Rules (XIF)
[MODEL: dataset = "vmware_carbon_black_cloud_raw"]
alter
event_type = if(to_string(flagged) != null, "audit log", to_string(severity) != null, "alert log", null)
| filter event_type in("alert log")
| alter //detection of IP address's types
external_ipv4 = arrayindex(regextract(device_external_ip,"(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"),0),
external_ipv6 = arrayindex(regextract(device_external_ip, "([a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5})"),0),
internal_ipv4 = arrayindex(regextract(device_internal_ip,"(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"),0),
internal_ipv6 = arrayindex(regextract(device_internal_ip, "([a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5})"),0)
| alter
xdm.source.cloud.project = org_key,
xdm.target.url = alert_url,
xdm.alert.original_alert_id = id,
xdm.event.type = type,
xdm.alert.severity = to_string(severity),
xdm.alert.description = reason,
xdm.alert.original_threat_id = threat_id,
xdm.event.id = primary_event_id,
xdm.target.host.device_id = to_string(device_id),
xdm.target.host.hostname = device_name,
xdm.alert.risks = arraycreate("Device target value:" + device_target_value, "ml classification final verdict: " + ml_classification_final_verdict),
xdm.target.resource.type = "Policy",
xdm.target.resource.name = device_policy,
xdm.target.resource.id = to_string(device_policy_id),
xdm.target.resource.value = policy_applied, //Policy applied or not applied
xdm.event.operation_sub_type = run_state, // did the threat ran or not
xdm.event.outcome = if(sensor_action ~= "ALLOW|ALLOW_AND_LOG", XDM_CONST.OUTCOME_SUCCESS, sensor_action ~= "DENY| TERMINATE", XDM_CONST.OUTCOME_FAILED, XDM_CONST.OUTCOME_UNKNOWN),
xdm.target.host.os_family = if(device_os = "WINDOWS", XDM_CONST.OS_FAMILY_WINDOWS, device_os = "MAC", XDM_CONST.OS_FAMILY_MACOS, device_os = "LINUX", XDM_CONST.OS_FAMILY_LINUX),
xdm.target.host.os = device_os_version,
xdm.target.user.username = device_username,
xdm.target.host.ipv4_addresses = arraycreate(internal_ipv4, external_ipv4),
xdm.target.host.ipv6_addresses = arraycreate(internal_ipv6, external_ipv6),
xdm.observer.type = "Watchlist",
xdm.observer.unique_identifier = report_id,
xdm.observer.name = report_name,
xdm.observer.action = report_description,
xdm.observer.product = report_link,
xdm.alert.mitre_tactics = arraycreate(report_link),
xdm.source.process.pid = process_pid,
xdm.source.process.executable.path = process_name,
xdm.source.process.executable.filename= arrayindex(regextract(process_name, "[^\\]+$"),0),
xdm.source.process.executable.sha256 = process_sha256,
xdm.source.process.executable.md5 = process_md5,
xdm.source.process.command_line = process_cmdline,
xdm.source.user.username = process_username, //username in which the actor process was executed
xdm.source.process.parent_id = to_string(parent_pid);
alter
event_type = if(to_string(flagged) != null, "audit log", to_string(severity) != null, "alert log", null)
| filter event_type in("audit log")
| alter
client_ipv4 = regextract(clientIp,"(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"),
client_ipv6 = regextract(clientIp, "([a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5})")
| alter
xdm.event.description = description,
xdm.source.cloud.project = orgName,
xdm.target.url = requestUrl,
xdm.source.user.username = loginName,
xdm.source.ipv4 = arrayindex(client_ipv4,0),
xdm.source.ipv6 = arrayindex(client_ipv6,0),
xdm.event.id = eventId;
Schema
vmware_carbon_black_cloud_raw
| Field |
Type |
Array? |
alert_url |
string |
— |
clientIp |
string |
— |
description |
string |
— |
device_external_ip |
string |
— |
device_id |
int |
— |
device_internal_ip |
string |
— |
device_name |
string |
— |
device_os |
string |
— |
device_os_version |
string |
— |
device_policy |
string |
— |
device_policy_id |
int |
— |
device_target_value |
string |
— |
device_username |
string |
— |
eventId |
string |
— |
flagged |
boolean |
— |
id |
string |
— |
loginName |
string |
— |
ml_classification_final_verdict |
string |
— |
orgName |
string |
— |
org_key |
string |
— |
parent_pid |
int |
— |
policy_applied |
string |
— |
primary_event_id |
string |
— |
process_cmdline |
string |
— |
process_issuer |
string |
— |
process_md5 |
string |
— |
process_name |
string |
— |
process_pid |
int |
— |
process_sha256 |
string |
— |
process_username |
string |
— |
reason |
string |
— |
report_description |
string |
— |
report_id |
string |
— |
report_link |
string |
— |
report_name |
string |
— |
requestUrl |
string |
— |
run_state |
string |
— |
sensor_action |
string |
— |
severity |
int |
— |
threat_id |
string |
— |
type |
string |
— |
Raw JSON
{
"vmware_carbon_black_cloud_raw": {
"org_key": {
"type": "string",
"is_array": false
},
"alert_url": {
"type": "string",
"is_array": false
},
"id": {
"type": "string",
"is_array": false
},
"type": {
"type": "string",
"is_array": false
},
"severity": {
"type": "int",
"is_array": false
},
"reason": {
"type": "string",
"is_array": false
},
"threat_id": {
"type": "string",
"is_array": false
},
"primary_event_id": {
"type": "string",
"is_array": false
},
"policy_applied": {
"type": "string",
"is_array": false
},
"run_state": {
"type": "string",
"is_array": false
},
"sensor_action": {
"type": "string",
"is_array": false
},
"device_id": {
"type": "int",
"is_array": false
},
"device_name": {
"type": "string",
"is_array": false
},
"device_target_value": {
"type": "string",
"is_array": false
},
"device_policy": {
"type": "string",
"is_array": false
},
"device_policy_id": {
"type": "int",
"is_array": false
},
"device_os": {
"type": "string",
"is_array": false
},
"device_os_version": {
"type": "string",
"is_array": false
},
"device_username": {
"type": "string",
"is_array": false
},
"device_external_ip": {
"type": "string",
"is_array": false
},
"device_internal_ip": {
"type": "string",
"is_array": false
},
"report_id": {
"type": "string",
"is_array": false
},
"report_name": {
"type": "string",
"is_array": false
},
"report_description": {
"type": "string",
"is_array": false
},
"report_link": {
"type": "string",
"is_array": false
},
"process_pid": {
"type": "int",
"is_array": false
},
"process_name": {
"type": "string",
"is_array": false
},
"process_sha256": {
"type": "string",
"is_array": false
},
"process_md5": {
"type": "string",
"is_array": false
},
"process_cmdline": {
"type": "string",
"is_array": false
},
"process_username": {
"type": "string",
"is_array": false
},
"process_issuer": {
"type": "string",
"is_array": false
},
"parent_pid": {
"type": "int",
"is_array": false
},
"ml_classification_final_verdict": {
"type": "string",
"is_array": false
},
"description": {
"type": "string",
"is_array": false
},
"orgName": {
"type": "string",
"is_array": false
},
"requestUrl": {
"type": "string",
"is_array": false
},
"loginName": {
"type": "string",
"is_array": false
},
"clientIp": {
"type": "string",
"is_array": false
},
"eventId": {
"type": "string",
"is_array": false
},
"flagged": {
"type": "boolean",
"is_array": false
}
}
}