Rules (XIF)
[MODEL: dataset=aruba_networks_clearpass_raw]
filter cat ~= "[s|S]ession"
| alter
dst_ip_v4 = if(dst !~= ":", dst, null),
dst_ip_v6 = if(dst ~= ":", dst, null),
dvc_ip_v4 = if(dvc !~= ":", dvc, null),
dvc_ip_v6 = if(dvc ~= ":", dvc, null),
src_ip_v4 = if(src !~= ":", src, null),
src_ip_v6 = if(src ~= ":", src, null)
| alter
xdm.target.ipv4 = dst_ip_v4,
xdm.target.ipv6 = dst_ip_v6,
xdm.source.host.ipv4_addresses = arraycreate(dvc_ip_v4),
xdm.source.host.ipv6_addresses = arraycreate(dvc_ip_v6),
xdm.source.ipv4 = src_ip_v4,
xdm.source.ipv6 = src_ip_v6,
xdm.event.type = cat,
xdm.target.host.mac_addresses = arraycreate(dmac),
xdm.event.description = dpriv,
xdm.target.user.username = duser,
xdm.event.original_event_type = cefName,
xdm.alert.severity = cefSeverity,
xdm.observer.version = cefDeviceVersion,
xdm.event.id = cefDeviceEventClassId,
xdm.target.process.name = destinationServiceName;
Schema
aruba_networks_clearpass_raw
| Field |
Type |
Array? |
cat |
string |
— |
cefDeviceEventClassId |
string |
— |
cefDeviceVersion |
string |
— |
cefName |
string |
— |
cefSeverity |
string |
— |
destinationServiceName |
string |
— |
dmac |
string |
— |
dpriv |
string |
— |
dst |
string |
— |
duser |
string |
— |
dvc |
string |
— |
rt |
int |
— |
src |
string |
— |
Raw JSON
{
"aruba_networks_clearpass_raw": {
"rt": {
"type": "int",
"is_array": false
},
"cat": {
"type": "string",
"is_array": false
},
"dst": {
"type": "string",
"is_array": false
},
"dvc": {
"type": "string",
"is_array": false
},
"src": {
"type": "string",
"is_array": false
},
"dmac": {
"type": "string",
"is_array": false
},
"dpriv": {
"type": "string",
"is_array": false
},
"duser": {
"type": "string",
"is_array": false
},
"cefName": {
"type": "string",
"is_array": false
},
"cefSeverity": {
"type": "string",
"is_array": false
},
"cefDeviceVersion": {
"type": "string",
"is_array": false
},
"cefDeviceEventClassId": {
"type": "string",
"is_array": false
},
"destinationServiceName": {
"type": "string",
"is_array": false
}
}
}