Commvault Backup Solutions Modeling Rule

Details

ID	`Commvault_Backup_Solutions_ModelingRule`
From Version	8.2.0

Rules (XIF)

[MODEL: dataset = commvault_backupsolution_raw]
alter
	xdm.alert.name = coalesce(alert, alert_name),
	xdm.alert.original_alert_id = to_string(alert_id),
	xdm.network.rule = alert_rule_name,
	xdm.alert.description = alertdescription,
	xdm.alert.severity = severity,
	xdm.observer.name = coalesce(commcell, commcellname),
	xdm.target.host.hostname = coalesce(computer, client),
	xdm.event.description = coalesce(description, details),
	xdm.event.type = if(
		opid != null and to_string(opid) !~= "^\s*$", "Audit",
		alert_id != null and to_string(alert_id) !~= "^\s*$", "Alert",
		event_id != null and to_string(event_id) !~= "^\s*$", coalesce(detected_criteria, type, "Event")
	),
	xdm.event.original_event_type = to_string(event_code),
	xdm.event.id = coalesce(to_string(event_id), to_string(opid)),
	xdm.event.operation_sub_type = operation,
	xdm.source.application.name = program,
	xdm.source.user.username = user;

Schema

`commvault_backupsolution_raw`

Field	Type	Array?
`alert`	string	—
`alert_id`	int	—
`alert_name`	string	—
`alert_rule_name`	string	—
`alertdescription`	string	—
`client`	string	—
`commcell`	string	—
`commcellname`	string	—
`computer`	string	—
`description`	string	—
`details`	string	—
`detected_criteria`	string	—
`event_code`	string	—
`event_id`	int	—
`operation`	string	—
`opid`	int	—
`program`	string	—
`severity`	string	—
`type`	string	—
`user`	string	—

Raw JSON

{
    "commvault_backupsolution_raw": {
        "alert": {
            "type": "string",
            "is_array": false
        },
        "alert_name": {
            "type": "string",
            "is_array": false
        },
        "alert_rule_name": {
            "type": "string",
            "is_array": false
        },
        "alertdescription": {
            "type": "string",
            "is_array": false
        },
        "severity": {
            "type": "string",
            "is_array": false
        },
        "commcell": {
            "type": "string",
            "is_array": false
        },
        "commcellname": {
            "type": "string",
            "is_array": false
        },
        "computer": {
            "type": "string",
            "is_array": false
        },
        "client": {
            "type": "string",
            "is_array": false
        },
        "description": {
            "type": "string",
            "is_array": false
        },
        "details": {
            "type": "string",
            "is_array": false
        },
        "detected_criteria": {
            "type": "string",
            "is_array": false
        },
        "type": {
            "type": "string",
            "is_array": false
        },
        "event_code": {
            "type": "string",
            "is_array": false
        },
        "operation": {
            "type": "string",
            "is_array": false
        },
        "program": {
            "type": "string",
            "is_array": false
        },
        "user": {
            "type": "string",
            "is_array": false
        },
        "event_id": {
            "type": "int",
            "is_array": false
        },
        "opid": {
            "type": "int",
            "is_array": false
        },
        "alert_id": {
            "type": "int",
            "is_array": false
        }        
    }
}