Rules (XIF)
[MODEL: dataset="F5_ASM_raw"]
alter
cs3_request_user_agent = arrayindex(regextract(cs3 ,"[Uu]ser\-[Aa]gent:\s*([^:]+)\s+\S+\:"), 0),
cs3_request_referrer = arrayindex(regextract(cs3 ,"[Rr]eferer\:\s*([^\s\\]+)"), 0),
cs3_request_host = arrayindex(regextract(cs3 ,"[Hh]ost:\s*([^\s\\]+)"), 0),
cs3_request_content_type = arrayindex(regextract(cs3 ,"[Cc]ontent\-[Tt]ype\:\s*([^:]+)\s+\S+\:"), 0),
cs3_request_cookie = arrayindex(regextract(cs3 ,"Cookie:\s*(.*)\s*X-Forwarded-For:"), 0),
cn1_response_code = to_string(cn1),
cs5_domain = if(is_ipv4(cs5) = FALSE AND is_ipv6(cs5) = FALSE, cs5, null)
| alter
xdm.event.type = cefName,
xdm.network.rule = cs1,
xdm.source.port = to_integer(spt),
xdm.target.port = to_integer(dpt),
xdm.network.ip_protocol = if(app = "HOPOPT", XDM_CONST.IP_PROTOCOL_HOPOPT, app = "ICMP",XDM_CONST.IP_PROTOCOL_ICMP, app = "IGMP",XDM_CONST.IP_PROTOCOL_IGMP, app = "GGP",XDM_CONST.IP_PROTOCOL_GGP, app = "IP",XDM_CONST.IP_PROTOCOL_IP, app = "ST",XDM_CONST.IP_PROTOCOL_ST, app = "TCP",XDM_CONST.IP_PROTOCOL_TCP, app = "CBT",XDM_CONST.IP_PROTOCOL_CBT, app = "EGP",XDM_CONST.IP_PROTOCOL_EGP, app = "IGP",XDM_CONST.IP_PROTOCOL_IGP, app = "BBN_RCC_MON",XDM_CONST.IP_PROTOCOL_BBN_RCC_MON, app = "NVP_II",XDM_CONST.IP_PROTOCOL_NVP_II, app = "PUP",XDM_CONST.IP_PROTOCOL_PUP, app = "ARGUS",XDM_CONST.IP_PROTOCOL_ARGUS, app = "EMCON",XDM_CONST.IP_PROTOCOL_EMCON, app = "XNET",XDM_CONST.IP_PROTOCOL_XNET, app = "CHAOS",XDM_CONST.IP_PROTOCOL_CHAOS, app = "UDP",XDM_CONST.IP_PROTOCOL_UDP, app = "MUX",XDM_CONST.IP_PROTOCOL_MUX, app = "DCN_MEAS",XDM_CONST.IP_PROTOCOL_DCN_MEAS, app = "HMP",XDM_CONST.IP_PROTOCOL_HMP, app = "PRM",XDM_CONST.IP_PROTOCOL_PRM, app = "XNS_IDP",XDM_CONST.IP_PROTOCOL_XNS_IDP, app = "TRUNK_1",XDM_CONST.IP_PROTOCOL_TRUNK_1, app = "TRUNK_2",XDM_CONST.IP_PROTOCOL_TRUNK_2, app = "LEAF_1",XDM_CONST.IP_PROTOCOL_LEAF_1, app = "LEAF_2",XDM_CONST.IP_PROTOCOL_LEAF_2, app = "RDP",XDM_CONST.IP_PROTOCOL_RDP, app = "IRTP",XDM_CONST.IP_PROTOCOL_IRTP, app = "ISO_TP4",XDM_CONST.IP_PROTOCOL_ISO_TP4, app = "NETBLT",XDM_CONST.IP_PROTOCOL_NETBLT, app = "MFE_NSP",XDM_CONST.IP_PROTOCOL_MFE_NSP, app = "MERIT_INP",XDM_CONST.IP_PROTOCOL_MERIT_INP, app = "DCCP",XDM_CONST.IP_PROTOCOL_DCCP, app = "3PC",XDM_CONST.IP_PROTOCOL_3PC, app = "IDPR",XDM_CONST.IP_PROTOCOL_IDPR, app = "XTP",XDM_CONST.IP_PROTOCOL_XTP, app = "DDP",XDM_CONST.IP_PROTOCOL_DDP, app = "IDPR_CMTP",XDM_CONST.IP_PROTOCOL_IDPR_CMTP, app = "TP",XDM_CONST.IP_PROTOCOL_TP, app = "IL",XDM_CONST.IP_PROTOCOL_IL, app = "IPV6",XDM_CONST.IP_PROTOCOL_IPV6, app = "SDRP",XDM_CONST.IP_PROTOCOL_SDRP, app = "IPV6_ROUTE",XDM_CONST.IP_PROTOCOL_IPV6_ROUTE, app = "IPV6_FRAG",XDM_CONST.IP_PROTOCOL_IPV6_FRAG, app = "IDRP",XDM_CONST.IP_PROTOCOL_IDRP, app = "RSVP",XDM_CONST.IP_PROTOCOL_RSVP, app = "GRE",XDM_CONST.IP_PROTOCOL_GRE, app = "DSR",XDM_CONST.IP_PROTOCOL_DSR, app = "BNA",XDM_CONST.IP_PROTOCOL_BNA, app = "ESP",XDM_CONST.IP_PROTOCOL_ESP, app = "AH",XDM_CONST.IP_PROTOCOL_AH, app = "I_NLSP",XDM_CONST.IP_PROTOCOL_I_NLSP, app = "SWIPE",XDM_CONST.IP_PROTOCOL_SWIPE, app = "NARP",XDM_CONST.IP_PROTOCOL_NARP, app = "MOBILE",XDM_CONST.IP_PROTOCOL_MOBILE, app = "TLSP",XDM_CONST.IP_PROTOCOL_TLSP, app = "SKIP",XDM_CONST.IP_PROTOCOL_SKIP, app = "IPV6_ICMP",XDM_CONST.IP_PROTOCOL_IPV6_ICMP, app = "IPV6_NONXT",XDM_CONST.IP_PROTOCOL_IPV6_NONXT, app = "IPV6_OPTS",XDM_CONST.IP_PROTOCOL_IPV6_OPTS, app = "CFTP",XDM_CONST.IP_PROTOCOL_CFTP, app = "SAT_EXPAK",XDM_CONST.IP_PROTOCOL_SAT_EXPAK, app = "KRYPTOLAN",XDM_CONST.IP_PROTOCOL_KRYPTOLAN, app = "RVD",XDM_CONST.IP_PROTOCOL_RVD, app = "IPPC",XDM_CONST.IP_PROTOCOL_IPPC, app = "SAT_MON",XDM_CONST.IP_PROTOCOL_SAT_MON, app = "VISA",XDM_CONST.IP_PROTOCOL_VISA, app = "IPCV",XDM_CONST.IP_PROTOCOL_IPCV, app = "CPNX",XDM_CONST.IP_PROTOCOL_CPNX, app = "CPHB",XDM_CONST.IP_PROTOCOL_CPHB, app = "WSN",XDM_CONST.IP_PROTOCOL_WSN, app = "PVP",XDM_CONST.IP_PROTOCOL_PVP, app = "BR_SAT_MON",XDM_CONST.IP_PROTOCOL_BR_SAT_MON, app = "SUN_ND",XDM_CONST.IP_PROTOCOL_SUN_ND, app = "WB_MON",XDM_CONST.IP_PROTOCOL_WB_MON, app = "WB_EXPAK",XDM_CONST.IP_PROTOCOL_WB_EXPAK, app = "ISO_IP",XDM_CONST.IP_PROTOCOL_ISO_IP, app = "VMTP",XDM_CONST.IP_PROTOCOL_VMTP, app = "SECURE_VMTP",XDM_CONST.IP_PROTOCOL_SECURE_VMTP, app = "VINES",XDM_CONST.IP_PROTOCOL_VINES, app = "TTP",XDM_CONST.IP_PROTOCOL_TTP, app = "NSFNET_IGP",XDM_CONST.IP_PROTOCOL_NSFNET_IGP, app = "DGP",XDM_CONST.IP_PROTOCOL_DGP, app = "TCF",XDM_CONST.IP_PROTOCOL_TCF, app = "EIGRP",XDM_CONST.IP_PROTOCOL_EIGRP, app = "OSPFIGP",XDM_CONST.IP_PROTOCOL_OSPFIGP, app = "SPRITE_RPC",XDM_CONST.IP_PROTOCOL_SPRITE_RPC, app = "LARP",XDM_CONST.IP_PROTOCOL_LARP, app = "MTP",XDM_CONST.IP_PROTOCOL_MTP, app = "AX25",XDM_CONST.IP_PROTOCOL_AX25, app = "IPIP",XDM_CONST.IP_PROTOCOL_IPIP, app = "MICP",XDM_CONST.IP_PROTOCOL_MICP, app = "SCC_SP",XDM_CONST.IP_PROTOCOL_SCC_SP, app = "ETHERIP",XDM_CONST.IP_PROTOCOL_ETHERIP, app = "ENCAP",XDM_CONST.IP_PROTOCOL_ENCAP, app = "GMTP",XDM_CONST.IP_PROTOCOL_GMTP, app = "IFMP",XDM_CONST.IP_PROTOCOL_IFMP, app = "PNNI",XDM_CONST.IP_PROTOCOL_PNNI, app = "PIM",XDM_CONST.IP_PROTOCOL_PIM, app = "ARIS",XDM_CONST.IP_PROTOCOL_ARIS, app = "SCPS",XDM_CONST.IP_PROTOCOL_SCPS, app = "QNX",XDM_CONST.IP_PROTOCOL_QNX, app = "AN",XDM_CONST.IP_PROTOCOL_AN, app = "IPCOMP",XDM_CONST.IP_PROTOCOL_IPCOMP, app = "SNP",XDM_CONST.IP_PROTOCOL_SNP, app = "COMPAQ_PEER",XDM_CONST.IP_PROTOCOL_COMPAQ_PEER, app = "IPX_IN_IP",XDM_CONST.IP_PROTOCOL_IPX_IN_IP, app = "VRRP",XDM_CONST.IP_PROTOCOL_VRRP, app = "PGM",XDM_CONST.IP_PROTOCOL_PGM, app = "L2TP",XDM_CONST.IP_PROTOCOL_L2TP, app = "DDX",XDM_CONST.IP_PROTOCOL_DDX, app = "IATP",XDM_CONST.IP_PROTOCOL_IATP, app = "STP",XDM_CONST.IP_PROTOCOL_STP, app = "SRP",XDM_CONST.IP_PROTOCOL_SRP, app = "UTI",XDM_CONST.IP_PROTOCOL_UTI, app = "SMP",XDM_CONST.IP_PROTOCOL_SMP, app = "SM",XDM_CONST.IP_PROTOCOL_SM, app = "PTP",XDM_CONST.IP_PROTOCOL_PTP, app = "ISIS",XDM_CONST.IP_PROTOCOL_ISIS, app = "FIRE",XDM_CONST.IP_PROTOCOL_FIRE, app = "CRTP",XDM_CONST.IP_PROTOCOL_CRTP, app = "CRUDP",XDM_CONST.IP_PROTOCOL_CRUDP, app = "SSCOPMCE",XDM_CONST.IP_PROTOCOL_SSCOPMCE, app = "IPLT",XDM_CONST.IP_PROTOCOL_IPLT, app = "SPS",XDM_CONST.IP_PROTOCOL_SPS, app = "PIPE",XDM_CONST.IP_PROTOCOL_PIPE, app = "SCTP",XDM_CONST.IP_PROTOCOL_SCTP, app = "FC",XDM_CONST.IP_PROTOCOL_FC, app = "RSVP_E2E_IGNORE",XDM_CONST.IP_PROTOCOL_RSVP_E2E_IGNORE, app = "MOBILITY",XDM_CONST.IP_PROTOCOL_MOBILITY, app = "UDPLITE",XDM_CONST.IP_PROTOCOL_UDPLITE, app = "MPLS_IN_IP",XDM_CONST.IP_PROTOCOL_MPLS_IN_IP, app = "MANET",XDM_CONST.IP_PROTOCOL_MANET, app = "HIP",XDM_CONST.IP_PROTOCOL_HIP, app = "SHIM6",XDM_CONST.IP_PROTOCOL_SHIM6, app = "WESP",XDM_CONST.IP_PROTOCOL_WESP, app = "ROHC",XDM_CONST.IP_PROTOCOL_ROHC, app = "RESERVED",XDM_CONST.IP_PROTOCOL_RESERVED,to_string(app)),
xdm.observer.unique_identifier = deviceExternalId,
xdm.alert.original_threat_name = to_string(cs4),
xdm.session_context_id = suid,
xdm.alert.original_alert_id = to_string(externalID),
xdm.alert.severity = to_string(cefseverity),
xdm.target.host.hostname = cs3_request_host,
xdm.network.http.content_type = cs3_request_content_type,
xdm.network.http.http_header.header = if(cs3_request_cookie = null, null, "Cookie"),
xdm.network.http.http_header.value = cs3_request_cookie,
xdm.source.ipv4 = if(is_ipv4(src), src, is_ipv4(cs5), cs5),
xdm.source.ipv6 = if(is_ipv6(src), src, is_ipv6(cs5), cs5),
xdm.source.user.domain = cs5_domain,
xdm.target.ipv4 = if(is_ipv4(dst), dst),
xdm.target.ipv6 = if(is_ipv6(dst), dst),
xdm.intermediate.ipv4 = if(is_ipv4(dvc), dvc),
xdm.intermediate.ipv6 = if(is_ipv6(dvc), dvc),
xdm.event.outcome = if(act ~= "[Pp]assed", XDM_CONST.OUTCOME_SUCCESS, act ~= "[Aa]lerted", XDM_CONST.OUTCOME_PARTIAL, act ~= "[Bb]locked", XDM_CONST.OUTCOME_FAILED, act ~= "^\s*$", XDM_CONST.OUTCOME_UNKNOWN, null),
xdm.observer.name = dvchost,
xdm.network.http.response_code = if(cn1_response_code = "200", XDM_CONST.HTTP_RSP_CODE_OK, cn1_response_code = "201", XDM_CONST.HTTP_RSP_CODE_CREATED, cn1_response_code = "302", XDM_CONST.HTTP_RSP_CODE_FOUND, cn1_response_code = "401", XDM_CONST.HTTP_RSP_CODE_UNAUTHORIZED, cn1_response_code = "403", XDM_CONST.HTTP_RSP_CODE_FORBIDDEN, cn1_response_code = "404", XDM_CONST.HTTP_RSP_CODE_NOT_FOUND, cn1_response_code = "500", XDM_CONST.HTTP_RSP_CODE_INTERNAL_SERVER_ERROR, cn1_response_code = "501", XDM_CONST.HTTP_RSP_CODE_NOT_IMPLEMENTED, cn1_response_code = "502", XDM_CONST.HTTP_RSP_CODE_BAD_GATEWAY, cn1_response_code = "503", XDM_CONST.HTTP_RSP_CODE_SERVICE_UNAVAILABLE, cn1_response_code = "504", XDM_CONST.HTTP_RSP_CODE_GATEWAY_TIMEOUT, cn1_response_code = "505", XDM_CONST.HTTP_RSP_CODE_HTTP_VERSION_NOT_SUPPORTED, cn1_response_code = "506", XDM_CONST.HTTP_RSP_CODE_VARIANT_ALSO_NEGOTIATES, cn1_response_code = "507", XDM_CONST.HTTP_RSP_CODE_INSUFFICIENT_STORAGE, cn1_response_code = "508", XDM_CONST.HTTP_RSP_CODE_LOOP_DETECTED, cn1_response_code = "511", XDM_CONST.HTTP_RSP_CODE_NETWORK_AUTHENTICATION_REQUIRED, cn1_response_code = "100", XDM_CONST.HTTP_RSP_CODE_CONTINUE, cn1_response_code = "101", XDM_CONST.HTTP_RSP_CODE_SWITCHING_PROTOCOLS, cn1_response_code = "102", XDM_CONST.HTTP_RSP_CODE_PROCESSING, cn1_response_code = "103", XDM_CONST.HTTP_RSP_CODE_EARLY_HINTS, cn1_response_code = "202", XDM_CONST.HTTP_RSP_CODE_ACCEPTED, cn1_response_code = "203", XDM_CONST.HTTP_RSP_CODE_NON__AUTHORITATIVE_INFORMATION, cn1_response_code = "204", XDM_CONST.HTTP_RSP_CODE_NO_CONTENT, cn1_response_code = "205", XDM_CONST.HTTP_RSP_CODE_RESET_CONTENT, cn1_response_code = "206", XDM_CONST.HTTP_RSP_CODE_PARTIAL_CONTENT, cn1_response_code = "207", XDM_CONST.HTTP_RSP_CODE_MULTI__STATUS, cn1_response_code = "208", XDM_CONST.HTTP_RSP_CODE_ALREADY_REPORTED, cn1_response_code = "226", XDM_CONST.HTTP_RSP_CODE_IM_USED, cn1_response_code = "300", XDM_CONST.HTTP_RSP_CODE_MULTIPLE_CHOICES, cn1_response_code = "301", XDM_CONST.HTTP_RSP_CODE_MOVED_PERMANENTLY, cn1_response_code = "303", XDM_CONST.HTTP_RSP_CODE_SEE_OTHER, cn1_response_code = "304", XDM_CONST.HTTP_RSP_CODE_NOT_MODIFIED, cn1_response_code = "305", XDM_CONST.HTTP_RSP_CODE_USE_PROXY, cn1_response_code = "307", XDM_CONST.HTTP_RSP_CODE_TEMPORARY_REDIRECT, cn1_response_code = "308", XDM_CONST.HTTP_RSP_CODE_PERMANENT_REDIRECT, cn1_response_code = "400", XDM_CONST.HTTP_RSP_CODE_BAD_REQUEST, cn1_response_code = "402", XDM_CONST.HTTP_RSP_CODE_PAYMENT_REQUIRED, cn1_response_code = "405", XDM_CONST.HTTP_RSP_CODE_METHOD_NOT_ALLOWED, cn1_response_code = "406", XDM_CONST.HTTP_RSP_CODE_NOT_ACCEPTABLE, cn1_response_code = "407", XDM_CONST.HTTP_RSP_CODE_PROXY_AUTHENTICATION_REQUIRED, cn1_response_code = "408", XDM_CONST.HTTP_RSP_CODE_REQUEST_TIMEOUT, cn1_response_code = "409", XDM_CONST.HTTP_RSP_CODE_CONFLICT, cn1_response_code = "410", XDM_CONST.HTTP_RSP_CODE_GONE, cn1_response_code = "411", XDM_CONST.HTTP_RSP_CODE_LENGTH_REQUIRED, cn1_response_code = "412", XDM_CONST.HTTP_RSP_CODE_PRECONDITION_FAILED, cn1_response_code = "413", XDM_CONST.HTTP_RSP_CODE_CONTENT_TOO_LARGE, cn1_response_code = "414", XDM_CONST.HTTP_RSP_CODE_URI_TOO_LONG, cn1_response_code = "415", XDM_CONST.HTTP_RSP_CODE_UNSUPPORTED_MEDIA_TYPE, cn1_response_code = "416", XDM_CONST.HTTP_RSP_CODE_RANGE_NOT_SATISFIABLE, cn1_response_code = "417", XDM_CONST.HTTP_RSP_CODE_EXPECTATION_FAILED, cn1_response_code = "421", XDM_CONST.HTTP_RSP_CODE_MISDIRECTED_REQUEST, cn1_response_code = "422", XDM_CONST.HTTP_RSP_CODE_UNPROCESSABLE_CONTENT, cn1_response_code = "423", XDM_CONST.HTTP_RSP_CODE_LOCKED, cn1_response_code = "424", XDM_CONST.HTTP_RSP_CODE_FAILED_DEPENDENCY, cn1_response_code = "425", XDM_CONST.HTTP_RSP_CODE_TOO_EARLY, cn1_response_code = "426", XDM_CONST.HTTP_RSP_CODE_UPGRADE_REQUIRED, cn1_response_code = "428", XDM_CONST.HTTP_RSP_CODE_PRECONDITION_REQUIRED, cn1_response_code = "429", XDM_CONST.HTTP_RSP_CODE_TOO_MANY_REQUESTS, cn1_response_code = "431", XDM_CONST.HTTP_RSP_CODE_REQUEST_HEADER_FIELDS_TOO_LARGE, cn1_response_code = "451", XDM_CONST.HTTP_RSP_CODE_UNAVAILABLE_FOR_LEGAL_REASONS, cn1_response_code),
xdm.network.http.method = if(requestMethod = "GET", XDM_CONST.HTTP_METHOD_GET, requestMethod = "POST", XDM_CONST.HTTP_METHOD_POST, requestMethod = "PUT", XDM_CONST.HTTP_METHOD_PUT, requestMethod = "OPTIONS", XDM_CONST.HTTP_METHOD_OPTIONS, requestMethod = "CONNECT", XDM_CONST.HTTP_METHOD_CONNECT, requestMethod = "ACL", XDM_CONST.HTTP_METHOD_ACL, requestMethod = "BASELINE_CONTROL", XDM_CONST.HTTP_METHOD_BASELINE_CONTROL, requestMethod = "BIND", XDM_CONST.HTTP_METHOD_BIND, requestMethod = "CHECKIN", XDM_CONST.HTTP_METHOD_CHECKIN, requestMethod = "CHECKOUT", XDM_CONST.HTTP_METHOD_CHECKOUT, requestMethod = "COPY", XDM_CONST.HTTP_METHOD_COPY, requestMethod = "DELETE", XDM_CONST.HTTP_METHOD_DELETE, requestMethod = "HEAD", XDM_CONST.HTTP_METHOD_HEAD, requestMethod = "LABEL", XDM_CONST.HTTP_METHOD_LABEL, requestMethod = "LINK", XDM_CONST.HTTP_METHOD_LINK, requestMethod = "LOCK", XDM_CONST.HTTP_METHOD_LOCK, requestMethod = "MERGE", XDM_CONST.HTTP_METHOD_MERGE, requestMethod = "MKACTIVITY", XDM_CONST.HTTP_METHOD_MKACTIVITY, requestMethod = "MKCALENDAR", XDM_CONST.HTTP_METHOD_MKCALENDAR, requestMethod = "MKCOL", XDM_CONST.HTTP_METHOD_MKCOL, requestMethod = "MKREDIRECTREF", XDM_CONST.HTTP_METHOD_MKREDIRECTREF, requestMethod = "MKWORKSPACE", XDM_CONST.HTTP_METHOD_MKWORKSPACE, requestMethod = "MOVE", XDM_CONST.HTTP_METHOD_MOVE, requestMethod = "ORDERPATCH", XDM_CONST.HTTP_METHOD_ORDERPATCH, requestMethod = "PATCH", XDM_CONST.HTTP_METHOD_PATCH, requestMethod = "PRI", XDM_CONST.HTTP_METHOD_PRI, requestMethod = "PROPFIND", XDM_CONST.HTTP_METHOD_PROPFIND, requestMethod = "PROPPATCH", XDM_CONST.HTTP_METHOD_PROPPATCH, requestMethod = "REBIND", XDM_CONST.HTTP_METHOD_REBIND, requestMethod = "REPORT", XDM_CONST.HTTP_METHOD_REPORT, requestMethod = "SEARCH", XDM_CONST.HTTP_METHOD_SEARCH, requestMethod = "TRACE", XDM_CONST.HTTP_METHOD_TRACE, requestMethod = "UNBIND", XDM_CONST.HTTP_METHOD_UNBIND, requestMethod = "UNCHECKOUT", XDM_CONST.HTTP_METHOD_UNCHECKOUT, requestMethod = "UNLINK", XDM_CONST.HTTP_METHOD_UNLINK, requestMethod = "UNLOCK", XDM_CONST.HTTP_METHOD_UNLOCK, requestMethod = "UPDATE", XDM_CONST.HTTP_METHOD_UPDATE, requestMethod = "UPDATEREDIRECTREF", XDM_CONST.HTTP_METHOD_UPDATEREDIRECTREF, requestMethod = "VERSION_CONTROL", XDM_CONST.HTTP_METHOD_VERSION_CONTROL, requestMethod),
xdm.target.url = request,
xdm.network.http.referrer = cs3_request_referrer,
xdm.source.user_agent = cs3_request_user_agent,
xdm.event.description = cs3;