[MODEL: dataset = "cyberark_pta_raw"]
// This is a beta Modeling Rule, which lets you process CyberArk PTA log fields to XDM fields.
// Since the Modeling Rule is considered as beta, it might not contain some of the fields that are available from the logs.
// We appreciate your feedback on the quality and usability of the Modeling Rule to help us identify issues, fix them, and continually improve.
alter
src_ip_v4 = if(src !~= ":", src, null),
src_ip_v6 = if(src ~= ":", src, null),
tar_ip_v4 = if(dst !~= ":", dst, null),
tar_ip_v6 = if(dst ~= ":", dst, null)
| alter
xdm.source.ipv4 = src_ip_v4,
xdm.source.ipv6 = src_ip_v6,
xdm.target.ipv4 = tar_ip_v4,
xdm.target.ipv6 = tar_ip_v6,
xdm.source.user.user_type = if(suser ~= "@", XDM_CONST.USER_TYPE_REGULAR, suser ~= "Vault user", XDM_CONST.USER_TYPE_SERVICE_ACCOUNT),
xdm.source.identity.user_type = if(suser ~= "@", XDM_CONST.USER_TYPE_REGULAR, suser ~= "Vault user", XDM_CONST.USER_TYPE_SERVICE_ACCOUNT),
xdm.target.user.user_type = if(duser ~= "@", XDM_CONST.USER_TYPE_REGULAR, duser ~= "Vault user", XDM_CONST.USER_TYPE_SERVICE_ACCOUNT),
xdm.target.identity.user_type = if(duser ~= "@", XDM_CONST.USER_TYPE_REGULAR, duser ~= "Vault user", XDM_CONST.USER_TYPE_SERVICE_ACCOUNT),
xdm.event.description = cs1,
xdm.alert.original_alert_id = cs2,
xdm.observer.unique_identifier = cs3,
xdm.intermediate.application.name = cs4,
xdm.event.operation_sub_type = cs5,
xdm.target.host.hostname = dhost,
xdm.target.user.username = duser,
xdm.target.identity.username = duser,
xdm.source.host.hostname = shost,
xdm.source.user.username = suser,
xdm.source.identity.username = suser,
xdm.event.type = cefName,
xdm.alert.severity = cefSeverity,
xdm.event.id = cefDeviceEventClassId;