Commvault Backup Solutions Modeling Rule

Details

ID	`Commvault_Backup_Solutions_ModelingRule`
From Version	8.15.0

Schema

`commvault_backupsolution_raw`

Field	Type	Array?
`alert`	string	—
`alert_id`	int	—
`alert_name`	string	—
`alert_rule_name`	string	—
`alertdescription`	string	—
`client`	string	—
`commcell`	string	—
`commcellname`	string	—
`computer`	string	—
`description`	string	—
`details`	string	—
`detected_criteria`	string	—
`event_code`	string	—
`event_id`	int	—
`operation`	string	—
`opid`	int	—
`program`	string	—
`severity`	string	—
`type`	string	—
`user`	string	—

Source

CommvaultBackupSolutions_2_11.xif CommvaultBackupSolutions_2_11.yml CommvaultBackupSolutions_2_11_schema.json

Download History Raw

[MODEL: dataset = commvault_backupsolution_raw]
alter
	xdm.alert.name = coalesce(alert, alert_name),
	xdm.alert.original_alert_id = to_string(alert_id),
	xdm.network.rule = alert_rule_name,
	xdm.alert.description = alertdescription,
	xdm.alert.severity = severity,
	xdm.observer.name = coalesce(commcell, commcellname),
	xdm.target.host.hostname = coalesce(computer, client),
	xdm.event.description = coalesce(description, details),
	xdm.event.type = if(
		opid != null and to_string(opid) !~= "^\s*$", "Audit",
		alert_id != null and to_string(alert_id) !~= "^\s*$", "Alert",
		event_id != null and to_string(event_id) !~= "^\s*$", coalesce(detected_criteria, type, "Event")
	),
	xdm.event.original_event_type = to_string(event_code),
	xdm.event.id = coalesce(to_string(event_id), to_string(opid)),
	xdm.event.operation_sub_type = operation,
	xdm.source.application.name = program,
	xdm.source.user.username = user,	xdm.source.identity.username = user;