FireEye NX Modeling Rule

Details

ID	`fireeye_nx_modeling_rule`
From Version	6.10.0
Tags	FireEyeNX

Rules (XIF)

[MODEL: dataset=fireeye_mps_raw]
alter 
    xdm.target.port = to_number(dpt),
    xdm.source.port = to_number(spt),
    xdm.event.operation_sub_type = act,
    xdm.target.ipv4 = dst,
    xdm.source.ipv4 = src,
    xdm.target.host.mac_addresses = arraycreate(coalesce(dmac,"")) ,
    xdm.source.host.mac_addresses = arraycreate(coalesce(smac,"")),
    xdm.target.process.name = dproc,
    xdm.target.file.filename = fname,
    xdm.network.ip_protocol = proto,
    xdm.target.host.hostname = dvchost,
    xdm.network.http.url = request,
    xdm.source.process.executable.path = filePath,
    xdm.source.process.executable.md5 = fileHash,
    xdm.source.process.executable.file_type = fileType,
    xdm.network.http.method = requestMethod,
    xdm.alert.original_threat_name = cs1;

Schema

`fireeye_mps_raw`

Field	Type	Array?
`act`	string	—
`cs1`	string	—
`dmac`	string	—
`dproc`	string	—
`dpt`	int	—
`dst`	string	—
`dvchost`	string	—
`fileHash`	string	—
`filePath`	string	—
`fileType`	string	—
`fname`	string	—
`proto`	string	—
`request`	string	—
`requestMethod`	string	—
`rt`	int	—
`smac`	string	—
`spt`	int	—
`src`	string	—

Raw JSON

{
    "fireeye_mps_raw": {
      "rt": {
        "type": "int",
        "is_array": false
      },
      "dpt": {
        "type": "int",
        "is_array": false
      },
      "spt": {
        "type": "int",
        "is_array": false
      },
      "act": {
        "type": "string",
        "is_array": false
      },
      "dst": {
        "type": "string",
        "is_array": false
      },
      "src": {
        "type": "string",
        "is_array": false
      },
      "dmac": {
        "type": "string",
        "is_array": false
      },
      "smac": {
        "type": "string",
        "is_array": false
      },
      "dproc": {
        "type": "string",
        "is_array": false
      },
      "fname": {
        "type": "string",
        "is_array": false
      },
      "proto": {
        "type": "string",
        "is_array": false
      },
      "dvchost": {
        "type": "string",
        "is_array": false
      },
      "request": {
        "type": "string",
        "is_array": false
      },
      "filePath": {
        "type": "string",
        "is_array": false
      },
      "fileHash": {
        "type": "string",
        "is_array": false
      },
      "fileType": {
        "type": "string",
        "is_array": false
      },
      "requestMethod": {
        "type": "string",
        "is_array": false
      },
      "cs1": {
        "type": "string",
        "is_array": false
      }
    }
  }