Rules (XIF)
[MODEL: dataset="F5_ASM_raw", model="Network"]
alter event_type = arrayindex(regextract(_raw_log ,"CEF\:\d\|\w+\|\w+\|\d+\.\d+[^A-Z]+([^\|]+) "), 0)
,dvchost = arrayindex(regextract(_raw_log ,"dvchost\=([^\s]+)"), 0)
,response_code= arrayindex(regextract(_raw_log ,"cn1\=(\d+)"), 0)
,spt = arrayindex(regextract(_raw_log ,"spt\=(\d+)"), 0)
,dst= arrayindex(regextract(_raw_log ,"dst\=(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}) "), 0)
,dpt= arrayindex(regextract(_raw_log , "dpt\=(\d+)"), 0)
,requestMethod = arrayindex(regextract(_raw_log , "requestMethod\=(\w+)"), 0)
,app = arrayindex(regextract(_raw_log ,"app\=(\w+)"), 0)
,rt = parse_timestamp("%b %d %Y %T",arrayindex(regextract(_raw_log ,"rt\=(\w+\s\d+\s\d+\s\d{2}:\d{2}:\d{2})"), 0))
,policy_apply_date= parse_timestamp("%b %d %Y %T",arrayindex(regextract(_raw_log ,"deviceCustomDate1\=(\w+\s\d+\s\d+\s\d{2}:\d{2}:\d{2})"), 0))
,deviceExternalId= arrayindex(regextract(_raw_log , "deviceExternalId\=(\d+)"), 0)
,attack_type=arrayindex(regextract(_raw_log , "cs4\=([^\!]+)\scs4Label"), 0)
,geo_location =arrayindex(regextract(_raw_log ,"cs6\=(\w+)"), 0)
,request=arrayindex(regextract(_raw_log ,"request\=([^\s]+)"), 0)
,full_request =arrayindex(regextract(_raw_log ,"cs3\=([^:]+)\\r\\nHost\:"), 0)
,host=arrayindex(regextract(_raw_log ,"Host:\s([^\\]+)"), 0)
,X_Forwarded_Proto=arrayindex(regextract(_raw_log ,"Proto\:\s(\w+)"), 0)
,User_agent=arrayindex(regextract(_raw_log ,"user\-agent\:\s([^\"]+)\\"), 0)
,referrer =arrayindex(regextract(_raw_log ,"referer\:\s([^\\]+)"), 0)
,policy_name= arrayindex(regextract(_raw_log ,"cs1\=([^\s]+)") ,0)
// extract device_address
| alter device_address_ipv4= arrayindex(regextract(_raw_log , "(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"), 0)
,device_address_ipv6 = arrayindex(regextract(_raw_log ,"(\w+\:\w+\:\w+\:\w+\:\w+\:\w+\:\w+\:\w+)") ,0)
| alter device_address = coalesce(device_address_ipv4 , device_address_ipv6)
// end extract dst
// extract source_address
| alter source_address_ipv4= arrayindex(regextract(_raw_log ,"c6a2\=(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"), 0)
,source_address_ipv6 = arrayindex(regextract(_raw_log ,"c6a2\=(\w+\:\w+\:\w+\:\w+\:\w+\:\w+\:\w+\:\w+)") ,0)
| alter source_address = coalesce(source_address_ipv4,source_address_ipv6 )
// end extract source_address
// extract destination_address
| alter destination_address_ipv4= arrayindex(regextract(_raw_log ,"c6a3\=(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"), 0)
,destination_address_ipv6 = arrayindex(regextract(_raw_log ,"c6a3\=(\w+\:\w+\:\w+\:\w+\:\w+\:\w+\:\w+\:\w+)") ,0)
| alter destination_address = coalesce(destination_address_ipv4,destination_address_ipv6 )
// end extract destination_address
// extract dvc
| alter dvc_ipv4= arrayindex(regextract(_raw_log ,"dvc\=(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"), 0)
,dvc_ipv6 = arrayindex(regextract(_raw_log ,"dvc\=(\w+\:\w+\:\w+\:\w+\:\w+\:\w+\:\w+\:\w+)") ,0)
| alter dvc = arraycreate(coalesce(dvc_ipv4,dvc_ipv6 ))
// end extract dvc
// extract dst
| alter dst_ipv4= arrayindex(regextract(_raw_log ,"dst\=(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}) "), 0)
,dst_ipv6 = arrayindex(regextract(_raw_log ,"\dst=(\w+\:\w+\:\w+\:\w+\:\w+\:\w+\:\w+\:\w+)") ,0)
| alter dst = coalesce(dst_ipv4,dst_ipv6 )
// end extract dst
| alter XDM.Network.Original_event_type= event_type
, XDM.Network.Source.host.hostname= dvchost
, XDM.Network.Destination.host.ipv4_addresses= dvc
, XDM.Network.rule = policy_name
, XDM.Network.observation_timestamp =policy_apply_date
, XDM.Network.http.response_code= response_code
, XDM.Network.Source.port= to_number(spt)
, XDM.Network.Destination.ipv4= dst
, XDM.Network.Destination.port= to_number(dpt)
, XDM.Network.http.method= requestMethod
, XDM.Network.application_protocol= app
, XDM.Network.event_timestamp= rt
, XDM.Network.Observer.unique_identifier= deviceExternalId
, XDM.Network.threat.name= attack_type
, XDM.Network.Source.location.geo= geo_location
, XDM.Network.Source.ipv4= source_address
, XDM.Network.http.url= request
, XDM.Network.Destination.process.executable.path = full_request
, XDM.Network.Destination.host.hostname= host
, XDM.Network.ip_protocol= X_Forwarded_Proto
//, XDM.Network.http.user_agent= User_agent
, XDM.Network.http.referrer= referrer;