Rules (XIF)
[MODEL: dataset ="lancope_stealthwatch_raw"]
alter
proto_string = to_string(proto)
| alter
xdm.source.ipv4 = if(src ~= "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}", src, null),
xdm.source.ipv6 = if(src ~= "[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}", src, null),
xdm.target.ipv4 = if(dst ~= "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}", dst, null),
xdm.target.ipv6 = if(dst ~= "[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}", dst, null),
xdm.target.port = to_integer(dstPort),
xdm.alert.name = eventName,
xdm.alert.description = concat(msg, " ", fullmessage),
xdm.alert.original_alert_id = alarmID,
xdm.alert.severity = alarmSev,
xdm.source.user.username = sourceUser,
xdm.target.user.username = targetUser,
xdm.target.host.hostname = targetHostname,
xdm.target.domain = domain,
xdm.network.ip_protocol = if(proto_string="0",XDM_CONST.IP_PROTOCOL_HOPOPT, proto_string="1",XDM_CONST.IP_PROTOCOL_ICMP, proto_string="2",XDM_CONST.IP_PROTOCOL_IGMP, proto_string="3",XDM_CONST.IP_PROTOCOL_GGP, proto_string="4",XDM_CONST.IP_PROTOCOL_IP, proto_string="5",XDM_CONST.IP_PROTOCOL_ST, proto_string="6",XDM_CONST.IP_PROTOCOL_TCP, proto_string="7",XDM_CONST.IP_PROTOCOL_CBT, proto_string="8",XDM_CONST.IP_PROTOCOL_EGP, proto_string="9",XDM_CONST.IP_PROTOCOL_IGP, proto_string="10",XDM_CONST.IP_PROTOCOL_BBN_RCC_MON, proto_string="11",XDM_CONST.IP_PROTOCOL_NVP_II, proto_string="12",XDM_CONST.IP_PROTOCOL_PUP, proto_string="13",XDM_CONST.IP_PROTOCOL_ARGUS, proto_string="14",XDM_CONST.IP_PROTOCOL_EMCON, proto_string="15",XDM_CONST.IP_PROTOCOL_XNET, proto_string="16",XDM_CONST.IP_PROTOCOL_CHAOS, proto_string="17",XDM_CONST.IP_PROTOCOL_UDP, proto_string="18",XDM_CONST.IP_PROTOCOL_MUX, proto_string="19",XDM_CONST.IP_PROTOCOL_DCN_MEAS, proto_string="20",XDM_CONST.IP_PROTOCOL_HMP, proto_string="21",XDM_CONST.IP_PROTOCOL_PRM, proto_string="22",XDM_CONST.IP_PROTOCOL_XNS_IDP, proto_string="23",XDM_CONST.IP_PROTOCOL_TRUNK_1, proto_string="24",XDM_CONST.IP_PROTOCOL_TRUNK_2, proto_string="25",XDM_CONST.IP_PROTOCOL_LEAF_1, proto_string="26",XDM_CONST.IP_PROTOCOL_LEAF_2, proto_string="27",XDM_CONST.IP_PROTOCOL_RDP, proto_string="28",XDM_CONST.IP_PROTOCOL_IRTP, proto_string="29",XDM_CONST.IP_PROTOCOL_ISO_TP4, proto_string="30",XDM_CONST.IP_PROTOCOL_NETBLT, proto_string="31",XDM_CONST.IP_PROTOCOL_MFE_NSP, proto_string="32",XDM_CONST.IP_PROTOCOL_MERIT_INP, proto_string="33",XDM_CONST.IP_PROTOCOL_DCCP, proto_string="34",XDM_CONST.IP_PROTOCOL_3PC, proto_string="35",XDM_CONST.IP_PROTOCOL_IDPR, proto_string="36",XDM_CONST.IP_PROTOCOL_XTP, proto_string="37",XDM_CONST.IP_PROTOCOL_DDP, proto_string="38",XDM_CONST.IP_PROTOCOL_IDPR_CMTP, proto_string="39",XDM_CONST.IP_PROTOCOL_TP, proto_string="40",XDM_CONST.IP_PROTOCOL_IL, proto_string="41",XDM_CONST.IP_PROTOCOL_IPV6, proto_string="42",XDM_CONST.IP_PROTOCOL_SDRP, proto_string="43",XDM_CONST.IP_PROTOCOL_IPV6_ROUTE, proto_string="44",XDM_CONST.IP_PROTOCOL_IPV6_FRAG, proto_string="45",XDM_CONST.IP_PROTOCOL_IDRP, proto_string="46",XDM_CONST.IP_PROTOCOL_RSVP, proto_string="47",XDM_CONST.IP_PROTOCOL_GRE, proto_string="48",XDM_CONST.IP_PROTOCOL_DSR, proto_string="49",XDM_CONST.IP_PROTOCOL_BNA, proto_string="50",XDM_CONST.IP_PROTOCOL_ESP, proto_string="51",XDM_CONST.IP_PROTOCOL_AH, proto_string="52",XDM_CONST.IP_PROTOCOL_I_NLSP, proto_string="53",XDM_CONST.IP_PROTOCOL_SWIPE, proto_string="54",XDM_CONST.IP_PROTOCOL_NARP, proto_string="55",XDM_CONST.IP_PROTOCOL_MOBILE, proto_string="56",XDM_CONST.IP_PROTOCOL_TLSP, proto_string="57",XDM_CONST.IP_PROTOCOL_SKIP, proto_string="58",XDM_CONST.IP_PROTOCOL_IPV6_ICMP, proto_string="59",XDM_CONST.IP_PROTOCOL_IPV6_NONXT, proto_string="60",XDM_CONST.IP_PROTOCOL_IPV6_OPTS, proto_string="62",XDM_CONST.IP_PROTOCOL_CFTP, proto_string="64",XDM_CONST.IP_PROTOCOL_SAT_EXPAK, proto_string="65",XDM_CONST.IP_PROTOCOL_KRYPTOLAN, proto_string="66",XDM_CONST.IP_PROTOCOL_RVD, proto_string="67",XDM_CONST.IP_PROTOCOL_IPPC, proto_string="69",XDM_CONST.IP_PROTOCOL_SAT_MON, proto_string="70",XDM_CONST.IP_PROTOCOL_VISA, proto_string="71",XDM_CONST.IP_PROTOCOL_IPCV, proto_string="72",XDM_CONST.IP_PROTOCOL_CPNX, proto_string="73",XDM_CONST.IP_PROTOCOL_CPHB, proto_string="74",XDM_CONST.IP_PROTOCOL_WSN, proto_string="75",XDM_CONST.IP_PROTOCOL_PVP, proto_string="76",XDM_CONST.IP_PROTOCOL_BR_SAT_MON, proto_string="77",XDM_CONST.IP_PROTOCOL_SUN_ND, proto_string="78",XDM_CONST.IP_PROTOCOL_WB_MON, proto_string="79",XDM_CONST.IP_PROTOCOL_WB_EXPAK, proto_string="80",XDM_CONST.IP_PROTOCOL_ISO_IP, proto_string="81",XDM_CONST.IP_PROTOCOL_VMTP, proto_string="82",XDM_CONST.IP_PROTOCOL_SECURE_VMTP, proto_string="83",XDM_CONST.IP_PROTOCOL_VINES, proto_string="84",XDM_CONST.IP_PROTOCOL_TTP, proto_string="85",XDM_CONST.IP_PROTOCOL_NSFNET_IGP, proto_string="86",XDM_CONST.IP_PROTOCOL_DGP, proto_string="87",XDM_CONST.IP_PROTOCOL_TCF, proto_string="88",XDM_CONST.IP_PROTOCOL_EIGRP, proto_string="89",XDM_CONST.IP_PROTOCOL_OSPFIGP, proto_string="90",XDM_CONST.IP_PROTOCOL_SPRITE_RPC, proto_string="91",XDM_CONST.IP_PROTOCOL_LARP, proto_string="92",XDM_CONST.IP_PROTOCOL_MTP, proto_string="93",XDM_CONST.IP_PROTOCOL_AX25, proto_string="94",XDM_CONST.IP_PROTOCOL_IPIP, proto_string="95",XDM_CONST.IP_PROTOCOL_MICP, proto_string="96",XDM_CONST.IP_PROTOCOL_SCC_SP, proto_string="97",XDM_CONST.IP_PROTOCOL_ETHERIP, proto_string="98",XDM_CONST.IP_PROTOCOL_ENCAP, proto_string="100",XDM_CONST.IP_PROTOCOL_GMTP, proto_string="101",XDM_CONST.IP_PROTOCOL_IFMP, proto_string="102",XDM_CONST.IP_PROTOCOL_PNNI, proto_string="103",XDM_CONST.IP_PROTOCOL_PIM, proto_string="104",XDM_CONST.IP_PROTOCOL_ARIS, proto_string="105",XDM_CONST.IP_PROTOCOL_SCPS, proto_string="106",XDM_CONST.IP_PROTOCOL_QNX, proto_string="107",XDM_CONST.IP_PROTOCOL_AN, proto_string="108",XDM_CONST.IP_PROTOCOL_IPCOMP, proto_string="110",XDM_CONST.IP_PROTOCOL_COMPAQ_PEER, proto_string="111",XDM_CONST.IP_PROTOCOL_IPX_IN_IP, proto_string="112",XDM_CONST.IP_PROTOCOL_VRRP, proto_string="113",XDM_CONST.IP_PROTOCOL_PGM, proto_string="115",XDM_CONST.IP_PROTOCOL_L2TP, proto_string="116",XDM_CONST.IP_PROTOCOL_DDX, proto_string="117",XDM_CONST.IP_PROTOCOL_IATP, proto_string="118",XDM_CONST.IP_PROTOCOL_STP, proto_string="119",XDM_CONST.IP_PROTOCOL_SRP, proto_string="120",XDM_CONST.IP_PROTOCOL_UTI, proto_string="121",XDM_CONST.IP_PROTOCOL_SMP, proto_string="122",XDM_CONST.IP_PROTOCOL_SM, proto_string="123",XDM_CONST.IP_PROTOCOL_PTP, proto_string="124",XDM_CONST.IP_PROTOCOL_ISIS, proto_string="125",XDM_CONST.IP_PROTOCOL_FIRE, proto_string="126",XDM_CONST.IP_PROTOCOL_CRTP, proto_string="127",XDM_CONST.IP_PROTOCOL_CRUDP, proto_string="128",XDM_CONST.IP_PROTOCOL_SSCOPMCE, proto_string="129",XDM_CONST.IP_PROTOCOL_IPLT, proto_string="130",XDM_CONST.IP_PROTOCOL_SPS, proto_string="131",XDM_CONST.IP_PROTOCOL_PIPE, proto_string="132",XDM_CONST.IP_PROTOCOL_SCTP, proto_string="133",XDM_CONST.IP_PROTOCOL_FC, proto_string="134",XDM_CONST.IP_PROTOCOL_RSVP_E2E_IGNORE, proto_string="135",XDM_CONST.IP_PROTOCOL_MOBILITY, proto_string="136",XDM_CONST.IP_PROTOCOL_UDPLITE, proto_string="137",XDM_CONST.IP_PROTOCOL_MPLS_IN_IP, proto_string);