Rules (XIF)
[MODEL: dataset="bitsight_bitsight_raw"]
alter ip_proto = details -> diligence_annotations.transport
| alter
xdm.event.original_event_type = coalesce(json_extract_scalar(arrayindex(json_extract_array(details, "$.diligence_annotations.annotation_tokens"), 0), "$.token"), risk_vector_label),
xdm.event.operation_sub_type = arraystring(json_extract_scalar_array(to_json_string(arrayindex(json_extract_array(details, "$.diligence_annotations.annotation_tokens"), 0)), "$.values"), ", "),
xdm.event.description = coalesce(json_extract_scalar(arrayindex(json_extract_array(details, "$.remediations"), 0), "$.help_text"), _alert_data -> alert_name),
xdm.event.outcome_reason = details -> diligence_annotations.Status,
xdm.target.host.hostname = arrayindex(regextract(_alert_data -> agent_hostname, "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}"), 0),
xdm.target.location.country = details -> country,
xdm.target.port = to_integer(details -> dest_port),
xdm.alert.name = _alert_data -> alert_name,
xdm.alert.subcategory = _alert_data -> alert_type,
xdm.alert.severity = concat(to_string(severity), " - ", severity_category),
xdm.alert.original_threat_name = risk_vector_label,
xdm.alert.description = object_create("Evidence Key", evidence_key, "Description", _alert_data -> alert_description),
xdm.alert.original_alert_id = temporary_id,
xdm.alert.risks = arraycreate(risk_category),
xdm.network.ip_protocol = if(ip_proto="hopopt",XDM_CONST.IP_PROTOCOL_HOPOPT, ip_proto="icmp",XDM_CONST.IP_PROTOCOL_ICMP, ip_proto="igmp",XDM_CONST.IP_PROTOCOL_IGMP, ip_proto="ggp",XDM_CONST.IP_PROTOCOL_GGP, ip_proto="ip",XDM_CONST.IP_PROTOCOL_IP, ip_proto="st",XDM_CONST.IP_PROTOCOL_ST, ip_proto="tcp",XDM_CONST.IP_PROTOCOL_TCP, ip_proto="cbt",XDM_CONST.IP_PROTOCOL_CBT, ip_proto="egp",XDM_CONST.IP_PROTOCOL_EGP, ip_proto="igp",XDM_CONST.IP_PROTOCOL_IGP, ip_proto="bbn_rcc_mon",XDM_CONST.IP_PROTOCOL_BBN_RCC_MON, ip_proto="nvp_ii",XDM_CONST.IP_PROTOCOL_NVP_II, ip_proto="pup",XDM_CONST.IP_PROTOCOL_PUP, ip_proto="argus",XDM_CONST.IP_PROTOCOL_ARGUS, ip_proto="emcon",XDM_CONST.IP_PROTOCOL_EMCON, ip_proto="xnet",XDM_CONST.IP_PROTOCOL_XNET, ip_proto="chaos",XDM_CONST.IP_PROTOCOL_CHAOS, ip_proto="udp",XDM_CONST.IP_PROTOCOL_UDP, ip_proto="mux",XDM_CONST.IP_PROTOCOL_MUX, ip_proto="dcn_meas",XDM_CONST.IP_PROTOCOL_DCN_MEAS, ip_proto="hmp",XDM_CONST.IP_PROTOCOL_HMP, ip_proto="prm",XDM_CONST.IP_PROTOCOL_PRM, ip_proto="xns_idp",XDM_CONST.IP_PROTOCOL_XNS_IDP, ip_proto="trunk_1",XDM_CONST.IP_PROTOCOL_TRUNK_1, ip_proto="trunk_2",XDM_CONST.IP_PROTOCOL_TRUNK_2, ip_proto="leaf_1",XDM_CONST.IP_PROTOCOL_LEAF_1, ip_proto="leaf_2",XDM_CONST.IP_PROTOCOL_LEAF_2, ip_proto="rdp",XDM_CONST.IP_PROTOCOL_RDP, ip_proto="irtp",XDM_CONST.IP_PROTOCOL_IRTP, ip_proto="iso_tp4",XDM_CONST.IP_PROTOCOL_ISO_TP4, ip_proto="netblt",XDM_CONST.IP_PROTOCOL_NETBLT, ip_proto="mfe_nsp",XDM_CONST.IP_PROTOCOL_MFE_NSP, ip_proto="merit_inp",XDM_CONST.IP_PROTOCOL_MERIT_INP, ip_proto="dccp",XDM_CONST.IP_PROTOCOL_DCCP, ip_proto="3pc",XDM_CONST.IP_PROTOCOL_3PC, ip_proto="idpr",XDM_CONST.IP_PROTOCOL_IDPR, ip_proto="xtp",XDM_CONST.IP_PROTOCOL_XTP, ip_proto="ddp",XDM_CONST.IP_PROTOCOL_DDP, ip_proto="idpr_cmtp",XDM_CONST.IP_PROTOCOL_IDPR_CMTP, ip_proto="tp",XDM_CONST.IP_PROTOCOL_TP, ip_proto="il",XDM_CONST.IP_PROTOCOL_IL, ip_proto="ipv6",XDM_CONST.IP_PROTOCOL_IPV6, ip_proto="sdrp",XDM_CONST.IP_PROTOCOL_SDRP, ip_proto="ipv6_route",XDM_CONST.IP_PROTOCOL_IPV6_ROUTE, ip_proto="ipv6_frag",XDM_CONST.IP_PROTOCOL_IPV6_FRAG, ip_proto="idrp",XDM_CONST.IP_PROTOCOL_IDRP, ip_proto="rsvp",XDM_CONST.IP_PROTOCOL_RSVP, ip_proto="gre",XDM_CONST.IP_PROTOCOL_GRE, ip_proto="dsr",XDM_CONST.IP_PROTOCOL_DSR, ip_proto="bna",XDM_CONST.IP_PROTOCOL_BNA, ip_proto="esp",XDM_CONST.IP_PROTOCOL_ESP, ip_proto="ah",XDM_CONST.IP_PROTOCOL_AH, ip_proto="i_nlsp",XDM_CONST.IP_PROTOCOL_I_NLSP, ip_proto="swipe",XDM_CONST.IP_PROTOCOL_SWIPE, ip_proto="narp",XDM_CONST.IP_PROTOCOL_NARP, ip_proto="mobile",XDM_CONST.IP_PROTOCOL_MOBILE, ip_proto="tlsp",XDM_CONST.IP_PROTOCOL_TLSP, ip_proto="skip",XDM_CONST.IP_PROTOCOL_SKIP, ip_proto="ipv6_icmp",XDM_CONST.IP_PROTOCOL_IPV6_ICMP, ip_proto="ipv6_nonxt",XDM_CONST.IP_PROTOCOL_IPV6_NONXT, ip_proto="ipv6_opts",XDM_CONST.IP_PROTOCOL_IPV6_OPTS, ip_proto="cftp",XDM_CONST.IP_PROTOCOL_CFTP, ip_proto="sat_expak",XDM_CONST.IP_PROTOCOL_SAT_EXPAK, ip_proto="kryptolan",XDM_CONST.IP_PROTOCOL_KRYPTOLAN, ip_proto="rvd",XDM_CONST.IP_PROTOCOL_RVD, ip_proto="ippc",XDM_CONST.IP_PROTOCOL_IPPC, ip_proto="sat_mon",XDM_CONST.IP_PROTOCOL_SAT_MON, ip_proto="visa",XDM_CONST.IP_PROTOCOL_VISA, ip_proto="ipcv",XDM_CONST.IP_PROTOCOL_IPCV, ip_proto="cpnx",XDM_CONST.IP_PROTOCOL_CPNX, ip_proto="cphb",XDM_CONST.IP_PROTOCOL_CPHB, ip_proto="wsn",XDM_CONST.IP_PROTOCOL_WSN, ip_proto="pvp",XDM_CONST.IP_PROTOCOL_PVP, ip_proto="br_sat_mon",XDM_CONST.IP_PROTOCOL_BR_SAT_MON, ip_proto="sun_nd",XDM_CONST.IP_PROTOCOL_SUN_ND, ip_proto="wb_mon",XDM_CONST.IP_PROTOCOL_WB_MON, ip_proto="wb_expak",XDM_CONST.IP_PROTOCOL_WB_EXPAK, ip_proto="iso_ip",XDM_CONST.IP_PROTOCOL_ISO_IP, ip_proto="vmtp",XDM_CONST.IP_PROTOCOL_VMTP, ip_proto="secure_vmtp",XDM_CONST.IP_PROTOCOL_SECURE_VMTP, ip_proto="vines",XDM_CONST.IP_PROTOCOL_VINES, ip_proto="ttp",XDM_CONST.IP_PROTOCOL_TTP, ip_proto="nsfnet_igp",XDM_CONST.IP_PROTOCOL_NSFNET_IGP, ip_proto="dgp",XDM_CONST.IP_PROTOCOL_DGP, ip_proto="tcf",XDM_CONST.IP_PROTOCOL_TCF, ip_proto="eigrp",XDM_CONST.IP_PROTOCOL_EIGRP, ip_proto="ospfigp",XDM_CONST.IP_PROTOCOL_OSPFIGP, ip_proto="sprite_rpc",XDM_CONST.IP_PROTOCOL_SPRITE_RPC, ip_proto="larp",XDM_CONST.IP_PROTOCOL_LARP, ip_proto="mtp",XDM_CONST.IP_PROTOCOL_MTP, ip_proto="ax25",XDM_CONST.IP_PROTOCOL_AX25, ip_proto="ipip",XDM_CONST.IP_PROTOCOL_IPIP, ip_proto="micp",XDM_CONST.IP_PROTOCOL_MICP, ip_proto="scc_sp",XDM_CONST.IP_PROTOCOL_SCC_SP, ip_proto="etherip",XDM_CONST.IP_PROTOCOL_ETHERIP, ip_proto="encap",XDM_CONST.IP_PROTOCOL_ENCAP, ip_proto="gmtp",XDM_CONST.IP_PROTOCOL_GMTP, ip_proto="ifmp",XDM_CONST.IP_PROTOCOL_IFMP, ip_proto="pnni",XDM_CONST.IP_PROTOCOL_PNNI, ip_proto="pim",XDM_CONST.IP_PROTOCOL_PIM, ip_proto="aris",XDM_CONST.IP_PROTOCOL_ARIS, ip_proto="scps",XDM_CONST.IP_PROTOCOL_SCPS, ip_proto="qnx",XDM_CONST.IP_PROTOCOL_QNX, ip_proto="an",XDM_CONST.IP_PROTOCOL_AN, ip_proto="ipcomp",XDM_CONST.IP_PROTOCOL_IPCOMP, ip_proto="snp",XDM_CONST.IP_PROTOCOL_SNP, ip_proto="compaq_peer",XDM_CONST.IP_PROTOCOL_COMPAQ_PEER, ip_proto="ipx_in_ip",XDM_CONST.IP_PROTOCOL_IPX_IN_IP, ip_proto="vrrp",XDM_CONST.IP_PROTOCOL_VRRP, ip_proto="pgm",XDM_CONST.IP_PROTOCOL_PGM, ip_proto="l2tp",XDM_CONST.IP_PROTOCOL_L2TP, ip_proto="ddx",XDM_CONST.IP_PROTOCOL_DDX, ip_proto="iatp",XDM_CONST.IP_PROTOCOL_IATP, ip_proto="stp",XDM_CONST.IP_PROTOCOL_STP, ip_proto="srp",XDM_CONST.IP_PROTOCOL_SRP, ip_proto="uti",XDM_CONST.IP_PROTOCOL_UTI, ip_proto="smp",XDM_CONST.IP_PROTOCOL_SMP, ip_proto="sm",XDM_CONST.IP_PROTOCOL_SM, ip_proto="ptp",XDM_CONST.IP_PROTOCOL_PTP, ip_proto="isis",XDM_CONST.IP_PROTOCOL_ISIS, ip_proto="fire",XDM_CONST.IP_PROTOCOL_FIRE, ip_proto="crtp",XDM_CONST.IP_PROTOCOL_CRTP, ip_proto="crudp",XDM_CONST.IP_PROTOCOL_CRUDP, ip_proto="sscopmce",XDM_CONST.IP_PROTOCOL_SSCOPMCE, ip_proto="iplt",XDM_CONST.IP_PROTOCOL_IPLT, ip_proto="sps",XDM_CONST.IP_PROTOCOL_SPS, ip_proto="pipe",XDM_CONST.IP_PROTOCOL_PIPE, ip_proto="sctp",XDM_CONST.IP_PROTOCOL_SCTP, ip_proto="fc",XDM_CONST.IP_PROTOCOL_FC, ip_proto="rsvp_e2e_ignore",XDM_CONST.IP_PROTOCOL_RSVP_E2E_IGNORE, ip_proto="mobility",XDM_CONST.IP_PROTOCOL_MOBILITY, ip_proto="udplite",XDM_CONST.IP_PROTOCOL_UDPLITE, ip_proto="mpls_in_ip",XDM_CONST.IP_PROTOCOL_MPLS_IN_IP, ip_proto="manet",XDM_CONST.IP_PROTOCOL_MANET, ip_proto="hip",XDM_CONST.IP_PROTOCOL_HIP, ip_proto="shim6",XDM_CONST.IP_PROTOCOL_SHIM6, ip_proto="wesp",XDM_CONST.IP_PROTOCOL_WESP, ip_proto="rohc",XDM_CONST.IP_PROTOCOL_ROHC, ip_proto="reserved",to_string(ip_proto));