Rules (XIF)
[MODEL: dataset="akamai_guardicore_raw"]
/* ==========================================
Audit logs mapping
========================================== */
filter cefName ~= "Audit"
| alter //Extraction fields
src_username_from_upn = if(suser ~= "@", arrayindex(regextract(suser, "(\S+)\@"),0)), //Sometimes the suser field comes as UPN.
msg_host = arrayindex(regextract(msg, "host\:\s(\S+)\,"),0),
msg_port = arrayindex(regextract(msg, "port\:\s(\d+)"),0),
msg_protocol = arrayindex(regextract(msg, "protocol\:\s(\w+)"),0),
msg_resource_name = arrayindex(regextract(msg, "resource\:\s(\S+)"),0),
msg_status_code = arrayindex(regextract(msg, "status\scode\:\s(\d+)"),0),
msg_failed_login_reason = arrayindex(regextract(msg,"reason\:\s(.+)"),0)
| alter //XDM Mapping
xdm.event.type = cefName,
xdm.observer.version = cefDeviceVersion,
xdm.event.operation = if(
act CONTAINS "authentication", XDM_CONST.OPERATION_TYPE_AUTHENTICATION,
act IN("Get asset*", "Access to*"), XDM_CONST.OPERATION_TYPE_READ,
act CONTAINS "Change password", XDM_CONST.OPERATION_TYPE_UPDATE,
act IN("Adding*", "Create*"), XDM_CONST.OPERATION_TYPE_CREATE,
act),
xdm.event.operation_sub_type = act,
xdm.source.user.upn = if(src_username_from_upn != null, suser),
xdm.source.user.username = coalesce(src_username_from_upn, suser),
xdm.source.ipv4 = if(is_ipv4(src) = TRUE, src),
xdm.source.ipv6 = if(is_ipv6(src) = TRUE, src),
xdm.event.description = msg,
xdm.target.host.hostname = msg_host,
xdm.target.port = to_integer(msg_port),
xdm.network.ip_protocol = if(
msg_protocol = null, null,
msg_protocol = "HOPOPT",XDM_CONST.IP_PROTOCOL_HOPOPT,
msg_protocol = "ICMP",XDM_CONST.IP_PROTOCOL_ICMP,
msg_protocol = "IGMP",XDM_CONST.IP_PROTOCOL_IGMP,
msg_protocol = "GGP",XDM_CONST.IP_PROTOCOL_GGP,
msg_protocol = "IP",XDM_CONST.IP_PROTOCOL_IP,
msg_protocol = "ST",XDM_CONST.IP_PROTOCOL_ST,
msg_protocol = "TCP",XDM_CONST.IP_PROTOCOL_TCP,
msg_protocol = "CBT",XDM_CONST.IP_PROTOCOL_CBT,
msg_protocol = "EGP",XDM_CONST.IP_PROTOCOL_EGP,
msg_protocol = "IGP",XDM_CONST.IP_PROTOCOL_IGP,
msg_protocol = "BBN_RCC_MON",XDM_CONST.IP_PROTOCOL_BBN_RCC_MON,
msg_protocol = "NVP_II",XDM_CONST.IP_PROTOCOL_NVP_II,
msg_protocol = "PUP",XDM_CONST.IP_PROTOCOL_PUP,
msg_protocol = "ARGUS",XDM_CONST.IP_PROTOCOL_ARGUS,
msg_protocol = "EMCON",XDM_CONST.IP_PROTOCOL_EMCON,
msg_protocol = "XNET",XDM_CONST.IP_PROTOCOL_XNET,
msg_protocol = "CHAOS",XDM_CONST.IP_PROTOCOL_CHAOS,
msg_protocol = "UDP",XDM_CONST.IP_PROTOCOL_UDP,
msg_protocol = "MUX",XDM_CONST.IP_PROTOCOL_MUX,
msg_protocol = "DCN_MEAS",XDM_CONST.IP_PROTOCOL_DCN_MEAS,
msg_protocol = "HMP",XDM_CONST.IP_PROTOCOL_HMP,
msg_protocol = "PRM",XDM_CONST.IP_PROTOCOL_PRM,
msg_protocol = "XNS_IDP",XDM_CONST.IP_PROTOCOL_XNS_IDP,
msg_protocol = "TRUNK_1",XDM_CONST.IP_PROTOCOL_TRUNK_1,
msg_protocol = "TRUNK_2",XDM_CONST.IP_PROTOCOL_TRUNK_2,
msg_protocol = "LEAF_1",XDM_CONST.IP_PROTOCOL_LEAF_1,
msg_protocol = "LEAF_2",XDM_CONST.IP_PROTOCOL_LEAF_2,
msg_protocol = "RDP",XDM_CONST.IP_PROTOCOL_RDP,
msg_protocol = "IRTP",XDM_CONST.IP_PROTOCOL_IRTP,
msg_protocol = "ISO_TP4",XDM_CONST.IP_PROTOCOL_ISO_TP4,
msg_protocol = "NETBLT",XDM_CONST.IP_PROTOCOL_NETBLT,
msg_protocol = "MFE_NSP",XDM_CONST.IP_PROTOCOL_MFE_NSP,
msg_protocol = "MERIT_INP",XDM_CONST.IP_PROTOCOL_MERIT_INP,
msg_protocol = "DCCP",XDM_CONST.IP_PROTOCOL_DCCP,
msg_protocol = "3PC",XDM_CONST.IP_PROTOCOL_3PC,
msg_protocol = "IDPR",XDM_CONST.IP_PROTOCOL_IDPR,
msg_protocol = "XTP",XDM_CONST.IP_PROTOCOL_XTP,
msg_protocol = "DDP",XDM_CONST.IP_PROTOCOL_DDP,
msg_protocol = "IDPR_CMTP",XDM_CONST.IP_PROTOCOL_IDPR_CMTP,
msg_protocol = "TP",XDM_CONST.IP_PROTOCOL_TP,
msg_protocol = "IL",XDM_CONST.IP_PROTOCOL_IL,
msg_protocol = "IPV6",XDM_CONST.IP_PROTOCOL_IPV6,
msg_protocol = "SDRP",XDM_CONST.IP_PROTOCOL_SDRP,
msg_protocol = "IPV6_ROUTE",XDM_CONST.IP_PROTOCOL_IPV6_ROUTE,
msg_protocol = "IPV6_FRAG",XDM_CONST.IP_PROTOCOL_IPV6_FRAG,
msg_protocol = "IDRP",XDM_CONST.IP_PROTOCOL_IDRP,
msg_protocol = "RSVP",XDM_CONST.IP_PROTOCOL_RSVP,
msg_protocol = "GRE",XDM_CONST.IP_PROTOCOL_GRE,
msg_protocol = "DSR",XDM_CONST.IP_PROTOCOL_DSR,
msg_protocol = "BNA",XDM_CONST.IP_PROTOCOL_BNA,
msg_protocol = "ESP",XDM_CONST.IP_PROTOCOL_ESP,
msg_protocol = "AH",XDM_CONST.IP_PROTOCOL_AH,
msg_protocol = "I_NLSP",XDM_CONST.IP_PROTOCOL_I_NLSP,
msg_protocol = "SWIPE",XDM_CONST.IP_PROTOCOL_SWIPE,
msg_protocol = "NARP",XDM_CONST.IP_PROTOCOL_NARP,
msg_protocol = "MOBILE",XDM_CONST.IP_PROTOCOL_MOBILE,
msg_protocol = "TLSP",XDM_CONST.IP_PROTOCOL_TLSP,
msg_protocol = "SKIP",XDM_CONST.IP_PROTOCOL_SKIP,
msg_protocol = "IPV6_ICMP",XDM_CONST.IP_PROTOCOL_IPV6_ICMP,
msg_protocol = "IPV6_NONXT",XDM_CONST.IP_PROTOCOL_IPV6_NONXT,
msg_protocol = "IPV6_OPTS",XDM_CONST.IP_PROTOCOL_IPV6_OPTS,
msg_protocol = "CFTP",XDM_CONST.IP_PROTOCOL_CFTP,
msg_protocol = "SAT_EXPAK",XDM_CONST.IP_PROTOCOL_SAT_EXPAK,
msg_protocol = "KRYPTOLAN",XDM_CONST.IP_PROTOCOL_KRYPTOLAN,
msg_protocol = "RVD",XDM_CONST.IP_PROTOCOL_RVD,
msg_protocol = "IPPC",XDM_CONST.IP_PROTOCOL_IPPC,
msg_protocol = "SAT_MON",XDM_CONST.IP_PROTOCOL_SAT_MON,
msg_protocol = "VISA",XDM_CONST.IP_PROTOCOL_VISA,
msg_protocol = "IPCV",XDM_CONST.IP_PROTOCOL_IPCV,
msg_protocol = "CPNX",XDM_CONST.IP_PROTOCOL_CPNX,
msg_protocol = "CPHB",XDM_CONST.IP_PROTOCOL_CPHB,
msg_protocol = "WSN",XDM_CONST.IP_PROTOCOL_WSN,
msg_protocol = "PVP",XDM_CONST.IP_PROTOCOL_PVP,
msg_protocol = "BR_SAT_MON",XDM_CONST.IP_PROTOCOL_BR_SAT_MON,
msg_protocol = "SUN_ND",XDM_CONST.IP_PROTOCOL_SUN_ND,
msg_protocol = "WB_MON",XDM_CONST.IP_PROTOCOL_WB_MON,
msg_protocol = "WB_EXPAK",XDM_CONST.IP_PROTOCOL_WB_EXPAK,
msg_protocol = "ISO_IP",XDM_CONST.IP_PROTOCOL_ISO_IP,
msg_protocol = "VMTP",XDM_CONST.IP_PROTOCOL_VMTP,
msg_protocol = "SECURE_VMTP",XDM_CONST.IP_PROTOCOL_SECURE_VMTP,
msg_protocol = "VINES",XDM_CONST.IP_PROTOCOL_VINES,
msg_protocol = "TTP",XDM_CONST.IP_PROTOCOL_TTP,
msg_protocol = "NSFNET_IGP",XDM_CONST.IP_PROTOCOL_NSFNET_IGP,
msg_protocol = "DGP",XDM_CONST.IP_PROTOCOL_DGP,
msg_protocol = "TCF",XDM_CONST.IP_PROTOCOL_TCF,
msg_protocol = "EIGRP",XDM_CONST.IP_PROTOCOL_EIGRP,
msg_protocol = "OSPFIGP",XDM_CONST.IP_PROTOCOL_OSPFIGP,
msg_protocol = "SPRITE_RPC",XDM_CONST.IP_PROTOCOL_SPRITE_RPC,
msg_protocol = "LARP",XDM_CONST.IP_PROTOCOL_LARP,
msg_protocol = "MTP",XDM_CONST.IP_PROTOCOL_MTP,
msg_protocol = "AX25",XDM_CONST.IP_PROTOCOL_AX25,
msg_protocol = "IPIP",XDM_CONST.IP_PROTOCOL_IPIP,
msg_protocol = "MICP",XDM_CONST.IP_PROTOCOL_MICP,
msg_protocol = "SCC_SP",XDM_CONST.IP_PROTOCOL_SCC_SP,
msg_protocol = "ETHERIP",XDM_CONST.IP_PROTOCOL_ETHERIP,
msg_protocol = "ENCAP",XDM_CONST.IP_PROTOCOL_ENCAP,
msg_protocol = "GMTP",XDM_CONST.IP_PROTOCOL_GMTP,
msg_protocol = "IFMP",XDM_CONST.IP_PROTOCOL_IFMP,
msg_protocol = "PNNI",XDM_CONST.IP_PROTOCOL_PNNI,
msg_protocol = "PIM",XDM_CONST.IP_PROTOCOL_PIM,
msg_protocol = "ARIS",XDM_CONST.IP_PROTOCOL_ARIS,
msg_protocol = "SCPS",XDM_CONST.IP_PROTOCOL_SCPS,
msg_protocol = "QNX",XDM_CONST.IP_PROTOCOL_QNX,
msg_protocol = "AN",XDM_CONST.IP_PROTOCOL_AN,
msg_protocol = "IPCOMP",XDM_CONST.IP_PROTOCOL_IPCOMP,
msg_protocol = "SNP",XDM_CONST.IP_PROTOCOL_SNP,
msg_protocol = "COMPAQ_PEER",XDM_CONST.IP_PROTOCOL_COMPAQ_PEER,
msg_protocol = "IPX_IN_IP",XDM_CONST.IP_PROTOCOL_IPX_IN_IP,
msg_protocol = "VRRP",XDM_CONST.IP_PROTOCOL_VRRP,
msg_protocol = "PGM",XDM_CONST.IP_PROTOCOL_PGM,
msg_protocol = "L2TP",XDM_CONST.IP_PROTOCOL_L2TP,
msg_protocol = "DDX",XDM_CONST.IP_PROTOCOL_DDX,
msg_protocol = "IATP",XDM_CONST.IP_PROTOCOL_IATP,
msg_protocol = "STP",XDM_CONST.IP_PROTOCOL_STP,
msg_protocol = "SRP",XDM_CONST.IP_PROTOCOL_SRP,
msg_protocol = "UTI",XDM_CONST.IP_PROTOCOL_UTI,
msg_protocol = "SMP",XDM_CONST.IP_PROTOCOL_SMP,
msg_protocol = "SM",XDM_CONST.IP_PROTOCOL_SM,
msg_protocol = "PTP",XDM_CONST.IP_PROTOCOL_PTP,
msg_protocol = "ISIS",XDM_CONST.IP_PROTOCOL_ISIS,
msg_protocol = "FIRE",XDM_CONST.IP_PROTOCOL_FIRE,
msg_protocol = "CRTP",XDM_CONST.IP_PROTOCOL_CRTP,
msg_protocol = "CRUDP",XDM_CONST.IP_PROTOCOL_CRUDP,
msg_protocol = "SSCOPMCE",XDM_CONST.IP_PROTOCOL_SSCOPMCE,
msg_protocol = "IPLT",XDM_CONST.IP_PROTOCOL_IPLT,
msg_protocol = "SPS",XDM_CONST.IP_PROTOCOL_SPS,
msg_protocol = "PIPE",XDM_CONST.IP_PROTOCOL_PIPE,
msg_protocol = "SCTP",XDM_CONST.IP_PROTOCOL_SCTP,
msg_protocol = "FC",XDM_CONST.IP_PROTOCOL_FC,
msg_protocol = "RSVP_E2E_IGNORE",XDM_CONST.IP_PROTOCOL_RSVP_E2E_IGNORE,
msg_protocol = "MOBILITY",XDM_CONST.IP_PROTOCOL_MOBILITY,
msg_protocol = "UDPLITE",XDM_CONST.IP_PROTOCOL_UDPLITE,
msg_protocol = "MPLS_IN_IP",XDM_CONST.IP_PROTOCOL_MPLS_IN_IP,
msg_protocol = "MANET",XDM_CONST.IP_PROTOCOL_MANET,
msg_protocol = "HIP",XDM_CONST.IP_PROTOCOL_HIP,
msg_protocol = "SHIM6",XDM_CONST.IP_PROTOCOL_SHIM6,
msg_protocol = "WESP",XDM_CONST.IP_PROTOCOL_WESP,
msg_protocol = "ROHC",XDM_CONST.IP_PROTOCOL_ROHC,
msg_protocol = "RESERVED",XDM_CONST.IP_PROTOCOL_RESERVED,
msg_protocol = "0",XDM_CONST.IP_PROTOCOL_HOPOPT,
msg_protocol = "1",XDM_CONST.IP_PROTOCOL_ICMP,
msg_protocol = "2",XDM_CONST.IP_PROTOCOL_IGMP,
msg_protocol = "3",XDM_CONST.IP_PROTOCOL_GGP,
msg_protocol = "4",XDM_CONST.IP_PROTOCOL_IP,
msg_protocol = "5",XDM_CONST.IP_PROTOCOL_ST,
msg_protocol = "6",XDM_CONST.IP_PROTOCOL_TCP,
msg_protocol = "7",XDM_CONST.IP_PROTOCOL_CBT,
msg_protocol = "8",XDM_CONST.IP_PROTOCOL_EGP,
msg_protocol = "9",XDM_CONST.IP_PROTOCOL_IGP,
msg_protocol = "10",XDM_CONST.IP_PROTOCOL_BBN_RCC_MON,
msg_protocol = "11",XDM_CONST.IP_PROTOCOL_NVP_II,
msg_protocol = "12",XDM_CONST.IP_PROTOCOL_PUP,
msg_protocol = "13",XDM_CONST.IP_PROTOCOL_ARGUS,
msg_protocol = "14",XDM_CONST.IP_PROTOCOL_EMCON,
msg_protocol = "15",XDM_CONST.IP_PROTOCOL_XNET,
msg_protocol = "16",XDM_CONST.IP_PROTOCOL_CHAOS,
msg_protocol = "17",XDM_CONST.IP_PROTOCOL_UDP,
msg_protocol = "18",XDM_CONST.IP_PROTOCOL_MUX,
msg_protocol = "19",XDM_CONST.IP_PROTOCOL_DCN_MEAS,
msg_protocol = "20",XDM_CONST.IP_PROTOCOL_HMP,
msg_protocol = "21",XDM_CONST.IP_PROTOCOL_PRM,
msg_protocol = "22",XDM_CONST.IP_PROTOCOL_XNS_IDP,
msg_protocol = "23",XDM_CONST.IP_PROTOCOL_TRUNK_1,
msg_protocol = "24",XDM_CONST.IP_PROTOCOL_TRUNK_2,
msg_protocol = "25",XDM_CONST.IP_PROTOCOL_LEAF_1,
msg_protocol = "26",XDM_CONST.IP_PROTOCOL_LEAF_2,
msg_protocol = "27",XDM_CONST.IP_PROTOCOL_RDP,
msg_protocol = "28",XDM_CONST.IP_PROTOCOL_IRTP,
msg_protocol = "29",XDM_CONST.IP_PROTOCOL_ISO_TP4,
msg_protocol = "30",XDM_CONST.IP_PROTOCOL_NETBLT,
msg_protocol = "31",XDM_CONST.IP_PROTOCOL_MFE_NSP,
msg_protocol = "32",XDM_CONST.IP_PROTOCOL_MERIT_INP,
msg_protocol = "33",XDM_CONST.IP_PROTOCOL_DCCP,
msg_protocol = "34",XDM_CONST.IP_PROTOCOL_3PC,
msg_protocol = "35",XDM_CONST.IP_PROTOCOL_IDPR,
msg_protocol = "36",XDM_CONST.IP_PROTOCOL_XTP,
msg_protocol = "37",XDM_CONST.IP_PROTOCOL_DDP,
msg_protocol = "38",XDM_CONST.IP_PROTOCOL_IDPR_CMTP,
msg_protocol = "39",XDM_CONST.IP_PROTOCOL_TP,
msg_protocol = "40",XDM_CONST.IP_PROTOCOL_IL,
msg_protocol = "41",XDM_CONST.IP_PROTOCOL_IPV6,
msg_protocol = "42",XDM_CONST.IP_PROTOCOL_SDRP,
msg_protocol = "43",XDM_CONST.IP_PROTOCOL_IPV6_ROUTE,
msg_protocol = "44",XDM_CONST.IP_PROTOCOL_IPV6_FRAG,
msg_protocol = "45",XDM_CONST.IP_PROTOCOL_IDRP,
msg_protocol = "46",XDM_CONST.IP_PROTOCOL_RSVP,
msg_protocol = "47",XDM_CONST.IP_PROTOCOL_GRE,
msg_protocol = "48",XDM_CONST.IP_PROTOCOL_DSR,
msg_protocol = "49",XDM_CONST.IP_PROTOCOL_BNA,
msg_protocol = "50",XDM_CONST.IP_PROTOCOL_ESP,
msg_protocol = "51",XDM_CONST.IP_PROTOCOL_AH,
msg_protocol = "52",XDM_CONST.IP_PROTOCOL_I_NLSP,
msg_protocol = "53",XDM_CONST.IP_PROTOCOL_SWIPE,
msg_protocol = "54",XDM_CONST.IP_PROTOCOL_NARP,
msg_protocol = "55",XDM_CONST.IP_PROTOCOL_MOBILE,
msg_protocol = "56",XDM_CONST.IP_PROTOCOL_TLSP,
msg_protocol = "57",XDM_CONST.IP_PROTOCOL_SKIP,
msg_protocol = "58",XDM_CONST.IP_PROTOCOL_IPV6_ICMP,
msg_protocol = "59",XDM_CONST.IP_PROTOCOL_IPV6_NONXT,
msg_protocol = "60",XDM_CONST.IP_PROTOCOL_IPV6_OPTS,
msg_protocol = "62",XDM_CONST.IP_PROTOCOL_CFTP,
msg_protocol = "64",XDM_CONST.IP_PROTOCOL_SAT_EXPAK,
msg_protocol = "65",XDM_CONST.IP_PROTOCOL_KRYPTOLAN,
msg_protocol = "66",XDM_CONST.IP_PROTOCOL_RVD,
msg_protocol = "67",XDM_CONST.IP_PROTOCOL_IPPC,
msg_protocol = "69",XDM_CONST.IP_PROTOCOL_SAT_MON,
msg_protocol = "70",XDM_CONST.IP_PROTOCOL_VISA,
msg_protocol = "71",XDM_CONST.IP_PROTOCOL_IPCV,
msg_protocol = "72",XDM_CONST.IP_PROTOCOL_CPNX,
msg_protocol = "73",XDM_CONST.IP_PROTOCOL_CPHB,
msg_protocol = "74",XDM_CONST.IP_PROTOCOL_WSN,
msg_protocol = "75",XDM_CONST.IP_PROTOCOL_PVP,
msg_protocol = "76",XDM_CONST.IP_PROTOCOL_BR_SAT_MON,
msg_protocol = "77",XDM_CONST.IP_PROTOCOL_SUN_ND,
msg_protocol = "78",XDM_CONST.IP_PROTOCOL_WB_MON,
msg_protocol = "79",XDM_CONST.IP_PROTOCOL_WB_EXPAK,
msg_protocol = "80",XDM_CONST.IP_PROTOCOL_ISO_IP,
msg_protocol = "81",XDM_CONST.IP_PROTOCOL_VMTP,
msg_protocol = "82",XDM_CONST.IP_PROTOCOL_SECURE_VMTP,
msg_protocol = "83",XDM_CONST.IP_PROTOCOL_VINES,
msg_protocol = "84",XDM_CONST.IP_PROTOCOL_TTP,
msg_protocol = "85",XDM_CONST.IP_PROTOCOL_NSFNET_IGP,
msg_protocol = "86",XDM_CONST.IP_PROTOCOL_DGP,
msg_protocol = "87",XDM_CONST.IP_PROTOCOL_TCF,
msg_protocol = "88",XDM_CONST.IP_PROTOCOL_EIGRP,
msg_protocol = "89",XDM_CONST.IP_PROTOCOL_OSPFIGP,
msg_protocol = "90",XDM_CONST.IP_PROTOCOL_SPRITE_RPC,
msg_protocol = "91",XDM_CONST.IP_PROTOCOL_LARP,
msg_protocol = "92",XDM_CONST.IP_PROTOCOL_MTP,
msg_protocol = "93",XDM_CONST.IP_PROTOCOL_AX25,
msg_protocol = "94",XDM_CONST.IP_PROTOCOL_IPIP,
msg_protocol = "95",XDM_CONST.IP_PROTOCOL_MICP,
msg_protocol = "96",XDM_CONST.IP_PROTOCOL_SCC_SP,
msg_protocol = "97",XDM_CONST.IP_PROTOCOL_ETHERIP,
msg_protocol = "98",XDM_CONST.IP_PROTOCOL_ENCAP,
msg_protocol = "100",XDM_CONST.IP_PROTOCOL_GMTP,
msg_protocol = "101",XDM_CONST.IP_PROTOCOL_IFMP,
msg_protocol = "102",XDM_CONST.IP_PROTOCOL_PNNI,
msg_protocol = "103",XDM_CONST.IP_PROTOCOL_PIM,
msg_protocol = "104",XDM_CONST.IP_PROTOCOL_ARIS,
msg_protocol = "105",XDM_CONST.IP_PROTOCOL_SCPS,
msg_protocol = "106",XDM_CONST.IP_PROTOCOL_QNX,
msg_protocol = "107",XDM_CONST.IP_PROTOCOL_AN,
msg_protocol = "108",XDM_CONST.IP_PROTOCOL_IPCOMP,
msg_protocol = "109",XDM_CONST.IP_PROTOCOL_SNP,
msg_protocol = "110",XDM_CONST.IP_PROTOCOL_COMPAQ_PEER,
msg_protocol = "111",XDM_CONST.IP_PROTOCOL_IPX_IN_IP,
msg_protocol = "112",XDM_CONST.IP_PROTOCOL_VRRP,
msg_protocol = "113",XDM_CONST.IP_PROTOCOL_PGM,
msg_protocol = "115",XDM_CONST.IP_PROTOCOL_L2TP,
msg_protocol = "116",XDM_CONST.IP_PROTOCOL_DDX,
msg_protocol = "117",XDM_CONST.IP_PROTOCOL_IATP,
msg_protocol = "118",XDM_CONST.IP_PROTOCOL_STP,
msg_protocol = "119",XDM_CONST.IP_PROTOCOL_SRP,
msg_protocol = "120",XDM_CONST.IP_PROTOCOL_UTI,
msg_protocol = "121",XDM_CONST.IP_PROTOCOL_SMP,
msg_protocol = "122",XDM_CONST.IP_PROTOCOL_SM,
msg_protocol = "123",XDM_CONST.IP_PROTOCOL_PTP,
msg_protocol = "124",XDM_CONST.IP_PROTOCOL_ISIS,
msg_protocol = "125",XDM_CONST.IP_PROTOCOL_FIRE,
msg_protocol = "126",XDM_CONST.IP_PROTOCOL_CRTP,
msg_protocol = "127",XDM_CONST.IP_PROTOCOL_CRUDP,
msg_protocol = "128",XDM_CONST.IP_PROTOCOL_SSCOPMCE,
msg_protocol = "129",XDM_CONST.IP_PROTOCOL_IPLT,
msg_protocol = "130",XDM_CONST.IP_PROTOCOL_SPS,
msg_protocol = "131",XDM_CONST.IP_PROTOCOL_PIPE,
msg_protocol = "132",XDM_CONST.IP_PROTOCOL_SCTP,
msg_protocol = "133",XDM_CONST.IP_PROTOCOL_FC,
msg_protocol = "134",XDM_CONST.IP_PROTOCOL_RSVP_E2E_IGNORE,
msg_protocol = "135",XDM_CONST.IP_PROTOCOL_MOBILITY,
msg_protocol = "136",XDM_CONST.IP_PROTOCOL_UDPLITE,
msg_protocol = "137",XDM_CONST.IP_PROTOCOL_MPLS_IN_IP,
msg_protocol = "138",XDM_CONST.IP_PROTOCOL_MANET,
msg_protocol = "139",XDM_CONST.IP_PROTOCOL_HIP,
msg_protocol = "140",XDM_CONST.IP_PROTOCOL_SHIM6,
msg_protocol = "141",XDM_CONST.IP_PROTOCOL_WESP,
msg_protocol = "142",XDM_CONST.IP_PROTOCOL_ROHC,
msg_protocol = "255",XDM_CONST.IP_PROTOCOL_RESERVED,
msg_protocol),
xdm.target.resource.name = msg_resource_name,
xdm.network.http.response_code = if(
msg_status_code = null, null,
msg_status_code = "100", XDM_CONST.HTTP_RSP_CODE_CONTINUE,
msg_status_code = "101", XDM_CONST.HTTP_RSP_CODE_SWITCHING_PROTOCOLS,
msg_status_code = "102", XDM_CONST.HTTP_RSP_CODE_PROCESSING,
msg_status_code = "103", XDM_CONST.HTTP_RSP_CODE_EARLY_HINTS,
msg_status_code = "200", XDM_CONST.HTTP_RSP_CODE_OK,
msg_status_code = "201", XDM_CONST.HTTP_RSP_CODE_CREATED,
msg_status_code = "202", XDM_CONST.HTTP_RSP_CODE_ACCEPTED,
msg_status_code = "203", XDM_CONST.HTTP_RSP_CODE_NON__AUTHORITATIVE_INFORMATION,
msg_status_code = "204", XDM_CONST.HTTP_RSP_CODE_NO_CONTENT,
msg_status_code = "205", XDM_CONST.HTTP_RSP_CODE_RESET_CONTENT,
msg_status_code = "206", XDM_CONST.HTTP_RSP_CODE_PARTIAL_CONTENT,
msg_status_code = "207", XDM_CONST.HTTP_RSP_CODE_MULTI__STATUS,
msg_status_code = "208", XDM_CONST.HTTP_RSP_CODE_ALREADY_REPORTED,
msg_status_code = "226", XDM_CONST.HTTP_RSP_CODE_IM_USED,
msg_status_code = "300", XDM_CONST.HTTP_RSP_CODE_MULTIPLE_CHOICES,
msg_status_code = "301", XDM_CONST.HTTP_RSP_CODE_MOVED_PERMANENTLY,
msg_status_code = "302", XDM_CONST.HTTP_RSP_CODE_FOUND,
msg_status_code = "303", XDM_CONST.HTTP_RSP_CODE_SEE_OTHER,
msg_status_code = "304", XDM_CONST.HTTP_RSP_CODE_NOT_MODIFIED,
msg_status_code = "305", XDM_CONST.HTTP_RSP_CODE_USE_PROXY,
msg_status_code = "307", XDM_CONST.HTTP_RSP_CODE_TEMPORARY_REDIRECT,
msg_status_code = "308", XDM_CONST.HTTP_RSP_CODE_PERMANENT_REDIRECT,
msg_status_code = "400", XDM_CONST.HTTP_RSP_CODE_BAD_REQUEST,
msg_status_code = "401", XDM_CONST.HTTP_RSP_CODE_UNAUTHORIZED,
msg_status_code = "402", XDM_CONST.HTTP_RSP_CODE_PAYMENT_REQUIRED,
msg_status_code = "403", XDM_CONST.HTTP_RSP_CODE_FORBIDDEN,
msg_status_code = "404", XDM_CONST.HTTP_RSP_CODE_NOT_FOUND,
msg_status_code = "405", XDM_CONST.HTTP_RSP_CODE_METHOD_NOT_ALLOWED,
msg_status_code = "406", XDM_CONST.HTTP_RSP_CODE_NOT_ACCEPTABLE,
msg_status_code = "407", XDM_CONST.HTTP_RSP_CODE_PROXY_AUTHENTICATION_REQUIRED,
msg_status_code = "408", XDM_CONST.HTTP_RSP_CODE_REQUEST_TIMEOUT,
msg_status_code = "409", XDM_CONST.HTTP_RSP_CODE_CONFLICT,
msg_status_code = "410", XDM_CONST.HTTP_RSP_CODE_GONE,
msg_status_code = "411", XDM_CONST.HTTP_RSP_CODE_LENGTH_REQUIRED,
msg_status_code = "412", XDM_CONST.HTTP_RSP_CODE_PRECONDITION_FAILED,
msg_status_code = "413", XDM_CONST.HTTP_RSP_CODE_CONTENT_TOO_LARGE,
msg_status_code = "414", XDM_CONST.HTTP_RSP_CODE_URI_TOO_LONG,
msg_status_code = "415", XDM_CONST.HTTP_RSP_CODE_UNSUPPORTED_MEDIA_TYPE,
msg_status_code = "416", XDM_CONST.HTTP_RSP_CODE_RANGE_NOT_SATISFIABLE,
msg_status_code = "417", XDM_CONST.HTTP_RSP_CODE_EXPECTATION_FAILED,
msg_status_code = "421", XDM_CONST.HTTP_RSP_CODE_MISDIRECTED_REQUEST,
msg_status_code = "422", XDM_CONST.HTTP_RSP_CODE_UNPROCESSABLE_CONTENT,
msg_status_code = "423", XDM_CONST.HTTP_RSP_CODE_LOCKED,
msg_status_code = "424", XDM_CONST.HTTP_RSP_CODE_FAILED_DEPENDENCY,
msg_status_code = "425", XDM_CONST.HTTP_RSP_CODE_TOO_EARLY,
msg_status_code = "426", XDM_CONST.HTTP_RSP_CODE_UPGRADE_REQUIRED,
msg_status_code = "428", XDM_CONST.HTTP_RSP_CODE_PRECONDITION_REQUIRED,
msg_status_code = "429", XDM_CONST.HTTP_RSP_CODE_TOO_MANY_REQUESTS,
msg_status_code = "431", XDM_CONST.HTTP_RSP_CODE_REQUEST_HEADER_FIELDS_TOO_LARGE,
msg_status_code = "451", XDM_CONST.HTTP_RSP_CODE_UNAVAILABLE_FOR_LEGAL_REASONS,
msg_status_code = "500", XDM_CONST.HTTP_RSP_CODE_INTERNAL_SERVER_ERROR,
msg_status_code = "501", XDM_CONST.HTTP_RSP_CODE_NOT_IMPLEMENTED,
msg_status_code = "502", XDM_CONST.HTTP_RSP_CODE_BAD_GATEWAY,
msg_status_code = "503", XDM_CONST.HTTP_RSP_CODE_SERVICE_UNAVAILABLE,
msg_status_code = "504", XDM_CONST.HTTP_RSP_CODE_GATEWAY_TIMEOUT,
msg_status_code = "505", XDM_CONST.HTTP_RSP_CODE_HTTP_VERSION_NOT_SUPPORTED,
msg_status_code = "506", XDM_CONST.HTTP_RSP_CODE_VARIANT_ALSO_NEGOTIATES,
msg_status_code = "507", XDM_CONST.HTTP_RSP_CODE_INSUFFICIENT_STORAGE,
msg_status_code = "508", XDM_CONST.HTTP_RSP_CODE_LOOP_DETECTED,
msg_status_code = "511", XDM_CONST.HTTP_RSP_CODE_NETWORK_AUTHENTICATION_REQUIRED,
msg_status_code),
xdm.event.outcome = if(
msg ~= "failed", XDM_CONST.OUTCOME_FAILED,
msg ~= "success", XDM_CONST.OUTCOME_SUCCESS,
msg_status_code IN("200","201","202","203","204","205","207","208","226"), XDM_CONST.OUTCOME_SUCCESS,
msg_status_code IN("4*","5*"),XDM_CONST.OUTCOME_FAILED,
msg_status_code IN("206"), XDM_CONST.OUTCOME_PARTIAL,
XDM_CONST.OUTCOME_UNKNOWN),
xdm.event.outcome_reason = msg_failed_login_reason;
/* ==========================================
Agent logs mapping
========================================== */
filter cefName ~= "Agent"
| alter
trg_os = parsed_cs1 -> os_name,
trg_hostname = arrayindex(regextract(cs1, "^([^\s]+)"),0)
| alter //XDM mapping
xdm.observer.version = cefDeviceVersion,
xdm.event.type = cefName,
xdm.event.id = id,
xdm.source.host.hostname = shost,
xdm.event.description = msg,
xdm.target.ipv4 = if(is_ipv4(parsed_cs1 -> ip) = TRUE, parsed_cs1 -> ip),
xdm.target.ipv6 = if(is_ipv6(parsed_cs1 -> ip) = TRUE, parsed_cs1 -> ip),
xdm.target.host.os = trg_os,
xdm.target.zone = parsed_cs1 -> Environment,
xdm.target.host.os_family = if(
trg_os ~= "Windows", XDM_CONST.OS_FAMILY_WINDOWS,
trg_os ~= "Mac", XDM_CONST.OS_FAMILY_MACOS,
trg_os ~= "Linux", XDM_CONST.OS_FAMILY_LINUX,
trg_os ~= "Ubuntu", XDM_CONST.OS_FAMILY_UBUNTU),
xdm.target.host.hostname = trg_hostname,
xdm.target.resource.name = trg_hostname,
xdm.target.resource.type = parsed_cs1 -> Role,
xdm.target.application.name = parsed_cs1 -> App,
xdm.event.outcome = if(
msg IN ("Success*","*success*", "*status flag was raised*"), XDM_CONST.OUTCOME_SUCCESS,
msg ~= "[Ff]ail", XDM_CONST.OUTCOME_FAILED,
XDM_CONST.OUTCOME_UNKNOWN),
xdm.alert.severity = cefSeverity;
/* ==========================================
System logs mapping
========================================== */
filter cefName ~= "System"
| alter //XDM mapping
xdm.observer.version = cefDeviceVersion,
xdm.event.type = cefName,
xdm.event.id = id,
xdm.event.log_level = if(
cefSeverity ~= "EMERGENCY" , XDM_CONST.LOG_LEVEL_EMERGENCY,
cefSeverity ~= "ALERT" , XDM_CONST.LOG_LEVEL_ALERT,
cefSeverity ~= "CRITICAL" ,XDM_CONST.LOG_LEVEL_CRITICAL,
cefSeverity ~= "ERROR" ,XDM_CONST.LOG_LEVEL_ERROR,
cefSeverity ~= "WARNING" ,XDM_CONST.LOG_LEVEL_WARNING,
cefSeverity ~= "NOTICE" ,XDM_CONST.LOG_LEVEL_NOTICE,
cefSeverity ~= "INFO" ,XDM_CONST.LOG_LEVEL_INFORMATIONAL,
cefSeverity ~= "DEBUG" ,XDM_CONST.LOG_LEVEL_DEBUG,
cefSeverity),
xdm.event.is_completed = if(cefSeverity ~= "COMPLETE", to_boolean(TRUE), to_boolean(FALSE)),
xdm.source.user_agent = src,
xdm.source.host.hostname = shost,
xdm.event.description = msg;
/* ==========================================
Network logs mapping
========================================== */
filter cefName ~= "Network"
| alter
proto = to_string(proto),
cs3_process_name = if(cs3 IN ("*\*"), arrayindex(regextract(cs3, "[^\\]+$"),0), cs3 IN ("*/*"), arrayindex(regextract(cs3, "[^\/]+$"),0)),
cs14_process_name = if(cs14 IN ("*\*"), arrayindex(regextract(cs14, "[^\\]+$"),0), cs14 IN ("*/*"), arrayindex(regextract(cs14, "[^\/]+$"),0)),
cs15_process_name = if(cs15 IN ("*\*"), arrayindex(regextract(cs15, "[^\\]+$"),0), cs15 IN ("*/*"), arrayindex(regextract(cs15, "[^\/]+$"),0)),
drpoc_process_name = if(drpoc IN ("*\*"), arrayindex(regextract(cs15, "[^\\]+$"),0), drpoc IN ("*/*"), arrayindex(regextract(drpoc, "[^\/]+$"),0))
| alter //XDM mapping
xdm.observer.version = cefDeviceVersion,
xdm.event.type = cefName,
xdm.event.id = id,
xdm.source.ipv4 = if(is_ipv4(src) = TRUE, src),
xdm.source.ipv6 = if(is_ipv6(src) = TRUE, src),
xdm.source.host.hostname = shost,
xdm.source.user.username = suser,
xdm.target.ipv4 = if(is_ipv4(dst) = TRUE, dst),
xdm.target.ipv6 = if(is_ipv6(dst) = TRUE, dst),
xdm.target.port = to_integer(dpt),
xdm.target.host.hostname = dhost,
xdm.target.user.username = duser,
xdm.network.ip_protocol = if(
proto = "HOPOPT",XDM_CONST.IP_PROTOCOL_HOPOPT,
proto = "ICMP",XDM_CONST.IP_PROTOCOL_ICMP,
proto = "IGMP",XDM_CONST.IP_PROTOCOL_IGMP,
proto = "GGP",XDM_CONST.IP_PROTOCOL_GGP,
proto = "IP",XDM_CONST.IP_PROTOCOL_IP,
proto = "ST",XDM_CONST.IP_PROTOCOL_ST,
proto = "TCP",XDM_CONST.IP_PROTOCOL_TCP,
proto = "CBT",XDM_CONST.IP_PROTOCOL_CBT,
proto = "EGP",XDM_CONST.IP_PROTOCOL_EGP,
proto = "IGP",XDM_CONST.IP_PROTOCOL_IGP,
proto = "BBN_RCC_MON",XDM_CONST.IP_PROTOCOL_BBN_RCC_MON,
proto = "NVP_II",XDM_CONST.IP_PROTOCOL_NVP_II,
proto = "PUP",XDM_CONST.IP_PROTOCOL_PUP,
proto = "ARGUS",XDM_CONST.IP_PROTOCOL_ARGUS,
proto = "EMCON",XDM_CONST.IP_PROTOCOL_EMCON,
proto = "XNET",XDM_CONST.IP_PROTOCOL_XNET,
proto = "CHAOS",XDM_CONST.IP_PROTOCOL_CHAOS,
proto = "UDP",XDM_CONST.IP_PROTOCOL_UDP,
proto = "MUX",XDM_CONST.IP_PROTOCOL_MUX,
proto = "DCN_MEAS",XDM_CONST.IP_PROTOCOL_DCN_MEAS,
proto = "HMP",XDM_CONST.IP_PROTOCOL_HMP,
proto = "PRM",XDM_CONST.IP_PROTOCOL_PRM,
proto = "XNS_IDP",XDM_CONST.IP_PROTOCOL_XNS_IDP,
proto = "TRUNK_1",XDM_CONST.IP_PROTOCOL_TRUNK_1,
proto = "TRUNK_2",XDM_CONST.IP_PROTOCOL_TRUNK_2,
proto = "LEAF_1",XDM_CONST.IP_PROTOCOL_LEAF_1,
proto = "LEAF_2",XDM_CONST.IP_PROTOCOL_LEAF_2,
proto = "RDP",XDM_CONST.IP_PROTOCOL_RDP,
proto = "IRTP",XDM_CONST.IP_PROTOCOL_IRTP,
proto = "ISO_TP4",XDM_CONST.IP_PROTOCOL_ISO_TP4,
proto = "NETBLT",XDM_CONST.IP_PROTOCOL_NETBLT,
proto = "MFE_NSP",XDM_CONST.IP_PROTOCOL_MFE_NSP,
proto = "MERIT_INP",XDM_CONST.IP_PROTOCOL_MERIT_INP,
proto = "DCCP",XDM_CONST.IP_PROTOCOL_DCCP,
proto = "3PC",XDM_CONST.IP_PROTOCOL_3PC,
proto = "IDPR",XDM_CONST.IP_PROTOCOL_IDPR,
proto = "XTP",XDM_CONST.IP_PROTOCOL_XTP,
proto = "DDP",XDM_CONST.IP_PROTOCOL_DDP,
proto = "IDPR_CMTP",XDM_CONST.IP_PROTOCOL_IDPR_CMTP,
proto = "TP",XDM_CONST.IP_PROTOCOL_TP,
proto = "IL",XDM_CONST.IP_PROTOCOL_IL,
proto = "IPV6",XDM_CONST.IP_PROTOCOL_IPV6,
proto = "SDRP",XDM_CONST.IP_PROTOCOL_SDRP,
proto = "IPV6_ROUTE",XDM_CONST.IP_PROTOCOL_IPV6_ROUTE,
proto = "IPV6_FRAG",XDM_CONST.IP_PROTOCOL_IPV6_FRAG,
proto = "IDRP",XDM_CONST.IP_PROTOCOL_IDRP,
proto = "RSVP",XDM_CONST.IP_PROTOCOL_RSVP,
proto = "GRE",XDM_CONST.IP_PROTOCOL_GRE,
proto = "DSR",XDM_CONST.IP_PROTOCOL_DSR,
proto = "BNA",XDM_CONST.IP_PROTOCOL_BNA,
proto = "ESP",XDM_CONST.IP_PROTOCOL_ESP,
proto = "AH",XDM_CONST.IP_PROTOCOL_AH,
proto = "I_NLSP",XDM_CONST.IP_PROTOCOL_I_NLSP,
proto = "SWIPE",XDM_CONST.IP_PROTOCOL_SWIPE,
proto = "NARP",XDM_CONST.IP_PROTOCOL_NARP,
proto = "MOBILE",XDM_CONST.IP_PROTOCOL_MOBILE,
proto = "TLSP",XDM_CONST.IP_PROTOCOL_TLSP,
proto = "SKIP",XDM_CONST.IP_PROTOCOL_SKIP,
proto = "IPV6_ICMP",XDM_CONST.IP_PROTOCOL_IPV6_ICMP,
proto = "IPV6_NONXT",XDM_CONST.IP_PROTOCOL_IPV6_NONXT,
proto = "IPV6_OPTS",XDM_CONST.IP_PROTOCOL_IPV6_OPTS,
proto = "CFTP",XDM_CONST.IP_PROTOCOL_CFTP,
proto = "SAT_EXPAK",XDM_CONST.IP_PROTOCOL_SAT_EXPAK,
proto = "KRYPTOLAN",XDM_CONST.IP_PROTOCOL_KRYPTOLAN,
proto = "RVD",XDM_CONST.IP_PROTOCOL_RVD,
proto = "IPPC",XDM_CONST.IP_PROTOCOL_IPPC,
proto = "SAT_MON",XDM_CONST.IP_PROTOCOL_SAT_MON,
proto = "VISA",XDM_CONST.IP_PROTOCOL_VISA,
proto = "IPCV",XDM_CONST.IP_PROTOCOL_IPCV,
proto = "CPNX",XDM_CONST.IP_PROTOCOL_CPNX,
proto = "CPHB",XDM_CONST.IP_PROTOCOL_CPHB,
proto = "WSN",XDM_CONST.IP_PROTOCOL_WSN,
proto = "PVP",XDM_CONST.IP_PROTOCOL_PVP,
proto = "BR_SAT_MON",XDM_CONST.IP_PROTOCOL_BR_SAT_MON,
proto = "SUN_ND",XDM_CONST.IP_PROTOCOL_SUN_ND,
proto = "WB_MON",XDM_CONST.IP_PROTOCOL_WB_MON,
proto = "WB_EXPAK",XDM_CONST.IP_PROTOCOL_WB_EXPAK,
proto = "ISO_IP",XDM_CONST.IP_PROTOCOL_ISO_IP,
proto = "VMTP",XDM_CONST.IP_PROTOCOL_VMTP,
proto = "SECURE_VMTP",XDM_CONST.IP_PROTOCOL_SECURE_VMTP,
proto = "VINES",XDM_CONST.IP_PROTOCOL_VINES,
proto = "TTP",XDM_CONST.IP_PROTOCOL_TTP,
proto = "NSFNET_IGP",XDM_CONST.IP_PROTOCOL_NSFNET_IGP,
proto = "DGP",XDM_CONST.IP_PROTOCOL_DGP,
proto = "TCF",XDM_CONST.IP_PROTOCOL_TCF,
proto = "EIGRP",XDM_CONST.IP_PROTOCOL_EIGRP,
proto = "OSPFIGP",XDM_CONST.IP_PROTOCOL_OSPFIGP,
proto = "SPRITE_RPC",XDM_CONST.IP_PROTOCOL_SPRITE_RPC,
proto = "LARP",XDM_CONST.IP_PROTOCOL_LARP,
proto = "MTP",XDM_CONST.IP_PROTOCOL_MTP,
proto = "AX25",XDM_CONST.IP_PROTOCOL_AX25,
proto = "IPIP",XDM_CONST.IP_PROTOCOL_IPIP,
proto = "MICP",XDM_CONST.IP_PROTOCOL_MICP,
proto = "SCC_SP",XDM_CONST.IP_PROTOCOL_SCC_SP,
proto = "ETHERIP",XDM_CONST.IP_PROTOCOL_ETHERIP,
proto = "ENCAP",XDM_CONST.IP_PROTOCOL_ENCAP,
proto = "GMTP",XDM_CONST.IP_PROTOCOL_GMTP,
proto = "IFMP",XDM_CONST.IP_PROTOCOL_IFMP,
proto = "PNNI",XDM_CONST.IP_PROTOCOL_PNNI,
proto = "PIM",XDM_CONST.IP_PROTOCOL_PIM,
proto = "ARIS",XDM_CONST.IP_PROTOCOL_ARIS,
proto = "SCPS",XDM_CONST.IP_PROTOCOL_SCPS,
proto = "QNX",XDM_CONST.IP_PROTOCOL_QNX,
proto = "AN",XDM_CONST.IP_PROTOCOL_AN,
proto = "IPCOMP",XDM_CONST.IP_PROTOCOL_IPCOMP,
proto = "SNP",XDM_CONST.IP_PROTOCOL_SNP,
proto = "COMPAQ_PEER",XDM_CONST.IP_PROTOCOL_COMPAQ_PEER,
proto = "IPX_IN_IP",XDM_CONST.IP_PROTOCOL_IPX_IN_IP,
proto = "VRRP",XDM_CONST.IP_PROTOCOL_VRRP,
proto = "PGM",XDM_CONST.IP_PROTOCOL_PGM,
proto = "L2TP",XDM_CONST.IP_PROTOCOL_L2TP,
proto = "DDX",XDM_CONST.IP_PROTOCOL_DDX,
proto = "IATP",XDM_CONST.IP_PROTOCOL_IATP,
proto = "STP",XDM_CONST.IP_PROTOCOL_STP,
proto = "SRP",XDM_CONST.IP_PROTOCOL_SRP,
proto = "UTI",XDM_CONST.IP_PROTOCOL_UTI,
proto = "SMP",XDM_CONST.IP_PROTOCOL_SMP,
proto = "SM",XDM_CONST.IP_PROTOCOL_SM,
proto = "PTP",XDM_CONST.IP_PROTOCOL_PTP,
proto = "ISIS",XDM_CONST.IP_PROTOCOL_ISIS,
proto = "FIRE",XDM_CONST.IP_PROTOCOL_FIRE,
proto = "CRTP",XDM_CONST.IP_PROTOCOL_CRTP,
proto = "CRUDP",XDM_CONST.IP_PROTOCOL_CRUDP,
proto = "SSCOPMCE",XDM_CONST.IP_PROTOCOL_SSCOPMCE,
proto = "IPLT",XDM_CONST.IP_PROTOCOL_IPLT,
proto = "SPS",XDM_CONST.IP_PROTOCOL_SPS,
proto = "PIPE",XDM_CONST.IP_PROTOCOL_PIPE,
proto = "SCTP",XDM_CONST.IP_PROTOCOL_SCTP,
proto = "FC",XDM_CONST.IP_PROTOCOL_FC,
proto = "RSVP_E2E_IGNORE",XDM_CONST.IP_PROTOCOL_RSVP_E2E_IGNORE,
proto = "MOBILITY",XDM_CONST.IP_PROTOCOL_MOBILITY,
proto = "UDPLITE",XDM_CONST.IP_PROTOCOL_UDPLITE,
proto = "MPLS_IN_IP",XDM_CONST.IP_PROTOCOL_MPLS_IN_IP,
proto = "MANET",XDM_CONST.IP_PROTOCOL_MANET,
proto = "HIP",XDM_CONST.IP_PROTOCOL_HIP,
proto = "SHIM6",XDM_CONST.IP_PROTOCOL_SHIM6,
proto = "WESP",XDM_CONST.IP_PROTOCOL_WESP,
proto = "ROHC",XDM_CONST.IP_PROTOCOL_ROHC,
proto = "RESERVED",XDM_CONST.IP_PROTOCOL_RESERVED,
proto = "0",XDM_CONST.IP_PROTOCOL_HOPOPT,
proto = "1",XDM_CONST.IP_PROTOCOL_ICMP,
proto = "2",XDM_CONST.IP_PROTOCOL_IGMP,
proto = "3",XDM_CONST.IP_PROTOCOL_GGP,
proto = "4",XDM_CONST.IP_PROTOCOL_IP,
proto = "5",XDM_CONST.IP_PROTOCOL_ST,
proto = "6",XDM_CONST.IP_PROTOCOL_TCP,
proto = "7",XDM_CONST.IP_PROTOCOL_CBT,
proto = "8",XDM_CONST.IP_PROTOCOL_EGP,
proto = "9",XDM_CONST.IP_PROTOCOL_IGP,
proto = "10",XDM_CONST.IP_PROTOCOL_BBN_RCC_MON,
proto = "11",XDM_CONST.IP_PROTOCOL_NVP_II,
proto = "12",XDM_CONST.IP_PROTOCOL_PUP,
proto = "13",XDM_CONST.IP_PROTOCOL_ARGUS,
proto = "14",XDM_CONST.IP_PROTOCOL_EMCON,
proto = "15",XDM_CONST.IP_PROTOCOL_XNET,
proto = "16",XDM_CONST.IP_PROTOCOL_CHAOS,
proto = "17",XDM_CONST.IP_PROTOCOL_UDP,
proto = "18",XDM_CONST.IP_PROTOCOL_MUX,
proto = "19",XDM_CONST.IP_PROTOCOL_DCN_MEAS,
proto = "20",XDM_CONST.IP_PROTOCOL_HMP,
proto = "21",XDM_CONST.IP_PROTOCOL_PRM,
proto = "22",XDM_CONST.IP_PROTOCOL_XNS_IDP,
proto = "23",XDM_CONST.IP_PROTOCOL_TRUNK_1,
proto = "24",XDM_CONST.IP_PROTOCOL_TRUNK_2,
proto = "25",XDM_CONST.IP_PROTOCOL_LEAF_1,
proto = "26",XDM_CONST.IP_PROTOCOL_LEAF_2,
proto = "27",XDM_CONST.IP_PROTOCOL_RDP,
proto = "28",XDM_CONST.IP_PROTOCOL_IRTP,
proto = "29",XDM_CONST.IP_PROTOCOL_ISO_TP4,
proto = "30",XDM_CONST.IP_PROTOCOL_NETBLT,
proto = "31",XDM_CONST.IP_PROTOCOL_MFE_NSP,
proto = "32",XDM_CONST.IP_PROTOCOL_MERIT_INP,
proto = "33",XDM_CONST.IP_PROTOCOL_DCCP,
proto = "34",XDM_CONST.IP_PROTOCOL_3PC,
proto = "35",XDM_CONST.IP_PROTOCOL_IDPR,
proto = "36",XDM_CONST.IP_PROTOCOL_XTP,
proto = "37",XDM_CONST.IP_PROTOCOL_DDP,
proto = "38",XDM_CONST.IP_PROTOCOL_IDPR_CMTP,
proto = "39",XDM_CONST.IP_PROTOCOL_TP,
proto = "40",XDM_CONST.IP_PROTOCOL_IL,
proto = "41",XDM_CONST.IP_PROTOCOL_IPV6,
proto = "42",XDM_CONST.IP_PROTOCOL_SDRP,
proto = "43",XDM_CONST.IP_PROTOCOL_IPV6_ROUTE,
proto = "44",XDM_CONST.IP_PROTOCOL_IPV6_FRAG,
proto = "45",XDM_CONST.IP_PROTOCOL_IDRP,
proto = "46",XDM_CONST.IP_PROTOCOL_RSVP,
proto = "47",XDM_CONST.IP_PROTOCOL_GRE,
proto = "48",XDM_CONST.IP_PROTOCOL_DSR,
proto = "49",XDM_CONST.IP_PROTOCOL_BNA,
proto = "50",XDM_CONST.IP_PROTOCOL_ESP,
proto = "51",XDM_CONST.IP_PROTOCOL_AH,
proto = "52",XDM_CONST.IP_PROTOCOL_I_NLSP,
proto = "53",XDM_CONST.IP_PROTOCOL_SWIPE,
proto = "54",XDM_CONST.IP_PROTOCOL_NARP,
proto = "55",XDM_CONST.IP_PROTOCOL_MOBILE,
proto = "56",XDM_CONST.IP_PROTOCOL_TLSP,
proto = "57",XDM_CONST.IP_PROTOCOL_SKIP,
proto = "58",XDM_CONST.IP_PROTOCOL_IPV6_ICMP,
proto = "59",XDM_CONST.IP_PROTOCOL_IPV6_NONXT,
proto = "60",XDM_CONST.IP_PROTOCOL_IPV6_OPTS,
proto = "62",XDM_CONST.IP_PROTOCOL_CFTP,
proto = "64",XDM_CONST.IP_PROTOCOL_SAT_EXPAK,
proto = "65",XDM_CONST.IP_PROTOCOL_KRYPTOLAN,
proto = "66",XDM_CONST.IP_PROTOCOL_RVD,
proto = "67",XDM_CONST.IP_PROTOCOL_IPPC,
proto = "69",XDM_CONST.IP_PROTOCOL_SAT_MON,
proto = "70",XDM_CONST.IP_PROTOCOL_VISA,
proto = "71",XDM_CONST.IP_PROTOCOL_IPCV,
proto = "72",XDM_CONST.IP_PROTOCOL_CPNX,
proto = "73",XDM_CONST.IP_PROTOCOL_CPHB,
proto = "74",XDM_CONST.IP_PROTOCOL_WSN,
proto = "75",XDM_CONST.IP_PROTOCOL_PVP,
proto = "76",XDM_CONST.IP_PROTOCOL_BR_SAT_MON,
proto = "77",XDM_CONST.IP_PROTOCOL_SUN_ND,
proto = "78",XDM_CONST.IP_PROTOCOL_WB_MON,
proto = "79",XDM_CONST.IP_PROTOCOL_WB_EXPAK,
proto = "80",XDM_CONST.IP_PROTOCOL_ISO_IP,
proto = "81",XDM_CONST.IP_PROTOCOL_VMTP,
proto = "82",XDM_CONST.IP_PROTOCOL_SECURE_VMTP,
proto = "83",XDM_CONST.IP_PROTOCOL_VINES,
proto = "84",XDM_CONST.IP_PROTOCOL_TTP,
proto = "85",XDM_CONST.IP_PROTOCOL_NSFNET_IGP,
proto = "86",XDM_CONST.IP_PROTOCOL_DGP,
proto = "87",XDM_CONST.IP_PROTOCOL_TCF,
proto = "88",XDM_CONST.IP_PROTOCOL_EIGRP,
proto = "89",XDM_CONST.IP_PROTOCOL_OSPFIGP,
proto = "90",XDM_CONST.IP_PROTOCOL_SPRITE_RPC,
proto = "91",XDM_CONST.IP_PROTOCOL_LARP,
proto = "92",XDM_CONST.IP_PROTOCOL_MTP,
proto = "93",XDM_CONST.IP_PROTOCOL_AX25,
proto = "94",XDM_CONST.IP_PROTOCOL_IPIP,
proto = "95",XDM_CONST.IP_PROTOCOL_MICP,
proto = "96",XDM_CONST.IP_PROTOCOL_SCC_SP,
proto = "97",XDM_CONST.IP_PROTOCOL_ETHERIP,
proto = "98",XDM_CONST.IP_PROTOCOL_ENCAP,
proto = "100",XDM_CONST.IP_PROTOCOL_GMTP,
proto = "101",XDM_CONST.IP_PROTOCOL_IFMP,
proto = "102",XDM_CONST.IP_PROTOCOL_PNNI,
proto = "103",XDM_CONST.IP_PROTOCOL_PIM,
proto = "104",XDM_CONST.IP_PROTOCOL_ARIS,
proto = "105",XDM_CONST.IP_PROTOCOL_SCPS,
proto = "106",XDM_CONST.IP_PROTOCOL_QNX,
proto = "107",XDM_CONST.IP_PROTOCOL_AN,
proto = "108",XDM_CONST.IP_PROTOCOL_IPCOMP,
proto = "109",XDM_CONST.IP_PROTOCOL_SNP,
proto = "110",XDM_CONST.IP_PROTOCOL_COMPAQ_PEER,
proto = "111",XDM_CONST.IP_PROTOCOL_IPX_IN_IP,
proto = "112",XDM_CONST.IP_PROTOCOL_VRRP,
proto = "113",XDM_CONST.IP_PROTOCOL_PGM,
proto = "115",XDM_CONST.IP_PROTOCOL_L2TP,
proto = "116",XDM_CONST.IP_PROTOCOL_DDX,
proto = "117",XDM_CONST.IP_PROTOCOL_IATP,
proto = "118",XDM_CONST.IP_PROTOCOL_STP,
proto = "119",XDM_CONST.IP_PROTOCOL_SRP,
proto = "120",XDM_CONST.IP_PROTOCOL_UTI,
proto = "121",XDM_CONST.IP_PROTOCOL_SMP,
proto = "122",XDM_CONST.IP_PROTOCOL_SM,
proto = "123",XDM_CONST.IP_PROTOCOL_PTP,
proto = "124",XDM_CONST.IP_PROTOCOL_ISIS,
proto = "125",XDM_CONST.IP_PROTOCOL_FIRE,
proto = "126",XDM_CONST.IP_PROTOCOL_CRTP,
proto = "127",XDM_CONST.IP_PROTOCOL_CRUDP,
proto = "128",XDM_CONST.IP_PROTOCOL_SSCOPMCE,
proto = "129",XDM_CONST.IP_PROTOCOL_IPLT,
proto = "130",XDM_CONST.IP_PROTOCOL_SPS,
proto = "131",XDM_CONST.IP_PROTOCOL_PIPE,
proto = "132",XDM_CONST.IP_PROTOCOL_SCTP,
proto = "133",XDM_CONST.IP_PROTOCOL_FC,
proto = "134",XDM_CONST.IP_PROTOCOL_RSVP_E2E_IGNORE,
proto = "135",XDM_CONST.IP_PROTOCOL_MOBILITY,
proto = "136",XDM_CONST.IP_PROTOCOL_UDPLITE,
proto = "137",XDM_CONST.IP_PROTOCOL_MPLS_IN_IP,
proto = "138",XDM_CONST.IP_PROTOCOL_MANET,
proto = "139",XDM_CONST.IP_PROTOCOL_HIP,
proto = "140",XDM_CONST.IP_PROTOCOL_SHIM6,
proto = "141",XDM_CONST.IP_PROTOCOL_WESP,
proto = "142",XDM_CONST.IP_PROTOCOL_ROHC,
proto = "255",XDM_CONST.IP_PROTOCOL_RESERVED,
proto),
xdm.source.process.name = coalesce(cs3,cs14),
xdm.source.user.identifier = cs11,
xdm.event.outcome_reason = cs6,
xdm.network.rule = cs7,
xdm.target.user.identifier = cs12,
xdm.source.process.executable.filename = coalesce(cs3_process_name, cs14_process_name),
xdm.source.process.executable.path = coalesce(cs13, cs14),
xdm.target.process.executable.filename = cs15_process_name,
xdm.target.process.executable.path = coalesce(cs15, drpoc_process_name),
xdm.target.application.name = cs16,
xdm.observer.action = act,
xdm.event.outcome = if(
cs1 ~= "SUCCESS", XDM_CONST.OUTCOME_SUCCESS,
cs1 ~= "FAIL", XDM_CONST.OUTCOME_FAILED,
XDM_CONST.OUTCOME_UNKNOWN
);
/* ==========================================
Label logs mapping
========================================== */
filter cefName ~= "Label"
| alter //XDM mapping
xdm.observer.version = cefDeviceVersion,
xdm.event.type = cefName,
xdm.alert.severity = cefSeverity,
xdm.event.id = id,
xdm.event.description = msg;
/* ==========================================
Incidents logs mapping
========================================== */
filter cefName NOT IN ("System*", "Audit*", "Agent*", "Network*", "Label*")
| alter //extract fields
cs5_app = arrayindex(regextract(cs5, "App\:\s([^,]+)"),0),
cs5_os = arrayindex(regextract(cs5, "OS\:\s([^,]+)"),0),
cs5_env = arrayindex(regextract(cs5, "Environment\:\s([^,]+)"),0)
| alter //XDM mapping
xdm.event.type = cefDeviceEventClassId,
xdm.observer.version = cefDeviceVersion,
xdm.event.description = cefName,
xdm.alert.severity = if(
to_string(cefSeverity) = "8", "High",
to_string(cefSeverity) = "5", "Medium",
to_string(cefSeverity) = "3", "Low",
cefSeverity),
xdm.observer.action = act,
xdm.target.ipv4 = if(is_ipv4(dvc) = TRUE, dvc),
xdm.target.ipv6 = if(is_ipv6(dvc) = TRUE, dvc),
xdm.target.host.hostname = dvchost,
xdm.event.id = cs1,
xdm.alert.source_url = cs2,
xdm.event.tags = split(cs3, ", "),
xdm.target.host.device_id = cs4,
xdm.target.application.name = cs5_app,
xdm.target.host.os = cs5_os,
xdm.target.host.os_family = if(
cs5_os ~= "Windows", XDM_CONST.OS_FAMILY_WINDOWS,
cs5_os ~= "Mac", XDM_CONST.OS_FAMILY_MACOS,
cs5_os ~= "Linux", XDM_CONST.OS_FAMILY_LINUX,
cs5_os ~= "Ubuntu", XDM_CONST.OS_FAMILY_UBUNTU),
xdm.target.zone = cs5_env;