FireEye NX Modeling Rule

Details

ID	`FireEye_NX_ModelingRule`
From Version	6.8.0
To Version	6.9.9
Tags	FireEye NX

Rules (XIF)

[MODEL:model="Network", dataset="fireeye_mps_raw"] 
alter XDM.Network.event_timestamp = parse_timestamp("%s",arrayindex( regextract(to_string(rt),"(\d+)\d{3}"),0) ),
    XDM.Network.Destination.port = to_number(dpt),
    XDM.Network.Source.port = to_number(spt),
    XDM.Network.outcome = act,
    XDM.Network.Destination.ipv4 = dst,
    XDM.Network.Source.ipv4 = src,
    XDM.Network.Destination.host.mac_addresses = arraycreate(coalesce(dmac,"")) ,
    XDM.Network.Source.host.mac_addresses = arraycreate(coalesce(smac,"")),
    XDM.Network.Destination.process.name = dproc,
    XDM.Network.Destination.process.executable.filename = fname,
    XDM.Network.ip_protocol =proto,
    XDM.Network.Destination.host.hostname = dvchost,
    XDM.Network.http.url = request,
    XDM.Network.Source.process.executable.path = filePath,
    XDM.Network.Source.process.executable.md5 = fileHash,
    XDM.Network.Source.process.executable.file_type = fileType,
    XDM.Network.http.method = requestMethod,
    XDM.Network.threat.name = cs1;

Schema

`fireeye_mps_raw`

Field	Type	Array?
`act`	string	—
`cs1`	string	—
`dmac`	string	—
`dproc`	string	—
`dpt`	int	—
`dst`	string	—
`dvchost`	string	—
`fileHash`	string	—
`filePath`	string	—
`fileType`	string	—
`fname`	string	—
`proto`	string	—
`request`	string	—
`requestMethod`	string	—
`rt`	int	—
`smac`	string	—
`spt`	int	—
`src`	string	—

Raw JSON

{
    "fireeye_mps_raw": {
      "rt": {
        "type": "int",
        "is_array": false
      },
      "dpt": {
        "type": "int",
        "is_array": false
      },
      "spt": {
        "type": "int",
        "is_array": false
      },
      "act": {
        "type": "string",
        "is_array": false
      },
      "dst": {
        "type": "string",
        "is_array": false
      },
      "src": {
        "type": "string",
        "is_array": false
      },
      "dmac": {
        "type": "string",
        "is_array": false
      },
      "smac": {
        "type": "string",
        "is_array": false
      },
      "dproc": {
        "type": "string",
        "is_array": false
      },
      "fname": {
        "type": "string",
        "is_array": false
      },
      "proto": {
        "type": "string",
        "is_array": false
      },
      "dvchost": {
        "type": "string",
        "is_array": false
      },
      "request": {
        "type": "string",
        "is_array": false
      },
      "filePath": {
        "type": "string",
        "is_array": false
      },
      "fileHash": {
        "type": "string",
        "is_array": false
      },
      "fileType": {
        "type": "string",
        "is_array": false
      },
      "requestMethod": {
        "type": "string",
        "is_array": false
      },
      "cs1": {
        "type": "string",
        "is_array": false
      }
    }
  }