Rules (XIF)
[MODEL: dataset = f5_ltm_raw]
alter
httpMethod1=arrayindex(regextract(_raw_log,"http_method\=\"([^=]+)\"\,"),0),
httpMethod2=arrayindex(regextract(_raw_log,"method\=\"([^=]+)\"\,"),0),
OS=arrayindex(regextract(_raw_log,"os_name\=\"([^=]+)\"\,"),0),
responseCode=arrayindex(regextract(_raw_log,"response_code\=\"([^=]+)\"\,"),0),
logLevel=arrayindex(regextract(_raw_log,"\d{2}\:\d{2}\s[\w\.\-\_\@\$]+\s([a-z]+)"),0)
|alter
xdm.intermediate.ipv4=coalesce(arrayindex(regextract(_raw_log,"bigip_mgmt_ip\=\"([^=]+)\"\,"),0),arrayindex(regextract(_raw_log,"bigip_mgmt_ip2\=\"([^=]+)\"\,"),0)),
xdm.source.ipv4=coalesce(arrayindex(regextract(_raw_log,"client_ip\=\"([^=]+)\"\,"),0),arrayindex(regextract(_raw_log,"ip_client\=\"([^=]+)\"\,"),0)),
xdm.source.location.country=coalesce(arrayindex(regextract(_raw_log,"client_ip_geo_location\=\"([^=]+)\"\,"),0),arrayindex(regextract(_raw_log,"geo_location\=\"([^=]+)\"\,"),0)),
xdm.source.port=to_integer(coalesce(arrayindex(regextract(_raw_log,"client_port\=\"([^=]+)\"\,"),0),arrayindex(regextract(_raw_log,"src_port\=\"([^=]+)\"\,"),0))),
xdm.target.url=coalesce(arrayindex(regextract(_raw_log,"client_request_uri\=\"([^=]+)\"\,"),0),arrayindex(regextract(_raw_log,"uri\=\"([^=]+)\"\,"),0),
arrayindex(regextract(_raw_log,"context_name\=\"([^=]+)\"\,"),0)),
xdm.target.ipv4=arrayindex(regextract(_raw_log,"dest_ip\=\"([^=]+)\"\,"),0),
xdm.target.port=to_integer(arrayindex(regextract(_raw_log,"dest_port\=\"([^=]+)\"\,"),0)),
xdm.intermediate.agent.version=arrayindex(regextract(_raw_log,"device_version\=\"([^=]+)\"\,"),0),
xdm.network.http.method=coalesce(if(httpMethod1 = "ACL", XDM_CONST.HTTP_METHOD_ACL, httpMethod1 = "BASELINE_CONTROL", XDM_CONST.HTTP_METHOD_BASELINE_CONTROL, httpMethod1 = "BIND", XDM_CONST.HTTP_METHOD_BIND, httpMethod1 = "CHECKIN", XDM_CONST.HTTP_METHOD_CHECKIN, httpMethod1 = "CHECKOUT", XDM_CONST.HTTP_METHOD_CHECKOUT, httpMethod1 = "CONNECT", XDM_CONST.HTTP_METHOD_CONNECT, httpMethod1 = "COPY", XDM_CONST.HTTP_METHOD_COPY, httpMethod1 = "DELETE", XDM_CONST.HTTP_METHOD_DELETE, httpMethod1 = "GET", XDM_CONST.HTTP_METHOD_GET, httpMethod1 = "HEAD", XDM_CONST.HTTP_METHOD_HEAD, httpMethod1 = "LABEL", XDM_CONST.HTTP_METHOD_LABEL, httpMethod1 = "LINK", XDM_CONST.HTTP_METHOD_LINK, httpMethod1 = "LOCK", XDM_CONST.HTTP_METHOD_LOCK, httpMethod1 = "MERGE", XDM_CONST.HTTP_METHOD_MERGE, httpMethod1 = "MKACTIVITY", XDM_CONST.HTTP_METHOD_MKACTIVITY, httpMethod1 = "MKCALENDAR", XDM_CONST.HTTP_METHOD_MKCALENDAR, httpMethod1 = "MKCOL", XDM_CONST.HTTP_METHOD_MKCOL, httpMethod1 = "MKREDIRECTREF", XDM_CONST.HTTP_METHOD_MKREDIRECTREF, httpMethod1 = "MKWORKSPACE", XDM_CONST.HTTP_METHOD_MKWORKSPACE, httpMethod1 = "MOVE", XDM_CONST.HTTP_METHOD_MOVE, httpMethod1 = "OPTIONS", XDM_CONST.HTTP_METHOD_OPTIONS, httpMethod1 = "ORDERPATCH", XDM_CONST.HTTP_METHOD_ORDERPATCH, httpMethod1 = "PATCH", XDM_CONST.HTTP_METHOD_PATCH, httpMethod1 = "POST", XDM_CONST.HTTP_METHOD_POST, httpMethod1 = "PRI", XDM_CONST.HTTP_METHOD_PRI, httpMethod1 = "PROPFIND", XDM_CONST.HTTP_METHOD_PROPFIND, httpMethod1 = "PROPPATCH", XDM_CONST.HTTP_METHOD_PROPPATCH, httpMethod1 = "PUT", XDM_CONST.HTTP_METHOD_PUT, httpMethod1 = "REBIND", XDM_CONST.HTTP_METHOD_REBIND, httpMethod1 = "REPORT", XDM_CONST.HTTP_METHOD_REPORT, httpMethod1 = "SEARCH", XDM_CONST.HTTP_METHOD_SEARCH, httpMethod1 = "TRACE", XDM_CONST.HTTP_METHOD_TRACE, httpMethod1 = "UNBIND", XDM_CONST.HTTP_METHOD_UNBIND, httpMethod1 = "UNCHECKOUT", XDM_CONST.HTTP_METHOD_UNCHECKOUT, httpMethod1 = "UNLINK", XDM_CONST.HTTP_METHOD_UNLINK, httpMethod1 = "UNLOCK", XDM_CONST.HTTP_METHOD_UNLOCK, httpMethod1 = "UPDATE", XDM_CONST.HTTP_METHOD_UPDATE, httpMethod1 = "UPDATEREDIRECTREF", XDM_CONST.HTTP_METHOD_UPDATEREDIRECTREF, httpMethod1 = "VERSION_CONTROL", XDM_CONST.HTTP_METHOD_VERSION_CONTROL, to_string(httpMethod1)),
if(httpMethod2 = "ACL", XDM_CONST.HTTP_METHOD_ACL, httpMethod2 = "BASELINE_CONTROL", XDM_CONST.HTTP_METHOD_BASELINE_CONTROL, httpMethod2 = "BIND", XDM_CONST.HTTP_METHOD_BIND, httpMethod2 = "CHECKIN", XDM_CONST.HTTP_METHOD_CHECKIN, httpMethod2 = "CHECKOUT", XDM_CONST.HTTP_METHOD_CHECKOUT, httpMethod2 = "CONNECT", XDM_CONST.HTTP_METHOD_CONNECT, httpMethod2 = "COPY", XDM_CONST.HTTP_METHOD_COPY, httpMethod2 = "DELETE", XDM_CONST.HTTP_METHOD_DELETE, httpMethod2 = "GET", XDM_CONST.HTTP_METHOD_GET, httpMethod2 = "HEAD", XDM_CONST.HTTP_METHOD_HEAD, httpMethod2 = "LABEL", XDM_CONST.HTTP_METHOD_LABEL, httpMethod2 = "LINK", XDM_CONST.HTTP_METHOD_LINK, httpMethod2 = "LOCK", XDM_CONST.HTTP_METHOD_LOCK, httpMethod2 = "MERGE", XDM_CONST.HTTP_METHOD_MERGE, httpMethod2 = "MKACTIVITY", XDM_CONST.HTTP_METHOD_MKACTIVITY, httpMethod2 = "MKCALENDAR", XDM_CONST.HTTP_METHOD_MKCALENDAR, httpMethod2 = "MKCOL", XDM_CONST.HTTP_METHOD_MKCOL, httpMethod2 = "MKREDIRECTREF", XDM_CONST.HTTP_METHOD_MKREDIRECTREF, httpMethod2 = "MKWORKSPACE", XDM_CONST.HTTP_METHOD_MKWORKSPACE, httpMethod2 = "MOVE", XDM_CONST.HTTP_METHOD_MOVE, httpMethod2 = "OPTIONS", XDM_CONST.HTTP_METHOD_OPTIONS, httpMethod2 = "ORDERPATCH", XDM_CONST.HTTP_METHOD_ORDERPATCH, httpMethod2 = "PATCH", XDM_CONST.HTTP_METHOD_PATCH, httpMethod2 = "POST", XDM_CONST.HTTP_METHOD_POST, httpMethod2 = "PRI", XDM_CONST.HTTP_METHOD_PRI, httpMethod2 = "PROPFIND", XDM_CONST.HTTP_METHOD_PROPFIND, httpMethod2 = "PROPPATCH", XDM_CONST.HTTP_METHOD_PROPPATCH, httpMethod2 = "PUT", XDM_CONST.HTTP_METHOD_PUT, httpMethod2 = "REBIND", XDM_CONST.HTTP_METHOD_REBIND, httpMethod2 = "REPORT", XDM_CONST.HTTP_METHOD_REPORT, httpMethod2 = "SEARCH", XDM_CONST.HTTP_METHOD_SEARCH, httpMethod2 = "TRACE", XDM_CONST.HTTP_METHOD_TRACE, httpMethod2 = "UNBIND", XDM_CONST.HTTP_METHOD_UNBIND, httpMethod2 = "UNCHECKOUT", XDM_CONST.HTTP_METHOD_UNCHECKOUT, httpMethod2 = "UNLINK", XDM_CONST.HTTP_METHOD_UNLINK, httpMethod2 = "UNLOCK", XDM_CONST.HTTP_METHOD_UNLOCK, httpMethod2 = "UPDATE", XDM_CONST.HTTP_METHOD_UPDATE, httpMethod2 = "UPDATEREDIRECTREF", XDM_CONST.HTTP_METHOD_UPDATEREDIRECTREF, httpMethod2 = "VERSION_CONTROL", XDM_CONST.HTTP_METHOD_VERSION_CONTROL, to_string(httpMethod2))),
xdm.intermediate.host.device_id=arrayindex(regextract(_raw_log,"device_id\=\"([^=]+)\"\,"),0),
xdm.source.host.hostname=arrayindex(regextract(_raw_log,"host\=\"([^=]+)\"\,"),0),
xdm.event.outcome_reason=arrayindex(regextract(_raw_log,"request_status\=\"([^=]+)\"\,"),0),
xdm.observer.action=arrayindex(regextract(_raw_log,"action\=\"([^=]+)\"\,"),0),
xdm.session_context_id=arrayindex(regextract(_raw_log,"session_id\=\"([^=]+)\"\,"),0),
xdm.event.type=arrayindex(regextract(_raw_log,"class\=\"([^=]+)\"\,"),0),
xdm.event.original_event_type=arrayindex(regextract(_raw_log,"client_type\=\"([^=]+)\"\,"),0),
xdm.source.application.name=arrayindex(regextract(_raw_log,"application_display_name\=\"([^=]+)\"\,"),0),
xdm.source.application.version=arrayindex(regextract(_raw_log,"application_version\=\"([^=]+)\"\,"),0),
xdm.source.host.os_family=if(lowercase(OS) contains "windows", XDM_CONST.OS_FAMILY_WINDOWS, lowercase(OS) contains "mac", XDM_CONST.OS_FAMILY_MACOS, lowercase(OS) contains "linux", XDM_CONST.OS_FAMILY_LINUX, lowercase(OS) contains "android", XDM_CONST.OS_FAMILY_ANDROID, lowercase(OS) contains "ios", XDM_CONST.OS_FAMILY_IOS, lowercase(OS) contains "ubuntu", XDM_CONST.OS_FAMILY_UBUNTU, lowercase(OS) contains "debian", XDM_CONST.OS_FAMILY_DEBIAN, lowercase(OS) contains "fedora", XDM_CONST.OS_FAMILY_FEDORA, lowercase(OS) contains "centos", XDM_CONST.OS_FAMILY_CENTOS, lowercase(OS) contains "chrome", XDM_CONST.OS_FAMILY_CHROMEOS, lowercase(OS) contains "solaris", XDM_CONST.OS_FAMILY_SOLARIS, lowercase(OS) contains "scada", XDM_CONST.OS_FAMILY_SCADA, to_string(OS)),
xdm.network.http.url=arrayindex(regextract(_raw_log,"http_request\=\"([^,]+)\"\,"),0),
xdm.network.http.response_code=if(responseCode = "100", XDM_CONST.HTTP_RSP_CODE_CONTINUE, responseCode = "101", XDM_CONST.HTTP_RSP_CODE_SWITCHING_PROTOCOLS, responseCode = "102", XDM_CONST.HTTP_RSP_CODE_PROCESSING, responseCode = "103", XDM_CONST.HTTP_RSP_CODE_EARLY_HINTS, responseCode = "200", XDM_CONST.HTTP_RSP_CODE_OK, responseCode = "201", XDM_CONST.HTTP_RSP_CODE_CREATED, responseCode = "202", XDM_CONST.HTTP_RSP_CODE_ACCEPTED, responseCode = "203", XDM_CONST.HTTP_RSP_CODE_NON__AUTHORITATIVE_INFORMATION, responseCode = "204", XDM_CONST.HTTP_RSP_CODE_NO_CONTENT, responseCode = "205", XDM_CONST.HTTP_RSP_CODE_RESET_CONTENT, responseCode = "206", XDM_CONST.HTTP_RSP_CODE_PARTIAL_CONTENT, responseCode = "207", XDM_CONST.HTTP_RSP_CODE_MULTI__STATUS, responseCode = "208", XDM_CONST.HTTP_RSP_CODE_ALREADY_REPORTED, responseCode = "226", XDM_CONST.HTTP_RSP_CODE_IM_USED, responseCode = "300", XDM_CONST.HTTP_RSP_CODE_MULTIPLE_CHOICES, responseCode = "301", XDM_CONST.HTTP_RSP_CODE_MOVED_PERMANENTLY, responseCode = "302", XDM_CONST.HTTP_RSP_CODE_FOUND, responseCode = "303", XDM_CONST.HTTP_RSP_CODE_SEE_OTHER, responseCode = "304", XDM_CONST.HTTP_RSP_CODE_NOT_MODIFIED, responseCode = "305", XDM_CONST.HTTP_RSP_CODE_USE_PROXY, responseCode = "307", XDM_CONST.HTTP_RSP_CODE_TEMPORARY_REDIRECT, responseCode = "308", XDM_CONST.HTTP_RSP_CODE_PERMANENT_REDIRECT, responseCode = "400", XDM_CONST.HTTP_RSP_CODE_BAD_REQUEST, responseCode = "401", XDM_CONST.HTTP_RSP_CODE_UNAUTHORIZED, responseCode = "402", XDM_CONST.HTTP_RSP_CODE_PAYMENT_REQUIRED, responseCode = "403", XDM_CONST.HTTP_RSP_CODE_FORBIDDEN, responseCode = "404", XDM_CONST.HTTP_RSP_CODE_NOT_FOUND, responseCode = "405", XDM_CONST.HTTP_RSP_CODE_METHOD_NOT_ALLOWED, responseCode = "406", XDM_CONST.HTTP_RSP_CODE_NOT_ACCEPTABLE, responseCode = "407", XDM_CONST.HTTP_RSP_CODE_PROXY_AUTHENTICATION_REQUIRED, responseCode = "408", XDM_CONST.HTTP_RSP_CODE_REQUEST_TIMEOUT, responseCode = "409", XDM_CONST.HTTP_RSP_CODE_CONFLICT, responseCode = "410", XDM_CONST.HTTP_RSP_CODE_GONE, responseCode = "411", XDM_CONST.HTTP_RSP_CODE_LENGTH_REQUIRED, responseCode = "412", XDM_CONST.HTTP_RSP_CODE_PRECONDITION_FAILED, responseCode = "413", XDM_CONST.HTTP_RSP_CODE_CONTENT_TOO_LARGE, responseCode = "414", XDM_CONST.HTTP_RSP_CODE_URI_TOO_LONG, responseCode = "415", XDM_CONST.HTTP_RSP_CODE_UNSUPPORTED_MEDIA_TYPE, responseCode = "416", XDM_CONST.HTTP_RSP_CODE_RANGE_NOT_SATISFIABLE, responseCode = "417", XDM_CONST.HTTP_RSP_CODE_EXPECTATION_FAILED, responseCode = "421", XDM_CONST.HTTP_RSP_CODE_MISDIRECTED_REQUEST, responseCode = "422", XDM_CONST.HTTP_RSP_CODE_UNPROCESSABLE_CONTENT, responseCode = "423", XDM_CONST.HTTP_RSP_CODE_LOCKED, responseCode = "424", XDM_CONST.HTTP_RSP_CODE_FAILED_DEPENDENCY, responseCode = "425", XDM_CONST.HTTP_RSP_CODE_TOO_EARLY, responseCode = "426", XDM_CONST.HTTP_RSP_CODE_UPGRADE_REQUIRED, responseCode = "428", XDM_CONST.HTTP_RSP_CODE_PRECONDITION_REQUIRED, responseCode = "429", XDM_CONST.HTTP_RSP_CODE_TOO_MANY_REQUESTS, responseCode = "431", XDM_CONST.HTTP_RSP_CODE_REQUEST_HEADER_FIELDS_TOO_LARGE, responseCode = "451", XDM_CONST.HTTP_RSP_CODE_UNAVAILABLE_FOR_LEGAL_REASONS, responseCode = "500", XDM_CONST.HTTP_RSP_CODE_INTERNAL_SERVER_ERROR, responseCode = "501", XDM_CONST.HTTP_RSP_CODE_NOT_IMPLEMENTED, responseCode = "502", XDM_CONST.HTTP_RSP_CODE_BAD_GATEWAY, responseCode = "503", XDM_CONST.HTTP_RSP_CODE_SERVICE_UNAVAILABLE, responseCode = "504", XDM_CONST.HTTP_RSP_CODE_GATEWAY_TIMEOUT, responseCode = "505", XDM_CONST.HTTP_RSP_CODE_HTTP_VERSION_NOT_SUPPORTED, responseCode = "506", XDM_CONST.HTTP_RSP_CODE_VARIANT_ALSO_NEGOTIATES, responseCode = "507", XDM_CONST.HTTP_RSP_CODE_INSUFFICIENT_STORAGE, responseCode = "508", XDM_CONST.HTTP_RSP_CODE_LOOP_DETECTED, responseCode = "511", XDM_CONST.HTTP_RSP_CODE_NETWORK_AUTHENTICATION_REQUIRED, responseCode = null, null, to_string(responseCode)),
xdm.alert.name=arrayindex(regextract(_raw_log,"attack_type\=\"([^=]+)\"\,"),0),
xdm.source.user.username=coalesce(arrayindex(regextract(_raw_log,"username\=\"([^=]+)\"\,"),0),arrayindex(regextract(_raw_log,"user\=([^=]+)\s"),0)),
xdm.alert.original_threat_name=arrayindex(regextract(_raw_log,"virus_name\=\"([^=]+)\"\,"),0),
xdm.observer.name=arrayindex(regextract(_raw_log,"hostname\=\"([^=]+)\"\,"),0),
xdm.event.log_level=if(logLevel in ("info","notice","err","debug","alert","warning","crit","critcal","emerg","emergancy"), logLevel, null),
xdm.event.description=if(logLevel in ("info","notice","err","debug","alert","warning","crit","critcal","emerg","emergancy"), arrayindex(regextract(_raw_log, "\d{2}\:\d{2}\s[\w\.\-\_\@\$]+\s[a-z]+\s(.*)"),0), null);