Rules (XIF)
[MODEL: dataset="celonis_celonis_raw"]
alter event_type = coalesce(event , authenticationEventType)
| alter
xdm.event.type = event_type,
xdm.source.user.upn = coalesce(email , message -> email , message -> userEmail , arrayindex(regextract(userId , "\((.*?)\)"),0)),
xdm.event.outcome = if(to_string(success) = "true", XDM_CONST.OUTCOME_SUCCESS, to_string(success) = "false", XDM_CONST.OUTCOME_FAILED, to_string(message -> ["login-history-enabled"]) = "true", XDM_CONST.OUTCOME_SUCCESS, to_string(message -> ["login-history-enabled"]) = "false", XDM_CONST.OUTCOME_FAILED, null),
xdm.auth.privilege_level = if(lowercase(userRole) = "admin" , XDM_CONST.PRIVILEGE_LEVEL_ADMIN),
xdm.event.description = coalesce(message , authenticationEventType),
xdm.target.resource.sub_type = coalesce(message -> name , message -> teamName, message -> dataPoolName , message -> clientName , message -> spaceName , message -> object_description , message -> dataJobName , message -> dataSourceName , message -> dataModelName , message -> nodeName , message -> variableKey , message -> ["object_description"]),
xdm.target.resource.id = coalesce(message -> teamId , message -> userId , message -> dataPoolId , message -> id , message -> clientId , message -> ["application-key-id"] , message -> spaceId , message -> object_id , message -> dataJobId , message -> dataSourceId , message -> dataModelId , message -> nodeId , message -> ["Analysis Id"] , message -> packageKey),
xdm.source.user.username = message -> sender,
xdm.target.user.username = message -> invitee,
xdm.target.resource_before.value = coalesce(message -> oldUserName, arraystring(message -> ["old_permissions"][], " ; ")),
xdm.target.resource.value = coalesce(message -> updatedUserName , arraystring(message -> ["new_permissions"][], " ; ")),
xdm.observer.version = message -> version,
xdm.target.resource.type = if (event_type in ("EXPORT_PARQUET_DISCLAIMER_AGREEMENT_*", "ROUTING_RULE_*", "SKILL_*"), "Action Engine",
event_type in ("ACTIONFLOW_*"), "Action Flows",
event_type in ("ADMIN USER INVITED", "APPLICATION_KEY_*", "APPLICATION_PERMISSIONS_CSV_DOWNLOADED", "AUDIT_LOG*","GROUP_*", "IP_RESTRICTIONS_*", "LLM_*", "LOGIN_HISTORY_CSV_DOWNLOADED", "LOGIN_HISTORY_DELETED", "LOGIN_HISTORY_PREFERENCES_UPDATED", "MEMBER_LOCK_POLICY_UPDATED", "OPEN_SIGNUP_UPDATED", "PERMISSIONS_*", "SSO_PROVIDER_*", "STUDIO_ADOPTION_*", "TEAM_*", "TRACKING_EVENT_DELETED", "TWO_FACTOR_UPDATED", "UPLINK_*", "USER_*"), "Admin and Settings",
event_type in ("PROCESS_WORKSPACE_NODE_UPDATED"), "Business Miner",
event_type in ("ANALYSIS_EXPORT_AUDIT_LOG_EVENT", "CUSTOM_EXTRACTION_*", "DATA_*", "PROCESS_INSTALLED"), "Data Integration",
event_type in ("FILE_UPLOAD_*", "JOB_EXECUTION_*"), "File Uploader",
event_type in ("ML_*"), "Machine Learning",
event_type in ("OCDM_*"), "Object-centric data model",
event_type in ("AGENT_REGISTERED*", "CONNECTION_*", "SKILL_*", "WORKFLOW_*"), "Process Automation",
event_type in ("ANALYSIS_EXPORT_AUDIT_LOG_EVENT", "STUDIO_*"), "Studio",
event_type in ("TASK_*"), "Task Mining",
event_type in ("TEAM_TO_TEAM_COPY_*"), "Team To Team Copy",
event_type in ("OBJECTIVE_*", "REPORTING_*"), "Transformation Center",
event_type in ("PACKAGE_MOVED_TO_TRASH", "PACKAGE_RESTORED_FROM_TRASH"), "Trash",
event_type in ("LOGIN_*", "NOT_MEMBER_OF_TEAM", "LOGOUT", "OAUTH_CLIENT_*"), "Login History",
event_type );