRITE_RPC", XDM_CONST.IP_PROTOCOL_SPRITE_RPC, get_Protocol = "LARP", XDM_CONST.IP_PROTOCOL_LARP, get_Protocol = "MTP", XDM_CONST.IP_PROTOCOL_MTP, get_Protocol = "AX25", XDM_CONST.IP_PROTOCOL_AX25, get_Protocol = "IPIP", XDM_CONST.IP_PROTOCOL_IPIP, get_Protocol = "MICP", XDM_CONST.IP_PROTOCOL_MICP, get_Protocol = "SCC_SP", XDM_CONST.IP_PROTOCOL_SCC_SP, get_Protocol = "ETHERIP", XDM_CONST.IP_PROTOCOL_ETHERIP, get_Protocol = "ENCAP", XDM_CONST.IP_PROTOCOL_ENCAP, get_Protocol = "GMTP", XDM_CONST.IP_PROTOCOL_GMTP, get_Protocol = "IFMP", XDM_CONST.IP_PROTOCOL_IFMP, get_Protocol = "PNNI", XDM_CONST.IP_PROTOCOL_PNNI, get_Protocol = "PIM", XDM_CONST.IP_PROTOCOL_PIM, get_Protocol = "ARIS", XDM_CONST.IP_PROTOCOL_ARIS, get_Protocol = "SCPS", XDM_CONST.IP_PROTOCOL_SCPS, get_Protocol = "QNX", XDM_CONST.IP_PROTOCOL_QNX, get_Protocol = "AN", XDM_CONST.IP_PROTOCOL_AN, get_Protocol = "IPCOMP", XDM_CONST.IP_PROTOCOL_IPCOMP, get_Protocol = "SNP", XDM_CONST.IP_PROTOCOL_SNP, get_Protocol = "COMPAQ_PEER", XDM_CONST.IP_PROTOCOL_COMPAQ_PEER, get_Protocol = "IPX_IN_IP", XDM_CONST.IP_PROTOCOL_IPX_IN_IP, get_Protocol = "VRRP", XDM_CONST.IP_PROTOCOL_VRRP, get_Protocol = "PGM", XDM_CONST.IP_PROTOCOL_PGM, get_Protocol = "L2TP", XDM_CONST.IP_PROTOCOL_L2TP, get_Protocol = "DDX", XDM_CONST.IP_PROTOCOL_DDX, get_Protocol = "IATP", XDM_CONST.IP_PROTOCOL_IATP, get_Protocol = "STP", XDM_CONST.IP_PROTOCOL_STP, get_Protocol = "SRP", XDM_CONST.IP_PROTOCOL_SRP, get_Protocol = "UTI", XDM_CONST.IP_PROTOCOL_UTI, get_Protocol = "SMP", XDM_CONST.IP_PROTOCOL_SMP, get_Protocol = "SM", XDM_CONST.IP_PROTOCOL_SM, get_Protocol = "PTP", XDM_CONST.IP_PROTOCOL_PTP, get_Protocol = "ISIS", XDM_CONST.IP_PROTOCOL_ISIS, get_Protocol = "FIRE", XDM_CONST.IP_PROTOCOL_FIRE, get_Protocol = "CRTP", XDM_CONST.IP_PROTOCOL_CRTP, get_Protocol = "CRUDP", XDM_CONST.IP_PROTOCOL_CRUDP, get_Protocol = "SSCOPMCE", XDM_CONST.IP_PROTOCOL_SSCOPMCE, get_Protocol = "IPLT", XDM_CONST.IP_PROTOCOL_IPLT, get_Protocol = "SPS", XDM_CONST.IP_PROTOCOL_SPS, get_Protocol = "PIPE", XDM_CONST.IP_PROTOCOL_PIPE, get_Protocol = "SCTP", XDM_CONST.IP_PROTOCOL_SCTP, get_Protocol = "FC", XDM_CONST.IP_PROTOCOL_FC, get_Protocol = "RSVP_E2E_IGNORE", XDM_CONST.IP_PROTOCOL_RSVP_E2E_IGNORE, get_Protocol = "MOBILITY", XDM_CONST.IP_PROTOCOL_MOBILITY, get_Protocol = "UDPLITE", XDM_CONST.IP_PROTOCOL_UDPLITE, get_Protocol = "MPLS_IN_IP", XDM_CONST.IP_PROTOCOL_MPLS_IN_IP, get_Protocol = "MANET", XDM_CONST.IP_PROTOCOL_MANET, get_Protocol = "HIP", XDM_CONST.IP_PROTOCOL_HIP, get_Protocol = "SHIM6", XDM_CONST.IP_PROTOCOL_SHIM6, get_Protocol = "WESP", XDM_CONST.IP_PROTOCOL_WESP, get_Protocol = "ROHC", XDM_CONST.IP_PROTOCOL_ROHC, get_Protocol = "RESERVED", XDM_CONST.IP_PROTOCOL_RESERVED, get_Protocol = null, null, to_string(get_Protocol)),
xdm.target.ipv4 = arrayindex(regextract(_raw_log -> PublicIpAddresses, "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}"), 0),
xdm.target.ipv6 = arrayindex(regextract(_raw_log -> PublicIpAddresses, "((?:[a-fA-F\d]{0,4}\:){2,7}[a-fA-F\d]{0,4})"), 0),
xdm.target.host.ipv4_public_addresses = regextract(_raw_log -> PublicIpAddresses, "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}"),
xdm.target.host.ipv6_public_addresses = regextract(_raw_log -> PublicIpAddresses, "((?:[a-fA-F\d]{0,4}\:){2,7}[a-fA-F\d]{0,4})"),
xdm.observer.action = _raw_log -> Status,
xdm.target.cloud.project_id = coalesce(_raw_log -> Subscription, _raw_log -> TenantId),
xdm.target.cloud.project = _raw_log -> SubscriptionName,
xdm.target.agent.identifier = _raw_log -> VirtualMachine,
xdm.target.zone = _raw_log -> Zones;