[RULE: druva_common_fields]
alter
src_username = arrayindex(regextract(initiator, "(\S+)\@"),0),
src_first_name = arrayindex(regextract(initiator,"(\w+?)\s"),0),
src_last_name = arrayindex(regextract(initiator,"\w+\s(\w+\s*\w*)"),0),
dst_username = arrayindex(regextract(inSyncUserEmail, "(\S+)\@"),0),
dst_first_name = arrayindex(regextract(inSyncUserName,"(\w+?)\s"),0),
dst_last_name = arrayindex(regextract(inSyncUserName,"\w+\s(\w+\s*\w*)"),0),
severity_str = rtrim(to_string(severity), ".0"),
inSyncDataSourceID_str = to_string(inSyncDataSourceID)
| alter
xdm.source.ipv4 = if(is_ipv4(ip), ip),
xdm.source.ipv6 = if(is_ipv6(ip), ip),
xdm.event.id = rtrim(to_string(eventID), ".0"),
xdm.target.host.os = if(clientOS = "", null, clientOS),
xdm.event.type = source_log_type,
xdm.event.original_event_type = eventType,
xdm.source.user.username = if(src_username != null, src_username ,initiator = "", null, initiator),
xdm.source.user.first_name = if(src_first_name != null, src_first_name),
xdm.source.user.last_name = if(src_last_name != null, src_last_name),
xdm.target.user.groups = arraycreate(profileName),
xdm.event.outcome = if(eventState contains "Success" or eventState contains "Warning", XDM_CONST.OUTCOME_SUCCESS, eventState contains "Failed" or eventState contains "Marked as Inactive", XDM_CONST.OUTCOME_FAILED, eventState contains "Backed up with Errors", XDM_CONST.OUTCOME_PARTIAL, eventState),
xdm.event.outcome_reason = if(eventState != "Success" and eventState != "Warning" and eventState != "Failed" ,eventState),
xdm.event.description = eventDetails,
xdm.target.user.identifier = rtrim(to_string(inSyncUserID), ".0"),
xdm.target.agent.version = if(clientVersion = "", null, clientVersion),
xdm.target.user.first_name = if(dst_first_name != null, dst_first_name),
xdm.target.user.last_name = if(dst_last_name != null, dst_last_name),
xdm.target.user.username = if(dst_username != null, dst_username, inSyncUserName),
xdm.target.user.upn = inSyncUserEmail,
xdm.target.host.device_id = if(inSyncDataSourceID_str = "", null, rtrim(inSyncDataSourceID_str, ".0")),
xdm.target.host.hostname = if(inSyncDataSourceName = "", null, inSyncDataSourceName),
xdm.event.log_level = if(severity_str = "0", XDM_CONST.LOG_LEVEL_EMERGENCY, severity_str = "1", XDM_CONST.LOG_LEVEL_ALERT, severity_str = "2", XDM_CONST.LOG_LEVEL_CRITICAL, severity_str = "3", XDM_CONST.LOG_LEVEL_ERROR, severity_str = "4", XDM_CONST.LOG_LEVEL_WARNING, severity_str = "5", XDM_CONST.LOG_LEVEL_NOTICE, severity_str = "6", XDM_CONST.LOG_LEVEL_INFORMATIONAL, severity_str = "7", XDM_CONST.LOG_LEVEL_DEBUG, severity_str);
[RULE:druva_alert_specific_fields]
alter
alert_name = arrayindex(regextract(eventDetails, "Alert\:(.+?)\,"),0),
alert_desc = arrayindex(regextract(eventDetails, "Alert\sDescription\:(.+?)\,"),0)
| alter
xdm.alert.name = alert_name,
xdm.alert.description = if(alert_desc = "NA.", null, alert_desc);
[RULE:druva_backup_specific_fields]
alter
bytes_sent = arrayindex(regextract(eventDetails, "Total\sBytes\sTransferred\:(\d+)"), 0)
| alter
xdm.target.sent_bytes = to_integer(bytes_sent);
[RULE: druva_security_common_fields]
alter
det = to_json_string(details)
| alter
sec_email = json_extract_scalar(det, "$.email"),
sec_status = json_extract_scalar(det, "$.status"),
sec_sourceip = json_extract_scalar(det, "$.sourceIP"),
sec_ip = json_extract_scalar(det, "$.ip"),
sec_initiator = json_extract_scalar(det, "$.initiator"),
sec_initiatorid= json_extract_scalar(det, "$.initiatorID"),
sec_errmsg = json_extract_scalar(det, "$.errorMessage"),
sec_admin_email= json_extract_scalar(det, "$.adminEmail"),
sec_admin_ip = json_extract_scalar(det, "$.adminIPAddress"),
sec_login_res = json_extract_scalar(det, "$.loginResult"),
sec_location = json_extract_scalar(det, "$.location"),
sec_eventstate = json_extract_scalar(det, "$.eventState"),
sec_eventdet = json_extract_scalar(det, "$.eventDetails"),
sec_mfamode = json_extract_scalar(to_json_string(det), "$.mfaMode"),
sec_alertname = json_extract_scalar(to_json_string(details), "$.alertName")
| alter
sec_actor_ip = coalesce(sec_sourceip, sec_ip, sec_admin_ip),
sec_actor_user = coalesce(sec_admin_email, sec_email, sec_initiator),
sec_outcome_raw= coalesce(sec_status, sec_login_res, sec_eventstate)
| alter
xdm.event.id = to_string(id),
xdm.event.type = source_log_type,
xdm.event.original_event_type = type,
xdm.event.description = coalesce(sec_eventdet, sec_errmsg),
xdm.source.ipv4 = if(is_ipv4(sec_actor_ip), sec_actor_ip),
xdm.source.ipv6 = if(is_ipv6(sec_actor_ip), sec_actor_ip),
xdm.source.location.country = sec_location,
xdm.alert.name = coalesce(sec_alertname, type),
xdm.auth.mfa.method = sec_mfamode,
xdm.source.user.username = arrayindex(regextract(sec_actor_user, "(\S+)\@"), 0),
xdm.source.user.upn = if(sec_actor_user contains "@", sec_actor_user),
xdm.source.user.identifier = sec_initiatorid,
xdm.event.outcome = if(sec_outcome_raw contains "Success" or sec_outcome_raw contains "Warning", XDM_CONST.OUTCOME_SUCCESS, sec_outcome_raw contains "Failure" or sec_outcome_raw contains "Failed", XDM_CONST.OUTCOME_FAILED, sec_outcome_raw),
xdm.event.outcome_reason = sec_errmsg,
xdm.event.log_level = if(to_string(syslogSeverity) = "3", XDM_CONST.LOG_LEVEL_ERROR, to_string(syslogSeverity) = "4", XDM_CONST.LOG_LEVEL_WARNING, to_string(syslogSeverity) = "6", XDM_CONST.LOG_LEVEL_INFORMATIONAL, to_string(syslogSeverity));
[MODEL: dataset="druva_druva_raw"]
filter eventType = "Alert"
| call druva_common_fields
| call druva_alert_specific_fields;
filter eventType = "Backup"
| call druva_common_fields
| call druva_backup_specific_fields;
filter category = "EVENT"
| call druva_security_common_fields;
filter eventType not in ("Alert", "Backup") and details = null
| call druva_common_fields;
filter category = "EVENT" and feature not in ("Admin Event","Alerts And Notifications") and eventType = null
| call druva_security_common_fields;