Rules (XIF)
[MODEL: dataset = "citrix_adc_raw"]
alter
http_method = arrayindex(regextract(_raw_log,"\s\:\s(\w+)\s\/"),0),
feature = arrayindex(regextract(_raw_log,"\:\s\w+\s(\w+)\s"),0),
message_type = arrayindex(regextract(_raw_log,"\:\s\w+\s\w+\s(\w+)\s"),0),
Status = lowercase(arrayindex(regextract(_raw_log,"Status\s\"(\w+)\""),0)),
message_type_lower = lowercase(arrayindex(regextract(_raw_log,"\:\s\w+\s\w+\s(\w+)\s"),0))
| alter
xdm.observer.name = arrayindex(regextract(_raw_log,"(\S+)\s\S+-\S+-\S+\s:"),0),
xdm.event.type = concat(feature, " - ", message_type),
xdm.event.id = arrayindex(regextract(_raw_log,"\:\s\w+\s\w+\s\w+\s(\d+)\s"),0),
xdm.event.description = coalesce(arrayindex(regextract(_raw_log,"\d+\s\d+\s\:\s+\"([^\"]+)\"*"),0),
arrayindex(regextract(_raw_log,"<\d+\>\s\d{2}\/\d{2}\/\d{4}\:\d{2}\:\d{2}\:\d{2}.\w{3}\s.+?\:.+?\:\s+(.+)"),0)
),
xdm.source.ipv4 = coalesce(arrayindex(regextract(_raw_log,"Source\s(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"),0),
arrayindex(regextract(_raw_log,"Client_ip\s(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\s"),0),
arrayindex(regextract(_raw_log,"Context\s[\w\d]+\@(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\s"),0),
arrayindex(regextract(_raw_log,"client=(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\:"),0),
arrayindex(regextract(_raw_log,"ClientIP\s(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"),0),
arrayindex(regextract(_raw_log,"Remote.ip\s[\=\s]*(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"),0)
),
xdm.source.ipv6 = coalesce(arrayindex(regextract(_raw_log,"Source\s([a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5})"),0),
arrayindex(regextract(_raw_log,"Client_ip\s([a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5})\s"),0),
arrayindex(regextract(_raw_log,"Context\s[\w\d]+\@([a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5})\s"),0),
arrayindex(regextract(_raw_log,"client=([a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5})\:"),0),
arrayindex(regextract(_raw_log,"ClientIP\s([a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5})"),0),
arrayindex(regextract(_raw_log,"Remote.ip\s[\=\s]*([a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5})"),0)
),
xdm.source.port = to_integer(coalesce(arrayindex(regextract(_raw_log,"Source\s\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\:(\d+)\s"),0),
arrayindex(regextract(_raw_log,"client=\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\:(\d+)"),0),
arrayindex(regextract(_raw_log,"ClientPort\s(\d+)"),0),
arrayindex(regextract(_raw_log,"Remote.ip\s[\=\s]*\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\:(\d+).+\sto"),0)
)),
xdm.target.port = to_integer(coalesce(arrayindex(regextract(_raw_log,"Destination\s\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\:(\d+)\s"),0),
arrayindex(regextract(_raw_log,"VserverServicePort\s(\d+)\s"),0),
arrayindex(regextract(_raw_log,"Sending\srequest\sto.+?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\:(\d+)"),0),
arrayindex(regextract(_raw_log,"Vserver\s\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\:(\d+)"),0),
arrayindex(regextract(_raw_log,"pcb_fport\s\=\s(\d+)"),0),
arrayindex(regextract(_raw_log,"sta-server\=\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\:(\d+)"),0),
arrayindex(regextract(_raw_log,"vda\=\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\:(\d+)"),0),
arrayindex(regextract(_raw_log,"received\sin\sSTA\sresponse\:\s\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\:(\d+)"),0)
)),
xdm.target.ipv4 = coalesce(arrayindex(regextract(_raw_log,"Destination\s(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\:"),0),
arrayindex(regextract(_raw_log,"Vserver[ServiceIP]*\s(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"),0),
arrayindex(regextract(_raw_log,"Sending\srequest\sto.+?(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"),0),
arrayindex(regextract(_raw_log,"ADldap\-(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"),0),
arrayindex(regextract(_raw_log,"sta-server\=(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"),0),
arrayindex(regextract(_raw_log,"client\spcb\_fip\s\=\s(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"),0),
arrayindex(regextract(_raw_log,"vda\=(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"),0),
arrayindex(regextract(_raw_log,"received\sin\sSTA\sresponse\:\s(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"),0)
),
xdm.target.ipv6 = coalesce(arrayindex(regextract(_raw_log,"Destination\s([a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5})\:"),0),
arrayindex(regextract(_raw_log,"Vserver[ServiceIP]*\s([a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5})"),0),
arrayindex(regextract(_raw_log,"Sending\srequest\sto.+?([a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5})\s"),0),
arrayindex(regextract(_raw_log,"ADldap\-([a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5})"),0),
arrayindex(regextract(_raw_log,"sta-server\=([a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5})"),0),
arrayindex(regextract(_raw_log,"vda\=([a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5})"),0),
arrayindex(regextract(_raw_log,"received\sin\sSTA\sresponse\:\s([a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5})"),0)
),
xdm.source.sent_bytes = to_integer(arrayindex(regextract(_raw_log,"Total_bytes_send\s(\d+)\s"),0)),
xdm.target.sent_bytes = to_integer(arrayindex(regextract(_raw_log,"Total_bytes_recv\s(\d+)\s"),0)),
xdm.source.application.name = arrayindex(regextract(_raw_log,"applicationName\s(\w+)\s"),0),
xdm.session_context_id = arrayindex(regextract(_raw_log,"connectionId\s(\w+)\s"),0),
xdm.source.user.username = coalesce(arrayindex(regextract(_raw_log,"username:domainname\s(\w+)\:"),0),
arrayindex(regextract(_raw_log,"User\s([\w\@\.\d]+)\s\:"),0),
arrayindex(regextract(_raw_log,"Context\s([\w\d]+)\@"),0),
arrayindex(regextract(_raw_log,"user:\s\<([\w\d\.\_\-]+)\@"),0),
arrayindex(regextract(_raw_log,"\sUser\s(\S+)"),0)
),
xdm.source.user.domain = arrayindex(regextract(_raw_log,"username:domainname\s\w+\:(\w+)\s"),0),
xdm.network.http.method = if(http_method="ACL", XDM_CONST.HTTP_METHOD_ACL,http_method="BASELINE_CONTROL", XDM_CONST.HTTP_METHOD_BASELINE_CONTROL,http_method="BIND", XDM_CONST.HTTP_METHOD_BIND,http_method="CHECKIN", XDM_CONST.HTTP_METHOD_CHECKIN,http_method="CHECKOUT", XDM_CONST.HTTP_METHOD_CHECKOUT,http_method="CONNECT", XDM_CONST.HTTP_METHOD_CONNECT,http_method="COPY", XDM_CONST.HTTP_METHOD_COPY,http_method="DELETE", XDM_CONST.HTTP_METHOD_DELETE,http_method="GET", XDM_CONST.HTTP_METHOD_GET,http_method="HEAD", XDM_CONST.HTTP_METHOD_HEAD,http_method="LABEL", XDM_CONST.HTTP_METHOD_LABEL,http_method="LINK", XDM_CONST.HTTP_METHOD_LINK,http_method="LOCK", XDM_CONST.HTTP_METHOD_LOCK,http_method="MERGE", XDM_CONST.HTTP_METHOD_MERGE,http_method="MKACTIVITY", XDM_CONST.HTTP_METHOD_MKACTIVITY,http_method="MKCALENDAR", XDM_CONST.HTTP_METHOD_MKCALENDAR,http_method="MKCOL", XDM_CONST.HTTP_METHOD_MKCOL,http_method="MKREDIRECTREF", XDM_CONST.HTTP_METHOD_MKREDIRECTREF,http_method="MKWORKSPACE", XDM_CONST.HTTP_METHOD_MKWORKSPACE,http_method="MOVE", XDM_CONST.HTTP_METHOD_MOVE,http_method="OPTIONS", XDM_CONST.HTTP_METHOD_OPTIONS,http_method="ORDERPATCH", XDM_CONST.HTTP_METHOD_ORDERPATCH,http_method="PATCH", XDM_CONST.HTTP_METHOD_PATCH,http_method="POST", XDM_CONST.HTTP_METHOD_POST,http_method="PRI", XDM_CONST.HTTP_METHOD_PRI,http_method="PROPFIND", XDM_CONST.HTTP_METHOD_PROPFIND,http_method="PROPPATCH", XDM_CONST.HTTP_METHOD_PROPPATCH,http_method="PUT", XDM_CONST.HTTP_METHOD_PUT,http_method="REBIND", XDM_CONST.HTTP_METHOD_REBIND,http_method="REPORT", XDM_CONST.HTTP_METHOD_REPORT,http_method="SEARCH", XDM_CONST.HTTP_METHOD_SEARCH,http_method="TRACE", XDM_CONST.HTTP_METHOD_TRACE,http_method="UNBIND", XDM_CONST.HTTP_METHOD_UNBIND,http_method="UNCHECKOUT", XDM_CONST.HTTP_METHOD_UNCHECKOUT,http_method="UNLINK", XDM_CONST.HTTP_METHOD_UNLINK,http_method="UNLOCK", XDM_CONST.HTTP_METHOD_UNLOCK,http_method="UPDATE", XDM_CONST.HTTP_METHOD_UPDATE,http_method="UPDATEREDIRECTREF", XDM_CONST.HTTP_METHOD_UPDATEREDIRECTREF,http_method="VERSION_CONTROL", XDM_CONST.HTTP_METHOD_VERSION_CONTROL, http_method),
xdm.network.http.url = arrayindex(regextract(_raw_log,"GET\s([\w\/\.]+)\s"),0),
xdm.intermediate.host.hostname = arrayindex(regextract(_raw_log,"\:\d{2}\s\w+\s([\w\-\_\.\d\:]+)\s"),0),
xdm.network.session_id = arrayindex(regextract(_raw_log,"SessionId:\s(\d+)\s"),0),
xdm.event.outcome = if(Status = "SUCCESS", XDM_CONST.OUTCOME_SUCCESS, Status = "FAILURE", XDM_CONST.OUTCOME_FAILED, message_type_lower contains "success", XDM_CONST.OUTCOME_SUCCESS, message_type_lower contains "failure", XDM_CONST.OUTCOME_FAILED, Status),
xdm.source.user_agent = arrayindex(regextract(_raw_log,"Browser_type\s\"([^\"]+)\""),0),
xdm.intermediate.ipv4 = arrayindex(regextract(_raw_log,"Vserver\s(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\:"),0),
xdm.intermediate.port = to_integer(arrayindex(regextract(_raw_log,"Vserver\s\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\:(\d+)\s"),0)),
xdm.network.tls.client_certificate.issuer = arrayindex(regextract(_raw_log, "IssuerName\s\"?\s?([^\"]+)\"?$"), 0),
xdm.network.tls.client_certificate.subject = arrayindex(regextract(_raw_log, "SubjectName\s\"?\s?([^\"]+)\"?$"), 0),
xdm.network.tls.client_certificate.version = coalesce(arrayindex(regextract(_raw_log, "ClientVersion\s([^\s]+)"), 0),
arrayindex(regextract(_raw_log, "ProtocolVersion\s([^\s]+)"), 0)),
xdm.network.tls.cipher = arrayindex(regextract(_raw_log, "CipherSuite\s\"([^\"]+)\""), 0),
xdm.event.outcome_reason = arrayindex(regextract(_raw_log, "Reason\s\"([^\"]+)\""), 0);