Digital Guardian ARC Modeling Rule

Details

ID	`DigitalGuardianModelingRule`
From Version	8.2.0

Schema

`digital_guardian_arc_raw`

Field	Type	Array?
`dg_comment`	string	—
`dg_description`	string	—
`dg_guid`	string	—
`dg_name`	string	—
`dg_tenant`	string	—
`dg_utype`	string	—
`inc_assign`	string	—
`inc_creator`	string	—
`inc_id`	string	—
`inc_mtime`	datetime	—
`inc_sev`	string	—
`inc_state`	string	—

Source

DigitalGuardianModelingRules_1_3.xif DigitalGuardianModelingRules_1_3.yml DigitalGuardianModelingRules_1_3_schema.json

Download History Raw

[MODEL: dataset = "digital_guardian_arc_raw"]
alter
    xdm.alert.original_alert_id = inc_id,
    xdm.alert.name = dg_name,
    xdm.alert.severity = inc_sev,
    xdm.alert.description = dg_description,
    xdm.target.user.username = inc_assign,
    xdm.event.type = dg_utype,
    xdm.source.user.username = inc_creator,
    xdm.alert.subcategory = inc_state,
    xdm.event.id = dg_guid;