Rules (XIF)
[MODEL: dataset = cisco_ucm_raw]
alter
src_ipv4 = coalesce(parsed_fields -> IPAddress, arrayindex(regextract(parsed_fields -> DeviceIPv4Address ,"\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}"),0), parsed_fields -> LoginFrom),
src_ipv6 = coalesce(parsed_fields -> IPV6Address, arrayindex(regextract(parsed_fields -> DeviceIPv6Address ,"[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}"),0)),
outcome = parsed_fields -> FailureDetail
| alter
xdm.event.id = to_string(arrayindex(regextract(_raw_log,"\<\d+\>(\d+):"),0)),
xdm.observer.name = parsed_fields -> NodeID,
xdm.observer.type = arrayindex(regextract(_raw_log,"%(UC.*?)-"),0),
xdm.event.type = arrayindex(regextract(_raw_log,"%UC.*?\d+-([^:]+)"),0),
xdm.target.port = to_integer(parsed_fields -> ConnectingPort),
xdm.source.ipv4 = if(is_ipv4(src_ipv4), src_ipv4, null),
xdm.source.ipv6 = if(is_ipv6(src_ipv6), src_ipv6, null),
xdm.source.interface = parsed_fields -> MACAddress,
xdm.source.host.mac_addresses = arraycreate(parsed_fields -> MACAddress),
xdm.source.user.identifier = parsed_fields -> UserID,
xdm.source.host.hostname = parsed_fields -> DeviceName,
xdm.network.application_protocol = parsed_fields -> Protocol,
xdm.event.description = arrayindex(regextract(_raw_log,"\]:(.*?)$"),0),
xdm.alert.description = coalesce(parsed_fields -> AlertDetail, parsed_fields -> Message),
xdm.source.user.username = coalesce(parsed_fields -> Description, parsed_fields -> StationDesc),
xdm.event.outcome = if(outcome != null, XDM_CONST.OUTCOME_FAILED, null),
xdm.event.outcome_reason = coalesce(to_string(parsed_fields -> Reason), to_string(parsed_fields -> FailureCause)),
xdm.source.host.device_model = coalesce(to_string(parsed_fields -> DeviceType), to_string(parsed_fields -> ModelNumber));