ForeScout CounterACT Modeling Rule

Details

ID	`ForeScout_CounterACT_ModelingRule`
From Version	8.5.0

Schema

`forescout_technologies_counteract_raw`

Field	Type	Array?
`cefDeviceEventClassId`	string	—
`cefDeviceVersion`	string	—
`cefName`	string	—
`cefSeverity`	string	—
`cs1`	string	—
`cs2`	string	—
`cs3`	string	—
`cs4`	string	—
`dhost`	string	—
`dmac`	string	—
`dntdom`	string	—
`dst`	string	—
`duser`	string	—
`dvc`	string	—
`dvchost`	string	—

Source

ForeScoutCounterACT.xif ForeScoutCounterACT.yml ForeScoutCounterACT_schema.json

Download History Raw

[MODEL: dataset = "forescout_technologies_counteract_raw"]
alter 
    xdm.event.type = cs1,
    xdm.event.original_event_type = cs2,
    xdm.event.description = if(cs3 = "yes", "Host Status Compliant",
                               cs3 = "no", "Host Status Non-Compliant",
                               "Host Compliancy Status Unknown"),
    xdm.event.operation_sub_type = cs4,
    xdm.source.host.hostname = dvchost,
    xdm.source.ipv4 = dvc,
    xdm.target.ipv4 = dst,
    xdm.target.host.mac_addresses = if(dmac = ":::::", null, arraycreate(dmac)),
    xdm.target.host.hostname = dhost,
    xdm.target.user.username = duser,
    xdm.target.host.fqdn = dntdom,
    xdm.alert.subcategory = cefName,
    xdm.alert.severity = cefSeverity,
    xdm.observer.version = cefDeviceVersion,
    xdm.target.resource.sub_type = cefDeviceEventClassId;