Rules (XIF)
[MODEL:dataset="fortinet_fortiweb_raw"]
filter cat = "audit"
// cs1Label => userID
// cs2Label => userName
// cs3Label => level
// cs4Label => endpointID
// cs5Label => endpointDomain
// cs6Label => appName
| alter
src_ip_v4 = if(src ~= "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}", src, null),
src_ip_v6 = if(src ~= "[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}", src, null),
lowercase_cs3 = lowercase(cs3)
| alter
xdm.observer.version = cefDeviceVersion,
xdm.observer.unique_identifier = to_string(cefDeviceEventClassId),
xdm.alert.name = cefName,
xdm.alert.severity = cefSeverity,
xdm.observer.type = cat,
xdm.source.user.identifier = cs1,
xdm.source.ipv4 = src_ip_v4,
xdm.source.ipv6 = src_ip_v6,
xdm.source.port = spt,
xdm.target.port = dpt,
xdm.source.user.username = cs2,
xdm.network.application_protocol = app,
xdm.observer.action = act,
xdm.event.log_level = if(lowercase_cs3 ~= "debu", XDM_CONST.LOG_LEVEL_DEBUG, lowercase_cs3 ~= "info", XDM_CONST.LOG_LEVEL_INFORMATIONAL, lowercase_cs3 ~= "noti", XDM_CONST.LOG_LEVEL_NOTICE, lowercase_cs3 ~= "warn", XDM_CONST.LOG_LEVEL_WARNING, lowercase_cs3 ~= "erro", XDM_CONST.LOG_LEVEL_ERROR, lowercase_cs3 ~= "crit", XDM_CONST.LOG_LEVEL_CRITICAL, lowercase_cs3 ~= "aler", XDM_CONST.LOG_LEVEL_ALERT, lowercase_cs3 ~= "emer", XDM_CONST.LOG_LEVEL_EMERGENCY, lowercase_cs3 = null, null, to_string(lowercase_cs3)),
xdm.source.host.device_id = cs4,
xdm.target.host.hostname = dhost,
xdm.network.http.url = request,
xdm.network.http.method = if(requestMethod = "ACL", XDM_CONST.HTTP_METHOD_ACL, requestMethod = "BASELINE_CONTROL", XDM_CONST.HTTP_METHOD_BASELINE_CONTROL, requestMethod = "BIND", XDM_CONST.HTTP_METHOD_BIND, requestMethod = "CHECKIN", XDM_CONST.HTTP_METHOD_CHECKIN, requestMethod = "CHECKOUT", XDM_CONST.HTTP_METHOD_CHECKOUT, requestMethod = "CONNECT", XDM_CONST.HTTP_METHOD_CONNECT, requestMethod = "COPY", XDM_CONST.HTTP_METHOD_COPY, requestMethod = "DELETE", XDM_CONST.HTTP_METHOD_DELETE, requestMethod = "GET", XDM_CONST.HTTP_METHOD_GET, requestMethod = "HEAD", XDM_CONST.HTTP_METHOD_HEAD, requestMethod = "LABEL", XDM_CONST.HTTP_METHOD_LABEL, requestMethod = "LINK", XDM_CONST.HTTP_METHOD_LINK, requestMethod = "LOCK", XDM_CONST.HTTP_METHOD_LOCK, requestMethod = "MERGE", XDM_CONST.HTTP_METHOD_MERGE, requestMethod = "MKACTIVITY", XDM_CONST.HTTP_METHOD_MKACTIVITY, requestMethod = "MKCALENDAR", XDM_CONST.HTTP_METHOD_MKCALENDAR, requestMethod = "MKCOL", XDM_CONST.HTTP_METHOD_MKCOL, requestMethod = "MKREDIRECTREF", XDM_CONST.HTTP_METHOD_MKREDIRECTREF, requestMethod = "MKWORKSPACE", XDM_CONST.HTTP_METHOD_MKWORKSPACE, requestMethod = "MOVE", XDM_CONST.HTTP_METHOD_MOVE, requestMethod = "OPTIONS", XDM_CONST.HTTP_METHOD_OPTIONS, requestMethod = "ORDERPATCH", XDM_CONST.HTTP_METHOD_ORDERPATCH, requestMethod = "PATCH", XDM_CONST.HTTP_METHOD_PATCH, requestMethod = "POST", XDM_CONST.HTTP_METHOD_POST, requestMethod = "PRI", XDM_CONST.HTTP_METHOD_PRI, requestMethod = "PROPFIND", XDM_CONST.HTTP_METHOD_PROPFIND, requestMethod = "PROPPATCH", XDM_CONST.HTTP_METHOD_PROPPATCH, requestMethod = "PUT", XDM_CONST.HTTP_METHOD_PUT, requestMethod = "REBIND", XDM_CONST.HTTP_METHOD_REBIND, requestMethod = "REPORT", XDM_CONST.HTTP_METHOD_REPORT, requestMethod = "SEARCH", XDM_CONST.HTTP_METHOD_SEARCH, requestMethod = "TRACE", XDM_CONST.HTTP_METHOD_TRACE, requestMethod = "UNBIND", XDM_CONST.HTTP_METHOD_UNBIND, requestMethod = "UNCHECKOUT", XDM_CONST.HTTP_METHOD_UNCHECKOUT, requestMethod = "UNLINK", XDM_CONST.HTTP_METHOD_UNLINK, requestMethod = "UNLOCK", XDM_CONST.HTTP_METHOD_UNLOCK, requestMethod = "UPDATE", XDM_CONST.HTTP_METHOD_UPDATE, requestMethod = "UPDATEREDIRECTREF", XDM_CONST.HTTP_METHOD_UPDATEREDIRECTREF, requestMethod = "VERSION_CONTROL", XDM_CONST.HTTP_METHOD_VERSION_CONTROL, requestMethod = null, null, to_string(requestMethod)),
xdm.source.user_agent = requestClientApplication,
xdm.source.application.name = cs6,
xdm.event.description = msg;
filter cat = "attack"
// cs1Label => appName
// cs2Label => srcCountry
// cs3Label => mainType
// cs4Label => subType
// cs5Label => threatLevel
// cs6Label => owaspTop10
// ------------------------
// cn1Label => threatWeight
// cn2Label => length
// cn3Label => signatureID
| alter
get_severity = coalesce(cefSeverity, cs5),
src_ip_v4 = if(src ~= "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}", src, null),
src_ip_v6 = if(src ~= "[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}", src, null)
| alter
xdm.observer.version = cefDeviceVersion,
xdm.observer.unique_identifier = cefDeviceEventClassId,
xdm.alert.name = cefName,
xdm.observer.type = cat,
xdm.source.application.name = cs1,
xdm.source.ipv4 = src_ip_v4 ,
xdm.source.ipv6 = src_ip_v6,
xdm.source.port = spt,
xdm.target.port = dpt,
xdm.network.application_protocol = app,
xdm.observer.action = act,
xdm.event.original_event_type = cs3,
xdm.event.type = cs4,
xdm.target.host.hostname = dhost,
xdm.network.http.url = request,
xdm.alert.severity = get_severity,
xdm.network.http.method = if(requestMethod = "ACL", XDM_CONST.HTTP_METHOD_ACL, requestMethod = "BASELINE_CONTROL", XDM_CONST.HTTP_METHOD_BASELINE_CONTROL, requestMethod = "BIND", XDM_CONST.HTTP_METHOD_BIND, requestMethod = "CHECKIN", XDM_CONST.HTTP_METHOD_CHECKIN, requestMethod = "CHECKOUT", XDM_CONST.HTTP_METHOD_CHECKOUT, requestMethod = "CONNECT", XDM_CONST.HTTP_METHOD_CONNECT, requestMethod = "COPY", XDM_CONST.HTTP_METHOD_COPY, requestMethod = "DELETE", XDM_CONST.HTTP_METHOD_DELETE, requestMethod = "GET", XDM_CONST.HTTP_METHOD_GET, requestMethod = "HEAD", XDM_CONST.HTTP_METHOD_HEAD, requestMethod = "LABEL", XDM_CONST.HTTP_METHOD_LABEL, requestMethod = "LINK", XDM_CONST.HTTP_METHOD_LINK, requestMethod = "LOCK", XDM_CONST.HTTP_METHOD_LOCK, requestMethod = "MERGE", XDM_CONST.HTTP_METHOD_MERGE, requestMethod = "MKACTIVITY", XDM_CONST.HTTP_METHOD_MKACTIVITY, requestMethod = "MKCALENDAR", XDM_CONST.HTTP_METHOD_MKCALENDAR, requestMethod = "MKCOL", XDM_CONST.HTTP_METHOD_MKCOL, requestMethod = "MKREDIRECTREF", XDM_CONST.HTTP_METHOD_MKREDIRECTREF, requestMethod = "MKWORKSPACE", XDM_CONST.HTTP_METHOD_MKWORKSPACE, requestMethod = "MOVE", XDM_CONST.HTTP_METHOD_MOVE, requestMethod = "OPTIONS", XDM_CONST.HTTP_METHOD_OPTIONS, requestMethod = "ORDERPATCH", XDM_CONST.HTTP_METHOD_ORDERPATCH, requestMethod = "PATCH", XDM_CONST.HTTP_METHOD_PATCH, requestMethod = "POST", XDM_CONST.HTTP_METHOD_POST, requestMethod = "PRI", XDM_CONST.HTTP_METHOD_PRI, requestMethod = "PROPFIND", XDM_CONST.HTTP_METHOD_PROPFIND, requestMethod = "PROPPATCH", XDM_CONST.HTTP_METHOD_PROPPATCH, requestMethod = "PUT", XDM_CONST.HTTP_METHOD_PUT, requestMethod = "REBIND", XDM_CONST.HTTP_METHOD_REBIND, requestMethod = "REPORT", XDM_CONST.HTTP_METHOD_REPORT, requestMethod = "SEARCH", XDM_CONST.HTTP_METHOD_SEARCH, requestMethod = "TRACE", XDM_CONST.HTTP_METHOD_TRACE, requestMethod = "UNBIND", XDM_CONST.HTTP_METHOD_UNBIND, requestMethod = "UNCHECKOUT", XDM_CONST.HTTP_METHOD_UNCHECKOUT, requestMethod = "UNLINK", XDM_CONST.HTTP_METHOD_UNLINK, requestMethod = "UNLOCK", XDM_CONST.HTTP_METHOD_UNLOCK, requestMethod = "UPDATE", XDM_CONST.HTTP_METHOD_UPDATE, requestMethod = "UPDATEREDIRECTREF", XDM_CONST.HTTP_METHOD_UPDATEREDIRECTREF, requestMethod = "VERSION_CONTROL", XDM_CONST.HTTP_METHOD_VERSION_CONTROL, requestMethod = null, null, to_string(requestMethod)),
xdm.source.user_agent = requestClientApplication,
xdm.network.rule = to_string(cn3),
xdm.alert.original_threat_name = cs6,
xdm.event.description = msg;
filter cat = "trafficlog"
| alter
src_ip_v4 = if(src ~= "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}", src, null),
src_ip_v6 = if(src ~= "[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}", src, null),
original_src_ip_v4 = if(original_src ~= "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}", original_src, null),
original_src_ip_v6 = if(original_src ~= "[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}", original_src, null),
dst_ip_v4 = if(dst ~= "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}", dst, null),
dst_ip_v6 = if(dst ~= "[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}", dst, null),
uppercase_http_method = uppercase(http_method),
int_http_retcode = to_integer(http_retcode)
| alter
xdm.network.tls.cipher = cipher_suite,
xdm.target.ipv4 = dst_ip_v4,
xdm.target.ipv6 = dst_ip_v6,
xdm.source.ipv4 = src_ip_v4,
xdm.source.ipv6 = src_ip_v6,
xdm.observer.type = cat,
xdm.target.host.fqdn = http_host,
xdm.source.host.ipv4_addresses = arraycreate(original_src_ip_v4),
xdm.source.host.ipv6_addresses = arraycreate(original_src_ip_v6),
xdm.target.sent_bytes = to_integer(http_response_bytes),
xdm.network.http.response_code = if(int_http_retcode = 100, XDM_CONST.HTTP_RSP_CODE_CONTINUE, int_http_retcode = 101, XDM_CONST.HTTP_RSP_CODE_SWITCHING_PROTOCOLS, int_http_retcode = 102, XDM_CONST.HTTP_RSP_CODE_PROCESSING, int_http_retcode = 103, XDM_CONST.HTTP_RSP_CODE_EARLY_HINTS, int_http_retcode = 200, XDM_CONST.HTTP_RSP_CODE_OK, int_http_retcode = 201, XDM_CONST.HTTP_RSP_CODE_CREATED, int_http_retcode = 202, XDM_CONST.HTTP_RSP_CODE_ACCEPTED, int_http_retcode = 203, XDM_CONST.HTTP_RSP_CODE_NON__AUTHORITATIVE_INFORMATION, int_http_retcode = 204, XDM_CONST.HTTP_RSP_CODE_NO_CONTENT, int_http_retcode = 205, XDM_CONST.HTTP_RSP_CODE_RESET_CONTENT, int_http_retcode = 206, XDM_CONST.HTTP_RSP_CODE_PARTIAL_CONTENT, int_http_retcode = 207, XDM_CONST.HTTP_RSP_CODE_MULTI__STATUS, int_http_retcode = 208, XDM_CONST.HTTP_RSP_CODE_ALREADY_REPORTED, int_http_retcode = 226, XDM_CONST.HTTP_RSP_CODE_IM_USED, int_http_retcode = 300, XDM_CONST.HTTP_RSP_CODE_MULTIPLE_CHOICES, int_http_retcode = 301, XDM_CONST.HTTP_RSP_CODE_MOVED_PERMANENTLY, int_http_retcode = 302, XDM_CONST.HTTP_RSP_CODE_FOUND, int_http_retcode = 303, XDM_CONST.HTTP_RSP_CODE_SEE_OTHER, int_http_retcode = 304, XDM_CONST.HTTP_RSP_CODE_NOT_MODIFIED, int_http_retcode = 305, XDM_CONST.HTTP_RSP_CODE_USE_PROXY, int_http_retcode = 307, XDM_CONST.HTTP_RSP_CODE_TEMPORARY_REDIRECT, int_http_retcode = 308, XDM_CONST.HTTP_RSP_CODE_PERMANENT_REDIRECT, int_http_retcode = 400, XDM_CONST.HTTP_RSP_CODE_BAD_REQUEST, int_http_retcode = 401, XDM_CONST.HTTP_RSP_CODE_UNAUTHORIZED, int_http_retcode = 402, XDM_CONST.HTTP_RSP_CODE_PAYMENT_REQUIRED, int_http_retcode = 403, XDM_CONST.HTTP_RSP_CODE_FORBIDDEN, int_http_retcode = 404, XDM_CONST.HTTP_RSP_CODE_NOT_FOUND, int_http_retcode = 405, XDM_CONST.HTTP_RSP_CODE_METHOD_NOT_ALLOWED, int_http_retcode = 406, XDM_CONST.HTTP_RSP_CODE_NOT_ACCEPTABLE, int_http_retcode = 407, XDM_CONST.HTTP_RSP_CODE_PROXY_AUTHENTICATION_REQUIRED, int_http_retcode = 408, XDM_CONST.HTTP_RSP_CODE_REQUEST_TIMEOUT, int_http_retcode = 409, XDM_CONST.HTTP_RSP_CODE_CONFLICT, int_http_retcode = 410, XDM_CONST.HTTP_RSP_CODE_GONE, int_http_retcode = 411, XDM_CONST.HTTP_RSP_CODE_LENGTH_REQUIRED, int_http_retcode = 412, XDM_CONST.HTTP_RSP_CODE_PRECONDITION_FAILED, int_http_retcode = 413, XDM_CONST.HTTP_RSP_CODE_CONTENT_TOO_LARGE, int_http_retcode = 414, XDM_CONST.HTTP_RSP_CODE_URI_TOO_LONG, int_http_retcode = 415, XDM_CONST.HTTP_RSP_CODE_UNSUPPORTED_MEDIA_TYPE, int_http_retcode = 416, XDM_CONST.HTTP_RSP_CODE_RANGE_NOT_SATISFIABLE, int_http_retcode = 417, XDM_CONST.HTTP_RSP_CODE_EXPECTATION_FAILED, int_http_retcode = 421, XDM_CONST.HTTP_RSP_CODE_MISDIRECTED_REQUEST, int_http_retcode = 422, XDM_CONST.HTTP_RSP_CODE_UNPROCESSABLE_CONTENT, int_http_retcode = 423, XDM_CONST.HTTP_RSP_CODE_LOCKED, int_http_retcode = 424, XDM_CONST.HTTP_RSP_CODE_FAILED_DEPENDENCY, int_http_retcode = 425, XDM_CONST.HTTP_RSP_CODE_TOO_EARLY, int_http_retcode = 426, XDM_CONST.HTTP_RSP_CODE_UPGRADE_REQUIRED, int_http_retcode = 428, XDM_CONST.HTTP_RSP_CODE_PRECONDITION_REQUIRED, int_http_retcode = 429, XDM_CONST.HTTP_RSP_CODE_TOO_MANY_REQUESTS, int_http_retcode = 431, XDM_CONST.HTTP_RSP_CODE_REQUEST_HEADER_FIELDS_TOO_LARGE, int_http_retcode = 451, XDM_CONST.HTTP_RSP_CODE_UNAVAILABLE_FOR_LEGAL_REASONS, int_http_retcode = 500, XDM_CONST.HTTP_RSP_CODE_INTERNAL_SERVER_ERROR, int_http_retcode = 501, XDM_CONST.HTTP_RSP_CODE_NOT_IMPLEMENTED, int_http_retcode = 502, XDM_CONST.HTTP_RSP_CODE_BAD_GATEWAY, int_http_retcode = 503, XDM_CONST.HTTP_RSP_CODE_SERVICE_UNAVAILABLE, int_http_retcode = 504, XDM_CONST.HTTP_RSP_CODE_GATEWAY_TIMEOUT, int_http_retcode = 505, XDM_CONST.HTTP_RSP_CODE_HTTP_VERSION_NOT_SUPPORTED, int_http_retcode = 506, XDM_CONST.HTTP_RSP_CODE_VARIANT_ALSO_NEGOTIATES, int_http_retcode = 507, XDM_CONST.HTTP_RSP_CODE_INSUFFICIENT_STORAGE, int_http_retcode = 508, XDM_CONST.HTTP_RSP_CODE_LOOP_DETECTED, int_http_retcode = 511, XDM_CONST.HTTP_RSP_CODE_NETWORK_AUTHENTICATION_REQUIRED, int_http_retcode = null, null, to_string(int_http_retcode)),
xdm.network.application_protocol = service,
xdm.target.port = to_integer(dst_port),
xdm.source.user.username = user_name,
xdm.network.http.method = if(uppercase_http_method = "ACL", XDM_CONST.HTTP_METHOD_ACL, uppercase_http_method = "BASELINE_CONTROL", XDM_CONST.HTTP_METHOD_BASELINE_CONTROL, uppercase_http_method = "BIND", XDM_CONST.HTTP_METHOD_BIND, uppercase_http_method = "CHECKIN", XDM_CONST.HTTP_METHOD_CHECKIN, uppercase_http_method = "CHECKOUT", XDM_CONST.HTTP_METHOD_CHECKOUT, uppercase_http_method = "CONNECT", XDM_CONST.HTTP_METHOD_CONNECT, uppercase_http_method = "COPY", XDM_CONST.HTTP_METHOD_COPY, uppercase_http_method = "DELETE", XDM_CONST.HTTP_METHOD_DELETE, uppercase_http_method = "GET", XDM_CONST.HTTP_METHOD_GET, uppercase_http_method = "HEAD", XDM_CONST.HTTP_METHOD_HEAD, uppercase_http_method = "LABEL", XDM_CONST.HTTP_METHOD_LABEL, uppercase_http_method = "LINK", XDM_CONST.HTTP_METHOD_LINK, uppercase_http_method = "LOCK", XDM_CONST.HTTP_METHOD_LOCK, uppercase_http_method = "MERGE", XDM_CONST.HTTP_METHOD_MERGE, uppercase_http_method = "MKACTIVITY", XDM_CONST.HTTP_METHOD_MKACTIVITY, uppercase_http_method = "MKCALENDAR", XDM_CONST.HTTP_METHOD_MKCALENDAR, uppercase_http_method = "MKCOL", XDM_CONST.HTTP_METHOD_MKCOL, uppercase_http_method = "MKREDIRECTREF", XDM_CONST.HTTP_METHOD_MKREDIRECTREF, uppercase_http_method = "MKWORKSPACE", XDM_CONST.HTTP_METHOD_MKWORKSPACE, uppercase_http_method = "MOVE", XDM_CONST.HTTP_METHOD_MOVE, uppercase_http_method = "OPTIONS", XDM_CONST.HTTP_METHOD_OPTIONS, uppercase_http_method = "ORDERPATCH", XDM_CONST.HTTP_METHOD_ORDERPATCH, uppercase_http_method = "PATCH", XDM_CONST.HTTP_METHOD_PATCH, uppercase_http_method = "POST", XDM_CONST.HTTP_METHOD_POST, uppercase_http_method = "PRI", XDM_CONST.HTTP_METHOD_PRI, uppercase_http_method = "PROPFIND", XDM_CONST.HTTP_METHOD_PROPFIND, uppercase_http_method = "PROPPATCH", XDM_CONST.HTTP_METHOD_PROPPATCH, uppercase_http_method = "PUT", XDM_CONST.HTTP_METHOD_PUT, uppercase_http_method = "REBIND", XDM_CONST.HTTP_METHOD_REBIND, uppercase_http_method = "REPORT", XDM_CONST.HTTP_METHOD_REPORT, uppercase_http_method = "SEARCH", XDM_CONST.HTTP_METHOD_SEARCH, uppercase_http_method = "TRACE", XDM_CONST.HTTP_METHOD_TRACE, uppercase_http_method = "UNBIND", XDM_CONST.HTTP_METHOD_UNBIND, uppercase_http_method = "UNCHECKOUT", XDM_CONST.HTTP_METHOD_UNCHECKOUT, uppercase_http_method = "UNLINK", XDM_CONST.HTTP_METHOD_UNLINK, uppercase_http_method = "UNLOCK", XDM_CONST.HTTP_METHOD_UNLOCK, uppercase_http_method = "UPDATE", XDM_CONST.HTTP_METHOD_UPDATE, uppercase_http_method = "UPDATEREDIRECTREF", XDM_CONST.HTTP_METHOD_UPDATEREDIRECTREF, uppercase_http_method = "VERSION_CONTROL", XDM_CONST.HTTP_METHOD_VERSION_CONTROL, uppercase_http_method = null, null, to_string(uppercase_http_method)),
xdm.source.sent_bytes = to_integer(http_request_bytes),
xdm.network.http.url = http_url,
xdm.network.http.referrer = http_refer,
xdm.source.user_agent = http_agent,
xdm.source.port = to_integer(src_port),
xdm.event.outcome = if(status = "success", XDM_CONST.OUTCOME_SUCCESS, status = "failure", XDM_CONST.OUTCOME_FAILED, status = null, null, to_string(status));
filter cefname = "traffic"
// cs2Label => message ID
// cs4Label => original src
// ------------------------
// cn1Label => HTTP response code
| alter
response_code = to_string(cn1),
cefseverity_lower = lowercase(cefSeverity),
ip_protocol = uppercase(proto),
requestmethod_upper = uppercase(requestmethod)
| alter
xdm.event.original_event_type = cefname,
xdm.event.description = msg,
xdm.event.outcome = if(lowercase(outcome) contains "success", XDM_CONST.OUTCOME_SUCCESS, lowercase(outcome) contains "fail", XDM_CONST.OUTCOME_FAILED, outcome),
xdm.event.outcome_reason = reason,
xdm.event.log_level = if(cefseverity_lower ~= "alert", XDM_CONST.LOG_LEVEL_ALERT, cefseverity_lower ~= "critical", XDM_CONST.LOG_LEVEL_CRITICAL, cefseverity_lower ~= "debug", XDM_CONST.LOG_LEVEL_DEBUG, cefseverity_lower ~= "emerg", XDM_CONST.LOG_LEVEL_EMERGENCY, cefseverity_lower ~= "error", XDM_CONST.LOG_LEVEL_ERROR, cefseverity_lower ~= "info", XDM_CONST.LOG_LEVEL_INFORMATIONAL, cefseverity_lower ~= "notice", XDM_CONST.LOG_LEVEL_NOTICE, cefseverity_lower ~= "warn", XDM_CONST.LOG_LEVEL_WARNING, cefseverity_lower = null, null, to_string(cefseverity_lower)),
xdm.event.id = cs2,
xdm.observer.name = deviceexternalid,
xdm.observer.version = cefdeviceversion,
xdm.network.application_protocol = if(app contains "/tls", arrayindex(split(app, "/"), 0), app),
xdm.network.tls.protocol_version = if(app contains "/tls", arrayindex(split(app, "/"), 1), null),
xdm.network.http.url = request,
xdm.network.http.method = if(requestmethod_upper = "ACL", XDM_CONST.HTTP_METHOD_ACL, requestmethod_upper = "BASELINE_CONTROL", XDM_CONST.HTTP_METHOD_BASELINE_CONTROL, requestmethod_upper = "BIND", XDM_CONST.HTTP_METHOD_BIND, requestmethod_upper = "CHECKIN", XDM_CONST.HTTP_METHOD_CHECKIN, requestmethod_upper = "CHECKOUT", XDM_CONST.HTTP_METHOD_CHECKOUT, requestmethod_upper = "CONNECT", XDM_CONST.HTTP_METHOD_CONNECT, requestmethod_upper = "COPY", XDM_CONST.HTTP_METHOD_COPY, requestmethod_upper = "DELETE", XDM_CONST.HTTP_METHOD_DELETE, requestmethod_upper = "GET", XDM_CONST.HTTP_METHOD_GET, requestmethod_upper = "HEAD", XDM_CONST.HTTP_METHOD_HEAD, requestmethod_upper = "LABEL", XDM_CONST.HTTP_METHOD_LABEL, requestmethod_upper = "LINK", XDM_CONST.HTTP_METHOD_LINK, requestmethod_upper = "LOCK", XDM_CONST.HTTP_METHOD_LOCK, requestmethod_upper = "MERGE", XDM_CONST.HTTP_METHOD_MERGE, requestmethod_upper = "MKACTIVITY", XDM_CONST.HTTP_METHOD_MKACTIVITY, requestmethod_upper = "MKCALENDAR", XDM_CONST.HTTP_METHOD_MKCALENDAR, requestmethod_upper = "MKCOL", XDM_CONST.HTTP_METHOD_MKCOL, requestmethod_upper = "MKREDIRECTREF", XDM_CONST.HTTP_METHOD_MKREDIRECTREF, requestmethod_upper = "MKWORKSPACE", XDM_CONST.HTTP_METHOD_MKWORKSPACE, requestmethod_upper = "MOVE", XDM_CONST.HTTP_METHOD_MOVE, requestmethod_upper = "OPTIONS", XDM_CONST.HTTP_METHOD_OPTIONS, requestmethod_upper = "ORDERPATCH", XDM_CONST.HTTP_METHOD_ORDERPATCH, requestmethod_upper = "PATCH", XDM_CONST.HTTP_METHOD_PATCH, requestmethod_upper = "POST", XDM_CONST.HTTP_METHOD_POST, requestmethod_upper = "PRI", XDM_CONST.HTTP_METHOD_PRI, requestmethod_upper = "PROPFIND", XDM_CONST.HTTP_METHOD_PROPFIND, requestmethod_upper = "PROPPATCH", XDM_CONST.HTTP_METHOD_PROPPATCH, requestmethod_upper = "PUT", XDM_CONST.HTTP_METHOD_PUT, requestmethod_upper = "REBIND", XDM_CONST.HTTP_METHOD_REBIND, requestmethod_upper = "REPORT", XDM_CONST.HTTP_METHOD_REPORT, requestmethod_upper = "SEARCH", XDM_CONST.HTTP_METHOD_SEARCH, requestmethod_upper = "TRACE", XDM_CONST.HTTP_METHOD_TRACE, requestmethod_upper = "UNBIND", XDM_CONST.HTTP_METHOD_UNBIND, requestmethod_upper = "UNCHECKOUT", XDM_CONST.HTTP_METHOD_UNCHECKOUT, requestmethod_upper = "UNLINK", XDM_CONST.HTTP_METHOD_UNLINK, requestmethod_upper = "UNLOCK", XDM_CONST.HTTP_METHOD_UNLOCK, requestmethod_upper = "UPDATE", XDM_CONST.HTTP_METHOD_UPDATE, requestmethod_upper = "UPDATEREDIRECTREF", XDM_CONST.HTTP_METHOD_UPDATEREDIRECTREF, requestmethod_upper = "VERSION_CONTROL", XDM_CONST.HTTP_METHOD_VERSION_CONTROL, to_string(requestmethod)),
xdm.network.http.response_code = if(response_code = "100", XDM_CONST.HTTP_RSP_CODE_CONTINUE, response_code = "101", XDM_CONST.HTTP_RSP_CODE_SWITCHING_PROTOCOLS, response_code = "102", XDM_CONST.HTTP_RSP_CODE_PROCESSING, response_code = "103", XDM_CONST.HTTP_RSP_CODE_EARLY_HINTS, response_code = "200", XDM_CONST.HTTP_RSP_CODE_OK, response_code = "201", XDM_CONST.HTTP_RSP_CODE_CREATED, response_code = "202", XDM_CONST.HTTP_RSP_CODE_ACCEPTED, response_code = "203", XDM_CONST.HTTP_RSP_CODE_NON__AUTHORITATIVE_INFORMATION, response_code = "204", XDM_CONST.HTTP_RSP_CODE_NO_CONTENT, response_code = "205", XDM_CONST.HTTP_RSP_CODE_RESET_CONTENT, response_code = "206", XDM_CONST.HTTP_RSP_CODE_PARTIAL_CONTENT, response_code = "207", XDM_CONST.HTTP_RSP_CODE_MULTI__STATUS, response_code = "208", XDM_CONST.HTTP_RSP_CODE_ALREADY_REPORTED, response_code = "226", XDM_CONST.HTTP_RSP_CODE_IM_USED, response_code = "300", XDM_CONST.HTTP_RSP_CODE_MULTIPLE_CHOICES, response_code = "301", XDM_CONST.HTTP_RSP_CODE_MOVED_PERMANENTLY, response_code = "302", XDM_CONST.HTTP_RSP_CODE_FOUND, response_code = "303", XDM_CONST.HTTP_RSP_CODE_SEE_OTHER, response_code = "304", XDM_CONST.HTTP_RSP_CODE_NOT_MODIFIED, response_code = "305", XDM_CONST.HTTP_RSP_CODE_USE_PROXY, response_code = "307", XDM_CONST.HTTP_RSP_CODE_TEMPORARY_REDIRECT, response_code = "308", XDM_CONST.HTTP_RSP_CODE_PERMANENT_REDIRECT, response_code = "400", XDM_CONST.HTTP_RSP_CODE_BAD_REQUEST, response_code = "401", XDM_CONST.HTTP_RSP_CODE_UNAUTHORIZED, response_code = "402", XDM_CONST.HTTP_RSP_CODE_PAYMENT_REQUIRED, response_code = "403", XDM_CONST.HTTP_RSP_CODE_FORBIDDEN, response_code = "404", XDM_CONST.HTTP_RSP_CODE_NOT_FOUND, response_code = "405", XDM_CONST.HTTP_RSP_CODE_METHOD_NOT_ALLOWED, response_code = "406", XDM_CONST.HTTP_RSP_CODE_NOT_ACCEPTABLE, response_code = "407", XDM_CONST.HTTP_RSP_CODE_PROXY_AUTHENTICATION_REQUIRED, response_code = "408", XDM_CONST.HTTP_RSP_CODE_REQUEST_TIMEOUT, response_code = "409", XDM_CONST.HTTP_RSP_CODE_CONFLICT, response_code = "410", XDM_CONST.HTTP_RSP_CODE_GONE, response_code = "411", XDM_CONST.HTTP_RSP_CODE_LENGTH_REQUIRED, response_code = "412", XDM_CONST.HTTP_RSP_CODE_PRECONDITION_FAILED, response_code = "413", XDM_CONST.HTTP_RSP_CODE_CONTENT_TOO_LARGE, response_code = "414", XDM_CONST.HTTP_RSP_CODE_URI_TOO_LONG, response_code = "415", XDM_CONST.HTTP_RSP_CODE_UNSUPPORTED_MEDIA_TYPE, response_code = "416", XDM_CONST.HTTP_RSP_CODE_RANGE_NOT_SATISFIABLE, response_code = "417", XDM_CONST.HTTP_RSP_CODE_EXPECTATION_FAILED, response_code = "421", XDM_CONST.HTTP_RSP_CODE_MISDIRECTED_REQUEST, response_code = "422", XDM_CONST.HTTP_RSP_CODE_UNPROCESSABLE_CONTENT, response_code = "423", XDM_CONST.HTTP_RSP_CODE_LOCKED, response_code = "424", XDM_CONST.HTTP_RSP_CODE_FAILED_DEPENDENCY, response_code = "425", XDM_CONST.HTTP_RSP_CODE_TOO_EARLY, response_code = "426", XDM_CONST.HTTP_RSP_CODE_UPGRADE_REQUIRED, response_code = "428", XDM_CONST.HTTP_RSP_CODE_PRECONDITION_REQUIRED, response_code = "429", XDM_CONST.HTTP_RSP_CODE_TOO_MANY_REQUESTS, response_code = "431", XDM_CONST.HTTP_RSP_CODE_REQUEST_HEADER_FIELDS_TOO_LARGE, response_code = "451", XDM_CONST.HTTP_RSP_CODE_UNAVAILABLE_FOR_LEGAL_REASONS, response_code = "500", XDM_CONST.HTTP_RSP_CODE_INTERNAL_SERVER_ERROR, response_code = "501", XDM_CONST.HTTP_RSP_CODE_NOT_IMPLEMENTED, response_code = "502", XDM_CONST.HTTP_RSP_CODE_BAD_GATEWAY, response_code = "503", XDM_CONST.HTTP_RSP_CODE_SERVICE_UNAVAILABLE, response_code = "504", XDM_CONST.HTTP_RSP_CODE_GATEWAY_TIMEOUT, response_code = "505", XDM_CONST.HTTP_RSP_CODE_HTTP_VERSION_NOT_SUPPORTED, response_code = "506", XDM_CONST.HTTP_RSP_CODE_VARIANT_ALSO_NEGOTIATES, response_code = "507", XDM_CONST.HTTP_RSP_CODE_INSUFFICIENT_STORAGE, response_code = "508", XDM_CONST.HTTP_RSP_CODE_LOOP_DETECTED, response_code = "511", XDM_CONST.HTTP_RSP_CODE_NETWORK_AUTHENTICATION_REQUIRED, response_code = null, null, to_string(response_code)),
xdm.network.ip_protocol = if(ip_protocol = null, null, ip_protocol = "UDP", XDM_CONST.IP_PROTOCOL_UDP, ip_protocol = "TCP", XDM_CONST.IP_PROTOCOL_TCP, ip_protocol ~= "ICMP", XDM_CONST.IP_PROTOCOL_ICMP, ip_protocol = "HOPOPT", XDM_CONST.IP_PROTOCOL_HOPOPT, ip_protocol = "IGMP", XDM_CONST.IP_PROTOCOL_IGMP, ip_protocol = "GGP", XDM_CONST.IP_PROTOCOL_GGP, ip_protocol = "IP", XDM_CONST.IP_PROTOCOL_IP, ip_protocol = "ST", XDM_CONST.IP_PROTOCOL_ST, ip_protocol = "CBT", XDM_CONST.IP_PROTOCOL_CBT, ip_protocol = "EGP", XDM_CONST.IP_PROTOCOL_EGP, ip_protocol = "IGP", XDM_CONST.IP_PROTOCOL_IGP, ip_protocol = "BBN_RCC_MON", XDM_CONST.IP_PROTOCOL_BBN_RCC_MON, ip_protocol = "NVP_II", XDM_CONST.IP_PROTOCOL_NVP_II, ip_protocol = "PUP", XDM_CONST.IP_PROTOCOL_PUP, ip_protocol = "ARGUS", XDM_CONST.IP_PROTOCOL_ARGUS, ip_protocol = "EMCON", XDM_CONST.IP_PROTOCOL_EMCON, ip_protocol = "XNET", XDM_CONST.IP_PROTOCOL_XNET, ip_protocol = "CHAOS", XDM_CONST.IP_PROTOCOL_CHAOS, ip_protocol = "MUX", XDM_CONST.IP_PROTOCOL_MUX, ip_protocol = "DCN_MEAS", XDM_CONST.IP_PROTOCOL_DCN_MEAS, ip_protocol = "HMP", XDM_CONST.IP_PROTOCOL_HMP, ip_protocol = "PRM", XDM_CONST.IP_PROTOCOL_PRM, ip_protocol = "XNS_IDP", XDM_CONST.IP_PROTOCOL_XNS_IDP, ip_protocol = "TRUNK_1", XDM_CONST.IP_PROTOCOL_TRUNK_1, ip_protocol = "TRUNK_2", XDM_CONST.IP_PROTOCOL_TRUNK_2, ip_protocol = "LEAF_1", XDM_CONST.IP_PROTOCOL_LEAF_1, ip_protocol = "LEAF_2", XDM_CONST.IP_PROTOCOL_LEAF_2, ip_protocol = "RDP", XDM_CONST.IP_PROTOCOL_RDP, ip_protocol = "IRTP", XDM_CONST.IP_PROTOCOL_IRTP, ip_protocol = "ISO_TP4", XDM_CONST.IP_PROTOCOL_ISO_TP4, ip_protocol = "NETBLT", XDM_CONST.IP_PROTOCOL_NETBLT, ip_protocol = "MFE_NSP", XDM_CONST.IP_PROTOCOL_MFE_NSP, ip_protocol = "MERIT_INP", XDM_CONST.IP_PROTOCOL_MERIT_INP, ip_protocol = "DCCP", XDM_CONST.IP_PROTOCOL_DCCP, ip_protocol = "3PC", XDM_CONST.IP_PROTOCOL_3PC, ip_protocol = "IDPR", XDM_CONST.IP_PROTOCOL_IDPR, ip_protocol = "XTP", XDM_CONST.IP_PROTOCOL_XTP, ip_protocol = "DDP", XDM_CONST.IP_PROTOCOL_DDP, ip_protocol = "IDPR_CMTP", XDM_CONST.IP_PROTOCOL_IDPR_CMTP, ip_protocol = "TP", XDM_CONST.IP_PROTOCOL_TP, ip_protocol = "IL", XDM_CONST.IP_PROTOCOL_IL, ip_protocol = "IPV6", XDM_CONST.IP_PROTOCOL_IPV6, ip_protocol = "SDRP", XDM_CONST.IP_PROTOCOL_SDRP, ip_protocol = "IPV6_ROUTE", XDM_CONST.IP_PROTOCOL_IPV6_ROUTE, ip_protocol = "IPV6_FRAG", XDM_CONST.IP_PROTOCOL_IPV6_FRAG, ip_protocol = "IDRP", XDM_CONST.IP_PROTOCOL_IDRP, ip_protocol = "RSVP", XDM_CONST.IP_PROTOCOL_RSVP, ip_protocol = "GRE", XDM_CONST.IP_PROTOCOL_GRE, ip_protocol = "DSR", XDM_CONST.IP_PROTOCOL_DSR, ip_protocol = "BNA", XDM_CONST.IP_PROTOCOL_BNA, ip_protocol = "ESP", XDM_CONST.IP_PROTOCOL_ESP, ip_protocol = "AH", XDM_CONST.IP_PROTOCOL_AH, ip_protocol = "I_NLSP", XDM_CONST.IP_PROTOCOL_I_NLSP, ip_protocol = "SWIPE", XDM_CONST.IP_PROTOCOL_SWIPE, ip_protocol = "NARP", XDM_CONST.IP_PROTOCOL_NARP, ip_protocol = "MOBILE", XDM_CONST.IP_PROTOCOL_MOBILE, ip_protocol = "TLSP", XDM_CONST.IP_PROTOCOL_TLSP, ip_protocol = "SKIP", XDM_CONST.IP_PROTOCOL_SKIP, ip_protocol = "IPV6_ICMP", XDM_CONST.IP_PROTOCOL_IPV6_ICMP, ip_protocol = "IPV6_NONXT", XDM_CONST.IP_PROTOCOL_IPV6_NONXT, ip_protocol = "IPV6_OPTS", XDM_CONST.IP_PROTOCOL_IPV6_OPTS, ip_protocol = "CFTP", XDM_CONST.IP_PROTOCOL_CFTP, ip_protocol = "SAT_EXPAK", XDM_CONST.IP_PROTOCOL_SAT_EXPAK, ip_protocol = "KRYPTOLAN", XDM_CONST.IP_PROTOCOL_KRYPTOLAN, ip_protocol = "RVD", XDM_CONST.IP_PROTOCOL_RVD, ip_protocol = "IPPC", XDM_CONST.IP_PROTOCOL_IPPC, ip_protocol = "SAT_MON", XDM_CONST.IP_PROTOCOL_SAT_MON, ip_protocol = "VISA", XDM_CONST.IP_PROTOCOL_VISA, ip_protocol = "IPCV", XDM_CONST.IP_PROTOCOL_IPCV, ip_protocol = "CPNX", XDM_CONST.IP_PROTOCOL_CPNX, ip_protocol = "CPHB", XDM_CONST.IP_PROTOCOL_CPHB, ip_protocol = "WSN", XDM_CONST.IP_PROTOCOL_WSN, ip_protocol = "PVP", XDM_CONST.IP_PROTOCOL_PVP, ip_protocol = "BR_SAT_MON", XDM_CONST.IP_PROTOCOL_BR_SAT_MON, ip_protocol = "SUN_ND", XDM_CONST.IP_PROTOCOL_SUN_ND, ip_protocol = "WB_MON", XDM_CONST.IP_PROTOCOL_WB_MON, ip_protocol = "WB_EXPAK", XDM_CONST.IP_PROTOCOL_WB_EXPAK, ip_protocol = "ISO_IP", XDM_CONST.IP_PROTOCOL_ISO_IP, ip_protocol = "VMTP", XDM_CONST.IP_PROTOCOL_VMTP, ip_protocol = "SECURE_VMTP", XDM_CONST.IP_PROTOCOL_SECURE_VMTP, ip_protocol = "VINES", XDM_CONST.IP_PROTOCOL_VINES, ip_protocol = "TTP", XDM_CONST.IP_PROTOCOL_TTP, ip_protocol = "NSFNET_IGP", XDM_CONST.IP_PROTOCOL_NSFNET_IGP, ip_protocol = "DGP", XDM_CONST.IP_PROTOCOL_DGP, ip_protocol = "TCF", XDM_CONST.IP_PROTOCOL_TCF, ip_protocol = "EIGRP", XDM_CONST.IP_PROTOCOL_EIGRP, ip_protocol = "OSPFIGP", XDM_CONST.IP_PROTOCOL_OSPFIGP, ip_protocol = "SPRITE_RPC", XDM_CONST.IP_PROTOCOL_SPRITE_RPC, ip_protocol = "LARP", XDM_CONST.IP_PROTOCOL_LARP, ip_protocol = "MTP", XDM_CONST.IP_PROTOCOL_MTP, ip_protocol = "AX25", XDM_CONST.IP_PROTOCOL_AX25, ip_protocol = "IPIP", XDM_CONST.IP_PROTOCOL_IPIP, ip_protocol = "MICP", XDM_CONST.IP_PROTOCOL_MICP, ip_protocol = "SCC_SP", XDM_CONST.IP_PROTOCOL_SCC_SP, ip_protocol = "ETHERIP", XDM_CONST.IP_PROTOCOL_ETHERIP, ip_protocol = "ENCAP", XDM_CONST.IP_PROTOCOL_ENCAP, ip_protocol = "GMTP", XDM_CONST.IP_PROTOCOL_GMTP, ip_protocol = "IFMP", XDM_CONST.IP_PROTOCOL_IFMP, ip_protocol = "PNNI", XDM_CONST.IP_PROTOCOL_PNNI, ip_protocol = "PIM", XDM_CONST.IP_PROTOCOL_PIM, ip_protocol = "ARIS", XDM_CONST.IP_PROTOCOL_ARIS, ip_protocol = "SCPS", XDM_CONST.IP_PROTOCOL_SCPS, ip_protocol = "QNX", XDM_CONST.IP_PROTOCOL_QNX, ip_protocol = "AN", XDM_CONST.IP_PROTOCOL_AN, ip_protocol = "IPCOMP", XDM_CONST.IP_PROTOCOL_IPCOMP, ip_protocol = "SNP", XDM_CONST.IP_PROTOCOL_SNP, ip_protocol = "COMPAQ_PEER", XDM_CONST.IP_PROTOCOL_COMPAQ_PEER, ip_protocol = "IPX_IN_IP", XDM_CONST.IP_PROTOCOL_IPX_IN_IP, ip_protocol = "VRRP", XDM_CONST.IP_PROTOCOL_VRRP, ip_protocol = "PGM", XDM_CONST.IP_PROTOCOL_PGM, ip_protocol = "L2TP", XDM_CONST.IP_PROTOCOL_L2TP, ip_protocol = "DDX", XDM_CONST.IP_PROTOCOL_DDX, ip_protocol = "IATP", XDM_CONST.IP_PROTOCOL_IATP, ip_protocol = "STP", XDM_CONST.IP_PROTOCOL_STP, ip_protocol = "SRP", XDM_CONST.IP_PROTOCOL_SRP, ip_protocol = "UTI", XDM_CONST.IP_PROTOCOL_UTI, ip_protocol = "SMP", XDM_CONST.IP_PROTOCOL_SMP, ip_protocol = "SM", XDM_CONST.IP_PROTOCOL_SM, ip_protocol = "PTP", XDM_CONST.IP_PROTOCOL_PTP, ip_protocol = "ISIS", XDM_CONST.IP_PROTOCOL_ISIS, ip_protocol = "FIRE", XDM_CONST.IP_PROTOCOL_FIRE, ip_protocol = "CRTP", XDM_CONST.IP_PROTOCOL_CRTP, ip_protocol = "CRUDP", XDM_CONST.IP_PROTOCOL_CRUDP, ip_protocol = "SSCOPMCE", XDM_CONST.IP_PROTOCOL_SSCOPMCE, ip_protocol = "IPLT", XDM_CONST.IP_PROTOCOL_IPLT, ip_protocol = "SPS", XDM_CONST.IP_PROTOCOL_SPS, ip_protocol = "PIPE", XDM_CONST.IP_PROTOCOL_PIPE, ip_protocol = "SCTP", XDM_CONST.IP_PROTOCOL_SCTP, ip_protocol = "FC", XDM_CONST.IP_PROTOCOL_FC, ip_protocol = "RSVP_E2E_IGNORE", XDM_CONST.IP_PROTOCOL_RSVP_E2E_IGNORE, ip_protocol = "MOBILITY", XDM_CONST.IP_PROTOCOL_MOBILITY, ip_protocol = "UDPLITE", XDM_CONST.IP_PROTOCOL_UDPLITE, ip_protocol = "MPLS_IN_IP", XDM_CONST.IP_PROTOCOL_MPLS_IN_IP, ip_protocol = "MANET", XDM_CONST.IP_PROTOCOL_MANET, ip_protocol = "HIP", XDM_CONST.IP_PROTOCOL_HIP, ip_protocol = "SHIM6", XDM_CONST.IP_PROTOCOL_SHIM6, ip_protocol = "WESP", XDM_CONST.IP_PROTOCOL_WESP, ip_protocol = "ROHC", XDM_CONST.IP_PROTOCOL_ROHC, ip_protocol = "RESERVED", XDM_CONST.IP_PROTOCOL_RESERVED, to_string(ip_protocol)),
xdm.target.ipv4 = if(dst ~= "(?:\d{1,3}\.){3}\d{1,3}", dst, null),
xdm.target.ipv6 = if(dst ~= "(?:[a-fA-F\d]{0,4}\:){2,7}[a-fA-F\d]{0,4}", dst, null),
xdm.target.port = to_integer(dpt),
xdm.target.host.hostname = dhost,
xdm.target.sent_bytes = to_integer(`in`),
xdm.source.ipv4 = if(cs4 = null and src ~= "(?:\d{1,3}\.){3}\d{1,3}", src, cs4 ~= "(?:\d{1,3}\.){3}\d{1,3}", cs4, null),
xdm.source.ipv6 = if(cs4 = null and src ~= "(?:[a-fA-F\d]{0,4}\:){2,7}[a-fA-F\d]{0,4}", src, cs4 ~= "(?:[a-fA-F\d]{0,4}\:){2,7}[a-fA-F\d]{0,4}", cs4, null),
xdm.source.port = to_integer(spt),
xdm.source.sent_bytes = to_integer(out),
xdm.source.user_agent = requestclientapplication,
xdm.intermediate.ipv4 = if (cs4 != null and cs4 != src and src ~= "(?:\d{1,3}\.){3}\d{1,3}", src, null),
xdm.intermediate.ipv6 = if (cs4 != null and cs4 != src and src ~= "(?:[a-fA-F\d]{0,4}\:){2,7}[a-fA-F\d]{0,4}", src, null);
filter cefname = "attack"
// cs2Label => severity level
// cs4Label => signature main class name
// cs5Label => signature subclass name
// cs6Label => signature ID
// ------------------------
// cn1Label => message ID
| alter
ip_protocol = uppercase(proto),
cefseverity_lower = lowercase(cefSeverity),
requestmethod_upper = uppercase(requestmethod)
| alter
xdm.event.original_event_type = cefname,
xdm.event.log_level = if(cefseverity_lower ~= "alert", XDM_CONST.LOG_LEVEL_ALERT, cefseverity_lower ~= "critical", XDM_CONST.LOG_LEVEL_CRITICAL, cefseverity_lower ~= "debug", XDM_CONST.LOG_LEVEL_DEBUG, cefseverity_lower ~= "emerg", XDM_CONST.LOG_LEVEL_EMERGENCY, cefseverity_lower ~= "error", XDM_CONST.LOG_LEVEL_ERROR, cefseverity_lower ~= "info", XDM_CONST.LOG_LEVEL_INFORMATIONAL, cefseverity_lower ~= "notice", XDM_CONST.LOG_LEVEL_NOTICE, cefseverity_lower ~= "warn", XDM_CONST.LOG_LEVEL_WARNING, cefseverity_lower = null, null, to_string(cefseverity_lower)),
xdm.alert.name = cat,
xdm.alert.description = msg,
xdm.alert.original_threat_id = cefdeviceeventclassid,
xdm.alert.original_alert_id = to_string(cn1),
xdm.alert.severity = cs2,
xdm.alert.category = cs4,
xdm.alert.subcategory = if(cs5 != "N/A" and cs6 != "N/A", concat(cs5, " - ", cs6), cs5 = "N/A" and cs6 != "N/A", cs6, cs5 != "N/A" and cs6 = "N/A", cs5, null),
xdm.observer.action = act,
xdm.observer.version = cefdeviceversion,
xdm.observer.name = deviceexternalid,
xdm.network.application_protocol = if(app contains "/tls", arrayindex(split(app, "/"), 0), app),
xdm.network.tls.protocol_version = if(app contains "/tls", arrayindex(split(app, "/"), 1), null),
xdm.network.http.url = request,
xdm.network.ip_protocol = if(ip_protocol = null, null, ip_protocol = "UDP", XDM_CONST.IP_PROTOCOL_UDP, ip_protocol = "TCP", XDM_CONST.IP_PROTOCOL_TCP, ip_protocol ~= "ICMP", XDM_CONST.IP_PROTOCOL_ICMP, ip_protocol = "HOPOPT", XDM_CONST.IP_PROTOCOL_HOPOPT, ip_protocol = "IGMP", XDM_CONST.IP_PROTOCOL_IGMP, ip_protocol = "GGP", XDM_CONST.IP_PROTOCOL_GGP, ip_protocol = "IP", XDM_CONST.IP_PROTOCOL_IP, ip_protocol = "ST", XDM_CONST.IP_PROTOCOL_ST, ip_protocol = "CBT", XDM_CONST.IP_PROTOCOL_CBT, ip_protocol = "EGP", XDM_CONST.IP_PROTOCOL_EGP, ip_protocol = "IGP", XDM_CONST.IP_PROTOCOL_IGP, ip_protocol = "BBN_RCC_MON", XDM_CONST.IP_PROTOCOL_BBN_RCC_MON, ip_protocol = "NVP_II", XDM_CONST.IP_PROTOCOL_NVP_II, ip_protocol = "PUP", XDM_CONST.IP_PROTOCOL_PUP, ip_protocol = "ARGUS", XDM_CONST.IP_PROTOCOL_ARGUS, ip_protocol = "EMCON", XDM_CONST.IP_PROTOCOL_EMCON, ip_protocol = "XNET", XDM_CONST.IP_PROTOCOL_XNET, ip_protocol = "CHAOS", XDM_CONST.IP_PROTOCOL_CHAOS, ip_protocol = "MUX", XDM_CONST.IP_PROTOCOL_MUX, ip_protocol = "DCN_MEAS", XDM_CONST.IP_PROTOCOL_DCN_MEAS, ip_protocol = "HMP", XDM_CONST.IP_PROTOCOL_HMP, ip_protocol = "PRM", XDM_CONST.IP_PROTOCOL_PRM, ip_protocol = "XNS_IDP", XDM_CONST.IP_PROTOCOL_XNS_IDP, ip_protocol = "TRUNK_1", XDM_CONST.IP_PROTOCOL_TRUNK_1, ip_protocol = "TRUNK_2", XDM_CONST.IP_PROTOCOL_TRUNK_2, ip_protocol = "LEAF_1", XDM_CONST.IP_PROTOCOL_LEAF_1, ip_protocol = "LEAF_2", XDM_CONST.IP_PROTOCOL_LEAF_2, ip_protocol = "RDP", XDM_CONST.IP_PROTOCOL_RDP, ip_protocol = "IRTP", XDM_CONST.IP_PROTOCOL_IRTP, ip_protocol = "ISO_TP4", XDM_CONST.IP_PROTOCOL_ISO_TP4, ip_protocol = "NETBLT", XDM_CONST.IP_PROTOCOL_NETBLT, ip_protocol = "MFE_NSP", XDM_CONST.IP_PROTOCOL_MFE_NSP, ip_protocol = "MERIT_INP", XDM_CONST.IP_PROTOCOL_MERIT_INP, ip_protocol = "DCCP", XDM_CONST.IP_PROTOCOL_DCCP, ip_protocol = "3PC", XDM_CONST.IP_PROTOCOL_3PC, ip_protocol = "IDPR", XDM_CONST.IP_PROTOCOL_IDPR, ip_protocol = "XTP", XDM_CONST.IP_PROTOCOL_XTP, ip_protocol = "DDP", XDM_CONST.IP_PROTOCOL_DDP, ip_protocol = "IDPR_CMTP", XDM_CONST.IP_PROTOCOL_IDPR_CMTP, ip_protocol = "TP", XDM_CONST.IP_PROTOCOL_TP, ip_protocol = "IL", XDM_CONST.IP_PROTOCOL_IL, ip_protocol = "IPV6", XDM_CONST.IP_PROTOCOL_IPV6, ip_protocol = "SDRP", XDM_CONST.IP_PROTOCOL_SDRP, ip_protocol = "IPV6_ROUTE", XDM_CONST.IP_PROTOCOL_IPV6_ROUTE, ip_protocol = "IPV6_FRAG", XDM_CONST.IP_PROTOCOL_IPV6_FRAG, ip_protocol = "IDRP", XDM_CONST.IP_PROTOCOL_IDRP, ip_protocol = "RSVP", XDM_CONST.IP_PROTOCOL_RSVP, ip_protocol = "GRE", XDM_CONST.IP_PROTOCOL_GRE, ip_protocol = "DSR", XDM_CONST.IP_PROTOCOL_DSR, ip_protocol = "BNA", XDM_CONST.IP_PROTOCOL_BNA, ip_protocol = "ESP", XDM_CONST.IP_PROTOCOL_ESP, ip_protocol = "AH", XDM_CONST.IP_PROTOCOL_AH, ip_protocol = "I_NLSP", XDM_CONST.IP_PROTOCOL_I_NLSP, ip_protocol = "SWIPE", XDM_CONST.IP_PROTOCOL_SWIPE, ip_protocol = "NARP", XDM_CONST.IP_PROTOCOL_NARP, ip_protocol = "MOBILE", XDM_CONST.IP_PROTOCOL_MOBILE, ip_protocol = "TLSP", XDM_CONST.IP_PROTOCOL_TLSP, ip_protocol = "SKIP", XDM_CONST.IP_PROTOCOL_SKIP, ip_protocol = "IPV6_ICMP", XDM_CONST.IP_PROTOCOL_IPV6_ICMP, ip_protocol = "IPV6_NONXT", XDM_CONST.IP_PROTOCOL_IPV6_NONXT, ip_protocol = "IPV6_OPTS", XDM_CONST.IP_PROTOCOL_IPV6_OPTS, ip_protocol = "CFTP", XDM_CONST.IP_PROTOCOL_CFTP, ip_protocol = "SAT_EXPAK", XDM_CONST.IP_PROTOCOL_SAT_EXPAK, ip_protocol = "KRYPTOLAN", XDM_CONST.IP_PROTOCOL_KRYPTOLAN, ip_protocol = "RVD", XDM_CONST.IP_PROTOCOL_RVD, ip_protocol = "IPPC", XDM_CONST.IP_PROTOCOL_IPPC, ip_protocol = "SAT_MON", XDM_CONST.IP_PROTOCOL_SAT_MON, ip_protocol = "VISA", XDM_CONST.IP_PROTOCOL_VISA, ip_protocol = "IPCV", XDM_CONST.IP_PROTOCOL_IPCV, ip_protocol = "CPNX", XDM_CONST.IP_PROTOCOL_CPNX, ip_protocol = "CPHB", XDM_CONST.IP_PROTOCOL_CPHB, ip_protocol = "WSN", XDM_CONST.IP_PROTOCOL_WSN, ip_protocol = "PVP", XDM_CONST.IP_PROTOCOL_PVP, ip_protocol = "BR_SAT_MON", XDM_CONST.IP_PROTOCOL_BR_SAT_MON, ip_protocol = "SUN_ND", XDM_CONST.IP_PROTOCOL_SUN_ND, ip_protocol = "WB_MON", XDM_CONST.IP_PROTOCOL_WB_MON, ip_protocol = "WB_EXPAK", XDM_CONST.IP_PROTOCOL_WB_EXPAK, ip_protocol = "ISO_IP", XDM_CONST.IP_PROTOCOL_ISO_IP, ip_protocol = "VMTP", XDM_CONST.IP_PROTOCOL_VMTP, ip_protocol = "SECURE_VMTP", XDM_CONST.IP_PROTOCOL_SECURE_VMTP, ip_protocol = "VINES", XDM_CONST.IP_PROTOCOL_VINES, ip_protocol = "TTP", XDM_CONST.IP_PROTOCOL_TTP, ip_protocol = "NSFNET_IGP", XDM_CONST.IP_PROTOCOL_NSFNET_IGP, ip_protocol = "DGP", XDM_CONST.IP_PROTOCOL_DGP, ip_protocol = "TCF", XDM_CONST.IP_PROTOCOL_TCF, ip_protocol = "EIGRP", XDM_CONST.IP_PROTOCOL_EIGRP, ip_protocol = "OSPFIGP", XDM_CONST.IP_PROTOCOL_OSPFIGP, ip_protocol = "SPRITE_RPC", XDM_CONST.IP_PROTOCOL_SPRITE_RPC, ip_protocol = "LARP", XDM_CONST.IP_PROTOCOL_LARP, ip_protocol = "MTP", XDM_CONST.IP_PROTOCOL_MTP, ip_protocol = "AX25", XDM_CONST.IP_PROTOCOL_AX25, ip_protocol = "IPIP", XDM_CONST.IP_PROTOCOL_IPIP, ip_protocol = "MICP", XDM_CONST.IP_PROTOCOL_MICP, ip_protocol = "SCC_SP", XDM_CONST.IP_PROTOCOL_SCC_SP, ip_protocol = "ETHERIP", XDM_CONST.IP_PROTOCOL_ETHERIP, ip_protocol = "ENCAP", XDM_CONST.IP_PROTOCOL_ENCAP, ip_protocol = "GMTP", XDM_CONST.IP_PROTOCOL_GMTP, ip_protocol = "IFMP", XDM_CONST.IP_PROTOCOL_IFMP, ip_protocol = "PNNI", XDM_CONST.IP_PROTOCOL_PNNI, ip_protocol = "PIM", XDM_CONST.IP_PROTOCOL_PIM, ip_protocol = "ARIS", XDM_CONST.IP_PROTOCOL_ARIS, ip_protocol = "SCPS", XDM_CONST.IP_PROTOCOL_SCPS, ip_protocol = "QNX", XDM_CONST.IP_PROTOCOL_QNX, ip_protocol = "AN", XDM_CONST.IP_PROTOCOL_AN, ip_protocol = "IPCOMP", XDM_CONST.IP_PROTOCOL_IPCOMP, ip_protocol = "SNP", XDM_CONST.IP_PROTOCOL_SNP, ip_protocol = "COMPAQ_PEER", XDM_CONST.IP_PROTOCOL_COMPAQ_PEER, ip_protocol = "IPX_IN_IP", XDM_CONST.IP_PROTOCOL_IPX_IN_IP, ip_protocol = "VRRP", XDM_CONST.IP_PROTOCOL_VRRP, ip_protocol = "PGM", XDM_CONST.IP_PROTOCOL_PGM, ip_protocol = "L2TP", XDM_CONST.IP_PROTOCOL_L2TP, ip_protocol = "DDX", XDM_CONST.IP_PROTOCOL_DDX, ip_protocol = "IATP", XDM_CONST.IP_PROTOCOL_IATP, ip_protocol = "STP", XDM_CONST.IP_PROTOCOL_STP, ip_protocol = "SRP", XDM_CONST.IP_PROTOCOL_SRP, ip_protocol = "UTI", XDM_CONST.IP_PROTOCOL_UTI, ip_protocol = "SMP", XDM_CONST.IP_PROTOCOL_SMP, ip_protocol = "SM", XDM_CONST.IP_PROTOCOL_SM, ip_protocol = "PTP", XDM_CONST.IP_PROTOCOL_PTP, ip_protocol = "ISIS", XDM_CONST.IP_PROTOCOL_ISIS, ip_protocol = "FIRE", XDM_CONST.IP_PROTOCOL_FIRE, ip_protocol = "CRTP", XDM_CONST.IP_PROTOCOL_CRTP, ip_protocol = "CRUDP", XDM_CONST.IP_PROTOCOL_CRUDP, ip_protocol = "SSCOPMCE", XDM_CONST.IP_PROTOCOL_SSCOPMCE, ip_protocol = "IPLT", XDM_CONST.IP_PROTOCOL_IPLT, ip_protocol = "SPS", XDM_CONST.IP_PROTOCOL_SPS, ip_protocol = "PIPE", XDM_CONST.IP_PROTOCOL_PIPE, ip_protocol = "SCTP", XDM_CONST.IP_PROTOCOL_SCTP, ip_protocol = "FC", XDM_CONST.IP_PROTOCOL_FC, ip_protocol = "RSVP_E2E_IGNORE", XDM_CONST.IP_PROTOCOL_RSVP_E2E_IGNORE, ip_protocol = "MOBILITY", XDM_CONST.IP_PROTOCOL_MOBILITY, ip_protocol = "UDPLITE", XDM_CONST.IP_PROTOCOL_UDPLITE, ip_protocol = "MPLS_IN_IP", XDM_CONST.IP_PROTOCOL_MPLS_IN_IP, ip_protocol = "MANET", XDM_CONST.IP_PROTOCOL_MANET, ip_protocol = "HIP", XDM_CONST.IP_PROTOCOL_HIP, ip_protocol = "SHIM6", XDM_CONST.IP_PROTOCOL_SHIM6, ip_protocol = "WESP", XDM_CONST.IP_PROTOCOL_WESP, ip_protocol = "ROHC", XDM_CONST.IP_PROTOCOL_ROHC, ip_protocol = "RESERVED", XDM_CONST.IP_PROTOCOL_RESERVED, to_string(ip_protocol)),
xdm.network.http.method = if(requestmethod_upper = "ACL", XDM_CONST.HTTP_METHOD_ACL, requestmethod_upper = "BASELINE_CONTROL", XDM_CONST.HTTP_METHOD_BASELINE_CONTROL, requestmethod_upper = "BIND", XDM_CONST.HTTP_METHOD_BIND, requestmethod_upper = "CHECKIN", XDM_CONST.HTTP_METHOD_CHECKIN, requestmethod_upper = "CHECKOUT", XDM_CONST.HTTP_METHOD_CHECKOUT, requestmethod_upper = "CONNECT", XDM_CONST.HTTP_METHOD_CONNECT, requestmethod_upper = "COPY", XDM_CONST.HTTP_METHOD_COPY, requestmethod_upper = "DELETE", XDM_CONST.HTTP_METHOD_DELETE, requestmethod_upper = "GET", XDM_CONST.HTTP_METHOD_GET, requestmethod_upper = "HEAD", XDM_CONST.HTTP_METHOD_HEAD, requestmethod_upper = "LABEL", XDM_CONST.HTTP_METHOD_LABEL, requestmethod_upper = "LINK", XDM_CONST.HTTP_METHOD_LINK, requestmethod_upper = "LOCK", XDM_CONST.HTTP_METHOD_LOCK, requestmethod_upper = "MERGE", XDM_CONST.HTTP_METHOD_MERGE, requestmethod_upper = "MKACTIVITY", XDM_CONST.HTTP_METHOD_MKACTIVITY, requestmethod_upper = "MKCALENDAR", XDM_CONST.HTTP_METHOD_MKCALENDAR, requestmethod_upper = "MKCOL", XDM_CONST.HTTP_METHOD_MKCOL, requestmethod_upper = "MKREDIRECTREF", XDM_CONST.HTTP_METHOD_MKREDIRECTREF, requestmethod_upper = "MKWORKSPACE", XDM_CONST.HTTP_METHOD_MKWORKSPACE, requestmethod_upper = "MOVE", XDM_CONST.HTTP_METHOD_MOVE, requestmethod_upper = "OPTIONS", XDM_CONST.HTTP_METHOD_OPTIONS, requestmethod_upper = "ORDERPATCH", XDM_CONST.HTTP_METHOD_ORDERPATCH, requestmethod_upper = "PATCH", XDM_CONST.HTTP_METHOD_PATCH, requestmethod_upper = "POST", XDM_CONST.HTTP_METHOD_POST, requestmethod_upper = "PRI", XDM_CONST.HTTP_METHOD_PRI, requestmethod_upper = "PROPFIND", XDM_CONST.HTTP_METHOD_PROPFIND, requestmethod_upper = "PROPPATCH", XDM_CONST.HTTP_METHOD_PROPPATCH, requestmethod_upper = "PUT", XDM_CONST.HTTP_METHOD_PUT, requestmethod_upper = "REBIND", XDM_CONST.HTTP_METHOD_REBIND, requestmethod_upper = "REPORT", XDM_CONST.HTTP_METHOD_REPORT, requestmethod_upper = "SEARCH", XDM_CONST.HTTP_METHOD_SEARCH, requestmethod_upper = "TRACE", XDM_CONST.HTTP_METHOD_TRACE, requestmethod_upper = "UNBIND", XDM_CONST.HTTP_METHOD_UNBIND, requestmethod_upper = "UNCHECKOUT", XDM_CONST.HTTP_METHOD_UNCHECKOUT, requestmethod_upper = "UNLINK", XDM_CONST.HTTP_METHOD_UNLINK, requestmethod_upper = "UNLOCK", XDM_CONST.HTTP_METHOD_UNLOCK, requestmethod_upper = "UPDATE", XDM_CONST.HTTP_METHOD_UPDATE, requestmethod_upper = "UPDATEREDIRECTREF", XDM_CONST.HTTP_METHOD_UPDATEREDIRECTREF, requestmethod_upper = "VERSION_CONTROL", XDM_CONST.HTTP_METHOD_VERSION_CONTROL, to_string(requestmethod)),
xdm.target.ipv4 = if(dst ~= "(?:\d{1,3}\.){3}\d{1,3}", dst, null),
xdm.target.ipv6 = if(dst ~= "(?:[a-fA-F\d]{0,4}\:){2,7}[a-fA-F\d]{0,4}", dst, null),
xdm.target.port = to_integer(dpt),
xdm.target.host.hostname = dhost,
xdm.source.ipv4 = if(src ~= "(?:\d{1,3}\.){3}\d{1,3}", src, null),
xdm.source.ipv6 = if(src ~= "(?:[a-fA-F\d]{0,4}\:){2,7}[a-fA-F\d]{0,4}", src, null),
xdm.source.port = to_integer(spt),
xdm.source.user_agent = requestclientapplication;