F5 ASM

Modeling Rule

F5 ASM

Details

IDF5_ASM
From Version6.8.0
To Version6.9.9
TagsF5 ASM

Rules (XIF)

[MODEL: dataset="F5_ASM_raw", model="Network"] 

alter event_type = arrayindex(regextract(_raw_log ,"CEF\:\d\|\w+\|\w+\|\d+\.\d+[^A-Z]+([^\|]+) "), 0)
	,dvchost  = arrayindex(regextract(_raw_log ,"dvchost\=([^\s]+)"), 0)
	,response_code= arrayindex(regextract(_raw_log ,"cn1\=(\d+)"), 0)
	,spt = arrayindex(regextract(_raw_log ,"spt\=(\d+)"), 0)
	,dst= arrayindex(regextract(_raw_log ,"dst\=(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}) "), 0)
	,dpt= arrayindex(regextract(_raw_log , "dpt\=(\d+)"), 0)
	,requestMethod = arrayindex(regextract(_raw_log , "requestMethod\=(\w+)"), 0)
	,app = arrayindex(regextract(_raw_log ,"app\=(\w+)"), 0)
	,rt = parse_timestamp("%b %d %Y %T",arrayindex(regextract(_raw_log ,"rt\=(\w+\s\d+\s\d+\s\d{2}:\d{2}:\d{2})"), 0))
	,policy_apply_date= parse_timestamp("%b %d %Y %T",arrayindex(regextract(_raw_log ,"deviceCustomDate1\=(\w+\s\d+\s\d+\s\d{2}:\d{2}:\d{2})"), 0))
	,deviceExternalId= arrayindex(regextract(_raw_log , "deviceExternalId\=(\d+)"), 0)
	,attack_type=arrayindex(regextract(_raw_log , "cs4\=([^\!]+)\scs4Label"), 0)
	,geo_location =arrayindex(regextract(_raw_log ,"cs6\=(\w+)"), 0)
	,request=arrayindex(regextract(_raw_log ,"request\=([^\s]+)"), 0)
	,full_request =arrayindex(regextract(_raw_log ,"cs3\=([^:]+)\\r\\nHost\:"), 0)
	,host=arrayindex(regextract(_raw_log ,"Host:\s([^\\]+)"), 0)
	,X_Forwarded_Proto=arrayindex(regextract(_raw_log ,"Proto\:\s(\w+)"), 0)
	,User_agent=arrayindex(regextract(_raw_log ,"user\-agent\:\s([^\"]+)\\"), 0)
	,referrer =arrayindex(regextract(_raw_log ,"referer\:\s([^\\]+)"), 0)
 ,policy_name= arrayindex(regextract(_raw_log ,"cs1\=([^\s]+)") ,0)
// extract device_address
| alter device_address_ipv4= arrayindex(regextract(_raw_log , "(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"), 0)
	,device_address_ipv6 = arrayindex(regextract(_raw_log ,"(\w+\:\w+\:\w+\:\w+\:\w+\:\w+\:\w+\:\w+)") ,0)
| alter device_address  = coalesce(device_address_ipv4 , device_address_ipv6)
// end extract dst
// extract source_address
| alter source_address_ipv4= arrayindex(regextract(_raw_log ,"c6a2\=(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"), 0)
	,source_address_ipv6 = arrayindex(regextract(_raw_log ,"c6a2\=(\w+\:\w+\:\w+\:\w+\:\w+\:\w+\:\w+\:\w+)") ,0)
| alter source_address = coalesce(source_address_ipv4,source_address_ipv6 )
// end extract source_address
// extract  destination_address
| alter destination_address_ipv4= arrayindex(regextract(_raw_log ,"c6a3\=(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"), 0)
	,destination_address_ipv6 = arrayindex(regextract(_raw_log ,"c6a3\=(\w+\:\w+\:\w+\:\w+\:\w+\:\w+\:\w+\:\w+)") ,0)
| alter destination_address = coalesce(destination_address_ipv4,destination_address_ipv6  )
// end extract  destination_address
// extract dvc
| alter dvc_ipv4= arrayindex(regextract(_raw_log ,"dvc\=(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"), 0)
	,dvc_ipv6 = arrayindex(regextract(_raw_log ,"dvc\=(\w+\:\w+\:\w+\:\w+\:\w+\:\w+\:\w+\:\w+)") ,0)
| alter dvc = arraycreate(coalesce(dvc_ipv4,dvc_ipv6 ))
// end extract  dvc
// extract dst
| alter dst_ipv4= arrayindex(regextract(_raw_log ,"dst\=(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}) "), 0)
	,dst_ipv6 = arrayindex(regextract(_raw_log ,"\dst=(\w+\:\w+\:\w+\:\w+\:\w+\:\w+\:\w+\:\w+)") ,0)
| alter dst = coalesce(dst_ipv4,dst_ipv6 )
// end extract  dst
| alter XDM.Network.Original_event_type= event_type
, XDM.Network.Source.host.hostname= dvchost 
, XDM.Network.Destination.host.ipv4_addresses= dvc
, XDM.Network.rule = policy_name
, XDM.Network.observation_timestamp =policy_apply_date
, XDM.Network.http.response_code= response_code
, XDM.Network.Source.port= to_number(spt)
, XDM.Network.Destination.ipv4= dst
, XDM.Network.Destination.port= to_number(dpt)
, XDM.Network.http.method= requestMethod
, XDM.Network.application_protocol= app
, XDM.Network.event_timestamp= rt
, XDM.Network.Observer.unique_identifier= deviceExternalId
, XDM.Network.threat.name= attack_type
, XDM.Network.Source.location.geo= geo_location
, XDM.Network.Source.ipv4= source_address  
, XDM.Network.http.url= request
, XDM.Network.Destination.process.executable.path = full_request
, XDM.Network.Destination.host.hostname= host
, XDM.Network.ip_protocol= X_Forwarded_Proto
//, XDM.Network.http.user_agent= User_agent
, XDM.Network.http.referrer= referrer;

Schema

F5_ASM_raw

Field Type Array?
_raw_log string
Raw JSON
{
  "F5_ASM_raw": {
    "_raw_log": {
      "type": "string",
      "is_array": false
    }
  }
}