Rules (XIF)
[MODEL: dataset ="darktrace_darktrace_raw"]
alter
xdm.alert.description = json_extract_scalar(model, "$.then.description"),
xdm.event.description = json_extract_scalar(model, "$.then.description"),
xdm.alert.mitre_tactics = arraymap(json_extract_array(model, "$.then.mitre.tactics"), trim("@element", "\"")),
xdm.alert.mitre_techniques = arraymap(json_extract_array(model, "$.then.mitre.techniques"), trim("@element", "\"")),
xdm.alert.original_alert_id = to_string(pbid),
xdm.event.id = to_string(pbid),
xdm.alert.original_threat_id = to_string(json_extract_scalar(model, "$.then.uuid")),
xdm.alert.original_threat_name = json_extract_scalar(model, "$.then.name"),
xdm.event.type = json_extract_scalar(model, "$.then.name"),
xdm.alert.severity = to_string(score),
priority = json_extract_scalar(model, "$.then.priority"),
xdm.event.tags = arraymap(json_extract_array(model, "$.then.tags"), trim("@element", "\"")),
xdm.network.rule = to_string(json_extract_scalar(model, "$.then.pid")),
xdm.observer.action = json_extract_scalar(model, "$.then.actions.antigena.action"),
xdm.observer.name = json_extract_scalar(device, "$.hostname"),
xdm.observer.unique_identifier = to_string(json_extract_scalar(device, "$.did")),
xdm.source.host.device_category = json_extract_scalar(device, "$.typelabel"),
xdm.source.host.device_id = to_string(coalesce(json_extract_scalar(device, "$.did"), json_extract_scalar(triggeredComponents, "$.device.did"))),
xdm.source.host.hostname = json_extract_scalar(device, "$.hostname"),
historically_associated_ip_records = json_extract_array(device, "$.ips"),
currently_associated_ip_address = json_extract_scalar(device, "$.ip"),
mac_address = json_extract_scalar(device, "$.macaddress"),
xdm.source.host.manufacturer = json_extract_scalar(device, "$.vendor"),
ip_address = json_extract_scalar(device, "$.ip"),
xdm.source.subnet = to_string(json_extract_scalar(device, "$.sid")),
xdm.target.resource_before.id = to_string(json_extract_scalar(model, "$.then.phid")),
xdm.target.resource_before.parent_id = json_extract_scalar(model, "$.then.created.by"),
xdm.target.resource.id = to_string(json_extract_scalar(model, "$.then.pid")),
xdm.target.resource.parent_id = coalesce(json_extract_scalar(model, "$.then.edited.by"), json_extract_scalar(model, "$.then.edited.userID"))
| alter
xdm.event.log_level = if(priority in("0", "1", "2", "3"), XDM_CONST.LOG_LEVEL_INFORMATIONAL, priority = "4", XDM_CONST.LOG_LEVEL_WARNING , priority = "5",XDM_CONST.LOG_LEVEL_CRITICAL),
historically_associated_ip_addresses = arraymap(historically_associated_ip_records , json_extract_scalar("@element", "$.ip")),
xdm.source.interface = mac_address,
xdm.source.host.mac_addresses = arraycreate(mac_address),
xdm.source.ipv4 = if(ip_address ~= "^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$", ip_address, null),
xdm.source.ipv6 = if(ip_address ~= "\:[a-fA-F\d]{1,4}|[a-fA-F\d]{1,4}\:", ip_address, null)
| alter
all_associated_ip_addresses = arraydistinct(arrayconcat(arraycreate(currently_associated_ip_address), historically_associated_ip_addresses))
| alter
xdm.source.host.ipv4_addresses = arrayfilter(all_associated_ip_addresses, "@element" ~= "^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$"),
xdm.source.host.ipv6_addresses = arrayfilter(all_associated_ip_addresses, "@element" ~= "\:[a-fA-F\d]{1,4}|[a-fA-F\d]{1,4}\:");