ForeScout CounterACT Modeling Rule

Details

ID	`ForeScout_CounterACT_ModelingRule`
From Version	8.5.0

Rules (XIF)

[MODEL: dataset = "forescout_technologies_counteract_raw"]
alter 
    xdm.event.type = cs1,
    xdm.event.original_event_type = cs2,
    xdm.event.description = if(cs3 = "yes", "Host Status Compliant",
                               cs3 = "no", "Host Status Non-Compliant",
                               "Host Compliancy Status Unknown"),
    xdm.event.operation_sub_type = cs4,
    xdm.source.host.hostname = dvchost,
    xdm.source.ipv4 = dvc,
    xdm.target.ipv4 = dst,
    xdm.target.host.mac_addresses = if(dmac = ":::::", null, arraycreate(dmac)),
    xdm.target.host.hostname = dhost,
    xdm.target.user.username = duser,
    xdm.target.host.fqdn = dntdom,
    xdm.alert.subcategory = cefName,
    xdm.alert.severity = cefSeverity,
    xdm.observer.version = cefDeviceVersion,
    xdm.target.resource.sub_type = cefDeviceEventClassId;

Schema

`forescout_technologies_counteract_raw`

Field	Type	Array?
`cefDeviceEventClassId`	string	—
`cefDeviceVersion`	string	—
`cefName`	string	—
`cefSeverity`	string	—
`cs1`	string	—
`cs2`	string	—
`cs3`	string	—
`cs4`	string	—
`dhost`	string	—
`dmac`	string	—
`dntdom`	string	—
`dst`	string	—
`duser`	string	—
`dvc`	string	—
`dvchost`	string	—

Raw JSON

{
    "forescout_technologies_counteract_raw": {
      "cs1": {
        "type": "string",
        "is_array": false
      },
      "cs2": {
        "type": "string",
        "is_array": false
      },
      "cs3": {
        "type": "string",
        "is_array": false
      },
      "cs4": {
        "type": "string",
        "is_array": false
      },
      "dvchost": {
        "type": "string",
        "is_array": false
      },
      "dvc": {
        "type": "string",
        "is_array": false
      },
      "dst": {
        "type": "string",
        "is_array": false
      },
      "dmac": {
        "type": "string",
        "is_array": false
      },
      "dhost": {
        "type": "string",
        "is_array": false
      },
      "duser": {
        "type": "string",
        "is_array": false
      },
      "dntdom": {
        "type": "string",
        "is_array": false
      },
      "cefName": {
        "type": "string",
        "is_array": false
      },
      "cefSeverity": {
        "type": "string",
        "is_array": false
      },
      "cefDeviceVersion": {
        "type": "string",
        "is_array": false
      },
      "cefDeviceEventClassId": {
        "type": "string",
        "is_array": false
      }
    }
  }