DropboxEventCollector

Details

Rules (XIF)

[MODEL: dataset=dropbox_dropbox_raw]
alter
    Get_Event_Type = event_category -> [".tag"],
    assets_array = arraystring(assets -> [], ",")
| alter
    xdm.event.type = Get_Event_Type,
    xdm.event.operation_sub_type = event_type -> [".tag"],
    xdm.event.description = event_type -> description,
    xdm.source.user.user_type = if(actor -> [".tag"] in ("admin","anonymous","reseller","user"),XDM_CONST.USER_TYPE_REGULAR ,actor -> [".tag"] in ("app","dropbox"),XDM_CONST.USER_TYPE_SERVICE_ACCOUNT,to_string(actor -> [".tag"])),
    xdm.source.user.identifier = if(Get_Event_Type != "logins", actor -> user.account_id, context -> account_id),
    xdm.source.user.username = if(Get_Event_Type = "logins" , context -> display_name,  actor -> user.display_name),
    xdm.source.user.upn = if(Get_Event_Type = "logins" ,context -> email , actor -> user.email),
    xdm.source.ipv4 = if(origin -> geo_location.ip_address ~= "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}", origin -> geo_location.ip_address),
    xdm.source.ipv6 = if(origin -> geo_location.ip_address ~= "[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}", origin -> geo_location.ip_address),
    xdm.source.location.city = origin -> geo_location.city,
    xdm.source.location.region = origin -> geo_location.region,
    xdm.source.location.country = origin -> geo_location.country,
    xdm.target.user.identifier = if(Get_Event_Type != "logins", context -> account_id),
    xdm.target.user.username = if(Get_Event_Type != "logins", context -> display_name),
    xdm.target.user.upn = if(Get_Event_Type != "logins", context -> email),
    xdm.target.user.groups = arraycreate(context -> team.display_name),
    xdm.target.resource.value = details -> [".tag"],
    xdm.target.url = details -> shared_content_link,
    xdm.target.file.file_type = assets_array -> [".tag"],
    xdm.target.file.path = coalesce(assets_array -> path.contextual, assets_array -> path.namespace_relative.relative_path),
    xdm.target.file.filename = assets_array -> display_name,
    xdm.target.file.size = to_integer(assets_array -> file_size);

Schema

dropbox_dropbox_raw

{
  "dropbox_dropbox_raw": {
    "actor": {
      "type": "string",
      "is_array": false
    },
    "assets": {
      "type": "string",
      "is_array": false
    },
    "context": {
      "type": "string",
      "is_array": false
    },
    "details": {
      "type": "string",
      "is_array": false
    },
    "event_category": {
      "type": "string",
      "is_array": false
    },
    "event_type": {
      "type": "string",
      "is_array": false
    },
    "origin": {
      "type": "string",
      "is_array": false
    },
    "timestamp": {
      "type": "datetime",
      "is_array": false
    }
  }
}