Rules (XIF)
[MODEL: dataset=corelight_zeek_raw]
// DNS Logs
filter _path ~= "dns"
| alter
xdm.source.ipv4 = if(id_orig_h ~= "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}", id_orig_h, null),
xdm.source.ipv6 = if(id_orig_h ~= ":", id_orig_h, null),
xdm.target.ipv4 = if(id_resp_h ~= "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}", id_resp_h, null),
xdm.target.ipv6 = if(id_resp_h ~= ":", id_resp_h, null),
xdm.source.port = to_integer(id_orig_p),
xdm.target.port = to_integer(id_resp_p),
xdm.observer.name = _system_name,
xdm.observer.version = version,
xdm.event.type = _path,
xdm.event.id = uid,
xdm.network.ip_protocol = if(proto=lowercase("HOPOPT"),XDM_CONST.IP_PROTOCOL_HOPOPT, proto=lowercase("ICMP"),XDM_CONST.IP_PROTOCOL_ICMP, proto=lowercase("IGMP"),XDM_CONST.IP_PROTOCOL_IGMP, proto=lowercase("GGP"),XDM_CONST.IP_PROTOCOL_GGP, proto=lowercase("IP"),XDM_CONST.IP_PROTOCOL_IP, proto=lowercase("ST"),XDM_CONST.IP_PROTOCOL_ST, proto=lowercase("TCP"),XDM_CONST.IP_PROTOCOL_TCP, proto=lowercase("CBT"),XDM_CONST.IP_PROTOCOL_CBT, proto=lowercase("EGP"),XDM_CONST.IP_PROTOCOL_EGP, proto=lowercase("IGP"),XDM_CONST.IP_PROTOCOL_IGP, proto=lowercase("BBN_RCC_MON"),XDM_CONST.IP_PROTOCOL_BBN_RCC_MON, proto=lowercase("NVP_II"),XDM_CONST.IP_PROTOCOL_NVP_II, proto=lowercase("PUP"),XDM_CONST.IP_PROTOCOL_PUP, proto=lowercase("ARGUS"),XDM_CONST.IP_PROTOCOL_ARGUS, proto=lowercase("EMCON"),XDM_CONST.IP_PROTOCOL_EMCON, proto=lowercase("XNET"),XDM_CONST.IP_PROTOCOL_XNET, proto=lowercase("CHAOS"),XDM_CONST.IP_PROTOCOL_CHAOS, proto=lowercase("UDP"),XDM_CONST.IP_PROTOCOL_UDP, proto=lowercase("MUX"),XDM_CONST.IP_PROTOCOL_MUX, proto=lowercase("DCN_MEAS"),XDM_CONST.IP_PROTOCOL_DCN_MEAS, proto=lowercase("HMP"),XDM_CONST.IP_PROTOCOL_HMP, proto=lowercase("PRM"),XDM_CONST.IP_PROTOCOL_PRM, proto=lowercase("XNS_IDP"),XDM_CONST.IP_PROTOCOL_XNS_IDP, proto=lowercase("TRUNK_1"),XDM_CONST.IP_PROTOCOL_TRUNK_1, proto=lowercase("TRUNK_2"),XDM_CONST.IP_PROTOCOL_TRUNK_2, proto=lowercase("LEAF_1"),XDM_CONST.IP_PROTOCOL_LEAF_1, proto=lowercase("LEAF_2"),XDM_CONST.IP_PROTOCOL_LEAF_2, proto=lowercase("RDP"),XDM_CONST.IP_PROTOCOL_RDP, proto=lowercase("IRTP"),XDM_CONST.IP_PROTOCOL_IRTP, proto=lowercase("ISO_TP4"),XDM_CONST.IP_PROTOCOL_ISO_TP4, proto=lowercase("NETBLT"),XDM_CONST.IP_PROTOCOL_NETBLT, proto=lowercase("MFE_NSP"),XDM_CONST.IP_PROTOCOL_MFE_NSP, proto=lowercase("MERIT_INP"),XDM_CONST.IP_PROTOCOL_MERIT_INP, proto=lowercase("DCCP"),XDM_CONST.IP_PROTOCOL_DCCP, proto=lowercase("3PC"),XDM_CONST.IP_PROTOCOL_3PC, proto=lowercase("IDPR"),XDM_CONST.IP_PROTOCOL_IDPR, proto=lowercase("XTP"),XDM_CONST.IP_PROTOCOL_XTP, proto=lowercase("DDP"),XDM_CONST.IP_PROTOCOL_DDP, proto=lowercase("IDPR_CMTP"),XDM_CONST.IP_PROTOCOL_IDPR_CMTP, proto=lowercase("TP"),XDM_CONST.IP_PROTOCOL_TP, proto=lowercase("IL"),XDM_CONST.IP_PROTOCOL_IL, proto=lowercase("IPV6"),XDM_CONST.IP_PROTOCOL_IPV6, proto=lowercase("SDRP"),XDM_CONST.IP_PROTOCOL_SDRP, proto=lowercase("IPV6_ROUTE"),XDM_CONST.IP_PROTOCOL_IPV6_ROUTE, proto=lowercase("IPV6_FRAG"),XDM_CONST.IP_PROTOCOL_IPV6_FRAG, proto=lowercase("IDRP"),XDM_CONST.IP_PROTOCOL_IDRP, proto=lowercase("RSVP"),XDM_CONST.IP_PROTOCOL_RSVP, proto=lowercase("GRE"),XDM_CONST.IP_PROTOCOL_GRE, proto=lowercase("DSR"),XDM_CONST.IP_PROTOCOL_DSR, proto=lowercase("BNA"),XDM_CONST.IP_PROTOCOL_BNA, proto=lowercase("ESP"),XDM_CONST.IP_PROTOCOL_ESP, proto=lowercase("AH"),XDM_CONST.IP_PROTOCOL_AH, proto=lowercase("I_NLSP"),XDM_CONST.IP_PROTOCOL_I_NLSP, proto=lowercase("SWIPE"),XDM_CONST.IP_PROTOCOL_SWIPE, proto=lowercase("NARP"),XDM_CONST.IP_PROTOCOL_NARP, proto=lowercase("MOBILE"),XDM_CONST.IP_PROTOCOL_MOBILE, proto=lowercase("TLSP"),XDM_CONST.IP_PROTOCOL_TLSP, proto=lowercase("SKIP"),XDM_CONST.IP_PROTOCOL_SKIP, proto=lowercase("IPV6_ICMP"),XDM_CONST.IP_PROTOCOL_IPV6_ICMP, proto=lowercase("IPV6_NONXT"),XDM_CONST.IP_PROTOCOL_IPV6_NONXT, proto=lowercase("IPV6_OPTS"),XDM_CONST.IP_PROTOCOL_IPV6_OPTS, proto=lowercase("CFTP"),XDM_CONST.IP_PROTOCOL_CFTP, proto=lowercase("SAT_EXPAK"),XDM_CONST.IP_PROTOCOL_SAT_EXPAK, proto=lowercase("KRYPTOLAN"),XDM_CONST.IP_PROTOCOL_KRYPTOLAN, proto=lowercase("RVD"),XDM_CONST.IP_PROTOCOL_RVD, proto=lowercase("IPPC"),XDM_CONST.IP_PROTOCOL_IPPC, proto=lowercase("SAT_MON"),XDM_CONST.IP_PROTOCOL_SAT_MON, proto=lowercase("VISA"),XDM_CONST.IP_PROTOCOL_VISA, proto=lowercase("IPCV"),XDM_CONST.IP_PROTOCOL_IPCV, proto=lowercase("CPNX"),XDM_CONST.IP_PROTOCOL_CPNX, proto=lowercase("CPHB"),XDM_CONST.IP_PROTOCOL_CPHB, proto=lowercase("WSN"),XDM_CONST.IP_PROTOCOL_WSN, proto=lowercase("PVP"),XDM_CONST.IP_PROTOCOL_PVP, proto=lowercase("BR_SAT_MON"),XDM_CONST.IP_PROTOCOL_BR_SAT_MON, proto=lowercase("SUN_ND"),XDM_CONST.IP_PROTOCOL_SUN_ND, proto=lowercase("WB_MON"),XDM_CONST.IP_PROTOCOL_WB_MON, proto=lowercase("WB_EXPAK"),XDM_CONST.IP_PROTOCOL_WB_EXPAK, proto=lowercase("ISO_IP"),XDM_CONST.IP_PROTOCOL_ISO_IP, proto=lowercase("VMTP"),XDM_CONST.IP_PROTOCOL_VMTP, proto=lowercase("SECURE_VMTP"),XDM_CONST.IP_PROTOCOL_SECURE_VMTP, proto=lowercase("VINES"),XDM_CONST.IP_PROTOCOL_VINES, proto=lowercase("TTP"),XDM_CONST.IP_PROTOCOL_TTP, proto=lowercase("NSFNET_IGP"),XDM_CONST.IP_PROTOCOL_NSFNET_IGP, proto=lowercase("DGP"),XDM_CONST.IP_PROTOCOL_DGP, proto=lowercase("TCF"),XDM_CONST.IP_PROTOCOL_TCF, proto=lowercase("EIGRP"),XDM_CONST.IP_PROTOCOL_EIGRP, proto=lowercase("OSPFIGP"),XDM_CONST.IP_PROTOCOL_OSPFIGP, proto=lowercase("SPRITE_RPC"),XDM_CONST.IP_PROTOCOL_SPRITE_RPC, proto=lowercase("LARP"),XDM_CONST.IP_PROTOCOL_LARP, proto=lowercase("MTP"),XDM_CONST.IP_PROTOCOL_MTP, proto=lowercase("AX25"),XDM_CONST.IP_PROTOCOL_AX25, proto=lowercase("IPIP"),XDM_CONST.IP_PROTOCOL_IPIP, proto=lowercase("MICP"),XDM_CONST.IP_PROTOCOL_MICP, proto=lowercase("SCC_SP"),XDM_CONST.IP_PROTOCOL_SCC_SP, proto=lowercase("ETHERIP"),XDM_CONST.IP_PROTOCOL_ETHERIP, proto=lowercase("ENCAP"),XDM_CONST.IP_PROTOCOL_ENCAP, proto=lowercase("GMTP"),XDM_CONST.IP_PROTOCOL_GMTP, proto=lowercase("IFMP"),XDM_CONST.IP_PROTOCOL_IFMP, proto=lowercase("PNNI"),XDM_CONST.IP_PROTOCOL_PNNI, proto=lowercase("PIM"),XDM_CONST.IP_PROTOCOL_PIM, proto=lowercase("ARIS"),XDM_CONST.IP_PROTOCOL_ARIS, proto=lowercase("SCPS"),XDM_CONST.IP_PROTOCOL_SCPS, proto=lowercase("QNX"),XDM_CONST.IP_PROTOCOL_QNX, proto=lowercase("AN"),XDM_CONST.IP_PROTOCOL_AN, proto=lowercase("IPCOMP"),XDM_CONST.IP_PROTOCOL_IPCOMP, proto=lowercase("COMPAQ_PEER"),XDM_CONST.IP_PROTOCOL_COMPAQ_PEER, proto=lowercase("IPX_IN_IP"),XDM_CONST.IP_PROTOCOL_IPX_IN_IP, proto=lowercase("VRRP"),XDM_CONST.IP_PROTOCOL_VRRP, proto=lowercase("PGM"),XDM_CONST.IP_PROTOCOL_PGM, proto=lowercase("L2TP"),XDM_CONST.IP_PROTOCOL_L2TP, proto=lowercase("DDX"),XDM_CONST.IP_PROTOCOL_DDX, proto=lowercase("IATP"),XDM_CONST.IP_PROTOCOL_IATP, proto=lowercase("STP"),XDM_CONST.IP_PROTOCOL_STP, proto=lowercase("SRP"),XDM_CONST.IP_PROTOCOL_SRP, proto=lowercase("UTI"),XDM_CONST.IP_PROTOCOL_UTI, proto=lowercase("SMP"),XDM_CONST.IP_PROTOCOL_SMP, proto=lowercase("SM"),XDM_CONST.IP_PROTOCOL_SM, proto=lowercase("PTP"),XDM_CONST.IP_PROTOCOL_PTP, proto=lowercase("ISIS"),XDM_CONST.IP_PROTOCOL_ISIS, proto=lowercase("FIRE"),XDM_CONST.IP_PROTOCOL_FIRE, proto=lowercase("CRTP"),XDM_CONST.IP_PROTOCOL_CRTP, proto=lowercase("CRUDP"),XDM_CONST.IP_PROTOCOL_CRUDP, proto=lowercase("SSCOPMCE"),XDM_CONST.IP_PROTOCOL_SSCOPMCE, proto=lowercase("IPLT"),XDM_CONST.IP_PROTOCOL_IPLT, proto=lowercase("SPS"),XDM_CONST.IP_PROTOCOL_SPS, proto=lowercase("PIPE"),XDM_CONST.IP_PROTOCOL_PIPE, proto=lowercase("SCTP"),XDM_CONST.IP_PROTOCOL_SCTP, proto=lowercase("FC"),XDM_CONST.IP_PROTOCOL_FC, proto=lowercase("RSVP_E2E_IGNORE"),XDM_CONST.IP_PROTOCOL_RSVP_E2E_IGNORE, proto=lowercase("MOBILITY"),XDM_CONST.IP_PROTOCOL_MOBILITY, proto=lowercase("UDPLITE"),XDM_CONST.IP_PROTOCOL_UDPLITE, proto=lowercase("MPLS_IN_IP"),XDM_CONST.IP_PROTOCOL_MPLS_IN_IP,to_string(proto)),
xdm.event.duration = to_integer(rtt),
xdm.network.dns.is_response = to_boolean(rejected),
xdm.network.dns.dns_question.name = query,
xdm.network.dns.dns_question.type = if(qtype_name="A",XDM_CONST.DNS_RECORD_TYPE_A, qtype_name="AAAA",XDM_CONST.DNS_RECORD_TYPE_AAAA, qtype_name="AFSDB",XDM_CONST.DNS_RECORD_TYPE_AFSDB, qtype_name="APL",XDM_CONST.DNS_RECORD_TYPE_APL, qtype_name="CAA",XDM_CONST.DNS_RECORD_TYPE_CAA, qtype_name="CDNSKEY",XDM_CONST.DNS_RECORD_TYPE_CDNSKEY, qtype_name="CDS",XDM_CONST.DNS_RECORD_TYPE_CDS, qtype_name="CERT",XDM_CONST.DNS_RECORD_TYPE_CERT, qtype_name="CNAME",XDM_CONST.DNS_RECORD_TYPE_CNAME, qtype_name="CSYNC",XDM_CONST.DNS_RECORD_TYPE_CSYNC, qtype_name="DHCID",XDM_CONST.DNS_RECORD_TYPE_DHCID, qtype_name="DLV",XDM_CONST.DNS_RECORD_TYPE_DLV, qtype_name="DNAME",XDM_CONST.DNS_RECORD_TYPE_DNAME, qtype_name="DNSKEY",XDM_CONST.DNS_RECORD_TYPE_DNSKEY, qtype_name="DS",XDM_CONST.DNS_RECORD_TYPE_DS, qtype_name="EUI48",XDM_CONST.DNS_RECORD_TYPE_EUI48, qtype_name="EUI64",XDM_CONST.DNS_RECORD_TYPE_EUI64, qtype_name="HINFO",XDM_CONST.DNS_RECORD_TYPE_HINFO, qtype_name="HIP",XDM_CONST.DNS_RECORD_TYPE_HIP, qtype_name="HTTPS",XDM_CONST.DNS_RECORD_TYPE_HTTPS, qtype_name="IPSECKEY",XDM_CONST.DNS_RECORD_TYPE_IPSECKEY, qtype_name="KEY",XDM_CONST.DNS_RECORD_TYPE_KEY, qtype_name="KX",XDM_CONST.DNS_RECORD_TYPE_KX, qtype_name="LOC",XDM_CONST.DNS_RECORD_TYPE_LOC, qtype_name="MX",XDM_CONST.DNS_RECORD_TYPE_MX, qtype_name="NAPTR",XDM_CONST.DNS_RECORD_TYPE_NAPTR, qtype_name="NS",XDM_CONST.DNS_RECORD_TYPE_NS, qtype_name="NSEC",XDM_CONST.DNS_RECORD_TYPE_NSEC, qtype_name="NSEC3",XDM_CONST.DNS_RECORD_TYPE_NSEC3, qtype_name="NSEC3PARAM",XDM_CONST.DNS_RECORD_TYPE_NSEC3PARAM, qtype_name="OPENPGPKEY",XDM_CONST.DNS_RECORD_TYPE_OPENPGPKEY, qtype_name="PTR",XDM_CONST.DNS_RECORD_TYPE_PTR, qtype_name="RRSIG",XDM_CONST.DNS_RECORD_TYPE_RRSIG, qtype_name="RP",XDM_CONST.DNS_RECORD_TYPE_RP, qtype_name="SIG",XDM_CONST.DNS_RECORD_TYPE_SIG, qtype_name="SMIMEA",XDM_CONST.DNS_RECORD_TYPE_SMIMEA, qtype_name="SOA",XDM_CONST.DNS_RECORD_TYPE_SOA, qtype_name="SRV",XDM_CONST.DNS_RECORD_TYPE_SRV, qtype_name="SSHFP",XDM_CONST.DNS_RECORD_TYPE_SSHFP, qtype_name="SVCB",XDM_CONST.DNS_RECORD_TYPE_SVCB, qtype_name="TA",XDM_CONST.DNS_RECORD_TYPE_TA, qtype_name="TKEY",XDM_CONST.DNS_RECORD_TYPE_TKEY, qtype_name="TLSA",XDM_CONST.DNS_RECORD_TYPE_TLSA, qtype_name="TSIG",XDM_CONST.DNS_RECORD_TYPE_TSIG, qtype_name="TXT",XDM_CONST.DNS_RECORD_TYPE_TXT, qtype_name="URI",XDM_CONST.DNS_RECORD_TYPE_URI, qtype_name="ZONEMD",XDM_CONST.DNS_RECORD_TYPE_ZONEMD, to_string(qtype_name)),
xdm.network.dns.dns_resource_record.name = to_string(rcode),
xdm.network.dns.dns_resource_record.type = if(rcode_name="A",XDM_CONST.DNS_RECORD_TYPE_A, rcode_name="AAAA",XDM_CONST.DNS_RECORD_TYPE_AAAA, rcode_name="AFSDB",XDM_CONST.DNS_RECORD_TYPE_AFSDB, rcode_name="APL",XDM_CONST.DNS_RECORD_TYPE_APL, rcode_name="CAA",XDM_CONST.DNS_RECORD_TYPE_CAA, rcode_name="CDNSKEY",XDM_CONST.DNS_RECORD_TYPE_CDNSKEY, rcode_name="CDS",XDM_CONST.DNS_RECORD_TYPE_CDS, rcode_name="CERT",XDM_CONST.DNS_RECORD_TYPE_CERT, rcode_name="CNAME",XDM_CONST.DNS_RECORD_TYPE_CNAME, rcode_name="CSYNC",XDM_CONST.DNS_RECORD_TYPE_CSYNC, rcode_name="DHCID",XDM_CONST.DNS_RECORD_TYPE_DHCID, rcode_name="DLV",XDM_CONST.DNS_RECORD_TYPE_DLV, rcode_name="DNAME",XDM_CONST.DNS_RECORD_TYPE_DNAME, rcode_name="DNSKEY",XDM_CONST.DNS_RECORD_TYPE_DNSKEY, rcode_name="DS",XDM_CONST.DNS_RECORD_TYPE_DS, rcode_name="EUI48",XDM_CONST.DNS_RECORD_TYPE_EUI48, rcode_name="EUI64",XDM_CONST.DNS_RECORD_TYPE_EUI64, rcode_name="HINFO",XDM_CONST.DNS_RECORD_TYPE_HINFO, rcode_name="HIP",XDM_CONST.DNS_RECORD_TYPE_HIP, rcode_name="HTTPS",XDM_CONST.DNS_RECORD_TYPE_HTTPS, rcode_name="IPSECKEY",XDM_CONST.DNS_RECORD_TYPE_IPSECKEY, rcode_name="KEY",XDM_CONST.DNS_RECORD_TYPE_KEY, rcode_name="KX",XDM_CONST.DNS_RECORD_TYPE_KX, rcode_name="LOC",XDM_CONST.DNS_RECORD_TYPE_LOC, rcode_name="MX",XDM_CONST.DNS_RECORD_TYPE_MX, rcode_name="NAPTR",XDM_CONST.DNS_RECORD_TYPE_NAPTR, rcode_name="NS",XDM_CONST.DNS_RECORD_TYPE_NS, rcode_name="NSEC",XDM_CONST.DNS_RECORD_TYPE_NSEC, rcode_name="NSEC3",XDM_CONST.DNS_RECORD_TYPE_NSEC3, rcode_name="NSEC3PARAM",XDM_CONST.DNS_RECORD_TYPE_NSEC3PARAM, rcode_name="OPENPGPKEY",XDM_CONST.DNS_RECORD_TYPE_OPENPGPKEY, rcode_name="PTR",XDM_CONST.DNS_RECORD_TYPE_PTR, rcode_name="RRSIG",XDM_CONST.DNS_RECORD_TYPE_RRSIG, rcode_name="RP",XDM_CONST.DNS_RECORD_TYPE_RP, rcode_name="SIG",XDM_CONST.DNS_RECORD_TYPE_SIG, rcode_name="SMIMEA",XDM_CONST.DNS_RECORD_TYPE_SMIMEA, rcode_name="SOA",XDM_CONST.DNS_RECORD_TYPE_SOA, rcode_name="SRV",XDM_CONST.DNS_RECORD_TYPE_SRV, rcode_name="SSHFP",XDM_CONST.DNS_RECORD_TYPE_SSHFP, rcode_name="SVCB",XDM_CONST.DNS_RECORD_TYPE_SVCB, rcode_name="TA",XDM_CONST.DNS_RECORD_TYPE_TA, rcode_name="TKEY",XDM_CONST.DNS_RECORD_TYPE_TKEY, rcode_name="TLSA",XDM_CONST.DNS_RECORD_TYPE_TLSA, rcode_name="TSIG",XDM_CONST.DNS_RECORD_TYPE_TSIG, rcode_name="TXT",XDM_CONST.DNS_RECORD_TYPE_TXT, rcode_name="URI",XDM_CONST.DNS_RECORD_TYPE_URI, rcode_name="ZONEMD",XDM_CONST.DNS_RECORD_TYPE_ZONEMD, to_string(rcode_name)),
//xdm.source.agent.identifier = trans_id,
xdm.network.dns.dns_resource_record.value = answers;
// HTTP Logs
filter _path ~= "http"
| alter
status_code_string = to_string(status_code)
| alter
xdm.source.ipv4 = if(id_orig_h ~= "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}", id_orig_h, null),
xdm.source.ipv6 = if(id_orig_h ~= ":", id_orig_h, null),
xdm.target.ipv4 = if(id_resp_h ~= "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}", id_resp_h, null),
xdm.target.ipv6 = if(id_resp_h ~= ":", id_resp_h, null),
xdm.source.port = to_integer(id_orig_p),
xdm.target.port = to_integer(id_resp_p),
xdm.event.type = _path,
xdm.observer.name = _system_name,
xdm.observer.version = version,
xdm.event.id = uid,
xdm.network.http.referrer = referrer,
xdm.network.http.url = uri,
xdm.observer.unique_identifier = tags,
xdm.source.user_agent = user_agent,
xdm.network.http.method = if(method = "ACL", XDM_CONST.HTTP_METHOD_ACL, method = "BASELINE_CONTROL", XDM_CONST.HTTP_METHOD_BASELINE_CONTROL , method = "BIND", XDM_CONST.HTTP_METHOD_BIND, method = "CHECKIN", XDM_CONST.HTTP_METHOD_CHECKIN, method = "CHECKOUT", XDM_CONST.HTTP_METHOD_CHECKOUT, method = "CONNECT", XDM_CONST.HTTP_METHOD_CONNECT, method = "COPY", XDM_CONST.HTTP_METHOD_COPY, method = "DELETE", XDM_CONST.HTTP_METHOD_DELETE, method = "GET", XDM_CONST.HTTP_METHOD_GET, method = "HEAD", XDM_CONST.HTTP_METHOD_HEAD, method = "LABEL", XDM_CONST.HTTP_METHOD_LABEL, method = "LINK", XDM_CONST.HTTP_METHOD_LINK, method = "LOCK", XDM_CONST.HTTP_METHOD_LOCK, method = "MERGE", XDM_CONST.HTTP_METHOD_MERGE, method = "MKACTIVITY", XDM_CONST.HTTP_METHOD_MKACTIVITY, method = "MKCALENDAR", XDM_CONST.HTTP_METHOD_MKCALENDAR, method = "MKCOL", XDM_CONST.HTTP_METHOD_MKCOL, method = "MKREDIRECTREF", XDM_CONST.HTTP_METHOD_MKREDIRECTREF, method = "MKWORKSPACE", XDM_CONST.HTTP_METHOD_MKWORKSPACE, method = "MOVE", XDM_CONST.HTTP_METHOD_MOVE, method = "OPTIONS", XDM_CONST.HTTP_METHOD_OPTIONS, method = "ORDERPATCH", XDM_CONST.HTTP_METHOD_ORDERPATCH, method = "PATCH", XDM_CONST.HTTP_METHOD_PATCH, method = "POST", XDM_CONST.HTTP_METHOD_POST, method = "PRI", XDM_CONST.HTTP_METHOD_PRI, method = "PROPFIND", XDM_CONST.HTTP_METHOD_PROPFIND, method = "PROPPATCH", XDM_CONST.HTTP_METHOD_PROPPATCH, method = "PUT", XDM_CONST.HTTP_METHOD_PUT, method = "REBIND", XDM_CONST.HTTP_METHOD_REBIND, method = "REPORT", XDM_CONST.HTTP_METHOD_REPORT, method = "SEARCH", XDM_CONST.HTTP_METHOD_SEARCH, method = "TRACE", XDM_CONST.HTTP_METHOD_TRACE, method = "UNBIND", XDM_CONST.HTTP_METHOD_UNBIND, method = "UNCHECKOUT", XDM_CONST.HTTP_METHOD_UNCHECKOUT, method = "UNLINK", XDM_CONST.HTTP_METHOD_UNLINK, method = "UNLOCK", XDM_CONST.HTTP_METHOD_UNLOCK, method = "UPDATE", XDM_CONST.HTTP_METHOD_UPDATE, method = "UPDATEREDIRECTREF", XDM_CONST.HTTP_METHOD_UPDATEREDIRECTREF, method = "VERSION_CONTROL", XDM_CONST.HTTP_METHOD_VERSION_CONTROL, method = null, null, to_string(method)),
xdm.network.http.response_code = if(status_code_string = "100", XDM_CONST.HTTP_RSP_CODE_CONTINUE, status_code_string = "101", XDM_CONST.HTTP_RSP_CODE_SWITCHING_PROTOCOLS, status_code_string = "102", XDM_CONST.HTTP_RSP_CODE_PROCESSING, status_code_string = "103", XDM_CONST.HTTP_RSP_CODE_EARLY_HINTS, status_code_string = "200", XDM_CONST.HTTP_RSP_CODE_OK, status_code_string = "201", XDM_CONST.HTTP_RSP_CODE_CREATED, status_code_string = "202", XDM_CONST.HTTP_RSP_CODE_ACCEPTED, status_code_string = "203", XDM_CONST.HTTP_RSP_CODE_NON__AUTHORITATIVE_INFORMATION, status_code_string = "204", XDM_CONST.HTTP_RSP_CODE_NO_CONTENT, status_code_string = "205", XDM_CONST.HTTP_RSP_CODE_RESET_CONTENT, status_code_string = "206", XDM_CONST.HTTP_RSP_CODE_PARTIAL_CONTENT, status_code_string = "207", XDM_CONST.HTTP_RSP_CODE_MULTI__STATUS, status_code_string = "208", XDM_CONST.HTTP_RSP_CODE_ALREADY_REPORTED, status_code_string = "226", XDM_CONST.HTTP_RSP_CODE_IM_USED, status_code_string = "300", XDM_CONST.HTTP_RSP_CODE_MULTIPLE_CHOICES, status_code_string = "301", XDM_CONST.HTTP_RSP_CODE_MOVED_PERMANENTLY, status_code_string = "302", XDM_CONST.HTTP_RSP_CODE_FOUND, status_code_string = "303", XDM_CONST.HTTP_RSP_CODE_SEE_OTHER, status_code_string = "304", XDM_CONST.HTTP_RSP_CODE_NOT_MODIFIED, status_code_string = "305", XDM_CONST.HTTP_RSP_CODE_USE_PROXY, status_code_string = "307", XDM_CONST.HTTP_RSP_CODE_TEMPORARY_REDIRECT, status_code_string = "308", XDM_CONST.HTTP_RSP_CODE_PERMANENT_REDIRECT, status_code_string = "400", XDM_CONST.HTTP_RSP_CODE_BAD_REQUEST, status_code_string = "401", XDM_CONST.HTTP_RSP_CODE_UNAUTHORIZED, status_code_string = "402", XDM_CONST.HTTP_RSP_CODE_PAYMENT_REQUIRED, status_code_string = "403", XDM_CONST.HTTP_RSP_CODE_FORBIDDEN, status_code_string = "404", XDM_CONST.HTTP_RSP_CODE_NOT_FOUND, status_code_string = "405", XDM_CONST.HTTP_RSP_CODE_METHOD_NOT_ALLOWED, status_code_string = "406", XDM_CONST.HTTP_RSP_CODE_NOT_ACCEPTABLE, status_code_string = "407", XDM_CONST.HTTP_RSP_CODE_PROXY_AUTHENTICATION_REQUIRED, status_code_string = "408", XDM_CONST.HTTP_RSP_CODE_REQUEST_TIMEOUT, status_code_string = "409", XDM_CONST.HTTP_RSP_CODE_CONFLICT, status_code_string = "410", XDM_CONST.HTTP_RSP_CODE_GONE, status_code_string = "411", XDM_CONST.HTTP_RSP_CODE_LENGTH_REQUIRED, status_code_string = "412", XDM_CONST.HTTP_RSP_CODE_PRECONDITION_FAILED, status_code_string = "413", XDM_CONST.HTTP_RSP_CODE_CONTENT_TOO_LARGE, status_code_string = "414", XDM_CONST.HTTP_RSP_CODE_URI_TOO_LONG, status_code_string = "415", XDM_CONST.HTTP_RSP_CODE_UNSUPPORTED_MEDIA_TYPE, status_code_string = "416", XDM_CONST.HTTP_RSP_CODE_RANGE_NOT_SATISFIABLE, status_code_string = "417", XDM_CONST.HTTP_RSP_CODE_EXPECTATION_FAILED, status_code_string = "421", XDM_CONST.HTTP_RSP_CODE_MISDIRECTED_REQUEST, status_code_string = "422", XDM_CONST.HTTP_RSP_CODE_UNPROCESSABLE_CONTENT, status_code_string = "423", XDM_CONST.HTTP_RSP_CODE_LOCKED, status_code_string = "424", XDM_CONST.HTTP_RSP_CODE_FAILED_DEPENDENCY, status_code_string = "425", XDM_CONST.HTTP_RSP_CODE_TOO_EARLY, status_code_string = "426", XDM_CONST.HTTP_RSP_CODE_UPGRADE_REQUIRED, status_code_string = "428", XDM_CONST.HTTP_RSP_CODE_PRECONDITION_REQUIRED, status_code_string = "429", XDM_CONST.HTTP_RSP_CODE_TOO_MANY_REQUESTS, status_code_string = "431", XDM_CONST.HTTP_RSP_CODE_REQUEST_HEADER_FIELDS_TOO_LARGE, status_code_string = "451", XDM_CONST.HTTP_RSP_CODE_UNAVAILABLE_FOR_LEGAL_REASONS, status_code_string = "500", XDM_CONST.HTTP_RSP_CODE_INTERNAL_SERVER_ERROR, status_code_string = "501", XDM_CONST.HTTP_RSP_CODE_NOT_IMPLEMENTED, status_code_string = "502", XDM_CONST.HTTP_RSP_CODE_BAD_GATEWAY, status_code_string = "503", XDM_CONST.HTTP_RSP_CODE_SERVICE_UNAVAILABLE, status_code_string = "504", XDM_CONST.HTTP_RSP_CODE_GATEWAY_TIMEOUT, status_code_string = "505", XDM_CONST.HTTP_RSP_CODE_HTTP_VERSION_NOT_SUPPORTED, status_code_string = "506", XDM_CONST.HTTP_RSP_CODE_VARIANT_ALSO_NEGOTIATES, status_code_string = "507", XDM_CONST.HTTP_RSP_CODE_INSUFFICIENT_STORAGE, status_code_string = "508", XDM_CONST.HTTP_RSP_CODE_LOOP_DETECTED, status_code_string = "511", XDM_CONST.HTTP_RSP_CODE_NETWORK_AUTHENTICATION_REQUIRED, status_code_string = null, null, to_string(status_code_string)),
xdm.source.host.hostname = origin,
xdm.source.sent_bytes = to_integer(request_body_len),
xdm.target.host.hostname = host,
xdm.target.sent_bytes = to_integer(response_body_len);
// NTLM Logs
filter _path ~= "ntlm"
| alter
xdm.source.ipv4 = if(id_orig_h ~= "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}", id_orig_h, null),
xdm.source.ipv6 = if(id_orig_h ~= ":", id_orig_h, null),
xdm.target.ipv4 = if(id_resp_h ~= "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}", id_resp_h, null),
xdm.target.ipv6 = if(id_resp_h ~= ":", id_resp_h, null),
xdm.source.port = to_integer(id_orig_p),
xdm.target.port = to_integer(id_resp_p),
xdm.event.type = _path,
xdm.observer.version = version,
xdm.observer.name = _system_name,
xdm.event.id = uid,
xdm.auth.ntlm.user_name = username,
xdm.auth.ntlm.hostname = hostname,
xdm.auth.ntlm.domain = domainname,
xdm.auth.ntlm.dns_domain = server_dns_computer_name,
xdm.auth.ntlm.dns_three = server_tree_name,
xdm.event.outcome = if(success = true, XDM_CONST.OUTCOME_SUCCESS, success = false, XDM_CONST.OUTCOME_FAILED, success = null, null, "UNKNOWN");
// Syslogs
filter _path ~= "syslog"
| alter
xdm.source.ipv4 = if(id_orig_h ~= "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}", id_orig_h, null),
xdm.source.ipv6 = if(id_orig_h ~= ":", id_orig_h, null),
xdm.target.ipv4 = if(id_resp_h ~= "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}", id_resp_h, null),
xdm.target.ipv6 = if(id_resp_h ~= ":", id_resp_h, null),
xdm.source.port = to_integer(id_orig_p),
xdm.target.port = to_integer(id_resp_p),
xdm.event.type = _path,
xdm.observer.version = version,
xdm.observer.name = _system_name,
xdm.event.id = uid,
xdm.event.description = message,
xdm.network.ip_protocol = if(proto=lowercase("HOPOPT"),XDM_CONST.IP_PROTOCOL_HOPOPT, proto=lowercase("ICMP"),XDM_CONST.IP_PROTOCOL_ICMP, proto=lowercase("IGMP"),XDM_CONST.IP_PROTOCOL_IGMP, proto=lowercase("GGP"),XDM_CONST.IP_PROTOCOL_GGP, proto=lowercase("IP"),XDM_CONST.IP_PROTOCOL_IP, proto=lowercase("ST"),XDM_CONST.IP_PROTOCOL_ST, proto=lowercase("TCP"),XDM_CONST.IP_PROTOCOL_TCP, proto=lowercase("CBT"),XDM_CONST.IP_PROTOCOL_CBT, proto=lowercase("EGP"),XDM_CONST.IP_PROTOCOL_EGP, proto=lowercase("IGP"),XDM_CONST.IP_PROTOCOL_IGP, proto=lowercase("BBN_RCC_MON"),XDM_CONST.IP_PROTOCOL_BBN_RCC_MON, proto=lowercase("NVP_II"),XDM_CONST.IP_PROTOCOL_NVP_II, proto=lowercase("PUP"),XDM_CONST.IP_PROTOCOL_PUP, proto=lowercase("ARGUS"),XDM_CONST.IP_PROTOCOL_ARGUS, proto=lowercase("EMCON"),XDM_CONST.IP_PROTOCOL_EMCON, proto=lowercase("XNET"),XDM_CONST.IP_PROTOCOL_XNET, proto=lowercase("CHAOS"),XDM_CONST.IP_PROTOCOL_CHAOS, proto=lowercase("UDP"),XDM_CONST.IP_PROTOCOL_UDP, proto=lowercase("MUX"),XDM_CONST.IP_PROTOCOL_MUX, proto=lowercase("DCN_MEAS"),XDM_CONST.IP_PROTOCOL_DCN_MEAS, proto=lowercase("HMP"),XDM_CONST.IP_PROTOCOL_HMP, proto=lowercase("PRM"),XDM_CONST.IP_PROTOCOL_PRM, proto=lowercase("XNS_IDP"),XDM_CONST.IP_PROTOCOL_XNS_IDP, proto=lowercase("TRUNK_1"),XDM_CONST.IP_PROTOCOL_TRUNK_1, proto=lowercase("TRUNK_2"),XDM_CONST.IP_PROTOCOL_TRUNK_2, proto=lowercase("LEAF_1"),XDM_CONST.IP_PROTOCOL_LEAF_1, proto=lowercase("LEAF_2"),XDM_CONST.IP_PROTOCOL_LEAF_2, proto=lowercase("RDP"),XDM_CONST.IP_PROTOCOL_RDP, proto=lowercase("IRTP"),XDM_CONST.IP_PROTOCOL_IRTP, proto=lowercase("ISO_TP4"),XDM_CONST.IP_PROTOCOL_ISO_TP4, proto=lowercase("NETBLT"),XDM_CONST.IP_PROTOCOL_NETBLT, proto=lowercase("MFE_NSP"),XDM_CONST.IP_PROTOCOL_MFE_NSP, proto=lowercase("MERIT_INP"),XDM_CONST.IP_PROTOCOL_MERIT_INP, proto=lowercase("DCCP"),XDM_CONST.IP_PROTOCOL_DCCP, proto=lowercase("3PC"),XDM_CONST.IP_PROTOCOL_3PC, proto=lowercase("IDPR"),XDM_CONST.IP_PROTOCOL_IDPR, proto=lowercase("XTP"),XDM_CONST.IP_PROTOCOL_XTP, proto=lowercase("DDP"),XDM_CONST.IP_PROTOCOL_DDP, proto=lowercase("IDPR_CMTP"),XDM_CONST.IP_PROTOCOL_IDPR_CMTP, proto=lowercase("TP"),XDM_CONST.IP_PROTOCOL_TP, proto=lowercase("IL"),XDM_CONST.IP_PROTOCOL_IL, proto=lowercase("IPV6"),XDM_CONST.IP_PROTOCOL_IPV6, proto=lowercase("SDRP"),XDM_CONST.IP_PROTOCOL_SDRP, proto=lowercase("IPV6_ROUTE"),XDM_CONST.IP_PROTOCOL_IPV6_ROUTE, proto=lowercase("IPV6_FRAG"),XDM_CONST.IP_PROTOCOL_IPV6_FRAG, proto=lowercase("IDRP"),XDM_CONST.IP_PROTOCOL_IDRP, proto=lowercase("RSVP"),XDM_CONST.IP_PROTOCOL_RSVP, proto=lowercase("GRE"),XDM_CONST.IP_PROTOCOL_GRE, proto=lowercase("DSR"),XDM_CONST.IP_PROTOCOL_DSR, proto=lowercase("BNA"),XDM_CONST.IP_PROTOCOL_BNA, proto=lowercase("ESP"),XDM_CONST.IP_PROTOCOL_ESP, proto=lowercase("AH"),XDM_CONST.IP_PROTOCOL_AH, proto=lowercase("I_NLSP"),XDM_CONST.IP_PROTOCOL_I_NLSP, proto=lowercase("SWIPE"),XDM_CONST.IP_PROTOCOL_SWIPE, proto=lowercase("NARP"),XDM_CONST.IP_PROTOCOL_NARP, proto=lowercase("MOBILE"),XDM_CONST.IP_PROTOCOL_MOBILE, proto=lowercase("TLSP"),XDM_CONST.IP_PROTOCOL_TLSP, proto=lowercase("SKIP"),XDM_CONST.IP_PROTOCOL_SKIP, proto=lowercase("IPV6_ICMP"),XDM_CONST.IP_PROTOCOL_IPV6_ICMP, proto=lowercase("IPV6_NONXT"),XDM_CONST.IP_PROTOCOL_IPV6_NONXT, proto=lowercase("IPV6_OPTS"),XDM_CONST.IP_PROTOCOL_IPV6_OPTS, proto=lowercase("CFTP"),XDM_CONST.IP_PROTOCOL_CFTP, proto=lowercase("SAT_EXPAK"),XDM_CONST.IP_PROTOCOL_SAT_EXPAK, proto=lowercase("KRYPTOLAN"),XDM_CONST.IP_PROTOCOL_KRYPTOLAN, proto=lowercase("RVD"),XDM_CONST.IP_PROTOCOL_RVD, proto=lowercase("IPPC"),XDM_CONST.IP_PROTOCOL_IPPC, proto=lowercase("SAT_MON"),XDM_CONST.IP_PROTOCOL_SAT_MON, proto=lowercase("VISA"),XDM_CONST.IP_PROTOCOL_VISA, proto=lowercase("IPCV"),XDM_CONST.IP_PROTOCOL_IPCV, proto=lowercase("CPNX"),XDM_CONST.IP_PROTOCOL_CPNX, proto=lowercase("CPHB"),XDM_CONST.IP_PROTOCOL_CPHB, proto=lowercase("WSN"),XDM_CONST.IP_PROTOCOL_WSN, proto=lowercase("PVP"),XDM_CONST.IP_PROTOCOL_PVP, proto=lowercase("BR_SAT_MON"),XDM_CONST.IP_PROTOCOL_BR_SAT_MON, proto=lowercase("SUN_ND"),XDM_CONST.IP_PROTOCOL_SUN_ND, proto=lowercase("WB_MON"),XDM_CONST.IP_PROTOCOL_WB_MON, proto=lowercase("WB_EXPAK"),XDM_CONST.IP_PROTOCOL_WB_EXPAK, proto=lowercase("ISO_IP"),XDM_CONST.IP_PROTOCOL_ISO_IP, proto=lowercase("VMTP"),XDM_CONST.IP_PROTOCOL_VMTP, proto=lowercase("SECURE_VMTP"),XDM_CONST.IP_PROTOCOL_SECURE_VMTP, proto=lowercase("VINES"),XDM_CONST.IP_PROTOCOL_VINES, proto=lowercase("TTP"),XDM_CONST.IP_PROTOCOL_TTP, proto=lowercase("NSFNET_IGP"),XDM_CONST.IP_PROTOCOL_NSFNET_IGP, proto=lowercase("DGP"),XDM_CONST.IP_PROTOCOL_DGP, proto=lowercase("TCF"),XDM_CONST.IP_PROTOCOL_TCF, proto=lowercase("EIGRP"),XDM_CONST.IP_PROTOCOL_EIGRP, proto=lowercase("OSPFIGP"),XDM_CONST.IP_PROTOCOL_OSPFIGP, proto=lowercase("SPRITE_RPC"),XDM_CONST.IP_PROTOCOL_SPRITE_RPC, proto=lowercase("LARP"),XDM_CONST.IP_PROTOCOL_LARP, proto=lowercase("MTP"),XDM_CONST.IP_PROTOCOL_MTP, proto=lowercase("AX25"),XDM_CONST.IP_PROTOCOL_AX25, proto=lowercase("IPIP"),XDM_CONST.IP_PROTOCOL_IPIP, proto=lowercase("MICP"),XDM_CONST.IP_PROTOCOL_MICP, proto=lowercase("SCC_SP"),XDM_CONST.IP_PROTOCOL_SCC_SP, proto=lowercase("ETHERIP"),XDM_CONST.IP_PROTOCOL_ETHERIP, proto=lowercase("ENCAP"),XDM_CONST.IP_PROTOCOL_ENCAP, proto=lowercase("GMTP"),XDM_CONST.IP_PROTOCOL_GMTP, proto=lowercase("IFMP"),XDM_CONST.IP_PROTOCOL_IFMP, proto=lowercase("PNNI"),XDM_CONST.IP_PROTOCOL_PNNI, proto=lowercase("PIM"),XDM_CONST.IP_PROTOCOL_PIM, proto=lowercase("ARIS"),XDM_CONST.IP_PROTOCOL_ARIS, proto=lowercase("SCPS"),XDM_CONST.IP_PROTOCOL_SCPS, proto=lowercase("QNX"),XDM_CONST.IP_PROTOCOL_QNX, proto=lowercase("AN"),XDM_CONST.IP_PROTOCOL_AN, proto=lowercase("IPCOMP"),XDM_CONST.IP_PROTOCOL_IPCOMP, proto=lowercase("COMPAQ_PEER"),XDM_CONST.IP_PROTOCOL_COMPAQ_PEER, proto=lowercase("IPX_IN_IP"),XDM_CONST.IP_PROTOCOL_IPX_IN_IP, proto=lowercase("VRRP"),XDM_CONST.IP_PROTOCOL_VRRP, proto=lowercase("PGM"),XDM_CONST.IP_PROTOCOL_PGM, proto=lowercase("L2TP"),XDM_CONST.IP_PROTOCOL_L2TP, proto=lowercase("DDX"),XDM_CONST.IP_PROTOCOL_DDX, proto=lowercase("IATP"),XDM_CONST.IP_PROTOCOL_IATP, proto=lowercase("STP"),XDM_CONST.IP_PROTOCOL_STP, proto=lowercase("SRP"),XDM_CONST.IP_PROTOCOL_SRP, proto=lowercase("UTI"),XDM_CONST.IP_PROTOCOL_UTI, proto=lowercase("SMP"),XDM_CONST.IP_PROTOCOL_SMP, proto=lowercase("SM"),XDM_CONST.IP_PROTOCOL_SM, proto=lowercase("PTP"),XDM_CONST.IP_PROTOCOL_PTP, proto=lowercase("ISIS"),XDM_CONST.IP_PROTOCOL_ISIS, proto=lowercase("FIRE"),XDM_CONST.IP_PROTOCOL_FIRE, proto=lowercase("CRTP"),XDM_CONST.IP_PROTOCOL_CRTP, proto=lowercase("CRUDP"),XDM_CONST.IP_PROTOCOL_CRUDP, proto=lowercase("SSCOPMCE"),XDM_CONST.IP_PROTOCOL_SSCOPMCE, proto=lowercase("IPLT"),XDM_CONST.IP_PROTOCOL_IPLT, proto=lowercase("SPS"),XDM_CONST.IP_PROTOCOL_SPS, proto=lowercase("PIPE"),XDM_CONST.IP_PROTOCOL_PIPE, proto=lowercase("SCTP"),XDM_CONST.IP_PROTOCOL_SCTP, proto=lowercase("FC"),XDM_CONST.IP_PROTOCOL_FC, proto=lowercase("RSVP_E2E_IGNORE"),XDM_CONST.IP_PROTOCOL_RSVP_E2E_IGNORE, proto=lowercase("MOBILITY"),XDM_CONST.IP_PROTOCOL_MOBILITY, proto=lowercase("UDPLITE"),XDM_CONST.IP_PROTOCOL_UDPLITE, proto=lowercase("MPLS_IN_IP"),XDM_CONST.IP_PROTOCOL_MPLS_IN_IP,to_string(proto)),
xdm.alert.severity = severity,
xdm.intermediate.process.name = facility;
// Conn Logs
filter _path ~= "conn"
| alter
xdm.source.ipv4 = if(id_orig_h ~= "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}", id_orig_h, null),
xdm.source.ipv6 = if(id_orig_h ~= ":", id_orig_h, null),
xdm.target.ipv4 = if(id_resp_h ~= "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}", id_resp_h, null),
xdm.target.ipv6 = if(id_resp_h ~= ":", id_resp_h, null),
xdm.source.port = to_integer(id_orig_p),
xdm.target.port = to_integer(id_resp_p),
xdm.event.type = _path,
xdm.observer.version = version,
xdm.observer.name = _system_name,
xdm.event.id = uid,
xdm.event.operation_sub_type = conn_state,
xdm.network.application_protocol = service,
xdm.network.ip_protocol = if(proto=lowercase("HOPOPT"),XDM_CONST.IP_PROTOCOL_HOPOPT, proto=lowercase("ICMP"),XDM_CONST.IP_PROTOCOL_ICMP, proto=lowercase("IGMP"),XDM_CONST.IP_PROTOCOL_IGMP, proto=lowercase("GGP"),XDM_CONST.IP_PROTOCOL_GGP, proto=lowercase("IP"),XDM_CONST.IP_PROTOCOL_IP, proto=lowercase("ST"),XDM_CONST.IP_PROTOCOL_ST, proto=lowercase("TCP"),XDM_CONST.IP_PROTOCOL_TCP, proto=lowercase("CBT"),XDM_CONST.IP_PROTOCOL_CBT, proto=lowercase("EGP"),XDM_CONST.IP_PROTOCOL_EGP, proto=lowercase("IGP"),XDM_CONST.IP_PROTOCOL_IGP, proto=lowercase("BBN_RCC_MON"),XDM_CONST.IP_PROTOCOL_BBN_RCC_MON, proto=lowercase("NVP_II"),XDM_CONST.IP_PROTOCOL_NVP_II, proto=lowercase("PUP"),XDM_CONST.IP_PROTOCOL_PUP, proto=lowercase("ARGUS"),XDM_CONST.IP_PROTOCOL_ARGUS, proto=lowercase("EMCON"),XDM_CONST.IP_PROTOCOL_EMCON, proto=lowercase("XNET"),XDM_CONST.IP_PROTOCOL_XNET, proto=lowercase("CHAOS"),XDM_CONST.IP_PROTOCOL_CHAOS, proto=lowercase("UDP"),XDM_CONST.IP_PROTOCOL_UDP, proto=lowercase("MUX"),XDM_CONST.IP_PROTOCOL_MUX, proto=lowercase("DCN_MEAS"),XDM_CONST.IP_PROTOCOL_DCN_MEAS, proto=lowercase("HMP"),XDM_CONST.IP_PROTOCOL_HMP, proto=lowercase("PRM"),XDM_CONST.IP_PROTOCOL_PRM, proto=lowercase("XNS_IDP"),XDM_CONST.IP_PROTOCOL_XNS_IDP, proto=lowercase("TRUNK_1"),XDM_CONST.IP_PROTOCOL_TRUNK_1, proto=lowercase("TRUNK_2"),XDM_CONST.IP_PROTOCOL_TRUNK_2, proto=lowercase("LEAF_1"),XDM_CONST.IP_PROTOCOL_LEAF_1, proto=lowercase("LEAF_2"),XDM_CONST.IP_PROTOCOL_LEAF_2, proto=lowercase("RDP"),XDM_CONST.IP_PROTOCOL_RDP, proto=lowercase("IRTP"),XDM_CONST.IP_PROTOCOL_IRTP, proto=lowercase("ISO_TP4"),XDM_CONST.IP_PROTOCOL_ISO_TP4, proto=lowercase("NETBLT"),XDM_CONST.IP_PROTOCOL_NETBLT, proto=lowercase("MFE_NSP"),XDM_CONST.IP_PROTOCOL_MFE_NSP, proto=lowercase("MERIT_INP"),XDM_CONST.IP_PROTOCOL_MERIT_INP, proto=lowercase("DCCP"),XDM_CONST.IP_PROTOCOL_DCCP, proto=lowercase("3PC"),XDM_CONST.IP_PROTOCOL_3PC, proto=lowercase("IDPR"),XDM_CONST.IP_PROTOCOL_IDPR, proto=lowercase("XTP"),XDM_CONST.IP_PROTOCOL_XTP, proto=lowercase("DDP"),XDM_CONST.IP_PROTOCOL_DDP, proto=lowercase("IDPR_CMTP"),XDM_CONST.IP_PROTOCOL_IDPR_CMTP, proto=lowercase("TP"),XDM_CONST.IP_PROTOCOL_TP, proto=lowercase("IL"),XDM_CONST.IP_PROTOCOL_IL, proto=lowercase("IPV6"),XDM_CONST.IP_PROTOCOL_IPV6, proto=lowercase("SDRP"),XDM_CONST.IP_PROTOCOL_SDRP, proto=lowercase("IPV6_ROUTE"),XDM_CONST.IP_PROTOCOL_IPV6_ROUTE, proto=lowercase("IPV6_FRAG"),XDM_CONST.IP_PROTOCOL_IPV6_FRAG, proto=lowercase("IDRP"),XDM_CONST.IP_PROTOCOL_IDRP, proto=lowercase("RSVP"),XDM_CONST.IP_PROTOCOL_RSVP, proto=lowercase("GRE"),XDM_CONST.IP_PROTOCOL_GRE, proto=lowercase("DSR"),XDM_CONST.IP_PROTOCOL_DSR, proto=lowercase("BNA"),XDM_CONST.IP_PROTOCOL_BNA, proto=lowercase("ESP"),XDM_CONST.IP_PROTOCOL_ESP, proto=lowercase("AH"),XDM_CONST.IP_PROTOCOL_AH, proto=lowercase("I_NLSP"),XDM_CONST.IP_PROTOCOL_I_NLSP, proto=lowercase("SWIPE"),XDM_CONST.IP_PROTOCOL_SWIPE, proto=lowercase("NARP"),XDM_CONST.IP_PROTOCOL_NARP, proto=lowercase("MOBILE"),XDM_CONST.IP_PROTOCOL_MOBILE, proto=lowercase("TLSP"),XDM_CONST.IP_PROTOCOL_TLSP, proto=lowercase("SKIP"),XDM_CONST.IP_PROTOCOL_SKIP, proto=lowercase("IPV6_ICMP"),XDM_CONST.IP_PROTOCOL_IPV6_ICMP, proto=lowercase("IPV6_NONXT"),XDM_CONST.IP_PROTOCOL_IPV6_NONXT, proto=lowercase("IPV6_OPTS"),XDM_CONST.IP_PROTOCOL_IPV6_OPTS, proto=lowercase("CFTP"),XDM_CONST.IP_PROTOCOL_CFTP, proto=lowercase("SAT_EXPAK"),XDM_CONST.IP_PROTOCOL_SAT_EXPAK, proto=lowercase("KRYPTOLAN"),XDM_CONST.IP_PROTOCOL_KRYPTOLAN, proto=lowercase("RVD"),XDM_CONST.IP_PROTOCOL_RVD, proto=lowercase("IPPC"),XDM_CONST.IP_PROTOCOL_IPPC, proto=lowercase("SAT_MON"),XDM_CONST.IP_PROTOCOL_SAT_MON, proto=lowercase("VISA"),XDM_CONST.IP_PROTOCOL_VISA, proto=lowercase("IPCV"),XDM_CONST.IP_PROTOCOL_IPCV, proto=lowercase("CPNX"),XDM_CONST.IP_PROTOCOL_CPNX, proto=lowercase("CPHB"),XDM_CONST.IP_PROTOCOL_CPHB, proto=lowercase("WSN"),XDM_CONST.IP_PROTOCOL_WSN, proto=lowercase("PVP"),XDM_CONST.IP_PROTOCOL_PVP, proto=lowercase("BR_SAT_MON"),XDM_CONST.IP_PROTOCOL_BR_SAT_MON, proto=lowercase("SUN_ND"),XDM_CONST.IP_PROTOCOL_SUN_ND, proto=lowercase("WB_MON"),XDM_CONST.IP_PROTOCOL_WB_MON, proto=lowercase("WB_EXPAK"),XDM_CONST.IP_PROTOCOL_WB_EXPAK, proto=lowercase("ISO_IP"),XDM_CONST.IP_PROTOCOL_ISO_IP, proto=lowercase("VMTP"),XDM_CONST.IP_PROTOCOL_VMTP, proto=lowercase("SECURE_VMTP"),XDM_CONST.IP_PROTOCOL_SECURE_VMTP, proto=lowercase("VINES"),XDM_CONST.IP_PROTOCOL_VINES, proto=lowercase("TTP"),XDM_CONST.IP_PROTOCOL_TTP, proto=lowercase("NSFNET_IGP"),XDM_CONST.IP_PROTOCOL_NSFNET_IGP, proto=lowercase("DGP"),XDM_CONST.IP_PROTOCOL_DGP, proto=lowercase("TCF"),XDM_CONST.IP_PROTOCOL_TCF, proto=lowercase("EIGRP"),XDM_CONST.IP_PROTOCOL_EIGRP, proto=lowercase("OSPFIGP"),XDM_CONST.IP_PROTOCOL_OSPFIGP, proto=lowercase("SPRITE_RPC"),XDM_CONST.IP_PROTOCOL_SPRITE_RPC, proto=lowercase("LARP"),XDM_CONST.IP_PROTOCOL_LARP, proto=lowercase("MTP"),XDM_CONST.IP_PROTOCOL_MTP, proto=lowercase("AX25"),XDM_CONST.IP_PROTOCOL_AX25, proto=lowercase("IPIP"),XDM_CONST.IP_PROTOCOL_IPIP, proto=lowercase("MICP"),XDM_CONST.IP_PROTOCOL_MICP, proto=lowercase("SCC_SP"),XDM_CONST.IP_PROTOCOL_SCC_SP, proto=lowercase("ETHERIP"),XDM_CONST.IP_PROTOCOL_ETHERIP, proto=lowercase("ENCAP"),XDM_CONST.IP_PROTOCOL_ENCAP, proto=lowercase("GMTP"),XDM_CONST.IP_PROTOCOL_GMTP, proto=lowercase("IFMP"),XDM_CONST.IP_PROTOCOL_IFMP, proto=lowercase("PNNI"),XDM_CONST.IP_PROTOCOL_PNNI, proto=lowercase("PIM"),XDM_CONST.IP_PROTOCOL_PIM, proto=lowercase("ARIS"),XDM_CONST.IP_PROTOCOL_ARIS, proto=lowercase("SCPS"),XDM_CONST.IP_PROTOCOL_SCPS, proto=lowercase("QNX"),XDM_CONST.IP_PROTOCOL_QNX, proto=lowercase("AN"),XDM_CONST.IP_PROTOCOL_AN, proto=lowercase("IPCOMP"),XDM_CONST.IP_PROTOCOL_IPCOMP, proto=lowercase("COMPAQ_PEER"),XDM_CONST.IP_PROTOCOL_COMPAQ_PEER, proto=lowercase("IPX_IN_IP"),XDM_CONST.IP_PROTOCOL_IPX_IN_IP, proto=lowercase("VRRP"),XDM_CONST.IP_PROTOCOL_VRRP, proto=lowercase("PGM"),XDM_CONST.IP_PROTOCOL_PGM, proto=lowercase("L2TP"),XDM_CONST.IP_PROTOCOL_L2TP, proto=lowercase("DDX"),XDM_CONST.IP_PROTOCOL_DDX, proto=lowercase("IATP"),XDM_CONST.IP_PROTOCOL_IATP, proto=lowercase("STP"),XDM_CONST.IP_PROTOCOL_STP, proto=lowercase("SRP"),XDM_CONST.IP_PROTOCOL_SRP, proto=lowercase("UTI"),XDM_CONST.IP_PROTOCOL_UTI, proto=lowercase("SMP"),XDM_CONST.IP_PROTOCOL_SMP, proto=lowercase("SM"),XDM_CONST.IP_PROTOCOL_SM, proto=lowercase("PTP"),XDM_CONST.IP_PROTOCOL_PTP, proto=lowercase("ISIS"),XDM_CONST.IP_PROTOCOL_ISIS, proto=lowercase("FIRE"),XDM_CONST.IP_PROTOCOL_FIRE, proto=lowercase("CRTP"),XDM_CONST.IP_PROTOCOL_CRTP, proto=lowercase("CRUDP"),XDM_CONST.IP_PROTOCOL_CRUDP, proto=lowercase("SSCOPMCE"),XDM_CONST.IP_PROTOCOL_SSCOPMCE, proto=lowercase("IPLT"),XDM_CONST.IP_PROTOCOL_IPLT, proto=lowercase("SPS"),XDM_CONST.IP_PROTOCOL_SPS, proto=lowercase("PIPE"),XDM_CONST.IP_PROTOCOL_PIPE, proto=lowercase("SCTP"),XDM_CONST.IP_PROTOCOL_SCTP, proto=lowercase("FC"),XDM_CONST.IP_PROTOCOL_FC, proto=lowercase("RSVP_E2E_IGNORE"),XDM_CONST.IP_PROTOCOL_RSVP_E2E_IGNORE, proto=lowercase("MOBILITY"),XDM_CONST.IP_PROTOCOL_MOBILITY, proto=lowercase("UDPLITE"),XDM_CONST.IP_PROTOCOL_UDPLITE, proto=lowercase("MPLS_IN_IP"),XDM_CONST.IP_PROTOCOL_MPLS_IN_IP,to_string(proto)),
xdm.event.duration = to_integer(multiply(to_float(duration), 1000)),
xdm.source.sent_bytes = to_integer(orig_bytes),
xdm.source.sent_packets = to_integer(orig_pkts),
xdm.target.sent_bytes = to_integer(resp_bytes),
xdm.target.sent_packets = to_integer(resp_pkts)
| alter
xdm.event.outcome = if(proto = "tcp" and to_integer(resp_pkts) > 0, XDM_CONST.OUTCOME_SUCCESS, proto = "tcp" and to_integer(resp_pkts) = 0, XDM_CONST.OUTCOME_FAILED, proto = "icmp" and to_integer(resp_pkts) > 0 and to_integer(orig_bytes) > 0, XDM_CONST.OUTCOME_SUCCESS, proto = "icmp" and to_integer(resp_pkts) = 0 and to_integer(orig_bytes) > 0, XDM_CONST.OUTCOME_FAILED, to_integer(resp_pkts) > 0 and to_integer(orig_bytes) > 0 and to_integer(resp_bytes) > 0 and to_integer(orig_pkts) > 0, XDM_CONST.OUTCOME_SUCCESS, null);
// Kerberos
filter _path ~= "kerberos"
| alter
lower_c_cipher = lowercase(cipher)
| alter
xdm.source.ipv4 = if(id_orig_h ~= "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}", id_orig_h, null),
xdm.source.ipv6 = if(id_orig_h ~= ":", id_orig_h, null),
xdm.target.ipv4 = if(id_resp_h ~= "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}", id_resp_h, null),
xdm.target.ipv6 = if(id_resp_h ~= ":", id_resp_h, null),
xdm.source.port = to_integer(id_orig_p),
xdm.target.port = to_integer(id_resp_p),
xdm.event.type = _path,
xdm.observer.version = version,
xdm.observer.name = _system_name,
xdm.event.id = uid,
xdm.event.outcome = if(success = true, XDM_CONST.OUTCOME_SUCCESS, success = false, XDM_CONST.OUTCOME_FAILED , success = null, null, to_string(success)),
xdm.auth.kerberos_tgt.msg_type = if(request_type = "AS", XDM_CONST.KERBEROS_MSG_TYPE_AS_REQ, request_type = "TGS", XDM_CONST.KERBEROS_MSG_TYPE_TGS_REQ, request_type = "AP", XDM_CONST.KERBEROS_MSG_TYPE_AP_REQ, request_type = "RESERVED16", XDM_CONST.KERBEROS_MSG_TYPE_RESERVED16, request_type = "SAFE", XDM_CONST.KERBEROS_MSG_TYPE_SAFE, request_type = "PRIV", XDM_CONST.KERBEROS_MSG_TYPE_PRIV, request_type = "CRED", XDM_CONST.KERBEROS_MSG_TYPE_CRED, request_type = "ERROR", XDM_CONST.KERBEROS_MSG_TYPE_ERROR, request_type = null, null, to_string(request_type)),
xdm.auth.kerberos_tgt.spn_values = arraycreate(service),
xdm.auth.kerberos_tgt.cname_values = arraycreate(client),
xdm.auth.kerberos_tgt.encryption_type = if(lower_c_cipher ~= "des[\-|\_]cbc[\-|\_]crc", XDM_CONST.KERBEROS_ENCRYPTION_TYPE_DES_CBC_CRC, lower_c_cipher ~= "aes128[\_|\-]cts[\_|\-]hmac[\_|\-]sha1[\_|\-]96", XDM_CONST.KERBEROS_ENCRYPTION_TYPE_AES128_CTS_HMAC_SHA1_96, lower_c_cipher ~= "aes128[\_|\-]cts[\_|\-]hmac[\_|\-]sha256[\_|\-]128", XDM_CONST.KERBEROS_ENCRYPTION_TYPE_AES128_CTS_HMAC_SHA1_96, lower_c_cipher ~= "aes256[\_|\-]cts[\_|\-]hmac[\_|\-]sha1[\_|\-]96", XDM_CONST.KERBEROS_ENCRYPTION_TYPE_AES256_CTS_HMAC_SHA1_96, lower_c_cipher ~= "aes256[\_|\-]cts[\_|\-]hmac[\_|\-]sha384[\_|\-]192", XDM_CONST.KERBEROS_ENCRYPTION_TYPE_AES256_CTS_HMAC_SHA384_192, lower_c_cipher ~= "camellia128[\_|\-]cts[\_|\-]cmac", XDM_CONST.KERBEROS_ENCRYPTION_TYPE_CAMELLIA128_CTS_CMAC, lower_c_cipher ~= "camellia256[\_|\-]cts[\_|\-]cmac", XDM_CONST.KERBEROS_ENCRYPTION_TYPE_CAMELLIA256_CTS_CMAC, lower_c_cipher ~= "des3[\_|\-]cbc[\_|\-]md5", XDM_CONST.KERBEROS_ENCRYPTION_TYPE_DES3_CBC_MD5, lower_c_cipher ~= "des3[\_|\-]cbc[\_|\-]raw", XDM_CONST.KERBEROS_ENCRYPTION_TYPE_DES3_CBC_RAW, lower_c_cipher ~= "des3[\_|\-]cbc[\_|\-]sha1[\_|\-]kd", XDM_CONST.KERBEROS_ENCRYPTION_TYPE_DES3_CBC_SHA1_KD, lower_c_cipher ~= "des3[\_|\-]cbc[\_|\-]sha1", XDM_CONST.KERBEROS_ENCRYPTION_TYPE_DES3_CBC_SHA1, lower_c_cipher ~= "des[\_|\-]cbc[\_|\-]md4", XDM_CONST.KERBEROS_ENCRYPTION_TYPE_DES_CBC_MD4, lower_c_cipher ~= "des[\_|\-]cbc[\_|\-]md5", XDM_CONST.KERBEROS_ENCRYPTION_TYPE_DES_CBC_MD5, lower_c_cipher ~= "des[\_|\-]cbc[\_|\-]raw", XDM_CONST.KERBEROS_ENCRYPTION_TYPE_DES_CBC_RAW, lower_c_cipher ~= "des[\_|\-]ede3[\_|\-]cbc[\_|\-]env[\_|\-]oid", XDM_CONST.KERBEROS_ENCRYPTION_TYPE_DES_EDE3_CBC_ENV_OID, lower_c_cipher ~= "des[\_|\-]hmac[\_|\-]sha1", XDM_CONST.KERBEROS_ENCRYPTION_TYPE_DES_HMAC_SHA1, lower_c_cipher ~= "dsawithsha1[\_|\-]cmsoid", XDM_CONST.KERBEROS_ENCRYPTION_TYPE_DSAWITHSHA1_CMSOID, lower_c_cipher ~= "md5withrsaencryption[\_|\-]cmsoid", XDM_CONST.KERBEROS_ENCRYPTION_TYPE_MD5WITHRSAENCRYPTION_CMSOID, lower_c_cipher ~= "rc2cbc[\_|\-]envoid", XDM_CONST.KERBEROS_ENCRYPTION_TYPE_RC2CBC_ENVOID, lower_c_cipher ~= "rc4[\_|\-]hmac[\_|\-]exp", XDM_CONST.KERBEROS_ENCRYPTION_TYPE_RC4_HMAC_EXP, lower_c_cipher ~= "rc4[\_|\-]hmac", XDM_CONST.KERBEROS_ENCRYPTION_TYPE_RC4_HMAC, lower_c_cipher ~= "rsaencryption[\_|\-]envoid", XDM_CONST.KERBEROS_ENCRYPTION_TYPE_RSAENCRYPTION_ENVOID, lower_c_cipher ~= "rsaes[\_|\-]oaep[\_|\-]env[\_|\-]oid", XDM_CONST.KERBEROS_ENCRYPTION_TYPE_RSAES_OAEP_ENV_OID, lower_c_cipher ~= "sha1withrsaencryption[\_|\-]cmsoid", XDM_CONST.KERBEROS_ENCRYPTION_TYPE_SHA1WITHRSAENCRYPTION_CMSOID, lower_c_cipher ~= "subkey[\_|\-]keymaterial", XDM_CONST.KERBEROS_ENCRYPTION_TYPE_SUBKEY_KEYMATERIAL, to_string(lower_c_cipher));
// DCE_RPC
filter _path ~= "dce_rpc"
| alter
xdm.source.ipv4 = if(id_orig_h ~= "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}", id_orig_h, null),
xdm.source.ipv6 = if(id_orig_h ~= ":", id_orig_h, null),
xdm.target.ipv4 = if(id_resp_h ~= "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}", id_resp_h, null),
xdm.target.ipv6 = if(id_resp_h ~= ":", id_resp_h, null),
xdm.source.port = to_integer(id_orig_p),
xdm.target.port = to_integer(id_resp_p),
xdm.event.type = _path,
xdm.observer.name = _system_name,
xdm.event.id = uid,
xdm.event.duration = to_integer(rtt),
xdm.intermediate.application.name = named_pipe,
xdm.source.user.identifier = endpoint,
xdm.event.outcome_reason = operation,
xdm.observer.version = version;