Rules (XIF)
[MODEL: dataset = cisco_asa_raw]
alter
protocol = uppercase(_json -> generalCiscoLog.protocol),
severity = _json -> severity,
user = _json -> generalCiscoLog.user,
src_fwuser = _json -> generalCiscoLog.src_fwuser,
vpn_user = _json -> generalCiscoLog.vpn_user,
duration_h_ms = multiply(to_integer(arrayindex(regextract(_json -> generalCiscoLog.duration, "(\d+)h?:\d+m?:\d+s?"),0)), to_integer(3600000)),
duration_m_ms = multiply(to_integer(arrayindex(regextract(_json -> generalCiscoLog.duration, "\d+h?:(\d+)m?:\d+s?"),0)), to_integer(60000)),
duration_s_ms = multiply(to_integer(arrayindex(regextract(_json -> generalCiscoLog.duration, "\d+h?:\d+m?:(\d+)s?"),0)), to_integer(1000)),
operation = lowercase(_json -> generalCiscoLog.operation)
| alter
xdm.observer.action = _json -> generalCiscoLog.action,
xdm.observer.name = if(_json -> device != "", _json -> device, null),
xdm.event.type = _json -> logType,
xdm.event.log_level = if(severity = "alert", XDM_CONST.LOG_LEVEL_ALERT, severity = "critical", XDM_CONST.LOG_LEVEL_CRITICAL, severity = "error", XDM_CONST.LOG_LEVEL_ERROR, severity = "warning", XDM_CONST.LOG_LEVEL_WARNING, severity = "notification", XDM_CONST.LOG_LEVEL_NOTICE, severity = "informational", XDM_CONST.LOG_LEVEL_INFORMATIONAL, severity = "debugging", XDM_CONST.LOG_LEVEL_DEBUG, to_string(severity)),
xdm.event.description = arrayindex(regextract(_raw_log, "^(?:(?:<\d+>\d\s)|(?:<\d+>:)|(?:<\d+>))?\s?(?:.*?)\s?%(?:.*?)-(?:\D+-)?(?:\d)-(?:\w+)(?:\s|:)\s*(.*)"), 0), xdm.event.operation = if(operation contains "create", XDM_CONST.OPERATION_TYPE_CREATE, operation contains "delete" or operation contains "erase" or operation contains "remove", XDM_CONST.OPERATION_TYPE_DELETE, operation contains "update" or operation contains "modify", XDM_CONST.OPERATION_TYPE_UPDATE, operation contains "read" or operation contains "view", XDM_CONST.OPERATION_TYPE_READ, to_string(operation)),
xdm.event.outcome = if(lowercase(_json -> generalCiscoLog.outcome) contains "fail" or lowercase(_json -> generalCiscoLog.outcome) contains "reject", XDM_CONST.OUTCOME_FAILED, lowercase(_json -> generalCiscoLog.outcome) contains "succ" or lowercase(_json -> generalCiscoLog.outcome) contains "pass", XDM_CONST.OUTCOME_SUCCESS, null),
xdm.event.outcome_reason = coalesce(_json -> generalCiscoLog.reason, _json -> generalCiscoLog.error_code),
xdm.event.duration = to_integer(add(add(duration_h_ms, duration_m_ms), duration_s_ms)),
xdm.alert.severity = _json -> generalCiscoLog.threat_level,
xdm.alert.category = _json -> generalCiscoLog.threat_category,
xdm.network.icmp.type = to_integer(_json -> generalCiscoLog.icmp_type),
xdm.network.icmp.code = to_integer(_json -> generalCiscoLog.icmp_code),
xdm.network.application_protocol = _json -> generalCiscoLog.application_protocol,
xdm.network.rule = _json -> generalCiscoLog.policy_name,
xdm.network.session_id = _json -> generalCiscoLog.session_id,
xdm.network.ip_protocol = if(protocol = "HOPOPT",XDM_CONST.IP_PROTOCOL_HOPOPT, protocol = "ICMP",XDM_CONST.IP_PROTOCOL_ICMP, protocol = "IGMP",XDM_CONST.IP_PROTOCOL_IGMP, protocol = "GGP",XDM_CONST.IP_PROTOCOL_GGP, protocol = "IP",XDM_CONST.IP_PROTOCOL_IP, protocol = "ST",XDM_CONST.IP_PROTOCOL_ST, protocol = "TCP",XDM_CONST.IP_PROTOCOL_TCP, protocol = "CBT",XDM_CONST.IP_PROTOCOL_CBT, protocol = "EGP",XDM_CONST.IP_PROTOCOL_EGP, protocol = "IGP",XDM_CONST.IP_PROTOCOL_IGP, protocol = "BBN_RCC_MON",XDM_CONST.IP_PROTOCOL_BBN_RCC_MON, protocol = "NVP_II",XDM_CONST.IP_PROTOCOL_NVP_II, protocol = "PUP",XDM_CONST.IP_PROTOCOL_PUP, protocol = "ARGUS",XDM_CONST.IP_PROTOCOL_ARGUS, protocol = "EMCON",XDM_CONST.IP_PROTOCOL_EMCON, protocol = "XNET",XDM_CONST.IP_PROTOCOL_XNET, protocol = "CHAOS",XDM_CONST.IP_PROTOCOL_CHAOS, protocol = "UDP",XDM_CONST.IP_PROTOCOL_UDP, protocol = "MUX",XDM_CONST.IP_PROTOCOL_MUX, protocol = "DCN_MEAS",XDM_CONST.IP_PROTOCOL_DCN_MEAS, protocol = "HMP",XDM_CONST.IP_PROTOCOL_HMP, protocol = "PRM",XDM_CONST.IP_PROTOCOL_PRM, protocol = "XNS_IDP",XDM_CONST.IP_PROTOCOL_XNS_IDP, protocol = "TRUNK_1",XDM_CONST.IP_PROTOCOL_TRUNK_1, protocol = "TRUNK_2",XDM_CONST.IP_PROTOCOL_TRUNK_2, protocol = "LEAF_1",XDM_CONST.IP_PROTOCOL_LEAF_1, protocol = "LEAF_2",XDM_CONST.IP_PROTOCOL_LEAF_2, protocol = "RDP",XDM_CONST.IP_PROTOCOL_RDP, protocol = "IRTP",XDM_CONST.IP_PROTOCOL_IRTP, protocol = "ISO_TP4",XDM_CONST.IP_PROTOCOL_ISO_TP4, protocol = "NETBLT",XDM_CONST.IP_PROTOCOL_NETBLT, protocol = "MFE_NSP",XDM_CONST.IP_PROTOCOL_MFE_NSP, protocol = "MERIT_INP",XDM_CONST.IP_PROTOCOL_MERIT_INP, protocol = "DCCP",XDM_CONST.IP_PROTOCOL_DCCP, protocol = "3PC",XDM_CONST.IP_PROTOCOL_3PC, protocol = "IDPR",XDM_CONST.IP_PROTOCOL_IDPR, protocol = "XTP",XDM_CONST.IP_PROTOCOL_XTP, protocol = "DDP",XDM_CONST.IP_PROTOCOL_DDP, protocol = "IDPR_CMTP",XDM_CONST.IP_PROTOCOL_IDPR_CMTP, protocol = "TP",XDM_CONST.IP_PROTOCOL_TP, protocol = "IL",XDM_CONST.IP_PROTOCOL_IL, protocol = "IPV6",XDM_CONST.IP_PROTOCOL_IPV6, protocol = "SDRP",XDM_CONST.IP_PROTOCOL_SDRP, protocol = "IPV6_ROUTE",XDM_CONST.IP_PROTOCOL_IPV6_ROUTE, protocol = "IPV6_FRAG",XDM_CONST.IP_PROTOCOL_IPV6_FRAG, protocol = "IDRP",XDM_CONST.IP_PROTOCOL_IDRP, protocol = "RSVP",XDM_CONST.IP_PROTOCOL_RSVP, protocol = "GRE",XDM_CONST.IP_PROTOCOL_GRE, protocol = "DSR",XDM_CONST.IP_PROTOCOL_DSR, protocol = "BNA",XDM_CONST.IP_PROTOCOL_BNA, protocol = "ESP",XDM_CONST.IP_PROTOCOL_ESP, protocol = "AH",XDM_CONST.IP_PROTOCOL_AH, protocol = "I_NLSP",XDM_CONST.IP_PROTOCOL_I_NLSP, protocol = "SWIPE",XDM_CONST.IP_PROTOCOL_SWIPE, protocol = "NARP",XDM_CONST.IP_PROTOCOL_NARP, protocol = "MOBILE",XDM_CONST.IP_PROTOCOL_MOBILE, protocol = "TLSP",XDM_CONST.IP_PROTOCOL_TLSP, protocol = "SKIP",XDM_CONST.IP_PROTOCOL_SKIP, protocol = "IPV6_ICMP",XDM_CONST.IP_PROTOCOL_IPV6_ICMP, protocol = "IPV6_NONXT",XDM_CONST.IP_PROTOCOL_IPV6_NONXT, protocol = "IPV6_OPTS",XDM_CONST.IP_PROTOCOL_IPV6_OPTS, protocol = "CFTP",XDM_CONST.IP_PROTOCOL_CFTP, protocol = "SAT_EXPAK",XDM_CONST.IP_PROTOCOL_SAT_EXPAK, protocol = "KRYPTOLAN",XDM_CONST.IP_PROTOCOL_KRYPTOLAN, protocol = "RVD",XDM_CONST.IP_PROTOCOL_RVD, protocol = "IPPC",XDM_CONST.IP_PROTOCOL_IPPC, protocol = "SAT_MON",XDM_CONST.IP_PROTOCOL_SAT_MON, protocol = "VISA",XDM_CONST.IP_PROTOCOL_VISA, protocol = "IPCV",XDM_CONST.IP_PROTOCOL_IPCV, protocol = "CPNX",XDM_CONST.IP_PROTOCOL_CPNX, protocol = "CPHB",XDM_CONST.IP_PROTOCOL_CPHB, protocol = "WSN",XDM_CONST.IP_PROTOCOL_WSN, protocol = "PVP",XDM_CONST.IP_PROTOCOL_PVP, protocol = "BR_SAT_MON",XDM_CONST.IP_PROTOCOL_BR_SAT_MON, protocol = "SUN_ND",XDM_CONST.IP_PROTOCOL_SUN_ND, protocol = "WB_MON",XDM_CONST.IP_PROTOCOL_WB_MON, protocol = "WB_EXPAK",XDM_CONST.IP_PROTOCOL_WB_EXPAK, protocol = "ISO_IP",XDM_CONST.IP_PROTOCOL_ISO_IP, protocol = "VMTP",XDM_CONST.IP_PROTOCOL_VMTP, protocol = "SECURE_VMTP",XDM_CONST.IP_PROTOCOL_SECURE_VMTP, protocol = "VINES",XDM_CONST.IP_PROTOCOL_VINES, protocol = "TTP",XDM_CONST.IP_PROTOCOL_TTP, protocol = "NSFNET_IGP",XDM_CONST.IP_PROTOCOL_NSFNET_IGP, protocol = "DGP",XDM_CONST.IP_PROTOCOL_DGP, protocol = "TCF",XDM_CONST.IP_PROTOCOL_TCF, protocol = "EIGRP",XDM_CONST.IP_PROTOCOL_EIGRP, protocol = "OSPFIGP",XDM_CONST.IP_PROTOCOL_OSPFIGP, protocol = "SPRITE_RPC",XDM_CONST.IP_PROTOCOL_SPRITE_RPC, protocol = "LARP",XDM_CONST.IP_PROTOCOL_LARP, protocol = "MTP",XDM_CONST.IP_PROTOCOL_MTP, protocol = "AX25",XDM_CONST.IP_PROTOCOL_AX25, protocol = "IPIP",XDM_CONST.IP_PROTOCOL_IPIP, protocol = "MICP",XDM_CONST.IP_PROTOCOL_MICP, protocol = "SCC_SP",XDM_CONST.IP_PROTOCOL_SCC_SP, protocol = "ETHERIP",XDM_CONST.IP_PROTOCOL_ETHERIP, protocol = "ENCAP",XDM_CONST.IP_PROTOCOL_ENCAP, protocol = "GMTP",XDM_CONST.IP_PROTOCOL_GMTP, protocol = "IFMP",XDM_CONST.IP_PROTOCOL_IFMP, protocol = "PNNI",XDM_CONST.IP_PROTOCOL_PNNI, protocol = "PIM",XDM_CONST.IP_PROTOCOL_PIM, protocol = "ARIS",XDM_CONST.IP_PROTOCOL_ARIS, protocol = "SCPS",XDM_CONST.IP_PROTOCOL_SCPS, protocol = "QNX",XDM_CONST.IP_PROTOCOL_QNX, protocol = "AN",XDM_CONST.IP_PROTOCOL_AN, protocol = "IPCOMP",XDM_CONST.IP_PROTOCOL_IPCOMP, protocol = "COMPAQ_PEER",XDM_CONST.IP_PROTOCOL_COMPAQ_PEER, protocol = "IPX_IN_IP",XDM_CONST.IP_PROTOCOL_IPX_IN_IP, protocol = "VRRP",XDM_CONST.IP_PROTOCOL_VRRP, protocol = "PGM",XDM_CONST.IP_PROTOCOL_PGM, protocol = "L2TP",XDM_CONST.IP_PROTOCOL_L2TP, protocol = "DDX",XDM_CONST.IP_PROTOCOL_DDX, protocol = "IATP",XDM_CONST.IP_PROTOCOL_IATP, protocol = "STP",XDM_CONST.IP_PROTOCOL_STP, protocol = "SRP",XDM_CONST.IP_PROTOCOL_SRP, protocol = "UTI",XDM_CONST.IP_PROTOCOL_UTI, protocol = "SMP",XDM_CONST.IP_PROTOCOL_SMP, protocol = "SM",XDM_CONST.IP_PROTOCOL_SM, protocol = "PTP",XDM_CONST.IP_PROTOCOL_PTP, protocol = "ISIS",XDM_CONST.IP_PROTOCOL_ISIS, protocol = "FIRE",XDM_CONST.IP_PROTOCOL_FIRE, protocol = "CRTP",XDM_CONST.IP_PROTOCOL_CRTP, protocol = "CRUDP",XDM_CONST.IP_PROTOCOL_CRUDP, protocol = "SSCOPMCE",XDM_CONST.IP_PROTOCOL_SSCOPMCE, protocol = "IPLT",XDM_CONST.IP_PROTOCOL_IPLT, protocol = "SPS",XDM_CONST.IP_PROTOCOL_SPS, protocol = "PIPE",XDM_CONST.IP_PROTOCOL_PIPE, protocol = "SCTP",XDM_CONST.IP_PROTOCOL_SCTP, protocol = "FC",XDM_CONST.IP_PROTOCOL_FC, protocol = "RSVP_E2E_IGNORE",XDM_CONST.IP_PROTOCOL_RSVP_E2E_IGNORE, protocol = "MOBILITY",XDM_CONST.IP_PROTOCOL_MOBILITY, protocol = "UDPLITE",XDM_CONST.IP_PROTOCOL_UDPLITE, protocol = "MPLS_IN_IP",XDM_CONST.IP_PROTOCOL_MPLS_IN_IP, protocol = "0", XDM_CONST.IP_PROTOCOL_HOPOPT, protocol = "1", XDM_CONST.IP_PROTOCOL_ICMP, protocol = "2", XDM_CONST.IP_PROTOCOL_IGMP, protocol = "3", XDM_CONST.IP_PROTOCOL_GGP, protocol = "4", XDM_CONST.IP_PROTOCOL_IP, protocol = "5", XDM_CONST.IP_PROTOCOL_ST, protocol = "6", XDM_CONST.IP_PROTOCOL_TCP, protocol = "7", XDM_CONST.IP_PROTOCOL_CBT, protocol = "8", XDM_CONST.IP_PROTOCOL_EGP, protocol = "9", XDM_CONST.IP_PROTOCOL_IGP, protocol = "10", XDM_CONST.IP_PROTOCOL_BBN_RCC_MON, protocol = "11", XDM_CONST.IP_PROTOCOL_NVP_II, protocol = "12", XDM_CONST.IP_PROTOCOL_PUP, protocol = "13", XDM_CONST.IP_PROTOCOL_ARGUS, protocol = "14", XDM_CONST.IP_PROTOCOL_EMCON, protocol = "15", XDM_CONST.IP_PROTOCOL_XNET, protocol = "16", XDM_CONST.IP_PROTOCOL_CHAOS, protocol = "17", XDM_CONST.IP_PROTOCOL_UDP, protocol = "18", XDM_CONST.IP_PROTOCOL_MUX, protocol = "19", XDM_CONST.IP_PROTOCOL_DCN_MEAS, protocol = "20", XDM_CONST.IP_PROTOCOL_HMP, protocol = "21", XDM_CONST.IP_PROTOCOL_PRM, protocol = "22", XDM_CONST.IP_PROTOCOL_XNS_IDP, protocol = "23", XDM_CONST.IP_PROTOCOL_TRUNK_1, protocol = "24", XDM_CONST.IP_PROTOCOL_TRUNK_2, protocol = "25", XDM_CONST.IP_PROTOCOL_LEAF_1, protocol = "26", XDM_CONST.IP_PROTOCOL_LEAF_2, protocol = "27", XDM_CONST.IP_PROTOCOL_RDP, protocol = "28", XDM_CONST.IP_PROTOCOL_IRTP, protocol = "29", XDM_CONST.IP_PROTOCOL_ISO_TP4, protocol = "30", XDM_CONST.IP_PROTOCOL_NETBLT, protocol = "31", XDM_CONST.IP_PROTOCOL_MFE_NSP, protocol = "32", XDM_CONST.IP_PROTOCOL_MERIT_INP, protocol = "33", XDM_CONST.IP_PROTOCOL_DCCP, protocol = "34", XDM_CONST.IP_PROTOCOL_3PC, protocol = "35", XDM_CONST.IP_PROTOCOL_IDPR, protocol = "36", XDM_CONST.IP_PROTOCOL_XTP, protocol = "37", XDM_CONST.IP_PROTOCOL_DDP, protocol = "38", XDM_CONST.IP_PROTOCOL_IDPR_CMTP, protocol = "39", XDM_CONST.IP_PROTOCOL_TP, protocol = "40", XDM_CONST.IP_PROTOCOL_IL, protocol = "41", XDM_CONST.IP_PROTOCOL_IPV6, protocol = "42", XDM_CONST.IP_PROTOCOL_SDRP, protocol = "43", XDM_CONST.IP_PROTOCOL_IPV6_ROUTE, protocol = "44", XDM_CONST.IP_PROTOCOL_IPV6_FRAG, protocol = "45", XDM_CONST.IP_PROTOCOL_IDRP, protocol = "46", XDM_CONST.IP_PROTOCOL_RSVP, protocol = "47", XDM_CONST.IP_PROTOCOL_GRE, protocol = "48", XDM_CONST.IP_PROTOCOL_DSR, protocol = "49", XDM_CONST.IP_PROTOCOL_BNA, protocol = "50", XDM_CONST.IP_PROTOCOL_ESP, protocol = "51", XDM_CONST.IP_PROTOCOL_AH, protocol = "52", XDM_CONST.IP_PROTOCOL_I_NLSP, protocol = "53", XDM_CONST.IP_PROTOCOL_SWIPE, protocol = "54", XDM_CONST.IP_PROTOCOL_NARP, protocol = "55", XDM_CONST.IP_PROTOCOL_MOBILE, protocol = "56", XDM_CONST.IP_PROTOCOL_TLSP, protocol = "57", XDM_CONST.IP_PROTOCOL_SKIP, protocol = "58", XDM_CONST.IP_PROTOCOL_IPV6_ICMP, protocol = "59", XDM_CONST.IP_PROTOCOL_IPV6_NONXT, protocol = "60", XDM_CONST.IP_PROTOCOL_IPV6_OPTS, protocol = "62", XDM_CONST.IP_PROTOCOL_CFTP, protocol = "64", XDM_CONST.IP_PROTOCOL_SAT_EXPAK, protocol = "65", XDM_CONST.IP_PROTOCOL_KRYPTOLAN, protocol = "66", XDM_CONST.IP_PROTOCOL_RVD, protocol = "67", XDM_CONST.IP_PROTOCOL_IPPC, protocol = "69", XDM_CONST.IP_PROTOCOL_SAT_MON, protocol = "70", XDM_CONST.IP_PROTOCOL_VISA, protocol = "71", XDM_CONST.IP_PROTOCOL_IPCV, protocol = "72", XDM_CONST.IP_PROTOCOL_CPNX, protocol = "73", XDM_CONST.IP_PROTOCOL_CPHB, protocol = "74", XDM_CONST.IP_PROTOCOL_WSN, protocol = "75", XDM_CONST.IP_PROTOCOL_PVP, protocol = "76", XDM_CONST.IP_PROTOCOL_BR_SAT_MON, protocol = "77", XDM_CONST.IP_PROTOCOL_SUN_ND, protocol = "78", XDM_CONST.IP_PROTOCOL_WB_MON, protocol = "79", XDM_CONST.IP_PROTOCOL_WB_EXPAK, protocol = "80", XDM_CONST.IP_PROTOCOL_ISO_IP, protocol = "81", XDM_CONST.IP_PROTOCOL_VMTP, protocol = "82", XDM_CONST.IP_PROTOCOL_SECURE_VMTP, protocol = "83", XDM_CONST.IP_PROTOCOL_VINES, protocol = "84", XDM_CONST.IP_PROTOCOL_TTP, protocol = "85", XDM_CONST.IP_PROTOCOL_NSFNET_IGP, protocol = "86", XDM_CONST.IP_PROTOCOL_DGP, protocol = "87", XDM_CONST.IP_PROTOCOL_TCF, protocol = "88", XDM_CONST.IP_PROTOCOL_EIGRP, protocol = "89", XDM_CONST.IP_PROTOCOL_OSPFIGP, protocol = "90", XDM_CONST.IP_PROTOCOL_SPRITE_RPC, protocol = "91", XDM_CONST.IP_PROTOCOL_LARP, protocol = "92", XDM_CONST.IP_PROTOCOL_MTP, protocol = "93", XDM_CONST.IP_PROTOCOL_AX25, protocol = "94", XDM_CONST.IP_PROTOCOL_IPIP, protocol = "95", XDM_CONST.IP_PROTOCOL_MICP, protocol = "96", XDM_CONST.IP_PROTOCOL_SCC_SP, protocol = "97", XDM_CONST.IP_PROTOCOL_ETHERIP, protocol = "98", XDM_CONST.IP_PROTOCOL_ENCAP, protocol = "100", XDM_CONST.IP_PROTOCOL_GMTP, protocol = "101", XDM_CONST.IP_PROTOCOL_IFMP, protocol = "102", XDM_CONST.IP_PROTOCOL_PNNI, protocol = "103", XDM_CONST.IP_PROTOCOL_PIM, protocol = "104", XDM_CONST.IP_PROTOCOL_ARIS, protocol = "105", XDM_CONST.IP_PROTOCOL_SCPS, protocol = "106", XDM_CONST.IP_PROTOCOL_QNX, protocol = "107", XDM_CONST.IP_PROTOCOL_AN, protocol = "108", XDM_CONST.IP_PROTOCOL_IPCOMP, protocol = "110", XDM_CONST.IP_PROTOCOL_COMPAQ_PEER, protocol = "111", XDM_CONST.IP_PROTOCOL_IPX_IN_IP, protocol = "112", XDM_CONST.IP_PROTOCOL_VRRP, protocol = "113", XDM_CONST.IP_PROTOCOL_PGM, protocol = "115", XDM_CONST.IP_PROTOCOL_L2TP, protocol = "116", XDM_CONST.IP_PROTOCOL_DDX, protocol = "117", XDM_CONST.IP_PROTOCOL_IATP, protocol = "118", XDM_CONST.IP_PROTOCOL_STP, protocol = "119", XDM_CONST.IP_PROTOCOL_SRP, protocol = "120", XDM_CONST.IP_PROTOCOL_UTI, protocol = "121", XDM_CONST.IP_PROTOCOL_SMP, protocol = "122", XDM_CONST.IP_PROTOCOL_SM, protocol = "123", XDM_CONST.IP_PROTOCOL_PTP, protocol = "124", XDM_CONST.IP_PROTOCOL_ISIS, protocol = "125", XDM_CONST.IP_PROTOCOL_FIRE, protocol = "126", XDM_CONST.IP_PROTOCOL_CRTP, protocol = "127", XDM_CONST.IP_PROTOCOL_CRUDP, protocol = "128", XDM_CONST.IP_PROTOCOL_SSCOPMCE, protocol = "129", XDM_CONST.IP_PROTOCOL_IPLT, protocol = "130", XDM_CONST.IP_PROTOCOL_SPS, protocol = "131", XDM_CONST.IP_PROTOCOL_PIPE, protocol = "132", XDM_CONST.IP_PROTOCOL_SCTP, protocol = "133", XDM_CONST.IP_PROTOCOL_FC, protocol = "134", XDM_CONST.IP_PROTOCOL_RSVP_E2E_IGNORE, protocol = "135", XDM_CONST.IP_PROTOCOL_MOBILITY, protocol = "136", XDM_CONST.IP_PROTOCOL_UDPLITE, protocol = "137", XDM_CONST.IP_PROTOCOL_MPLS_IN_IP, to_string(protocol)),
xdm.source.ipv4 = if(is_ipv4(_json -> generalCiscoLog.src_ip), _json -> generalCiscoLog.src_ip, null),
xdm.source.ipv6 = if(is_ipv6(_json -> generalCiscoLog.src_ip), _json -> generalCiscoLog.src_ip, null),
xdm.source.port = to_integer(_json -> generalCiscoLog.src_port),
xdm.source.interface = _json -> generalCiscoLog.src_interface,
xdm.source.host.mac_addresses = arraycreate(_json -> generalCiscoLog.src_mac_address),
xdm.source.user.username = coalesce(user, src_fwuser, vpn_user),
xdm.source.user.groups = arraycreate(_json -> generalCiscoLog.group),
xdm.source.process.name = _json -> generalCiscoLog.process,
xdm.source.process.command_line = _json -> generalCiscoLog.command,
xdm.source.sent_bytes = to_integer(_json -> generalCiscoLog.sent_bytes),
xdm.source.application.name = _json -> generalCiscoLog.application,
xdm.intermediate.ipv4 = if(is_ipv4(_json -> generalCiscoLog.global_ip), _json -> generalCiscoLog.global_ip, null),
xdm.intermediate.ipv6 = if(is_ipv6(_json -> generalCiscoLog.global_ip), _json -> generalCiscoLog.global_ip, null),
xdm.intermediate.port = to_integer(_json -> generalCiscoLog.global_port),
xdm.target.host.hostname = _json -> generalCiscoLog.destination_hostname,
xdm.target.ipv4 = if(is_ipv4(_json -> generalCiscoLog.dst_ip), _json -> generalCiscoLog.dst_ip, null),
xdm.target.ipv6 = if(is_ipv6(_json -> generalCiscoLog.dst_ip), _json -> generalCiscoLog.dst_ip, null),
xdm.target.port = to_integer(_json -> generalCiscoLog.dst_port),
xdm.target.interface = _json -> generalCiscoLog.dst_interface,
xdm.target.host.mac_addresses = arraycreate(_json -> generalCiscoLog.dst_mac_address),
xdm.target.url = _json -> generalCiscoLog.url,
xdm.target.user.username = _json -> generalCiscoLog.dst_fwuser,
xdm.target.sent_bytes = to_integer(_json -> generalCiscoLog.received_bytes),
xdm.target.domain = _json -> generalCiscoLog.domain,
xdm.target.file.filename = _json -> generalCiscoLog.file,
xdm.target.file.directory = _json -> generalCiscoLog.directory;