FireEye NX Modeling Rule

Details

ID	`fireeye_nx_modeling_rule`
From Version	6.10.0
Tags	FireEyeNX

Schema

`fireeye_mps_raw`

Field	Type	Array?
`act`	string	—
`cs1`	string	—
`dmac`	string	—
`dproc`	string	—
`dpt`	int	—
`dst`	string	—
`dvchost`	string	—
`fileHash`	string	—
`filePath`	string	—
`fileType`	string	—
`fname`	string	—
`proto`	string	—
`request`	string	—
`requestMethod`	string	—
`rt`	int	—
`smac`	string	—
`spt`	int	—
`src`	string	—

Source

FireEyeNX_1_3.xif FireEyeNX_1_3.yml FireEyeNX_1_3_schema.json

Download History Raw

[MODEL: dataset=fireeye_mps_raw]
alter 
    xdm.target.port = to_number(dpt),
    xdm.source.port = to_number(spt),
    xdm.event.operation_sub_type = act,
    xdm.target.ipv4 = dst,
    xdm.source.ipv4 = src,
    xdm.target.host.mac_addresses = arraycreate(coalesce(dmac,"")) ,
    xdm.source.host.mac_addresses = arraycreate(coalesce(smac,"")),
    xdm.target.process.name = dproc,
    xdm.target.file.filename = fname,
    xdm.network.ip_protocol = proto,
    xdm.target.host.hostname = dvchost,
    xdm.network.http.url = request,
    xdm.source.process.executable.path = filePath,
    xdm.source.process.executable.md5 = fileHash,
    xdm.source.process.executable.file_type = fileType,
    xdm.network.http.method = requestMethod,
    xdm.alert.original_threat_name = cs1;