[MODEL: dataset=aruba_networks_clearpass_raw]
filter cat ~= "[s|S]ession"
| alter
dst_ip_v4 = if(dst !~= ":", dst, null),
dst_ip_v6 = if(dst ~= ":", dst, null),
dvc_ip_v4 = if(dvc !~= ":", dvc, null),
dvc_ip_v6 = if(dvc ~= ":", dvc, null),
src_ip_v4 = if(src !~= ":", src, null),
src_ip_v6 = if(src ~= ":", src, null)
| alter
xdm.target.ipv4 = dst_ip_v4,
xdm.target.ipv6 = dst_ip_v6,
xdm.source.host.ipv4_addresses = arraycreate(dvc_ip_v4),
xdm.source.host.ipv6_addresses = arraycreate(dvc_ip_v6),
xdm.source.ipv4 = src_ip_v4,
xdm.source.ipv6 = src_ip_v6,
xdm.event.type = cat,
xdm.target.host.mac_addresses = arraycreate(dmac),
xdm.event.description = dpriv,
xdm.target.user.username = duser,
xdm.event.original_event_type = cefName,
xdm.alert.severity = cefSeverity,
xdm.observer.version = cefDeviceVersion,
xdm.event.id = cefDeviceEventClassId,
xdm.target.process.name = destinationServiceName;