Duo Modeling Rule

Details

Rules (XIF)

[MODEL: dataset=duo_duo_raw, model=Auth]
filter eventtype = "authentication"
| alter XDM.Auth.Client.host.hostname = json_extract_scalar(access_device, "$.hostname"),
XDM.Auth.Client.host.ipv4_addresses = arraycreate(json_extract_scalar(access_device, "$.ip")),
XDM.Auth.Client.location.city = json_extract_scalar(access_device, "$.location.city"),
XDM.Auth.Client.location.country = json_extract_scalar(access_device, "$.location.country"),
XDM.Auth.Server.host.os_family = json_extract_scalar(access_device, "$.os"),
XDM.Auth.Server.host.os = json_extract_scalar(access_device, "$.os_version"),
XDM.Auth.original_event_type = eventtype,
XDM.Auth.auth_method = factor,
XDM.Auth.event_timestamp = to_timestamp(to_integer(timestamp), "SECONDS");

[MODEL: dataset=duo_duo_raw, model=Audit]
filter eventtype = "administrator"
| alter XDM.Audit.operation = action,
XDM.Audit.original_event_description = description,
XDM.Audit.audited_resource.name = object,
XDM.Audit.event_timestamp = to_timestamp(to_integer(timestamp), "SECONDS"),
XDM.Audit.TriggeredBy.identity.name = username,
XDM.Audit.TriggeredBy.identity.type = context,
XDM.Audit.identity.uuid = phone,
XDM.Audit.original_event_type = type,
XDM.Audit.identity.name = json_extract_scalar(description , "$.hostname"),
XDM.Audit.audited_resource.type = json_extract_scalar(description , "$.factor");

Schema

duo_duo_raw

{
  "duo_duo_raw": {
    "access_device": {
      "type": "string",
      "is_array": false
    },
    "application": {
      "type": "string",
      "is_array": false
    },
    "eventtype": {
      "type": "string",
      "is_array": false
    },
    "factor": {
      "type": "string",
      "is_array": false
    },
    "isotimestamp": {
      "type": "string",
      "is_array": false
    },
    "action": {
      "type": "string",
      "is_array": false
    },
    "description": {
      "type": "string",
      "is_array": false
    },
    "object": {
      "type": "string",
      "is_array": false
    },
    "timestamp": {
      "type": "string",
      "is_array": false
    },
    "username": {
      "type": "string",
      "is_array": false
    },
    "context": {
      "type": "string",
      "is_array": false
    },
    "phone": {
      "type": "string",
      "is_array": false
    },
    "type": {
      "type": "string",
      "is_array": false
    }
  }
}