Druva Druva Modeling Rule

Details

Rules (XIF)

// Mapping and extraction of fields for all event types.
[RULE: druva_common_fields]
alter
    src_username = arrayindex(regextract(initiator, "(\S+)\@"),0),
    src_first_name = arrayindex(regextract(initiator,"(\w+?)\s"),0),
    src_last_name = arrayindex(regextract(initiator,"\w+\s(\w+\s*\w*)"),0),
    dst_username = arrayindex(regextract(inSyncUserEmail, "(\S+)\@"),0),
    dst_first_name = arrayindex(regextract(inSyncUserName,"(\w+?)\s"),0),
    dst_last_name = arrayindex(regextract(inSyncUserName,"\w+\s(\w+\s*\w*)"),0),
    severity_str = rtrim(to_string(severity), ".0"),
    inSyncDataSourceID_str = to_string(inSyncDataSourceID)
| alter
    xdm.source.ipv4 = if(is_ipv4(ip), ip),
    xdm.source.ipv6 = if(is_ipv6(ip), ip),
    xdm.event.id  = rtrim(to_string(eventID), ".0"),
    xdm.target.host.os = if(clientOS = "", null, clientOS),
    xdm.event.type = eventType,
    xdm.source.user.username = if(src_username != null, src_username ,initiator = "", null, initiator),
    xdm.source.user.first_name = if(src_first_name != null, src_first_name),
    xdm.source.user.last_name = if(src_last_name != null, src_last_name),
    xdm.target.user.groups = arraycreate(profileName),
    xdm.event.outcome = if(eventState contains  "Success" or eventState contains "Warning", XDM_CONST.OUTCOME_SUCCESS, eventState contains "Failed" or eventState contains "Marked as Inactive", XDM_CONST.OUTCOME_FAILED, eventState contains "Backed up with Errors", XDM_CONST.OUTCOME_PARTIAL, eventState),
    xdm.event.outcome_reason = if(eventState != "Success" and eventState != "Warning" and eventState != "Failed" ,eventState),
    xdm.event.description = eventDetails,
    xdm.target.user.identifier = rtrim(to_string(inSyncUserID), ".0"),
    xdm.target.agent.version = if(clientVersion = "", null, clientVersion),
    xdm.target.user.first_name = if(dst_first_name != null, dst_first_name),
    xdm.target.user.last_name = if(dst_last_name != null, dst_last_name),
    xdm.target.user.username = if(dst_username != null, dst_username, inSyncUserName),
    xdm.target.user.upn = inSyncUserEmail,
    xdm.target.host.device_id = if(inSyncDataSourceID_str = "", null, rtrim(inSyncDataSourceID_str, ".0")),
    xdm.target.host.hostname = if(inSyncDataSourceName = "", null, inSyncDataSourceName),
    xdm.event.log_level = if(severity_str = "0", XDM_CONST.LOG_LEVEL_EMERGENCY, severity_str = "1", XDM_CONST.LOG_LEVEL_ALERT, severity_str = "2", XDM_CONST.LOG_LEVEL_CRITICAL, severity_str = "3", XDM_CONST.LOG_LEVEL_ERROR, severity_str = "4", XDM_CONST.LOG_LEVEL_WARNING, severity_str = "5", XDM_CONST.LOG_LEVEL_NOTICE, severity_str = "6", XDM_CONST.LOG_LEVEL_INFORMATIONAL, severity_str = "7", XDM_CONST.LOG_LEVEL_DEBUG, severity_str);

[MODEL: dataset="druva_druva_raw"]
filter eventType = "Alert" //Extraction of fields from 'eventDetails' that are relevant to 'Alert' event types.
| call druva_common_fields
| alter
    alert_name = arrayindex(regextract(eventDetails, "Alert\:(.+?)\,"),0),
    alert_desc = arrayindex(regextract(eventDetails, "Alert\sDescription\:(.+?)\,"),0)
| alter
    xdm.alert.name = alert_name,
    xdm.alert.description = if(alert_desc = "NA.", null, alert_desc);

filter eventType = "Backup" //Extraction of fields from 'eventDetails' that are relevant to 'Backup' event types.
| call druva_common_fields
| alter
    bytes_sent = arrayindex(regextract(eventDetails, "Total\sBytes\sTransferred\:(\d+)"), 0)
| alter
    xdm.target.sent_bytes = to_integer(bytes_sent);

filter eventType not in ("Alert", "Backup")
| call druva_common_fields;

Schema

druva_druva_raw

{
    "druva_druva_raw": {
        "timeStamp": {
            "type": "datetime",
            "is_array": false
        },
        "clientOS": {
            "type": "string",
            "is_array": false
        },
        "clientVersion": {
            "type": "string",
            "is_array": false
        },
        "eventDetails": {
            "type": "string",
            "is_array": false
        },
        "eventID": {
            "type": "int",
            "is_array": false
        },
        "eventState": {
            "type": "string",
            "is_array": false
        },
        "eventType": {
            "type": "string",
            "is_array": false
        },
        "initiator": {
            "type": "string",
            "is_array": false
        },
        "inSyncDataSourceID": {
            "type": "int",
            "is_array": false
        },
        "inSyncUserEmail": {
            "type": "string",
            "is_array": false
        },
        "inSyncUserID": {
            "type": "int",
            "is_array": false
        },
        "inSyncUserName": {
            "type": "string",
            "is_array": false
        },
        "ip": {
            "type": "string",
            "is_array": false
        },
        "profileName": {
            "type": "string",
            "is_array": false
        },
        "severity": {
            "type": "int",
            "is_array": false
        },
        "inSyncDataSourceName": {
            "type": "string",
            "is_array": false
        }
    }
}