Rules (XIF)
[MODEL: dataset="Cisco_SMA_raw", model=Audit]
filter _raw_log contains "system_logs" or _raw_log contains "ftpd_logs" or _raw_log contains "euqgui_logs: Info:"or _raw_log contains"euqgui_logs: Info: login:" and _raw_log not contains "euqgui_logs: Info: logout:" or _raw_log contains "audit_logs" and _raw_log not contains "Event: User logged out" and _raw_log not contains "Event: User input was" and _raw_log not contains "Event: Successful login" and _raw_log not contains "Event: Permission denied" and _raw_log not contains "Event: User visited the web page"
| alter date= arrayindex(regextract(_raw_log ,"(\w+\s\d+)") ,0)
| alter time= arrayindex(regextract(_raw_log ,"\s(\d+\:\d+\:\d+)") ,0)
| alter Timestamp= concat (date, " ",time)
| alter Message = arrayindex(regextract(_raw_log ,"\w+\s\d+\s\d+\:\d+\:\d+\s\w+\:\s[A-Z]\w+\:([^\>?\)]+)") ,0)
| alter log_category= arrayindex(regextract(_raw_log ,"\w+\s\d+\s\d+\:\d+\:\d+\s(\w+)") ,0)
| alter Username1= arrayindex(regextract(_raw_log ,"U?u?ser\s?\:?\s([^\s?\,]+)") ,0)
| alter username2 = arrayindex(regextract(_raw_log ,"login\S+\suser\:([^\s]+)") ,0)
| alter username = coalesce(Username1,username2)
| alter session= arrayindex(regextract(_raw_log ,"ID:(\d+)") ,0)
| alter Filename= arrayindex(regextract(_raw_log ,"(\S+)\s\d+\sbytes") ,0)
| alter source_ip1= arrayindex(regextract(_raw_log ,"from\s(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})") ,0)
| alter source_ip2= arrayindex(regextract(_raw_log ,"Source\sIP\:\s(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})") ,0)
| alter sourceip = coalesce(source_ip2, source_ip1 )
| alter appliance= arrayindex(regextract(_raw_log ,"Appliance:\s([^\,]+)") ,0)
| alter location= arrayindex(regextract(_raw_log ,"Location\:\s([^\,]+)") ,0)
| alter event_id= arrayindex(regextract(_raw_log ,"Event\:\s([^\.]+)") ,0)
| alter XDM.Audit.observation_timestamp=parse_timestamp("%h %e %T",Timestamp)
| alter XDM.Audit.original_event_description= Message
| alter XDM.Audit.original_event_type = log_category
| alter XDM.Audit.TriggeredBy.identity.name= Username
| alter XDM.Audit.identity.uuid = Session
| alter XDM.Audit.audited_resource.name= Filename
| alter XDM.Audit.TriggeredBy.ipv4= sourceip
| alter XDM.Audit.audited_resource.name= appliance
| alter XDM.Audit.audited_resource.value=location
| alter XDM.Audit.original_event_type =event_id;
[MODEL: dataset="Cisco_SMA_raw", model=Auth]
filter _raw_log contains "cli_logs" or _raw_log contains "Event: User logged out" or _raw_log contains "Event: User input was" or _raw_log contains "Event: Successful login" or _raw_log contains "Event: Permission denied" or _raw_log contains "Event: User visited the web page"
or _raw_log contains "euqgui_logs: Info: login:" or _raw_log contains "euqgui_logs: Info: logout:"
| alter date= arrayindex(regextract(_raw_log ,"(\w+\s\d+)") ,0)
| alter time= arrayindex(regextract(_raw_log ,"\s(\d+\:\d+\:\d+)") ,0)
| alter Timestamp= concat (date, " ",time)
| alter Message1 = arrayindex(regextract(_raw_log ,"PID\s\d+\:\s([^\@]+)") ,0)
| alter Message2 = arrayindex(regextract(_raw_log ,"\w+\s\d+\s\d+\:\d+\:\d+\s\w+\:\s[A-Z]\w+\:([^\!]+)") ,0)
| alter Message = coalesce(Message1,Message2)
| alter log_category= arrayindex(regextract(_raw_log ,"\w+\s\d+\s\d+\:\d+\:\d+\s(\w+)") ,0)
| alter Username1= arrayindex(regextract(_raw_log ,"U?u?ser\s?\:?\s([^\s?\,]+)") ,0)
| alter username2 = arrayindex(regextract(_raw_log ,"login\S+\suser\:([^\s]+)") ,0)
| alter username = coalesce(Username1,username2)
| alter Process_id= arrayindex(regextract(_raw_log ,"PID\s(\d+)") ,0)
| alter Command= arrayindex(regextract(_raw_log ,"command:\s\'?([^\'?\"]+)") ,0)
| alter destination_ip = arrayindex(regextract(_raw_log ,"on\s(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})") ,0)
| alter source_ip1= arrayindex(regextract(_raw_log ,"from\s(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})") ,0)
| alter source_ip2= arrayindex(regextract(_raw_log ,"Source\sIP\:\s(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})") ,0)
| alter sourceip = coalesce(source_ip2, source_ip1 )
| alter appliance= arrayindex(regextract(_raw_log ,"Appliance:\s([^\,]+)") ,0)
| alter location= arrayindex(regextract(_raw_log ,"Location\:\s([^\,]+)") ,0)
| alter event_id= arrayindex(regextract(_raw_log ,"Event\:\s([^\.]+)") ,0)
| alter XDM.Auth.observation_timestamp =parse_timestamp("%h %e %T",Timestamp)
| alter XDM.Auth.original_event_description = Message
| alter XDM.Auth.original_event_type = log_category
| alter XDM.Auth.Client.user.username= Username
| alter XDM.Auth.Client.process.pid= to_number(Process_id)
| alter XDM.Auth.Server.process.command_line= command
| alter XDM.Auth.Client.host.ipv4_addresses = arraycreate(coalesce(destination_ip, ""))
| alter XDM.Auth.Client.ipv4 = Sourceip
| alter XDM.Auth.Observer.product= appliance
| alter XDM.Auth.Server.process.executable.path= location
| alter XDM.Auth.original_event_id= event_id;
[MODEL: dataset="Cisco_SMA_raw", model=Email]
filter _raw_log contains "mail_logs"
| alter date= arrayindex(regextract(_raw_log ,"(\w+\s\d+)") ,0)
| alter time= arrayindex(regextract(_raw_log ,"\s(\d+\:\d+\:\d+)") ,0)
| alter Timestamp= concat (date, " ",time)
| alter Message= arrayindex(regextract(_raw_log ,"mail\_logs\:\s[A-Z][^\s]+([^\!]+)") ,0)
| alter log_category= arrayindex(regextract(_raw_log ,"\w+\s\d+\s\d+\:\d+\:\d+\s(\w+)") ,0)
| alter Source_ip= arrayindex(regextract(_raw_log ,"(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})") ,0)
| alter Message_ID= arrayindex(regextract(_raw_log ,"Message\-ID\s\'?\<([^\>]+)") ,0)
| alter Subject= arrayindex(regextract(_raw_log ,"Subject\s([^\s]+)") ,0)
| alter hostname1 = arrayindex(regextract(_raw_log ,"Hostname\=([^\]]+)") ,0)
| alter hostname2= arrayindex(regextract(_raw_log ,"\shost\s([^\s]+)"),0)
| alter Hostname = coalesce(hostname1,hostname2)
| alter InternalId= arrayindex(regextract(_raw_log ,"InternalId\=(\d+)") ,0)
| alter sender1= arrayindex(regextract(_raw_log ,"mailfrom\s\S+\s([^\s]+)") ,0)
| alter sender2= arrayindex(regextract(_raw_log ,"bytes\sfrom\s\<?([^\"\>?]+)") ,0)
| alter sender3= arrayindex(regextract(_raw_log ,"Response\s\S+\s([^\s]+)") ,0)
| alter sender4= arrayindex(regextract(_raw_log ,"Message\-ID\s([^\']+)") ,0)
| alter sender5= arrayindex(regextract(_raw_log ,"\'from\'\,\s([^\s]+)") ,0)
| alter sender6= arrayindex(regextract(_raw_log ,"\'from\'\,\s\'([^\>]+)") ,0)
| alter sender = coalesce(sender1,sender2,sender3,sender4,sender5,sender6)
| alter verified= arrayindex(regextract(_raw_log ,"verified\s(\w+)") ,0)
| alter Mailer_Identifier = arrayindex(regextract(_raw_log ,"MID\s(\d+)") ,0)
| alter reciver1 = arrayindex(regextract(_raw_log ,"to\'?\,\s([^\%]+)") ,0)
| alter reciver2= arrayindex(regextract(_raw_log ,"To\:\s\<?([^\s\>?]+)") ,0)
| alter reciver3= arrayindex(regextract(_raw_log ,"\'to\'\,\s\'([^\>?\']+)") ,0)
| alter reciver = coalesce(reciver1,reciver2,reciver3)
| alter protocol = arrayindex(regextract(_raw_log ,"New\s(\w+)") ,0)
| alter attachment = arrayindex(regextract(_raw_log ,"attachment\s\'?([^\']+)") ,0)
| alter signature_status= arrayindex(regextract(_raw_log ,"(\w+)\s\(v\=") ,0)
| alter XDM.Email.observation_timestamp=parse_timestamp("%h %e %T",Timestamp)
,XDM.Email.original_event_description=Message
, XDM.Email.original_event_type= log_category
,XDM.Email.subject= Subject
, XDM.Email.Client.host.ipv4_addresses = arraycreate(coalesce(Source_ip, ""))
, XDM.Email.message_id = Message_ID
, XDM.Email.Server.host.hostname =Hostname
, XDM.Email.Observer.unique_identifier = InternalId
, XDM.Email.application_protocol = protocol
, XDM.Email.sender= sender
, XDM.Email.recipients = arraycreate(coalesce(reciver, ""))
, XDM.Email.attachment.is_signed = to_boolean(verified)
, XDM.Email.attachment.signature_status= signature_status
, XDM.Email.attachment.filename = attachment
, XDM.Email.session_context_id = Mailer_Identifier;
[MODEL: dataset="Cisco_SMA_raw", model=Network]
filter _raw_log contains "gui_logs: Info: req:" or _raw_log contains "euqgui_logs: Info: req:"
| alter date= arrayindex(regextract(_raw_log ,"(\w+\s\d+)") ,0)
| alter time= arrayindex(regextract(_raw_log ,"\s(\d+\:\d+\:\d+)") ,0)
| alter Timestamp= concat (date, " ",time)
| alter Message= arrayindex(regextract(_raw_log ,"I?i?nfo\:\s([^\!]+)") ,0)
| alter log_category= arrayindex(regextract(_raw_log ,"\w+\s\d+\s\d+\:\d+\:\d+\s(\w+)") ,0)
| alter Username= arrayindex(regextract(_raw_log ,"U?u?ser\s?\:?([^\s]+)") ,0)
| alter source_ip = arrayindex(regextract(_raw_log ,"req\:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})") ,0)
| alter id= arrayindex(regextract(_raw_log ,"id\:(\S+)") ,0)
| alter http_status_code= arrayindex(regextract(_raw_log ,"id\:\S+\s(\d+)") ,0)
| alter http_method= arrayindex(regextract(_raw_log ,"id\:\S+\s\d+\s(\w+)") ,0)
| alter URI= arrayindex(regextract(_raw_log ,"id\:\S+\s\d+\s\w+\s(\S+)") ,0)
| alter http_version= arrayindex(regextract(_raw_log ,"id\:\S+\s\d+\s\w+\s\S+\s([^\s]+)") ,0)
| alter user_agent= arrayindex(regextract(_raw_log ,"id\:\S+\s\d+\s\w+\s\S+\s[^\s]+\s([^\!]+)") ,0)
| alter XDM.Network.observation_timestamp=parse_timestamp("%h %e %T",Timestamp)
| alter XDM.Network.original_event_description= Message
| alter XDM.Network.original_event_type= log_category
| alter XDM.Network.Source.user.username = Username
| alter XDM.Network.Source.ipv4 = source_ip
| alter XDM.Network.session_id = id
| alter XDM.Network.http.response_code= http_status_code
| alter XDM.Network.http.method= http_method
| alter XDM.Network.http.url = URI
| alter XDM.Network.Observer.version= http_version
| alter XDM.Network.http.user_agent= user_agent;