Rules (XIF)
[MODEL: dataset="exabeam_threat_center_raw"]
alter
// =====================================================================
// PART 1: EXTRACTION & FILTERING
// =====================================================================
tmp_priority = uppercase(to_string(priority)),
// Process Simple String Arrays natively (Extract and trim double quotes)
tmp_src_ip_array = arraymap(srcIp -> [], trim("@element", "\"")),
tmp_dest_ip_array = arraymap(destIp -> [], trim("@element", "\"")),
tmp_user_list = arraymap(user -> [], trim("@element", "\"")),
tmp_src_host_list = arraymap(srcHost -> [], trim("@element", "\"")),
tmp_dest_host_list = arraymap(destHost -> [], trim("@element", "\"")),
tmp_use_cases_list = arraymap(useCases -> [], trim("@element", "\"")),
// Process JSON Object Arrays (Extract array, then parse specific keys from each object)
tmp_tactic_keys = arraymap(mitres -> [], json_extract_scalar("@element", "$.tacticKey")),
tmp_technique_keys = arraymap(mitres -> [], json_extract_scalar("@element", "$.techniqueKey")),
// Use arraydistinct to ensure no duplicate rule names/reasons/ids if multiple rules hit
tmp_rule_names = arraydistinct(arraymap(rules -> [], json_extract_scalar("@element", "$.ruleName"))),
tmp_rule_reasons = arraydistinct(arraymap(rules -> [], json_extract_scalar("@element", "$.ruleReason"))),
tmp_rule_ids = arraydistinct(arraymap(rules -> [], json_extract_scalar("@element", "$.ruleId")))
| alter
// Filter the extracted IP arrays using is_ipv4() and is_ipv6() natively
tmp_src_ipv4_list = arrayfilter(tmp_src_ip_array, is_ipv4("@element")),
tmp_src_ipv6_list = arrayfilter(tmp_src_ip_array, is_ipv6("@element")),
tmp_dest_ipv4_list = arrayfilter(tmp_dest_ip_array, is_ipv4("@element")),
tmp_dest_ipv6_list = arrayfilter(tmp_dest_ip_array, is_ipv6("@element"))
| alter
// =====================================================================
// PART 2: EXPLICIT MITRE MAPPING
// =====================================================================
tmp_mitre_tactics = arraymap(tmp_tactic_keys, if("@element" = "TA0001", XDM_CONST.MITRE_TACTIC_INITIAL_ACCESS, "@element" = "TA0002", XDM_CONST.MITRE_TACTIC_EXECUTION, "@element" = "TA0003", XDM_CONST.MITRE_TACTIC_PERSISTENCE, "@element" = "TA0004", XDM_CONST.MITRE_TACTIC_PRIVILEGE_ESCALATION, "@element" = "TA0005", XDM_CONST.MITRE_TACTIC_DEFENSE_EVASION, "@element" = "TA0006", XDM_CONST.MITRE_TACTIC_CREDENTIAL_ACCESS, "@element" = "TA0007", XDM_CONST.MITRE_TACTIC_DISCOVERY, "@element" = "TA0008", XDM_CONST.MITRE_TACTIC_LATERAL_MOVEMENT, "@element" = "TA0009", XDM_CONST.MITRE_TACTIC_COLLECTION, "@element" = "TA0010", XDM_CONST.MITRE_TACTIC_EXFILTRATION, "@element" = "TA0011", XDM_CONST.MITRE_TACTIC_COMMAND_AND_CONTROL, "@element" = "TA0040", XDM_CONST.MITRE_TACTIC_IMPACT, "@element" = "TA0042", XDM_CONST.MITRE_TACTIC_RESOURCE_DEVELOPMENT, "@element" = "TA0043", XDM_CONST.MITRE_TACTIC_RECONNAISSANCE, "@element")),
tmp_mitre_techniques = arraymap(tmp_technique_keys, if("@element" = "T1548", XDM_CONST.MITRE_TECHNIQUE_ABUSE_ELEVATION_CONTROL_MECHANISM, "@element" = "T1134", XDM_CONST.MITRE_TECHNIQUE_ACCESS_TOKEN_MANIPULATION, "@element" = "T1531", XDM_CONST.MITRE_TECHNIQUE_ACCOUNT_ACCESS_REMOVAL, "@element" = "T1087", XDM_CONST.MITRE_TECHNIQUE_ACCOUNT_DISCOVERY, "@element" = "T1098", XDM_CONST.MITRE_TECHNIQUE_ACCOUNT_MANIPULATION, "@element" = "T1583", XDM_CONST.MITRE_TECHNIQUE_ACQUIRE_INFRASTRUCTURE, "@element" = "T1595", XDM_CONST.MITRE_TECHNIQUE_ACTIVE_SCANNING, "@element" = "T1557", XDM_CONST.MITRE_TECHNIQUE_ADVERSARY_IN_THE_MIDDLE, "@element" = "T1071", XDM_CONST.MITRE_TECHNIQUE_APPLICATION_LAYER_PROTOCOL, "@element" = "T1010", XDM_CONST.MITRE_TECHNIQUE_APPLICATION_WINDOW_DISCOVERY, "@element" = "T1560", XDM_CONST.MITRE_TECHNIQUE_ARCHIVE_COLLECTED_DATA, "@element" = "T1123", XDM_CONST.MITRE_TECHNIQUE_AUDIO_CAPTURE, "@element" = "T1119", XDM_CONST.MITRE_TECHNIQUE_AUTOMATED_COLLECTION, "@element" = "T1020", XDM_CONST.MITRE_TECHNIQUE_AUTOMATED_EXFILTRATION, "@element" = "T1197", XDM_CONST.MITRE_TECHNIQUE_BITS_JOBS, "@element" = "T1547", XDM_CONST.MITRE_TECHNIQUE_BOOT_OR_LOGON_AUTOSTART_EXECUTION, "@element" = "T1037", XDM_CONST.MITRE_TECHNIQUE_BOOT_OR_LOGON_INITIALIZATION_SCRIPTS, "@element" = "T1217", XDM_CONST.MITRE_TECHNIQUE_BROWSER_BOOKMARK_DISCOVERY, "@element" = "T1176", XDM_CONST.MITRE_TECHNIQUE_BROWSER_EXTENSIONS, "@element" = "T1185", XDM_CONST.MITRE_TECHNIQUE_BROWSER_SESSION_HIJACKING, "@element" = "T1110", XDM_CONST.MITRE_TECHNIQUE_BRUTE_FORCE, "@element" = "T1612", XDM_CONST.MITRE_TECHNIQUE_BUILD_IMAGE_ON_HOST, "@element" = "T1115", XDM_CONST.MITRE_TECHNIQUE_CLIPBOARD_DATA, "@element" = "T1580", XDM_CONST.MITRE_TECHNIQUE_CLOUD_INFRASTRUCTURE_DISCOVERY, "@element" = "T1538", XDM_CONST.MITRE_TECHNIQUE_CLOUD_SERVICE_DASHBOARD, "@element" = "T1526", XDM_CONST.MITRE_TECHNIQUE_CLOUD_SERVICE_DISCOVERY, "@element" = "T1619", XDM_CONST.MITRE_TECHNIQUE_CLOUD_STORAGE_OBJECT_DISCOVERY, "@element" = "T1059", XDM_CONST.MITRE_TECHNIQUE_COMMAND_AND_SCRIPTING_INTERPRETER, "@element" = "T1092", XDM_CONST.MITRE_TECHNIQUE_COMMUNICATION_THROUGH_REMOVABLE_MEDIA, "@element" = "T1586", XDM_CONST.MITRE_TECHNIQUE_COMPROMISE_ACCOUNTS, "@element" = "T1554", XDM_CONST.MITRE_TECHNIQUE_COMPROMISE_CLIENT_SOFTWARE_BINARY, "@element" = "T1584", XDM_CONST.MITRE_TECHNIQUE_COMPROMISE_INFRASTRUCTURE, "@element" = "T1609", XDM_CONST.MITRE_TECHNIQUE_CONTAINER_ADMINISTRATION_COMMAND, "@element" = "T1613", XDM_CONST.MITRE_TECHNIQUE_CONTAINER_AND_RESOURCE_DISCOVERY, "@element" = "T1136", XDM_CONST.MITRE_TECHNIQUE_CREATE_ACCOUNT, "@element" = "T1543", XDM_CONST.MITRE_TECHNIQUE_CREATE_OR_MODIFY_SYSTEM_PROCESS, "@element" = "T1555", XDM_CONST.MITRE_TECHNIQUE_CREDENTIALS_FROM_PASSWORD_STORES, "@element" = "T1485", XDM_CONST.MITRE_TECHNIQUE_DATA_DESTRUCTION, "@element" = "T1132", XDM_CONST.MITRE_TECHNIQUE_DATA_ENCODING, "@element" = "T1486", XDM_CONST.MITRE_TECHNIQUE_DATA_ENCRYPTED_FOR_IMPACT, "@element" = "T1530", XDM_CONST.MITRE_TECHNIQUE_DATA_FROM_CLOUD_STORAGE_OBJECT, "@element" = "T1602", XDM_CONST.MITRE_TECHNIQUE_DATA_FROM_CONFIGURATION_REPOSITORY, "@element" = "T1213", XDM_CONST.MITRE_TECHNIQUE_DATA_FROM_INFORMATION_REPOSITORIES, "@element" = "T1005", XDM_CONST.MITRE_TECHNIQUE_DATA_FROM_LOCAL_SYSTEM, "@element" = "T1039", XDM_CONST.MITRE_TECHNIQUE_DATA_FROM_NETWORK_SHARED_DRIVE, "@element" = "T1025", XDM_CONST.MITRE_TECHNIQUE_DATA_FROM_REMOVABLE_MEDIA, "@element" = "T1565", XDM_CONST.MITRE_TECHNIQUE_DATA_MANIPULATION, "@element" = "T1001", XDM_CONST.MITRE_TECHNIQUE_DATA_OBFUSCATION, "@element" = "T1074", XDM_CONST.MITRE_TECHNIQUE_DATA_STAGED, "@element" = "T1030", XDM_CONST.MITRE_TECHNIQUE_DATA_TRANSFER_SIZE_LIMITS, "@element" = "T1491", XDM_CONST.MITRE_TECHNIQUE_DEFACEMENT, "@element" = "T1140", XDM_CONST.MITRE_TECHNIQUE_DEOBFUSCATE_DECODE_FILES_OR_INFORMATION, "@element" = "T1610", XDM_CONST.MITRE_TECHNIQUE_DEPLOY_CONTAINER, "@element" = "T1587", XDM_CONST.MITRE_TECHNIQUE_DEVELOP_CAPABILITIES, "@element" = "T1006", XDM_CONST.MITRE_TECHNIQUE_DIRECT_VOLUME_ACCESS, "@element" = "T1561", XDM_CONST.MITRE_TECHNIQUE_DISK_WIPE, "@element" = "T1484", XDM_CONST.MITRE_TECHNIQUE_DOMAIN_POLICY_MODIFICATION, "@element" = "T1482", XDM_CONST.MITRE_TECHNIQUE_DOMAIN_TRUST_DISCOVERY, "@element" = "T1189", XDM_CONST.MITRE_TECHNIQUE_DRIVE_BY_COMPROMISE, "@element" = "T1568", XDM_CONST.MITRE_TECHNIQUE_DYNAMIC_RESOLUTION, "@element" = "T1114", XDM_CONST.MITRE_TECHNIQUE_EMAIL_COLLECTION, "@element" = "T1573", XDM_CONST.MITRE_TECHNIQUE_ENCRYPTED_CHANNEL, "@element" = "T1499", XDM_CONST.MITRE_TECHNIQUE_ENDPOINT_DENIAL_OF_SERVICE, "@element" = "T1611", XDM_CONST.MITRE_TECHNIQUE_ESCAPE_TO_HOST, "@element" = "T1585", XDM_CONST.MITRE_TECHNIQUE_ESTABLISH_ACCOUNTS, "@element" = "T1546", XDM_CONST.MITRE_TECHNIQUE_EVENT_TRIGGERED_EXECUTION, "@element" = "T1480", XDM_CONST.MITRE_TECHNIQUE_EXECUTION_GUARDRAILS, "@element" = "T1048", XDM_CONST.MITRE_TECHNIQUE_EXFILTRATION_OVER_ALTERNATIVE_PROTOCOL, "@element" = "T1041", XDM_CONST.MITRE_TECHNIQUE_EXFILTRATION_OVER_C2_CHANNEL, "@element" = "T1011", XDM_CONST.MITRE_TECHNIQUE_EXFILTRATION_OVER_OTHER_NETWORK_MEDIUM, "@element" = "T1052", XDM_CONST.MITRE_TECHNIQUE_EXFILTRATION_OVER_PHYSICAL_MEDIUM, "@element" = "T1567", XDM_CONST.MITRE_TECHNIQUE_EXFILTRATION_OVER_WEB_SERVICE, "@element" = "T1190", XDM_CONST.MITRE_TECHNIQUE_EXPLOIT_PUBLIC_FACING_APPLICATION, "@element" = "T1203", XDM_CONST.MITRE_TECHNIQUE_EXPLOITATION_FOR_CLIENT_EXECUTION, "@element" = "T1212", XDM_CONST.MITRE_TECHNIQUE_EXPLOITATION_FOR_CREDENTIAL_ACCESS, "@element" = "T1211", XDM_CONST.MITRE_TECHNIQUE_EXPLOITATION_FOR_DEFENSE_EVASION, "@element" = "T1068", XDM_CONST.MITRE_TECHNIQUE_EXPLOITATION_FOR_PRIVILEGE_ESCALATION, "@element" = "T1210", XDM_CONST.MITRE_TECHNIQUE_EXPLOITATION_OF_REMOTE_SERVICES, "@element" = "T1133", XDM_CONST.MITRE_TECHNIQUE_EXTERNAL_REMOTE_SERVICES, "@element" = "T1008", XDM_CONST.MITRE_TECHNIQUE_FALLBACK_CHANNELS, "@element" = "T1083", XDM_CONST.MITRE_TECHNIQUE_FILE_AND_DIRECTORY_DISCOVERY, "@element" = "T1222", XDM_CONST.MITRE_TECHNIQUE_FILE_AND_DIRECTORY_PERMISSIONS_MODIFICATION, "@element" = "T1495", XDM_CONST.MITRE_TECHNIQUE_FIRMWARE_CORRUPTION, "@element" = "T1187", XDM_CONST.MITRE_TECHNIQUE_FORCED_AUTHENTICATION, "@element" = "T1606", XDM_CONST.MITRE_TECHNIQUE_FORGE_WEB_CREDENTIALS, "@element" = "T1592", XDM_CONST.MITRE_TECHNIQUE_GATHER_VICTIM_HOST_INFORMATION, "@element" = "T1589", XDM_CONST.MITRE_TECHNIQUE_GATHER_VICTIM_IDENTITY_INFORMATION, "@element" = "T1590", XDM_CONST.MITRE_TECHNIQUE_GATHER_VICTIM_NETWORK_INFORMATION, "@element" = "T1591", XDM_CONST.MITRE_TECHNIQUE_GATHER_VICTIM_ORG_INFORMATION, "@element" = "T1615", XDM_CONST.MITRE_TECHNIQUE_GROUP_POLICY_DISCOVERY, "@element" = "T1200", XDM_CONST.MITRE_TECHNIQUE_HARDWARE_ADDITIONS, "@element" = "T1564", XDM_CONST.MITRE_TECHNIQUE_HIDE_ARTIFACTS, "@element" = "T1574", XDM_CONST.MITRE_TECHNIQUE_HIJACK_EXECUTION_FLOW, "@element" = "T1562", XDM_CONST.MITRE_TECHNIQUE_IMPAIR_DEFENSES, "@element" = "T1525", XDM_CONST.MITRE_TECHNIQUE_IMPLANT_INTERNAL_IMAGE, "@element" = "T1070", XDM_CONST.MITRE_TECHNIQUE_INDICATOR_REMOVAL_ON_HOST, "@element" = "T1202", XDM_CONST.MITRE_TECHNIQUE_INDIRECT_COMMAND_EXECUTION, "@element" = "T1105", XDM_CONST.MITRE_TECHNIQUE_INGRESS_TOOL_TRANSFER, "@element" = "T1490", XDM_CONST.MITRE_TECHNIQUE_INHIBIT_SYSTEM_RECOVERY, "@element" = "T1056", XDM_CONST.MITRE_TECHNIQUE_INPUT_CAPTURE, "@element" = "T1559", XDM_CONST.MITRE_TECHNIQUE_INTER_PROCESS_COMMUNICATION, "@element" = "T1534", XDM_CONST.MITRE_TECHNIQUE_INTERNAL_SPEARPHISHING, "@element" = "T1570", XDM_CONST.MITRE_TECHNIQUE_LATERAL_TOOL_TRANSFER, "@element" = "T1036", XDM_CONST.MITRE_TECHNIQUE_MASQUERADING, "@element" = "T1556", XDM_CONST.MITRE_TECHNIQUE_MODIFY_AUTHENTICATION_PROCESS, "@element" = "T1578", XDM_CONST.MITRE_TECHNIQUE_MODIFY_CLOUD_COMPUTE_INFRASTRUCTURE, "@element" = "T1112", XDM_CONST.MITRE_TECHNIQUE_MODIFY_REGISTRY, "@element" = "T1601", XDM_CONST.MITRE_TECHNIQUE_MODIFY_SYSTEM_IMAGE, "@element" = "T1104", XDM_CONST.MITRE_TECHNIQUE_MULTI_STAGE_CHANNELS, "@element" = "T1106", XDM_CONST.MITRE_TECHNIQUE_NATIVE_API, "@element" = "T1599", XDM_CONST.MITRE_TECHNIQUE_NETWORK_BOUNDARY_BRIDGING, "@element" = "T1498", XDM_CONST.MITRE_TECHNIQUE_NETWORK_DENIAL_OF_SERVICE, "@element" = "T1046", XDM_CONST.MITRE_TECHNIQUE_NETWORK_SERVICE_SCANNING, "@element" = "T1135", XDM_CONST.MITRE_TECHNIQUE_NETWORK_SHARE_DISCOVERY, "@element" = "T1040", XDM_CONST.MITRE_TECHNIQUE_NETWORK_SNIFFING, "@element" = "T1095", XDM_CONST.MITRE_TECHNIQUE_NON_APPLICATION_LAYER_PROTOCOL, "@element" = "T1571", XDM_CONST.MITRE_TECHNIQUE_NON_STANDARD_PORT, "@element" = "T1003", XDM_CONST.MITRE_TECHNIQUE_OS_CREDENTIAL_DUMPING, "@element" = "T1027", XDM_CONST.MITRE_TECHNIQUE_OBFUSCATED_FILES_OR_INFORMATION, "@element" = "T1588", XDM_CONST.MITRE_TECHNIQUE_OBTAIN_CAPABILITIES, "@element" = "T1137", XDM_CONST.MITRE_TECHNIQUE_OFFICE_APPLICATION_STARTUP, "@element" = "T1201", XDM_CONST.MITRE_TECHNIQUE_PASSWORD_POLICY_DISCOVERY, "@element" = "T1120", XDM_CONST.MITRE_TECHNIQUE_PERIPHERAL_DEVICE_DISCOVERY, "@element" = "T1069", XDM_CONST.MITRE_TECHNIQUE_PERMISSION_GROUPS_DISCOVERY, "@element" = "T1566", XDM_CONST.MITRE_TECHNIQUE_PHISHING, "@element" = "T1598", XDM_CONST.MITRE_TECHNIQUE_PHISHING_FOR_INFORMATION, "@element" = "T1542", XDM_CONST.MITRE_TECHNIQUE_PRE_OS_BOOT, "@element" = "T1057", XDM_CONST.MITRE_TECHNIQUE_PROCESS_DISCOVERY, "@element" = "T1055", XDM_CONST.MITRE_TECHNIQUE_PROCESS_INJECTION, "@element" = "T1572", XDM_CONST.MITRE_TECHNIQUE_PROTOCOL_TUNNELING, "@element" = "T1090", XDM_CONST.MITRE_TECHNIQUE_PROXY, "@element" = "T1012", XDM_CONST.MITRE_TECHNIQUE_QUERY_REGISTRY, "@element" = "T1620", XDM_CONST.MITRE_TECHNIQUE_REFLECTIVE_CODE_LOADING, "@element" = "T1219", XDM_CONST.MITRE_TECHNIQUE_REMOTE_ACCESS_SOFTWARE, "@element" = "T1563", XDM_CONST.MITRE_TECHNIQUE_REMOTE_SERVICE_SESSION_HIJACKING, "@element" = "T1021", XDM_CONST.MITRE_TECHNIQUE_REMOTE_SERVICES, "@element" = "T1018", XDM_CONST.MITRE_TECHNIQUE_REMOTE_SYSTEM_DISCOVERY, "@element" = "T1091", XDM_CONST.MITRE_TECHNIQUE_REPLICATION_THROUGH_REMOVABLE_MEDIA, "@element" = "T1496", XDM_CONST.MITRE_TECHNIQUE_RESOURCE_HIJACKING, "@element" = "T1207", XDM_CONST.MITRE_TECHNIQUE_ROGUE_DOMAIN_CONTROLLER, "@element" = "T1014", XDM_CONST.MITRE_TECHNIQUE_ROOTKIT, "@element" = "T1053", XDM_CONST.MITRE_TECHNIQUE_SCHEDULED_TASK, "@element" = "T1029", XDM_CONST.MITRE_TECHNIQUE_SCHEDULED_TRANSFER, "@element" = "T1113", XDM_CONST.MITRE_TECHNIQUE_SCREEN_CAPTURE, "@element" = "T1597", XDM_CONST.MITRE_TECHNIQUE_SEARCH_CLOSED_SOURCES, "@element" = "T1596", XDM_CONST.MITRE_TECHNIQUE_SEARCH_OPEN_TECHNICAL_DATABASES, "@element" = "T1593", XDM_CONST.MITRE_TECHNIQUE_SEARCH_OPEN_WEBSITES_DOMAINS, "@element" = "T1594", XDM_CONST.MITRE_TECHNIQUE_SEARCH_VICTIM_OWNED_WEBSITES, "@element" = "T1505", XDM_CONST.MITRE_TECHNIQUE_SERVER_SOFTWARE_COMPONENT, "@element" = "T1489", XDM_CONST.MITRE_TECHNIQUE_SERVICE_STOP, "@element" = "T1129", XDM_CONST.MITRE_TECHNIQUE_SHARED_MODULES, "@element" = "T1218", XDM_CONST.MITRE_TECHNIQUE_SIGNED_BINARY_PROXY_EXECUTION, "@element" = "T1216", XDM_CONST.MITRE_TECHNIQUE_SIGNED_SCRIPT_PROXY_EXECUTION, "@element" = "T1072", XDM_CONST.MITRE_TECHNIQUE_SOFTWARE_DEPLOYMENT_TOOLS, "@element" = "T1518", XDM_CONST.MITRE_TECHNIQUE_SOFTWARE_DISCOVERY, "@element" = "T1608", XDM_CONST.MITRE_TECHNIQUE_STAGE_CAPABILITIES, "@element" = "T1528", XDM_CONST.MITRE_TECHNIQUE_STEAL_APPLICATION_ACCESS_TOKEN, "@element" = "T1539", XDM_CONST.MITRE_TECHNIQUE_STEAL_WEB_SESSION_COOKIE, "@element" = "T1558", XDM_CONST.MITRE_TECHNIQUE_STEAL_OR_FORGE_KERBEROS_TICKETS, "@element" = "T1553", XDM_CONST.MITRE_TECHNIQUE_SUBVERT_TRUST_CONTROLS, "@element" = "T1195", XDM_CONST.MITRE_TECHNIQUE_SUPPLY_CHAIN_COMPROMISE, "@element" = "T1082", XDM_CONST.MITRE_TECHNIQUE_SYSTEM_INFORMATION_DISCOVERY, "@element" = "T1614", XDM_CONST.MITRE_TECHNIQUE_SYSTEM_LOCATION_DISCOVERY, "@element" = "T1016", XDM_CONST.MITRE_TECHNIQUE_SYSTEM_NETWORK_CONFIGURATION_DISCOVERY, "@element" = "T1049", XDM_CONST.MITRE_TECHNIQUE_SYSTEM_NETWORK_CONNECTIONS_DISCOVERY, "@element" = "T1033", XDM_CONST.MITRE_TECHNIQUE_SYSTEM_OWNER_USER_DISCOVERY, "@element" = "T1007", XDM_CONST.MITRE_TECHNIQUE_SYSTEM_SERVICE_DISCOVERY, "@element" = "T1569", XDM_CONST.MITRE_TECHNIQUE_SYSTEM_SERVICES, "@element" = "T1529", XDM_CONST.MITRE_TECHNIQUE_SYSTEM_SHUTDOWN_OR_REBOOT, "@element" = "T1124", XDM_CONST.MITRE_TECHNIQUE_SYSTEM_TIME_DISCOVERY, "@element" = "T1080", XDM_CONST.MITRE_TECHNIQUE_TAINT_SHARED_CONTENT, "@element" = "T1221", XDM_CONST.MITRE_TECHNIQUE_TEMPLATE_INJECTION, "@element" = "T1205", XDM_CONST.MITRE_TECHNIQUE_TRAFFIC_SIGNALING, "@element" = "T1537", XDM_CONST.MITRE_TECHNIQUE_TRANSFER_DATA_TO_CLOUD_ACCOUNT, "@element" = "T1127", XDM_CONST.MITRE_TECHNIQUE_TRUSTED_DEVELOPER_UTILITIES_PROXY_EXECUTION, "@element" = "T1199", XDM_CONST.MITRE_TECHNIQUE_TRUSTED_RELATIONSHIP, "@element" = "T1111", XDM_CONST.MITRE_TECHNIQUE_TWO_FACTOR_AUTHENTICATION_INTERCEPTION, "@element" = "T1552", XDM_CONST.MITRE_TECHNIQUE_UNSECURED_CREDENTIALS, "@element" = "T1535", XDM_CONST.MITRE_TECHNIQUE_UNSUPPORTED_CLOUD_REGIONS, "@element" = "T1550", XDM_CONST.MITRE_TECHNIQUE_USE_ALTERNATE_AUTHENTICATION_MATERIAL, "@element" = "T1204", XDM_CONST.MITRE_TECHNIQUE_USER_EXECUTION, "@element" = "T1078", XDM_CONST.MITRE_TECHNIQUE_VALID_ACCOUNTS, "@element" = "T1497", XDM_CONST.MITRE_TECHNIQUE_SANDBOX_EVASION, "@element" = "T1125", XDM_CONST.MITRE_TECHNIQUE_VIDEO_CAPTURE, "@element" = "T1600", XDM_CONST.MITRE_TECHNIQUE_WEAKEN_ENCRYPTION, "@element" = "T1102", XDM_CONST.MITRE_TECHNIQUE_WEB_SERVICE, "@element" = "T1047", XDM_CONST.MITRE_TECHNIQUE_WINDOWS_MANAGEMENT_INSTRUMENTATION, "@element" = "T1220", XDM_CONST.MITRE_TECHNIQUE_XSL_SCRIPT_PROCESSING, "@element"))
| alter
// =====================================================================
// PART 3: FINAL XDM MAPPING
// =====================================================================
xdm.alert.original_alert_id = alertId,
xdm.alert.name = name,
xdm.alert.severity = tmp_priority,
xdm.alert.subcategory = arraystring(tmp_use_cases_list, ", "),
xdm.alert.description = arrayindex(tmp_rule_names, 0),
xdm.alert.original_threat_id = arraystring(tmp_rule_ids, ", "),
xdm.event.description = arrayindex(tmp_rule_reasons, 0),
xdm.alert.mitre_tactics = tmp_mitre_tactics,
xdm.alert.mitre_techniques = tmp_mitre_techniques,
xdm.source.host.ipv4_addresses = tmp_src_ipv4_list,
xdm.source.host.ipv6_addresses = tmp_src_ipv6_list,
xdm.target.host.ipv4_addresses = tmp_dest_ipv4_list,
xdm.target.host.ipv6_addresses = tmp_dest_ipv6_list,
xdm.source.host.hostname = arraystring(tmp_src_host_list, ", "),
xdm.target.host.hostname = arraystring(tmp_dest_host_list, ", "),
xdm.source.user.username = arraystring(tmp_user_list, ", ");