Cisco AppDynamics Modeling Rule

Details

ID	`Cisco_AppDynamics_ModelingRule`
From Version	8.15.0

Schema

`cisco_appdynamics_raw`

Field	Type	Array?
`action`	string	—
`applicationName`	string	—
`changes`	string	—
`description`	string	—
`objectId`	int	—
`objectName`	string	—
`objectType`	string	—
`securityProviderType`	string	—
`userName`	string	—

Source

CiscoAppDynamics_2_11.xif CiscoAppDynamics_2_11.yml CiscoAppDynamics_2_11_schema.json

Download History Raw

[MODEL: dataset=cisco_appdynamics_raw]
alter
    xdm.target.resource.id = to_string(objectId),
    xdm.target.resource.value = changes,
	xdm.source.user.username = userName,
	xdm.source.identity.username = userName,
	xdm.target.resource.name = objectName,
	xdm.target.resource.type = objectType,
	xdm.event.description = description,
	xdm.target.application.name = applicationName,
	xdm.observer.type = securityProviderType,
	xdm.event.outcome_reason = action,
	xdm.event.outcome = if(action ~= "LOGIN_FAILED|LOGOUT_FAILED", XDM_CONST.OUTCOME_FAILED, XDM_CONST.OUTCOME_SUCCESS);