Rules (XIF)
[MODEL: dataset="fortinet_fortigate_raw"]
/* Log Message Reference:
https://docs.fortinet.com/document/fortigate/7.4.4/fortios-log-message-reference
https://fortinetweb.s3.amazonaws.com/docs.fortinet.com/v2/attachments/94f9e5fe-0e30-11ef-8c42-fa163e15d75b/FortiOS_7.4.4_Log_Reference.pdf
*/
alter // format, validate & regroup relevant raw data
cef_pri_level = lowercase(FTNTFGTlevel),
dns_record_class = if(FTNTFGTqclass = null, null, FTNTFGTqclass = "IN", 1, FTNTFGTqclass = "CS", 2, FTNTFGTqclass = "CH", 3, FTNTFGTqclass = "HS", 4),
dns_record_type = if(FTNTFGTqtype = null, null, FTNTFGTqtype = "A", XDM_CONST.DNS_RECORD_TYPE_A, FTNTFGTqtype = "AAAA", XDM_CONST.DNS_RECORD_TYPE_AAAA, FTNTFGTqtype = "AFSDB", XDM_CONST.DNS_RECORD_TYPE_AFSDB, FTNTFGTqtype = "APL", XDM_CONST.DNS_RECORD_TYPE_APL, FTNTFGTqtype = "CAA", XDM_CONST.DNS_RECORD_TYPE_CAA, FTNTFGTqtype = "CDNSKEY", XDM_CONST.DNS_RECORD_TYPE_CDNSKEY, FTNTFGTqtype = "CDS", XDM_CONST.DNS_RECORD_TYPE_CDS, FTNTFGTqtype = "CERT", XDM_CONST.DNS_RECORD_TYPE_CERT, FTNTFGTqtype = "CNAME", XDM_CONST.DNS_RECORD_TYPE_CNAME, FTNTFGTqtype = "CSYNC", XDM_CONST.DNS_RECORD_TYPE_CSYNC, FTNTFGTqtype = "DHCID", XDM_CONST.DNS_RECORD_TYPE_DHCID, FTNTFGTqtype = "DLV", XDM_CONST.DNS_RECORD_TYPE_DLV, FTNTFGTqtype = "DNAME", XDM_CONST.DNS_RECORD_TYPE_DNAME, FTNTFGTqtype = "DNSKEY", XDM_CONST.DNS_RECORD_TYPE_DNSKEY, FTNTFGTqtype = "DS", XDM_CONST.DNS_RECORD_TYPE_DS, FTNTFGTqtype = "EUI48", XDM_CONST.DNS_RECORD_TYPE_EUI48, FTNTFGTqtype = "EUI64", XDM_CONST.DNS_RECORD_TYPE_EUI64, FTNTFGTqtype = "HINFO", XDM_CONST.DNS_RECORD_TYPE_HINFO, FTNTFGTqtype = "HIP", XDM_CONST.DNS_RECORD_TYPE_HIP, FTNTFGTqtype = "HTTPS", XDM_CONST.DNS_RECORD_TYPE_HTTPS, FTNTFGTqtype = "IPSECKEY", XDM_CONST.DNS_RECORD_TYPE_IPSECKEY, FTNTFGTqtype = "KEY", XDM_CONST.DNS_RECORD_TYPE_KEY, FTNTFGTqtype = "KX", XDM_CONST.DNS_RECORD_TYPE_KX, FTNTFGTqtype = "LOC", XDM_CONST.DNS_RECORD_TYPE_LOC, FTNTFGTqtype = "MX", XDM_CONST.DNS_RECORD_TYPE_MX, FTNTFGTqtype = "NAPTR", XDM_CONST.DNS_RECORD_TYPE_NAPTR, FTNTFGTqtype = "NS", XDM_CONST.DNS_RECORD_TYPE_NS, FTNTFGTqtype = "NSEC", XDM_CONST.DNS_RECORD_TYPE_NSEC, FTNTFGTqtype = "NSEC3", XDM_CONST.DNS_RECORD_TYPE_NSEC3, FTNTFGTqtype = "NSEC3PARAM", XDM_CONST.DNS_RECORD_TYPE_NSEC3PARAM, FTNTFGTqtype = "OPENPGPKEY", XDM_CONST.DNS_RECORD_TYPE_OPENPGPKEY, FTNTFGTqtype = "PTR", XDM_CONST.DNS_RECORD_TYPE_PTR, FTNTFGTqtype = "RRSIG", XDM_CONST.DNS_RECORD_TYPE_RRSIG, FTNTFGTqtype = "RP", XDM_CONST.DNS_RECORD_TYPE_RP, FTNTFGTqtype = "SIG", XDM_CONST.DNS_RECORD_TYPE_SIG, FTNTFGTqtype = "SMIMEA", XDM_CONST.DNS_RECORD_TYPE_SMIMEA, FTNTFGTqtype = "SOA", XDM_CONST.DNS_RECORD_TYPE_SOA, FTNTFGTqtype = "SRV", XDM_CONST.DNS_RECORD_TYPE_SRV, FTNTFGTqtype = "SSHFP", XDM_CONST.DNS_RECORD_TYPE_SSHFP, FTNTFGTqtype = "SVCB", XDM_CONST.DNS_RECORD_TYPE_SVCB, FTNTFGTqtype = "TA", XDM_CONST.DNS_RECORD_TYPE_TA, FTNTFGTqtype = "TKEY", XDM_CONST.DNS_RECORD_TYPE_TKEY, FTNTFGTqtype = "TLSA", XDM_CONST.DNS_RECORD_TYPE_TLSA, FTNTFGTqtype = "TSIG", XDM_CONST.DNS_RECORD_TYPE_TSIG, FTNTFGTqtype = "TXT", XDM_CONST.DNS_RECORD_TYPE_TXT, FTNTFGTqtype = "URI", XDM_CONST.DNS_RECORD_TYPE_URI, FTNTFGTqtype = "ZONEMD", XDM_CONST.DNS_RECORD_TYPE_ZONEMD, FTNTFGTqtype),
dhcp_msg_type = uppercase(FTNTFGTdhcp_msg),
dst_ip_address = arraydistinct(arraycreate(dst, FTNTFGTdaddr, FTNTFGTserver, FTNTFGTremote, c6a3)),
dst_os = lowercase(FTNTFGTdstosname),
icmp_type_hex = lowercase(FTNTFGTicmptype),
icmp_code_hex = lowercase(FTNTFGTicmpcode),
filehash_length = len(FTNTFGTfilehash),
ppp_gateway_ipv4 = if(FTNTFGTgateway ~= "(?:\d{1,3}\.){3}\d{1,3}", FTNTFGTgateway),
ppp_gateway_ipv6 = if(FTNTFGTgateway ~= "(?:[a-fA-F\d]{0,4}\:){1,7}[a-fA-F\d]{0,4}", FTNTFGTgateway),
network_rules = arraycreate(FTNTFGTpolicyname, FTNTFGTprofile, FTNTFGTapplist, FTNTFGTpolicy_id, FTNTFGTpolicyid, FTNTFGTshapingpolicyid),
src_ip_addresses = arraydistinct(arraycreate(src, sourceTranslatedAddress, FTNTFGTnat, FTNTFGTsaddr, FTNTFGTlocal, FTNTFGTtrueclntip, FTNTFGTtunnelip, FTNTFGTassigned, FTNTFGTassignip, FTNTFGTbanned_src, c6a2)),
src_os = lowercase(FTNTFGTosname),
target_url = if(request ~= """^\/""", coalesce(
concat(coalesce(dhost, dst), ":", to_string(dpt), request),
concat(coalesce(dhost, dst), request),
request), request),
url_category = coalesce(requestContext, FTNTFGTcatdesc),
vpn_tunnel_ipv4 = if(FTNTFGTtunnelip ~= "(?:\d{1,3}\.){3}\d{1,3}", FTNTFGTtunnelip),
vpn_tunnel_ipv6 = if(FTNTFGTtunnelip ~= "(?:[a-fA-F\d]{0,4}\:){1,7}[a-fA-F\d]{0,4}", FTNTFGTtunnelip),
vpn_tunnel_assigned_ipv4 = if(FTNTFGTassignip ~= "(?:\d{1,3}\.){3}\d{1,3}", FTNTFGTassignip),
vpn_tunnel_assigned_ipv6 = if(FTNTFGTassignip ~= "(?:[a-fA-F\d]{0,4}\:){1,7}[a-fA-F\d]{0,4}", FTNTFGTassignip),
xff_ipv4_addresses = regextract(FTNTFGTforwardedfor, "((?:\d{1,3}\.){3}\d{1,3})"),
xff_ipv6_addresses = regextract(FTNTFGTforwardedfor, "((?:[a-fA-F\d]{0,4}\:){1,7}[a-fA-F\d]{0,4})"),
cat_string = to_string(cat),
// group together risk artifacts
alert_risk_artifacts = object_create(
"threat_type", FTNTFGTthreattype,
"attack_id", FTNTFGTattackid,
"attack_name", FTNTFGTattack,
"virus_id", FTNTFGTvirusid,
"virus_name", FTNTFGTvirus,
"virus_category", FTNTFGTviruscat,
"cve_id", FTNTFGTcveid,
"vulnerability_id", FTNTFGTvulnid,
"vulnerability_name", FTNTFGTvulnname,
"vulnerability_category", FTNTFGTvulncat)
| alter
// remove null artifacts from the alert_risk_artifacts object
risks_formatted = concat("{", arraystring(arrayfilter(split(rtrim(ltrim(to_string(alert_risk_artifacts), "{"), "}"), ","), "@element" !~= "null"), ","), "}"),
// validate & divide ip addresses according to the version ipv4/6
dst_ipv4_addresses = if(array_length(dst_ip_address) > 0, arrayfilter(dst_ip_address, "@element" ~= "(?:\d{1,3}\.){3}\d{1,3}")),
dst_ipv6_addresses = if(array_length(dst_ip_address) > 0, arrayfilter(dst_ip_address, "@element" ~= "(?:[a-fA-F\d]{0,4}\:){1,7}[a-fA-F\d]{0,4}")),
src_ipv4_addresses = if(array_length(xff_ipv4_addresses) > 0,
arraydistinct(arrayconcat(arrayfilter(src_ip_addresses, "@element" ~= "(?:\d{1,3}\.){3}\d{1,3}"), xff_ipv4_addresses)),
arrayfilter(src_ip_addresses, "@element" ~= "(?:\d{1,3}\.){3}\d{1,3}")),
src_ipv6_addresses = if(array_length(xff_ipv6_addresses) > 0,
arraydistinct(arrayconcat(arrayfilter(src_ip_addresses, "@element" ~= "(?:[a-fA-F\d]{0,4}\:){1,7}[a-fA-F\d]{0,4}"), xff_ipv6_addresses)),
arrayfilter(src_ip_addresses, "@element" ~= "(?:[a-fA-F\d]{0,4}\:){1,7}[a-fA-F\d]{0,4}")),
intermediate_ipv4_addresses = arraydistinct(arraycreate(vpn_tunnel_ipv4, vpn_tunnel_assigned_ipv4, ppp_gateway_ipv4)),
intermediate_ipv6_addresses = arraydistinct(arraycreate(vpn_tunnel_ipv6, vpn_tunnel_assigned_ipv6, ppp_gateway_ipv6)),
// extract the icmp code & icmp type lsb (least significant bit) & msb (most significant bit) in their hexadecimal representation
icmp_code_lsb_hex = if(icmp_type_hex = null, null, arrayindex(regextract(icmp_code_hex, "(?:0x[a-f\d]|0x)([a-f\d])$"), 0)),
icmp_code_msb_hex = if(icmp_type_hex = null, null, coalesce(arrayindex(regextract(icmp_code_hex, "0x([a-f\d])[a-f\d]$"), 0), "0")),
icmp_type_lsb_hex = if(icmp_type_hex = null, null, arrayindex(regextract(icmp_type_hex, "(?:0x[a-f\d]|0x)([a-f\d])$"), 0)),
icmp_type_msb_hex = if(icmp_type_hex = null, null, coalesce(arrayindex(regextract(icmp_type_hex, "0x([a-f\d])[a-f\d]$"), 0), "0"))
| alter
// convert the icmp code & icmp type lsb & msb from their hexadecimal representation to decimal representation
icmp_code_lsb_decimal = if(icmp_code_lsb_hex = "f", 15, icmp_code_lsb_hex = "e", 14, icmp_code_lsb_hex = "d", 13, icmp_code_lsb_hex = "c", 12, icmp_code_lsb_hex = "b", 11, icmp_code_lsb_hex = "a", 10, to_integer(icmp_code_lsb_hex)),
icmp_code_msb_decimal = if(icmp_code_msb_hex = "f", 240, icmp_code_msb_hex = "e", 224, icmp_code_msb_hex = "d", 208, icmp_code_msb_hex = "c", 192, icmp_code_msb_hex = "b", 176, icmp_code_msb_hex = "a", 160, icmp_code_msb_hex = "0", 0, multiply(16, to_integer(icmp_code_msb_hex))),
icmp_type_lsb_decimal = if(icmp_type_lsb_hex = "f", 15, icmp_type_lsb_hex = "e", 14, icmp_type_lsb_hex = "d", 13, icmp_type_lsb_hex = "c", 12, icmp_type_lsb_hex = "b", 11, icmp_type_lsb_hex = "a", 10, to_integer(icmp_type_lsb_hex)),
icmp_type_msb_decimal = if(icmp_type_msb_hex = "f", 240, icmp_type_msb_hex = "e", 224, icmp_type_msb_hex = "d", 208, icmp_type_msb_hex = "c", 192, icmp_type_msb_hex = "b", 176, icmp_type_msb_hex = "a", 160, icmp_type_msb_hex = "0", 0, multiply(16, to_integer(icmp_type_msb_hex))),
// isolate public ipv4 addresses
src_ipv4_public_addresses = arrayfilter(src_ipv4_addresses, not incidr("@element", "10.0.0.0/8") and not incidr("@element", "172.16.0.0/12") and not incidr("@element", "192.168.0.0/16") and not incidr("@element","127.0.0.0/8") and not incidr("@element","169.254.0.0/16")),
dst_ipv4_public_addresses = arrayfilter(dst_ipv4_addresses, not incidr("@element", "10.0.0.0/8") and not incidr("@element", "172.16.0.0/12") and not incidr("@element", "192.168.0.0/16") and not incidr("@element","127.0.0.0/8") and not incidr("@element","169.254.0.0/16")),
intermediate_ipv4_public_addresses = arrayfilter(intermediate_ipv4_addresses, not incidr("@element", "10.0.0.0/8") and not incidr("@element", "172.16.0.0/12") and not incidr("@element", "192.168.0.0/16") and not incidr("@element","127.0.0.0/8") and not incidr("@element","169.254.0.0/16"))
| alter // XDM Mappings
xdm.alert.category = FTNTFGTviruscat,
xdm.alert.description = FTNTFGTref,
xdm.alert.original_alert_id = to_string(FTNTFGTincidentserialno),
xdm.alert.original_threat_id = coalesce(FTNTFGTattackid, FTNTFGTvirusid, FTNTFGTvulnid, FTNTFGTcveid),
xdm.alert.original_threat_name = coalesce(FTNTFGTattack, FTNTFGTvirus, FTNTFGTvulnname, FTNTFGTthreattype),
xdm.alert.risks = if(risks_formatted != null and len(risks_formatted) > 2, arraycreate(to_json_string(risks_formatted))),
xdm.alert.severity = coalesce(FTNTFGTCRlevel, FTNTFGTseverity, FTNTFGTapprisk),
xdm.alert.subcategory = FTNTFGTlogdesc,
xdm.event.description = msg,
xdm.event.duration = to_integer(multiply(to_integer(FTNTFGTduration), 1000)),
xdm.event.id = to_string(FTNTFGTlogid),
xdm.event.is_completed = to_boolean("TRUE"),
xdm.event.log_level = if(
cefSeverity = "1" or cef_pri_level = "debug", XDM_CONST.LOG_LEVEL_DEBUG,
cefSeverity = "2" or cef_pri_level = "information", XDM_CONST.LOG_LEVEL_INFORMATIONAL,
cefSeverity = "3" or cef_pri_level ~= "notice|notification", XDM_CONST.LOG_LEVEL_NOTICE,
cefSeverity = "4" or cef_pri_level = "warning", XDM_CONST.LOG_LEVEL_WARNING,
cefSeverity = "5" or cef_pri_level = "error", XDM_CONST.LOG_LEVEL_ERROR,
cefSeverity = "6" or cef_pri_level = "critical", XDM_CONST.LOG_LEVEL_CRITICAL,
cefSeverity = "7" or cef_pri_level = "alert", XDM_CONST.LOG_LEVEL_ALERT,
cefSeverity = "8" or cef_pri_level = "emergency", XDM_CONST.LOG_LEVEL_EMERGENCY,
FTNTFGTlevel),
xdm.event.operation_sub_type = FTNTFGTsubtype,
xdm.event.outcome = if(
outcome in ("update", "success", "succeeded") or FTNTFGTresult in("OK", "DONE"), XDM_CONST.OUTCOME_SUCCESS,
outcome in ("failure", "failed", "negotiate_error") or FTNTFGTresult = "ERROR", XDM_CONST.OUTCOME_FAILED,
outcome in ("database-check", "authentication-required"), XDM_CONST.OUTCOME_PARTIAL,
outcome in ("unregistered", "new") or FTNTFGTresult = "N/A", XDM_CONST.OUTCOME_UNKNOWN,
coalesce(outcome, FTNTFGTresult)),
xdm.event.outcome_reason = coalesce(reason, FTNTFGTerror, FTNTFGTerror_num),
xdm.event.type = FTNTFGTsubtype,
xdm.intermediate.host.device_id = to_string(FTNTFGTtunnelid),
xdm.intermediate.host.hardware_uuid = coalesce(FTNTFGTapsn, FTNTFGTsnclosest),
xdm.intermediate.host.hostname = coalesce(FTNTFGTvpntunnel, FTNTFGTap),
xdm.intermediate.host.ipv4_addresses = intermediate_ipv4_addresses,
xdm.intermediate.host.ipv6_addresses = intermediate_ipv6_addresses,
xdm.intermediate.host.mac_addresses = arrayfilter(arraydistinct(arraycreate(FTNTFGTbssid, FTNTFGTstamac)), "@element" ~= "(?:[\da-fA-F]{2}\:){5}[\da-fA-F]{2}"),
xdm.intermediate.ipv4 = coalesce(vpn_tunnel_assigned_ipv4, vpn_tunnel_ipv4, ppp_gateway_ipv4),
xdm.intermediate.host.ipv4_public_addresses = intermediate_ipv4_public_addresses,
xdm.intermediate.ipv6 = coalesce(vpn_tunnel_assigned_ipv6, vpn_tunnel_ipv6, ppp_gateway_ipv6),
xdm.intermediate.location.country = if(FTNTFGTopercountry != "Reserved", FTNTFGTopercountry),
xdm.intermediate.user.groups = if(FTNTFGTxauthgroup != "N/A", arraycreate(FTNTFGTxauthgroup)),
xdm.intermediate.user.username = if(FTNTFGTxauthuser = "N/A", FTNTFGTxauthuser),
xdm.network.application_protocol = coalesce(app, FTNTFGTmethod, FTNTFGTvoip_proto),
xdm.network.application_protocol_category = if(FTNTFGTappcat != "unknown", FTNTFGTappcat),
xdm.network.dhcp.lease = to_integer(FTNTFGTlease),
xdm.network.dhcp.message_type = if(dhcp_msg_type = null, null, dhcp_msg_type = "DISCOVER", XDM_CONST.DHCP_MESSAGE_TYPE_DHCPDISCOVER, dhcp_msg_type = "OFFER", XDM_CONST.DHCP_MESSAGE_TYPE_DHCPOFFER, dhcp_msg_type = "REQUEST", XDM_CONST.DHCP_MESSAGE_TYPE_DHCPREQUEST, dhcp_msg_type = "DECLINE", XDM_CONST.DHCP_MESSAGE_TYPE_DHCPDECLINE, dhcp_msg_type = "ACK", XDM_CONST.DHCP_MESSAGE_TYPE_DHCPACK, dhcp_msg_type = "NAK", XDM_CONST.DHCP_MESSAGE_TYPE_DHCPNAK, dhcp_msg_type = "RELEASE", XDM_CONST.DHCP_MESSAGE_TYPE_DHCPRELEASE, dhcp_msg_type = "INFORM", XDM_CONST.DHCP_MESSAGE_TYPE_DHCPINFORM, dhcp_msg_type = "FORCERENEW", XDM_CONST.DHCP_MESSAGE_TYPE_DHCPFORCERENEW, dhcp_msg_type = "LEASEQUERY", XDM_CONST.DHCP_MESSAGE_TYPE_DHCPLEASEQUERY, dhcp_msg_type = "LEASEUNASSIGNED", XDM_CONST.DHCP_MESSAGE_TYPE_DHCPLEASEUNASSIGNED, dhcp_msg_type = "LEASEUNKNOWN", XDM_CONST.DHCP_MESSAGE_TYPE_DHCPLEASEUNKNOWN, dhcp_msg_type = "LEASEACTIVE", XDM_CONST.DHCP_MESSAGE_TYPE_DHCPLEASEACTIVE, dhcp_msg_type = "BULKLEASEQUERY", XDM_CONST.DHCP_MESSAGE_TYPE_DHCPBULKLEASEQUERY, dhcp_msg_type = "LEASEQUERYDONE", XDM_CONST.DHCP_MESSAGE_TYPE_DHCPLEASEQUERYDONE, dhcp_msg_type = "ACTIVELEASEQUERY", XDM_CONST.DHCP_MESSAGE_TYPE_DHCPACTIVELEASEQUERY, dhcp_msg_type = "LEASEQUERYSTATUS", XDM_CONST.DHCP_MESSAGE_TYPE_DHCPLEASEQUERYSTATUS, dhcp_msg_type = "TLS", XDM_CONST.DHCP_MESSAGE_TYPE_DHCPTLS, dhcp_msg_type),
xdm.network.dns.dns_question.class = dns_record_class,
xdm.network.dns.dns_question.name = FTNTFGTqname,
xdm.network.dns.dns_question.type = dns_record_type,
xdm.network.dns.dns_resource_record.class = dns_record_class,
xdm.network.dns.dns_resource_record.name = FTNTFGTqname,
xdm.network.dns.dns_resource_record.type = dns_record_type,
xdm.network.dns.dns_resource_record.value = FTNTFGTipaddr,
xdm.network.dns.is_response = if(FTNTFGTeventtype = "dns-response", to_boolean("TRUE"), FTNTFGTeventtype = "dns-query", to_boolean("FALSE")),
xdm.network.http.http_header.header = if(FTNTFGTforwardedfor != null, "X-Forwarded-For"),
xdm.network.http.http_header.value = FTNTFGTforwardedfor,
xdm.network.http.method = if(FTNTFGThttpmethod = "GET", XDM_CONST.HTTP_METHOD_GET, FTNTFGThttpmethod = "POST", XDM_CONST.HTTP_METHOD_POST, FTNTFGThttpmethod = "PUT", XDM_CONST.HTTP_METHOD_PUT, FTNTFGThttpmethod = "OPTIONS", XDM_CONST.HTTP_METHOD_OPTIONS, FTNTFGThttpmethod = "CONNECT", XDM_CONST.HTTP_METHOD_CONNECT, FTNTFGThttpmethod = "ACL", XDM_CONST.HTTP_METHOD_ACL, FTNTFGThttpmethod = "BASELINE_CONTROL", XDM_CONST.HTTP_METHOD_BASELINE_CONTROL, FTNTFGThttpmethod = "BIND", XDM_CONST.HTTP_METHOD_BIND, FTNTFGThttpmethod = "CHECKIN", XDM_CONST.HTTP_METHOD_CHECKIN, FTNTFGThttpmethod = "CHECKOUT", XDM_CONST.HTTP_METHOD_CHECKOUT, FTNTFGThttpmethod = "COPY", XDM_CONST.HTTP_METHOD_COPY, FTNTFGThttpmethod = "DELETE", XDM_CONST.HTTP_METHOD_DELETE, FTNTFGThttpmethod = "HEAD", XDM_CONST.HTTP_METHOD_HEAD, FTNTFGThttpmethod = "LABEL", XDM_CONST.HTTP_METHOD_LABEL, FTNTFGThttpmethod = "LINK", XDM_CONST.HTTP_METHOD_LINK, FTNTFGThttpmethod = "LOCK", XDM_CONST.HTTP_METHOD_LOCK, FTNTFGThttpmethod = "MERGE", XDM_CONST.HTTP_METHOD_MERGE, FTNTFGThttpmethod = "MKACTIVITY", XDM_CONST.HTTP_METHOD_MKACTIVITY, FTNTFGThttpmethod = "MKCALENDAR", XDM_CONST.HTTP_METHOD_MKCALENDAR, FTNTFGThttpmethod = "MKCOL", XDM_CONST.HTTP_METHOD_MKCOL, FTNTFGThttpmethod = "MKREDIRECTREF", XDM_CONST.HTTP_METHOD_MKREDIRECTREF, FTNTFGThttpmethod = "MKWORKSPACE", XDM_CONST.HTTP_METHOD_MKWORKSPACE, FTNTFGThttpmethod = "MOVE", XDM_CONST.HTTP_METHOD_MOVE, FTNTFGThttpmethod = "ORDERPATCH", XDM_CONST.HTTP_METHOD_ORDERPATCH, FTNTFGThttpmethod = "PATCH", XDM_CONST.HTTP_METHOD_PATCH, FTNTFGThttpmethod = "PRI", XDM_CONST.HTTP_METHOD_PRI, FTNTFGThttpmethod = "PROPFIND", XDM_CONST.HTTP_METHOD_PROPFIND, FTNTFGThttpmethod = "PROPPATCH", XDM_CONST.HTTP_METHOD_PROPPATCH, FTNTFGThttpmethod = "REBIND", XDM_CONST.HTTP_METHOD_REBIND, FTNTFGThttpmethod = "REPORT", XDM_CONST.HTTP_METHOD_REPORT, FTNTFGThttpmethod = "SEARCH", XDM_CONST.HTTP_METHOD_SEARCH, FTNTFGThttpmethod = "TRACE", XDM_CONST.HTTP_METHOD_TRACE, FTNTFGThttpmethod = "UNBIND", XDM_CONST.HTTP_METHOD_UNBIND, FTNTFGThttpmethod = "UNCHECKOUT", XDM_CONST.HTTP_METHOD_UNCHECKOUT, FTNTFGThttpmethod = "UNLINK", XDM_CONST.HTTP_METHOD_UNLINK, FTNTFGThttpmethod = "UNLOCK", XDM_CONST.HTTP_METHOD_UNLOCK, FTNTFGThttpmethod = "UPDATE", XDM_CONST.HTTP_METHOD_UPDATE, FTNTFGThttpmethod = "UPDATEREDIRECTREF", XDM_CONST.HTTP_METHOD_UPDATEREDIRECTREF, FTNTFGThttpmethod = "VERSION_CONTROL", XDM_CONST.HTTP_METHOD_VERSION_CONTROL, FTNTFGThttpmethod),
xdm.network.http.referrer = FTNTFGTreferralurl,
xdm.network.http.response_code = if(FTNTFGThttpcode = null, null, FTNTFGThttpcode = "100", XDM_CONST.HTTP_RSP_CODE_CONTINUE, FTNTFGThttpcode = "101", XDM_CONST.HTTP_RSP_CODE_SWITCHING_PROTOCOLS, FTNTFGThttpcode = "102", XDM_CONST.HTTP_RSP_CODE_PROCESSING, FTNTFGThttpcode = "103", XDM_CONST.HTTP_RSP_CODE_EARLY_HINTS, FTNTFGThttpcode = "200", XDM_CONST.HTTP_RSP_CODE_OK, FTNTFGThttpcode = "201", XDM_CONST.HTTP_RSP_CODE_CREATED, FTNTFGThttpcode = "202", XDM_CONST.HTTP_RSP_CODE_ACCEPTED, FTNTFGThttpcode = "203", XDM_CONST.HTTP_RSP_CODE_NON__AUTHORITATIVE_INFORMATION, FTNTFGThttpcode = "204", XDM_CONST.HTTP_RSP_CODE_NO_CONTENT, FTNTFGThttpcode = "205", XDM_CONST.HTTP_RSP_CODE_RESET_CONTENT, FTNTFGThttpcode = "206", XDM_CONST.HTTP_RSP_CODE_PARTIAL_CONTENT, FTNTFGThttpcode = "207", XDM_CONST.HTTP_RSP_CODE_MULTI__STATUS, FTNTFGThttpcode = "208", XDM_CONST.HTTP_RSP_CODE_ALREADY_REPORTED, FTNTFGThttpcode = "226", XDM_CONST.HTTP_RSP_CODE_IM_USED, FTNTFGThttpcode = "300", XDM_CONST.HTTP_RSP_CODE_MULTIPLE_CHOICES, FTNTFGThttpcode = "301", XDM_CONST.HTTP_RSP_CODE_MOVED_PERMANENTLY, FTNTFGThttpcode = "302", XDM_CONST.HTTP_RSP_CODE_FOUND, FTNTFGThttpcode = "303", XDM_CONST.HTTP_RSP_CODE_SEE_OTHER, FTNTFGThttpcode = "304", XDM_CONST.HTTP_RSP_CODE_NOT_MODIFIED, FTNTFGThttpcode = "305", XDM_CONST.HTTP_RSP_CODE_USE_PROXY, FTNTFGThttpcode = "307", XDM_CONST.HTTP_RSP_CODE_TEMPORARY_REDIRECT, FTNTFGThttpcode = "308", XDM_CONST.HTTP_RSP_CODE_PERMANENT_REDIRECT, FTNTFGThttpcode = "400", XDM_CONST.HTTP_RSP_CODE_BAD_REQUEST, FTNTFGThttpcode = "401", XDM_CONST.HTTP_RSP_CODE_UNAUTHORIZED, FTNTFGThttpcode = "402", XDM_CONST.HTTP_RSP_CODE_PAYMENT_REQUIRED, FTNTFGThttpcode = "403", XDM_CONST.HTTP_RSP_CODE_FORBIDDEN, FTNTFGThttpcode = "404", XDM_CONST.HTTP_RSP_CODE_NOT_FOUND, FTNTFGThttpcode = "405", XDM_CONST.HTTP_RSP_CODE_METHOD_NOT_ALLOWED, FTNTFGThttpcode = "406", XDM_CONST.HTTP_RSP_CODE_NOT_ACCEPTABLE, FTNTFGThttpcode = "407", XDM_CONST.HTTP_RSP_CODE_PROXY_AUTHENTICATION_REQUIRED, FTNTFGThttpcode = "408", XDM_CONST.HTTP_RSP_CODE_REQUEST_TIMEOUT, FTNTFGThttpcode = "409", XDM_CONST.HTTP_RSP_CODE_CONFLICT, FTNTFGThttpcode = "410", XDM_CONST.HTTP_RSP_CODE_GONE, FTNTFGThttpcode = "411", XDM_CONST.HTTP_RSP_CODE_LENGTH_REQUIRED, FTNTFGThttpcode = "412", XDM_CONST.HTTP_RSP_CODE_PRECONDITION_FAILED, FTNTFGThttpcode = "413", XDM_CONST.HTTP_RSP_CODE_CONTENT_TOO_LARGE, FTNTFGThttpcode = "414", XDM_CONST.HTTP_RSP_CODE_URI_TOO_LONG, FTNTFGThttpcode = "415", XDM_CONST.HTTP_RSP_CODE_UNSUPPORTED_MEDIA_TYPE, FTNTFGThttpcode = "416", XDM_CONST.HTTP_RSP_CODE_RANGE_NOT_SATISFIABLE, FTNTFGThttpcode = "417", XDM_CONST.HTTP_RSP_CODE_EXPECTATION_FAILED, FTNTFGThttpcode = "421", XDM_CONST.HTTP_RSP_CODE_MISDIRECTED_REQUEST, FTNTFGThttpcode = "422", XDM_CONST.HTTP_RSP_CODE_UNPROCESSABLE_CONTENT, FTNTFGThttpcode = "423", XDM_CONST.HTTP_RSP_CODE_LOCKED, FTNTFGThttpcode = "424", XDM_CONST.HTTP_RSP_CODE_FAILED_DEPENDENCY, FTNTFGThttpcode = "425", XDM_CONST.HTTP_RSP_CODE_TOO_EARLY, FTNTFGThttpcode = "426", XDM_CONST.HTTP_RSP_CODE_UPGRADE_REQUIRED, FTNTFGThttpcode = "428", XDM_CONST.HTTP_RSP_CODE_PRECONDITION_REQUIRED, FTNTFGThttpcode = "429", XDM_CONST.HTTP_RSP_CODE_TOO_MANY_REQUESTS, FTNTFGThttpcode = "431", XDM_CONST.HTTP_RSP_CODE_REQUEST_HEADER_FIELDS_TOO_LARGE, FTNTFGThttpcode = "451", XDM_CONST.HTTP_RSP_CODE_UNAVAILABLE_FOR_LEGAL_REASONS, FTNTFGThttpcode = "500", XDM_CONST.HTTP_RSP_CODE_INTERNAL_SERVER_ERROR, FTNTFGThttpcode = "501", XDM_CONST.HTTP_RSP_CODE_NOT_IMPLEMENTED, FTNTFGThttpcode = "502", XDM_CONST.HTTP_RSP_CODE_BAD_GATEWAY, FTNTFGThttpcode = "503", XDM_CONST.HTTP_RSP_CODE_SERVICE_UNAVAILABLE, FTNTFGThttpcode = "504", XDM_CONST.HTTP_RSP_CODE_GATEWAY_TIMEOUT, FTNTFGThttpcode = "505", XDM_CONST.HTTP_RSP_CODE_HTTP_VERSION_NOT_SUPPORTED, FTNTFGThttpcode = "506", XDM_CONST.HTTP_RSP_CODE_VARIANT_ALSO_NEGOTIATES, FTNTFGThttpcode = "507", XDM_CONST.HTTP_RSP_CODE_INSUFFICIENT_STORAGE, FTNTFGThttpcode = "508", XDM_CONST.HTTP_RSP_CODE_LOOP_DETECTED, FTNTFGThttpcode = "511", XDM_CONST.HTTP_RSP_CODE_NETWORK_AUTHENTICATION_REQUIRED, to_string(FTNTFGThttpcode)),
xdm.network.http.url = target_url,
xdm.network.http.url_category = if(url_category !~= "(?i)unkown", url_category),
xdm.network.icmp.code = to_integer(add(icmp_type_lsb_decimal, icmp_type_msb_decimal)),
xdm.network.icmp.type = to_integer(add(icmp_code_lsb_decimal, icmp_code_msb_decimal)),
xdm.network.ip_protocol = if(proto="0", XDM_CONST.IP_PROTOCOL_HOPOPT, proto="1", XDM_CONST.IP_PROTOCOL_ICMP, proto="2", XDM_CONST.IP_PROTOCOL_IGMP, proto="3", XDM_CONST.IP_PROTOCOL_GGP, proto="4", XDM_CONST.IP_PROTOCOL_IP, proto="5", XDM_CONST.IP_PROTOCOL_ST, proto="6", XDM_CONST.IP_PROTOCOL_TCP, proto="7", XDM_CONST.IP_PROTOCOL_CBT, proto="8", XDM_CONST.IP_PROTOCOL_EGP, proto="9", XDM_CONST.IP_PROTOCOL_IGP, proto="10", XDM_CONST.IP_PROTOCOL_BBN_RCC_MON, proto="11", XDM_CONST.IP_PROTOCOL_NVP_II, proto="12", XDM_CONST.IP_PROTOCOL_PUP, proto="13", XDM_CONST.IP_PROTOCOL_ARGUS, proto="14", XDM_CONST.IP_PROTOCOL_EMCON, proto="15", XDM_CONST.IP_PROTOCOL_XNET, proto="16", XDM_CONST.IP_PROTOCOL_CHAOS, proto="17", XDM_CONST.IP_PROTOCOL_UDP, proto="18", XDM_CONST.IP_PROTOCOL_MUX, proto="19", XDM_CONST.IP_PROTOCOL_DCN_MEAS, proto="20", XDM_CONST.IP_PROTOCOL_HMP, proto="21", XDM_CONST.IP_PROTOCOL_PRM, proto="22", XDM_CONST.IP_PROTOCOL_XNS_IDP, proto="23", XDM_CONST.IP_PROTOCOL_TRUNK_1, proto="24", XDM_CONST.IP_PROTOCOL_TRUNK_2, proto="25", XDM_CONST.IP_PROTOCOL_LEAF_1, proto="26", XDM_CONST.IP_PROTOCOL_LEAF_2, proto="27", XDM_CONST.IP_PROTOCOL_RDP, proto="28", XDM_CONST.IP_PROTOCOL_IRTP, proto="29", XDM_CONST.IP_PROTOCOL_ISO_TP4, proto="30", XDM_CONST.IP_PROTOCOL_NETBLT, proto="31", XDM_CONST.IP_PROTOCOL_MFE_NSP, proto="32", XDM_CONST.IP_PROTOCOL_MERIT_INP, proto="33", XDM_CONST.IP_PROTOCOL_DCCP, proto="34", XDM_CONST.IP_PROTOCOL_3PC, proto="35", XDM_CONST.IP_PROTOCOL_IDPR, proto="36", XDM_CONST.IP_PROTOCOL_XTP, proto="37", XDM_CONST.IP_PROTOCOL_DDP, proto="38", XDM_CONST.IP_PROTOCOL_IDPR_CMTP, proto="39", XDM_CONST.IP_PROTOCOL_TP, proto="40", XDM_CONST.IP_PROTOCOL_IL, proto="41", XDM_CONST.IP_PROTOCOL_IPV6, proto="42", XDM_CONST.IP_PROTOCOL_SDRP, proto="43", XDM_CONST.IP_PROTOCOL_IPV6_ROUTE, proto="44", XDM_CONST.IP_PROTOCOL_IPV6_FRAG, proto="45", XDM_CONST.IP_PROTOCOL_IDRP, proto="46", XDM_CONST.IP_PROTOCOL_RSVP, proto="47", XDM_CONST.IP_PROTOCOL_GRE, proto="48", XDM_CONST.IP_PROTOCOL_DSR, proto="49", XDM_CONST.IP_PROTOCOL_BNA, proto="50", XDM_CONST.IP_PROTOCOL_ESP, proto="51", XDM_CONST.IP_PROTOCOL_AH, proto="52", XDM_CONST.IP_PROTOCOL_I_NLSP, proto="53", XDM_CONST.IP_PROTOCOL_SWIPE, proto="54", XDM_CONST.IP_PROTOCOL_NARP, proto="55", XDM_CONST.IP_PROTOCOL_MOBILE, proto="56", XDM_CONST.IP_PROTOCOL_TLSP, proto="57", XDM_CONST.IP_PROTOCOL_SKIP, proto="58", XDM_CONST.IP_PROTOCOL_IPV6_ICMP, proto="59", XDM_CONST.IP_PROTOCOL_IPV6_NONXT, proto="60", XDM_CONST.IP_PROTOCOL_IPV6_OPTS, proto="62", XDM_CONST.IP_PROTOCOL_CFTP, proto="64", XDM_CONST.IP_PROTOCOL_SAT_EXPAK, proto="65", XDM_CONST.IP_PROTOCOL_KRYPTOLAN, proto="66", XDM_CONST.IP_PROTOCOL_RVD, proto="67", XDM_CONST.IP_PROTOCOL_IPPC, proto="69", XDM_CONST.IP_PROTOCOL_SAT_MON, proto="70", XDM_CONST.IP_PROTOCOL_VISA, proto="71", XDM_CONST.IP_PROTOCOL_IPCV, proto="72", XDM_CONST.IP_PROTOCOL_CPNX, proto="73", XDM_CONST.IP_PROTOCOL_CPHB, proto="74", XDM_CONST.IP_PROTOCOL_WSN, proto="75", XDM_CONST.IP_PROTOCOL_PVP, proto="76", XDM_CONST.IP_PROTOCOL_BR_SAT_MON, proto="77", XDM_CONST.IP_PROTOCOL_SUN_ND, proto="78", XDM_CONST.IP_PROTOCOL_WB_MON, proto="79", XDM_CONST.IP_PROTOCOL_WB_EXPAK, proto="80", XDM_CONST.IP_PROTOCOL_ISO_IP, proto="81", XDM_CONST.IP_PROTOCOL_VMTP, proto="82", XDM_CONST.IP_PROTOCOL_SECURE_VMTP, proto="83", XDM_CONST.IP_PROTOCOL_VINES, proto="84", XDM_CONST.IP_PROTOCOL_TTP, proto="85", XDM_CONST.IP_PROTOCOL_NSFNET_IGP, proto="86", XDM_CONST.IP_PROTOCOL_DGP, proto="87", XDM_CONST.IP_PROTOCOL_TCF, proto="88", XDM_CONST.IP_PROTOCOL_EIGRP, proto="89", XDM_CONST.IP_PROTOCOL_OSPFIGP, proto="90", XDM_CONST.IP_PROTOCOL_SPRITE_RPC, proto="91", XDM_CONST.IP_PROTOCOL_LARP, proto="92", XDM_CONST.IP_PROTOCOL_MTP, proto="93", XDM_CONST.IP_PROTOCOL_AX25, proto="94", XDM_CONST.IP_PROTOCOL_IPIP, proto="95", XDM_CONST.IP_PROTOCOL_MICP, proto="96", XDM_CONST.IP_PROTOCOL_SCC_SP, proto="97", XDM_CONST.IP_PROTOCOL_ETHERIP, proto="98", XDM_CONST.IP_PROTOCOL_ENCAP, proto="100", XDM_CONST.IP_PROTOCOL_GMTP, proto="101", XDM_CONST.IP_PROTOCOL_IFMP, proto="102", XDM_CONST.IP_PROTOCOL_PNNI, proto="103", XDM_CONST.IP_PROTOCOL_PIM, proto="104", XDM_CONST.IP_PROTOCOL_ARIS, proto="105", XDM_CONST.IP_PROTOCOL_SCPS, proto="106", XDM_CONST.IP_PROTOCOL_QNX, proto="107", XDM_CONST.IP_PROTOCOL_AN, proto="108", XDM_CONST.IP_PROTOCOL_IPCOMP, proto="110", XDM_CONST.IP_PROTOCOL_COMPAQ_PEER, proto="111", XDM_CONST.IP_PROTOCOL_IPX_IN_IP, proto="112", XDM_CONST.IP_PROTOCOL_VRRP, proto="113", XDM_CONST.IP_PROTOCOL_PGM, proto="115", XDM_CONST.IP_PROTOCOL_L2TP, proto="116", XDM_CONST.IP_PROTOCOL_DDX, proto="117", XDM_CONST.IP_PROTOCOL_IATP, proto="118", XDM_CONST.IP_PROTOCOL_STP, proto="119", XDM_CONST.IP_PROTOCOL_SRP, proto="120", XDM_CONST.IP_PROTOCOL_UTI, proto="121", XDM_CONST.IP_PROTOCOL_SMP, proto="122", XDM_CONST.IP_PROTOCOL_SM, proto="123", XDM_CONST.IP_PROTOCOL_PTP, proto="124", XDM_CONST.IP_PROTOCOL_ISIS, proto="125", XDM_CONST.IP_PROTOCOL_FIRE, proto="126", XDM_CONST.IP_PROTOCOL_CRTP, proto="127", XDM_CONST.IP_PROTOCOL_CRUDP, proto="128", XDM_CONST.IP_PROTOCOL_SSCOPMCE, proto="129", XDM_CONST.IP_PROTOCOL_IPLT, proto="130", XDM_CONST.IP_PROTOCOL_SPS, proto="131", XDM_CONST.IP_PROTOCOL_PIPE, proto="132", XDM_CONST.IP_PROTOCOL_SCTP, proto="133", XDM_CONST.IP_PROTOCOL_FC, proto="134", XDM_CONST.IP_PROTOCOL_RSVP_E2E_IGNORE, proto="135", XDM_CONST.IP_PROTOCOL_MOBILITY, proto="136", XDM_CONST.IP_PROTOCOL_UDPLITE, proto="137", XDM_CONST.IP_PROTOCOL_MPLS_IN_IP,to_string(proto)),
xdm.network.rule = if(array_length(network_rules) > 0, arraystring(network_rules, "; ")),
xdm.network.session_id = externalId,
xdm.network.tls.cipher = FTNTFGTcipher,
xdm.network.tls.client_certificate.issuer = FTNTFGTccertissuer,
xdm.network.tls.protocol_version = FTNTFGTtlsver,
xdm.network.tls.server_certificate.issuer = FTNTFGTscertissuer,
xdm.network.tls.server_name = FTNTFGTscertcname,
xdm.network.vpn.allocated_ipv4 = coalesce(vpn_tunnel_assigned_ipv4, vpn_tunnel_ipv4),
xdm.network.vpn.allocated_ipv6 = coalesce(vpn_tunnel_assigned_ipv6, vpn_tunnel_ipv6),
xdm.observer.action = coalesce(act, FTNTFGTsslaction, FTNTFGTutmaction),
xdm.observer.name = if(dvchost != null and dvchost != "" and dvchost != "N/A", dvchost, deviceExternalId),
xdm.observer.type = if(cat_string = "0", "Unrated", cat_string = "1", "Drug Abuse", cat_string = "2", "Alternative Beliefs", cat_string = "3", "Hacking", cat_string = "4", "Illegal or Unethical", cat_string = "5", "Discrimination", cat_string = "6", "Explicit Violence", cat_string = "7", "Abortion", cat_string = "8", "Other Adult Materials", cat_string = "9", "Advocacy Organizations", cat_string = "11", "Gambling", cat_string = "12", "Extremist Groups", cat_string = "13", "Nudity and Risque", cat_string = "14", "Pornography", cat_string = "15", "Dating", cat_string = "16", "Weapons (Sales)", cat_string = "17", "Advertising", cat_string = "18", "Brokerage and Trading", cat_string = "19", "Freeware and Software Downloads", cat_string = "20", "Games", cat_string = "23", "Web-based Email", cat_string = "24", "File Sharing and Storage", cat_string = "25", "Streaming Media and Download", cat_string = "26", "Malicious Websites", cat_string = "28", "Entertainment", cat_string = "29", "Arts and Culture", cat_string = "30", "Education", cat_string = "31", "Finance and Banking", cat_string = "33", "Health and Wellness", cat_string = "34", "Job Search", cat_string = "35", "Medicine", cat_string = "36", "News and Media", cat_string = "37", "Social Networking", cat_string = "38", "Political Organizations", cat_string = "39", "Reference", cat_string = "40", "Global Religion", cat_string = "41", "Search Engines and Portals", cat_string = "42", "Shopping", cat_string = "43", "General Organizations", cat_string = "44", "Society and Lifestyles", cat_string = "46", "Sports", cat_string = "47", "Travel", cat_string = "48", "Personal Vehicles", cat_string = "49", "Business", cat_string = "50", "Information and Computer Security", cat_string = "51", "Government and Legal Organizations", cat_string = "52", "Information Technology", cat_string = "53", "Armed Forces", cat_string = "54", "Dynamic Content", cat_string = "55", "Meaningless Content", cat_string = "56", "Web Hosting", cat_string = "57", "Marijuana", cat_string = "58", "Folklore", cat_string = "59", "Proxy Avoidance", cat_string = "61", "Phishing", cat_string = "62", "Plagiarism", cat_string = "63", "Sex Education", cat_string = "64", "Alcohol", cat_string = "65", "Tobacco", cat_string = "66", "Lingerie and Swimsuit", cat_string = "67", "Sports Hunting and War Games", cat_string = "68", "Web Chat", cat_string = "69", "Instant Messaging", cat_string = "70", "Newsgroups and Message Boards", cat_string = "71", "Digital Postcards", cat_string = "72", "Peer-to-peer File Sharing", cat_string = "75", "Internet Radio and TV", cat_string = "76", "Internet Telephony", cat_string = "77", "Child Education", cat_string = "78", "Real Estate", cat_string = "79", "Restaurant and Dining", cat_string = "80", "Personal Websites and Blogs", cat_string = "81", "Secure Websites", cat_string = "82", "Content Servers", cat_string = "83", "Child Sexual Abuse", cat_string = "84", "Web-based Applications", cat_string = "85", "Domain Parking", cat_string = "86", "Spam URLs", cat_string = "87", "Personal Privacy", cat_string = "88", "Dynamic DNS", cat_string = "89", "Auction", cat_string = "90", "Newly Observed Domain", cat_string = "91", "Newly Registered Domain", cat_string = "92", "Charitable Organizations", cat_string = "93", "Remote Access", cat_string = "94", "Web Analytics", cat_string = "95", "Online Meeting", cat_string = "96", "Terrorism", cat_string = "97", "URL Shortening", cat_string = "98", "Crypto Mining", cat_string = "99", "Potentially Unwanted Program", cat_string = "100", "Artificial Intelligence Technology", cat_string = "101", "Cryptocurrency", cat_string = null, null, cat_string),
xdm.observer.unique_identifier = deviceExternalId,
xdm.observer.version = cefDeviceVersion,
xdm.session_context_id = externalId,
xdm.source.host.device_category = coalesce(concat(FTNTFGTdevtype, " (", FTNTFGTsrcfamily, ")"), FTNTFGTdevtype, FTNTFGTsrcfamily),
xdm.source.host.device_id = FTNTFGTsrcuuid,
xdm.source.host.fqdn = shost,
xdm.source.host.hostname = shost,
xdm.source.host.mac_addresses = arraydistinct(arraycreate(FTNTFGTmastersrcmac, FTNTFGTsrcmac, FTNTFGTtamac)),
xdm.source.host.manufacturer = coalesce(FTNTFGTsrchwvendor, FTNTFGTmanuf),
xdm.source.host.os = FTNTFGTosname,
xdm.source.host.os_family = if(src_os contains "windows", XDM_CONST.OS_FAMILY_WINDOWS, src_os contains "mac", XDM_CONST.OS_FAMILY_MACOS, src_os contains "linux", XDM_CONST.OS_FAMILY_LINUX, src_os contains "android", XDM_CONST.OS_FAMILY_ANDROID, src_os contains "ios", XDM_CONST.OS_FAMILY_IOS, src_os contains "ubuntu", XDM_CONST.OS_FAMILY_UBUNTU, src_os contains "debian", XDM_CONST.OS_FAMILY_DEBIAN, src_os contains "fedora", XDM_CONST.OS_FAMILY_FEDORA, src_os contains "centos", XDM_CONST.OS_FAMILY_CENTOS, src_os contains "chrome", XDM_CONST.OS_FAMILY_CHROMEOS, src_os contains "solaris", XDM_CONST.OS_FAMILY_SOLARIS, src_os contains "scada", XDM_CONST.OS_FAMILY_SCADA),
xdm.source.interface = coalesce(FTNTFGTmastersrcmac, FTNTFGTsrcmac, FTNTFGTtamac),
xdm.source.host.ipv4_addresses = if(array_length(src_ipv4_addresses) > 0, src_ipv4_addresses),
xdm.source.host.ipv4_public_addresses = if(array_length(src_ipv4_public_addresses) > 0, src_ipv4_public_addresses),
xdm.source.host.ipv6_addresses = if(array_length(src_ipv6_addresses) > 0, src_ipv6_addresses),
xdm.source.ipv4 = arrayindex(src_ipv4_addresses, 0),
xdm.source.ipv6 = if(array_length(src_ipv6_addresses) > 0, arrayindex(src_ipv6_addresses, 0)),
xdm.source.location.city = FTNTFGTsrccity,
xdm.source.location.country = if(FTNTFGTsrccountry != "Reserved", FTNTFGTsrccountry),
xdm.source.location.region = FTNTFGTsrcregion,
xdm.source.port = coalesce(to_integer(spt), to_integer(FTNTFGTpsrcport), to_integer(sourceTranslatedPort)),
xdm.source.process.executable.filename = fname,
xdm.source.process.name = sproc,
xdm.source.sent_bytes = to_integer(out),
xdm.source.sent_packets = to_integer(FTNTFGTsentpkt),
xdm.source.user_agent = requestClientApplication,
xdm.source.user.domain = FTNTFGTvd,
xdm.source.user.groups = arrayfilter(arraydistinct(arraycreate(FTNTFGTgroup, FTNTFGTadgroup)), "@element" != "N/A" and "@element" != ""),
xdm.source.user.identifier = FTNTFGTfctuid,
xdm.source.user.username = coalesce(suser, FTNTFGTlogin, FTNTFGinitiator, FTNTFGTunauthuser),
xdm.target.application.name = if(FTNTFGTappid != null, concat(FTNTFGTapp, " (", to_string(FTNTFGTappid), ")"), FTNTFGTapp),
xdm.target.file.file_type = FTNTFGTfiletype,
xdm.target.file.filename = fname,
xdm.target.file.md5 = if(filehash_length = 32, FTNTFGTfilehash),
xdm.target.file.sha256 = if(filehash_length = 64, FTNTFGTfilehash),
xdm.target.file.size = to_integer(fsize),
xdm.target.host.device_category = coalesce(concat(FTNTFGTdstdevtype, " (", FTNTFGTdstfamily, ")"), FTNTFGTdevtype, FTNTFGTdstfamily),
xdm.target.host.device_model = FTNTFGTdsthwversion,
xdm.target.host.fqdn = dhost,
xdm.target.host.hardware_uuid = coalesce(FTNTFGTserialno, FTNTFGTsn),
xdm.target.host.hostname = if(dhost != null, dhost, FTNTFGTdst_host != null and FTNTFGTdst_host != "N/A", FTNTFGTdst_host, FTNTFGTdstauthserver),
xdm.target.host.mac_addresses = arraydistinct(arraycreate(FTNTFGTmasterdstmac, FTNTFGTdstmac, FTNTFGTinvalidmac)),
xdm.target.host.manufacturer = FTNTFGTdsthwvendor,
xdm.target.host.os = FTNTFGTdstosname,
xdm.target.host.os_family = if(dst_os contains "windows", XDM_CONST.OS_FAMILY_WINDOWS, dst_os contains "mac", XDM_CONST.OS_FAMILY_MACOS, dst_os contains "linux", XDM_CONST.OS_FAMILY_LINUX, dst_os contains "android", XDM_CONST.OS_FAMILY_ANDROID, dst_os contains "ios", XDM_CONST.OS_FAMILY_IOS, dst_os contains "ubuntu", XDM_CONST.OS_FAMILY_UBUNTU, dst_os contains "debian", XDM_CONST.OS_FAMILY_DEBIAN, dst_os contains "fedora", XDM_CONST.OS_FAMILY_FEDORA, dst_os contains "centos", XDM_CONST.OS_FAMILY_CENTOS, dst_os contains "chrome", XDM_CONST.OS_FAMILY_CHROMEOS, dst_os contains "solaris", XDM_CONST.OS_FAMILY_SOLARIS, dst_os contains "scada", XDM_CONST.OS_FAMILY_SCADA),
xdm.target.interface = coalesce(FTNTFGTmasterdstmac, FTNTFGTdstmac, FTNTFGTinvalidmac),
xdm.target.host.ipv4_addresses = if(array_length(dst_ipv4_addresses) > 0, dst_ipv4_addresses),
xdm.target.host.ipv4_public_addresses = if(array_length(dst_ipv4_public_addresses) > 0, dst_ipv4_public_addresses),
xdm.target.host.ipv6_addresses = if(array_length(dst_ipv6_addresses) > 0, dst_ipv6_addresses),
xdm.target.ipv4 = arrayindex(dst_ipv4_addresses, 0),
xdm.target.ipv6 = arrayindex(dst_ipv6_addresses, 0),
xdm.target.location.city = FTNTFGTdstcity,
xdm.target.location.country = if(FTNTFGTdstcountry != "Reserved", FTNTFGTdstcountry),
xdm.target.location.region = FTNTFGTdstregion,
xdm.target.port = coalesce(to_integer(dpt), to_integer(FTNTFGTpdstport)),
xdm.target.process.command_line = FTNTFGTcommand,
xdm.target.resource_before.value = coalesce(FTNTFGToldvalue, FTNTFGTold_value, FTNTFGTold_status, FTNTFGToldwprof),
xdm.target.resource.name = coalesce(FTNTFGTcfgattr, FTNTFGTpoolname),
xdm.target.resource.type = coalesce(FTNTFGTauditreporttype, FTNTFGTreporttype, FTNTFGTcfgpath),
xdm.target.resource.value = coalesce(FTNTFGTnewvalue, FTNTFGTnew_value, FTNTFGTnew_status, FTNTFGTcfgobj),
xdm.target.sent_bytes = to_integer(`in`),
xdm.target.sent_packets = to_integer(FTNTFGTrcvdpkt),
xdm.target.url = target_url,
xdm.target.user.username = if(duser != null and duser != "N/A", duser, FTNTFGTdstuser != null and FTNTFGTdstuser != "N/A", FTNTFGTdstuser, FTNTFGTdstunauthuser != null and FTNTFGTdstunauthuser != "N/A", FTNTFGTdstunauthuser);