CiscoFirepower Modeling Rule

Details

ID	`CiscoFirepower_modeling_rule`
From Version	6.10.0
Tags	CiscoFirepower

Rules (XIF)

[MODEL: dataset="cisco_firepower_raw"]
alter 
xdm.target.port=to_integer(dpt),
xdm.source.port=to_integer(spt),
xdm.target.sent_bytes=to_integer(bytesIn),
xdm.source.sent_bytes=to_integer(bytesOut),
xdm.observer.action=act,
xdm.network.application_protocol=app,
xdm.network.rule=cs2,
xdm.source.zone=cs3,
xdm.target.zone=cs4,
xdm.alert.category=cs5,
xdm.source.ipv4=if(is_ipv4(src), src),
xdm.source.ipv6=if(is_ipv6(src), src),
xdm.target.ipv4=if(is_ipv4(dst), dst),
xdm.target.ipv6=if(is_ipv6(dst), dst),
xdm.source.user.username=suser,
xdm.target.user.username=duser,
xdm.source.process.pid=to_integer(dvcpid),
xdm.event.outcome_reason=reason,
xdm.source.application.name=requestClientApplication,
xdm.source.interface=deviceOutboundInterface,
xdm.target.interface=deviceInboundInterface,
xdm.observer.unique_identifier=deviceExternalId,
xdm.alert.severity=cefSeverity,
xdm.event.id=externalId,
xdm.network.http.url=request,
xdm.observer.name=dvchost,
xdm.event.outcome=outcome,
xdm.event.type=cefName,
xdm.observer.vendor=cefDeviceVendor,
xdm.observer.product=cefDeviceProduct,
xdm.target.file.filename=fname,
xdm.target.file.md5=fileHash,
xdm.target.file.file_type=fileType;

Schema

`cisco_firepower_raw`

Field	Type	Array?
`act`	string	—
`app`	string	—
`bytesIn`	int	—
`bytesOut`	int	—
`cefDeviceProduct`	string	—
`cefDeviceVendor`	string	—
`cefName`	string	—
`cefSeverity`	string	—
`cs2`	string	—
`cs3`	string	—
`cs4`	string	—
`cs5`	string	—
`deviceExternalId`	string	—
`deviceInboundInterface`	string	—
`deviceOutboundInterface`	string	—
`dpt`	int	—
`dst`	string	—
`duser`	string	—
`dvchost`	string	—
`dvcpid`	string	—
`externalId`	string	—
`fileHash`	string	—
`fileType`	string	—
`fname`	string	—
`outcome`	string	—
`reason`	string	—
`request`	string	—
`requestClientApplication`	string	—
`spt`	int	—
`src`	string	—
`suser`	string	—

Raw JSON

{
    "cisco_firepower_raw": {
        "dpt": {
          "type": "int",
          "is_array": false
        },
        "dst": {
          "type": "string",
          "is_array": false
        },
        "src": {
          "type": "string",
          "is_array": false
        },
        "spt": {
          "type": "int",
          "is_array": false
        },
        "act": {
          "type": "string",
          "is_array": false
        },
        "cs2": {
          "type": "string",
          "is_array": false
        },
        "cs3": {
          "type": "string",
          "is_array": false
        },
        "app": {
          "type": "string",
          "is_array": false
        },
        "cs4": {
          "type": "string",
          "is_array": false
        },
        "cs5": {
          "type": "string",
          "is_array": false
        },
        "suser": {
          "type": "string",
          "is_array": false
        },
        "duser": {
          "type": "string",
          "is_array": false
        },
        "dvcpid": {
          "type": "string",
          "is_array": false
        },
        "reason": {
          "type": "string",
          "is_array": false
        },
        "requestClientApplication": {
          "type": "string",
          "is_array": false
        },
        "deviceOutboundInterface": {
          "type": "string",
          "is_array": false
        },
        "deviceInboundInterface": {
          "type": "string",
          "is_array": false
        },
        "deviceExternalId": {
          "type": "string",
          "is_array": false
        },
        "cefSeverity": {
          "type": "string",
          "is_array": false
        },
        "externalId": {
          "type": "string",
          "is_array": false
        },
        "request": {
          "type": "string",
          "is_array": false
        },
        "dvchost": {
          "type": "string",
          "is_array": false
        },
        "outcome": {
          "type": "string",
          "is_array": false
        },
        "bytesOut": {
          "type": "int",
          "is_array": false
        },
        "bytesIn": {
          "type": "int",
          "is_array": false
        },
        "cefName": {
            "type": "string",
            "is_array": false
          },
        "cefDeviceVendor": {
            "type": "string",
            "is_array": false
          },
        "cefDeviceProduct": {
            "type": "string",
            "is_array": false
          },
        "fname": {
            "type": "string",
            "is_array": false
          },
        "fileHash": {
            "type": "string",
            "is_array": false
          },
        "fileType": {
            "type": "string",
            "is_array": false
    }
  }
}