Rules (XIF)
[MODEL: dataset="cyber_ark_vault_raw"]
alter
event_description = uppercase(cefName),
reason_uppercase = uppercase(reason),
cs2_len = len(cs2),
cn2_len = len(to_string(cn2))
| alter
xdm.alert.name = cefName,
xdm.alert.severity = cefSeverity,
xdm.alert.original_alert_id = to_string(cn1),
xdm.database.name = cs4, // ExtraDetails.DataBase
xdm.event.id = cefDeviceEventClassId,
xdm.event.type = cefName,
xdm.event.description = msg,
xdm.event.operation_sub_type = act,
xdm.event.outcome = if(event_description ~= "SUCCESS|SUCCEEDED",XDM_CONST.OUTCOME_SUCCESS, event_description ~= "FAIL|UNAUTHORIZED|BLOCK|INCORRECT", XDM_CONST.OUTCOME_FAILED),
xdm.event.outcome_reason = if(reason_uppercase ~= "FAILURE|WARNING|INFO", reason, cn2_len > 0, cn2, msg),
xdm.event.log_level = if(cefSeverity = "10", XDM_CONST.LOG_LEVEL_CRITICAL, cefSeverity = "7", XDM_CONST.LOG_LEVEL_ERROR, cefSeverity = "5", XDM_CONST.LOG_LEVEL_INFORMATIONAL),
xdm.intermediate.ipv4 = if(dvc ~= "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}", dvc, null),
xdm.intermediate.ipv6 = if(dvc ~= "[a-fA-F\d\:]{8,}", dvc, null),
xdm.network.application_protocol = app, // ExtraDetails.Protocol
xdm.network.session_id = to_string(externalID), // ExtraDetails.SessionID
xdm.observer.version = cefDeviceVersion,
xdm.source.user.username = suser,
xdm.source.ipv4 = if(shost ~= "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}", shost),
xdm.source.ipv6 = if(shost ~= "[a-fA-F\d\:]{8,}", shost),
xdm.source.host.hostname = if(shost !~= "\d{1,3}\.\d{1,3}\d{1,3}\.\d{1,3}|[a-fA-F\d\:]{8,}", shost),
xdm.source.host.device_category = cs3,
xdm.source.process.command_line = reason, // ExtraDetails.Command
xdm.target.ipv4 = if(dhost ~= "\d{1,3}\.\d{1,3}\d{1,3}\.\d{1,3}", dhost),
xdm.target.ipv6 = if(dhost ~= "[a-fA-F\d\:]{8,}", dhost),
xdm.target.host.hostname = if(dhost !~= "\d{1,3}\.\d{1,3}\d{1,3}\.\d{1,3}|[a-fA-F\d\:]{8,}", dhost),
xdm.target.user.username = if(len(duser) > 0, duser, cs1),
xdm.target.file.filename = fname,
xdm.target.resource.name = if(cs2_len > 0, cs2), // name of the target safe
xdm.target.resource.type = if(cs2_len > 0, trim(cs2Label, "\"")); // "Safe Name" label
Schema
cyber_ark_vault_raw
| Field |
Type |
Array? |
act |
string |
— |
app |
string |
— |
cefDeviceEventClassId |
string |
— |
cefDeviceProduct |
string |
— |
cefDeviceVendor |
string |
— |
cefDeviceVersion |
string |
— |
cefName |
string |
— |
cefSeverity |
string |
— |
cn1 |
string |
— |
cn1Label |
string |
— |
cn2 |
string |
— |
cn2Label |
string |
— |
cs1 |
string |
— |
cs1Label |
string |
— |
cs2 |
string |
— |
cs2Label |
string |
— |
cs3 |
string |
— |
cs3Label |
string |
— |
cs4 |
string |
— |
cs4Label |
string |
— |
cs5 |
string |
— |
cs5Label |
string |
— |
cs6 |
datetime |
— |
cs6Label |
string |
— |
dhost |
string |
— |
duser |
string |
— |
dvc |
string |
— |
externalID |
string |
— |
fname |
string |
— |
msg |
string |
— |
reason |
string |
— |
shost |
string |
— |
suser |
string |
— |
Raw JSON
{
"cyber_ark_vault_raw": {
"act": {
"type": "string",
"is_array": false
},
"app": {
"type": "string",
"is_array": false
},
"cefDeviceEventClassId": {
"type": "string",
"is_array": false
},
"cefDeviceProduct": {
"type": "string",
"is_array": false
},
"cefDeviceVendor": {
"type": "string",
"is_array": false
},
"cefDeviceVersion": {
"type": "string",
"is_array": false
},
"cefName": {
"type": "string",
"is_array": false
},
"cefSeverity": {
"type": "string",
"is_array": false
},
"cn1": {
"type": "string",
"is_array": false
},
"cn1Label": {
"type": "string",
"is_array": false
},
"cn2": {
"type": "string",
"is_array": false
},
"cn2Label": {
"type": "string",
"is_array": false
},
"cs1": {
"type": "string",
"is_array": false
},
"cs1Label": {
"type": "string",
"is_array": false
},
"cs2": {
"type": "string",
"is_array": false
},
"cs2Label": {
"type": "string",
"is_array": false
},
"cs3": {
"type": "string",
"is_array": false
},
"cs3Label": {
"type": "string",
"is_array": false
},
"cs4": {
"type": "string",
"is_array": false
},
"cs4Label": {
"type": "string",
"is_array": false
},
"cs5": {
"type": "string",
"is_array": false
},
"cs5Label": {
"type": "string",
"is_array": false
},
"cs6": {
"type": "datetime",
"is_array": false
},
"cs6Label": {
"type": "string",
"is_array": false
},
"dhost": {
"type": "string",
"is_array": false
},
"duser": {
"type": "string",
"is_array": false
},
"dvc": {
"type": "string",
"is_array": false
},
"externalID": {
"type": "string",
"is_array": false
},
"fname": {
"type": "string",
"is_array": false
},
"msg": {
"type": "string",
"is_array": false
},
"reason": {
"type": "string",
"is_array": false
},
"shost": {
"type": "string",
"is_array": false
},
"suser": {
"type": "string",
"is_array": false
}
}
}