Delinea Secret Server

Details

ID	`Delinea Secret Server`
From Version	6.10.0
Tags	Delinea Secret Server

Rules (XIF)

[MODEL: dataset="thycotic_software_secret_server_raw"]
alter
xdm.target.file.directory=cs3,
xdm.event.description=msg,
xdm.source.ipv4=src,
xdm.target.user.identifier=duid,
xdm.source.user.identifier=suid,
xdm.target.user.username=coalesce(duser,cs2),
xdm.target.resource.name=fname,
xdm.source.user.username=coalesce(suser,cs4),
xdm.target.resource.id=fileId,
xdm.event.type=cefName,
xdm.target.file.file_type=fileType,
xdm.alert.severity=cefSeverity,
xdm.observer.version=cefDeviceVersion;

Schema

`thycotic_software_secret_server_raw`

Field	Type	Array?
`cefDeviceVersion`	string	—
`cefName`	string	—
`cefSeverity`	string	—
`cs2`	string	—
`cs3`	string	—
`cs4`	string	—
`duid`	string	—
`duser`	string	—
`fileId`	string	—
`fileType`	string	—
`fname`	string	—
`msg`	string	—
`src`	string	—
`suid`	string	—
`suser`	string	—

Raw JSON

{
    "thycotic_software_secret_server_raw": {
        "cs2": {
          "type": "string",
          "is_array": false
        },
        "cs3": {
            "type": "string",
            "is_array": false
          },
          "msg": {
            "type": "string",
            "is_array": false
          },
          "src": {
            "type": "string",
            "is_array": false
          },
          "duid": {
            "type": "string",
            "is_array": false
          },
          "suid": {
            "type": "string",
            "is_array": false
          },
          "duser": {
            "type": "string",
            "is_array": false
          },
          "fname": {
            "type": "string",
            "is_array": false
          },
          "suser": {
            "type": "string",
            "is_array": false
          },
          "cs4": {
            "type": "string",
            "is_array": false
          },
          "fileId": {
            "type": "string",
            "is_array": false
          },
          "cefName": {
            "type": "string",
            "is_array": false
          },
          "fileType": {
            "type": "string",
            "is_array": false
          },
          "cefSeverity": {
            "type": "string",
            "is_array": false
          },
          "cefDeviceVersion": {
            "type": "string",
            "is_array": false
          }        
    }
  }