Google Drive Modeling Rule

Details

Rules (XIF)

[MODEL: dataset = google_workspace_drive_raw]
alter type = json_extract_scalar(events, "$.0.type"),
    operation = json_extract_scalar(events ,"$.0.name"),
    event_parameters = json_extract(events ,"$.0.parameters"),
    actor_email = json_extract_scalar(actor ,"$.email"),
    actor_profileId = json_extract_scalar(actor ,"$.profileId")
// change parameters type
| alter event_parameters = to_json_string(event_parameters )
| alter event_parameters = replace(event_parameters ,"\\"","\"")
//
| alter doc_type = arrayindex( regextract(event_parameters, "\"name\":\"doc_type\",\"value\"\:\"([^\"]+)\"") ,0),
    doc_title = arrayindex( regextract(event_parameters, "\"name\":\"doc_title\",\"value\"\:\"([^\"]+)\"") ,0),
    owner = arrayindex( regextract(event_parameters, "\"name\":\"owner\",\"value\"\:\"([^\"]+)\"") ,0)
| alter xdm.source.ipv4 = ipAddress,
    xdm.event.operation = operation,
    xdm.event.type = type,
    xdm.target.file.file_type = doc_type,
    xdm.target.file.filename = doc_title,
    xdm.source.user.username = actor_email,
    xdm.target.user.username = owner,
    xdm.source.user.identifier = actor_profileId,
    xdm.target.resource.type = kind,
    xdm.observer.vendor = _vendor,
    xdm.observer.product = _product;

Schema

google_workspace_drive_raw

{
    "google_workspace_drive_raw": {
        "events": {
            "type": "string",
            "is_array": false
        },
        "ipAddress": {
            "type": "string",
            "is_array": false
        },
        "_product": {
            "type": "string",
            "is_array": false
        },
        "_vendor": {
            "type": "string",
            "is_array": false
        },
        "kind": {
            "type": "string",
            "is_array": false
        },
        "actor": {
            "type": "string",
            "is_array": false
        },
        "id": {
            "type": "string",
            "is_array": false
        }
    }
}