IBM Guardium Modeling Rule

Modeling Rule

IBM Guardium

Details

IDIBM_Guardium_ModelingRule
From Version8.5.0

Rules (XIF)

[MODEL:dataset="ibm_guardium_raw"]
// extract source ipv4 and ipv6
alter tmp_src_ipv4 = if(src ~= "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}", src),
    tmp_src_ipv6 = if(src ~= "([a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5})", src)
// extract target ipv4 and ipv6
| alter tmp_dst_ipv4 = if(dst ~= "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}", dst),
    tmp_dst_ipv6 = if(dst ~= "([a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5})", dst)

// mapping ip protocol
| alter tmp_ip_proto = proto
| alter xdm.network.ip_protocol = if(proto="0",XDM_CONST.IP_PROTOCOL_HOPOPT, proto="1",XDM_CONST.IP_PROTOCOL_ICMP, proto="2",XDM_CONST.IP_PROTOCOL_IGMP, proto="3",XDM_CONST.IP_PROTOCOL_GGP, proto="4",XDM_CONST.IP_PROTOCOL_IP, proto="5",XDM_CONST.IP_PROTOCOL_ST, proto="6",XDM_CONST.IP_PROTOCOL_TCP, proto="7",XDM_CONST.IP_PROTOCOL_CBT, proto="8",XDM_CONST.IP_PROTOCOL_EGP, proto="9",XDM_CONST.IP_PROTOCOL_IGP, proto="10",XDM_CONST.IP_PROTOCOL_BBN_RCC_MON, proto="11",XDM_CONST.IP_PROTOCOL_NVP_II, proto="12",XDM_CONST.IP_PROTOCOL_PUP, proto="13",XDM_CONST.IP_PROTOCOL_ARGUS, proto="14",XDM_CONST.IP_PROTOCOL_EMCON, proto="15",XDM_CONST.IP_PROTOCOL_XNET, proto="16",XDM_CONST.IP_PROTOCOL_CHAOS, proto="17",XDM_CONST.IP_PROTOCOL_UDP, proto="18",XDM_CONST.IP_PROTOCOL_MUX, proto="19",XDM_CONST.IP_PROTOCOL_DCN_MEAS, proto="20",XDM_CONST.IP_PROTOCOL_HMP, proto="21",XDM_CONST.IP_PROTOCOL_PRM, proto="22",XDM_CONST.IP_PROTOCOL_XNS_IDP, proto="23",XDM_CONST.IP_PROTOCOL_TRUNK_1, proto="24",XDM_CONST.IP_PROTOCOL_TRUNK_2, proto="25",XDM_CONST.IP_PROTOCOL_LEAF_1, proto="26",XDM_CONST.IP_PROTOCOL_LEAF_2, proto="27",XDM_CONST.IP_PROTOCOL_RDP, proto="28",XDM_CONST.IP_PROTOCOL_IRTP, proto="29",XDM_CONST.IP_PROTOCOL_ISO_TP4, proto="30",XDM_CONST.IP_PROTOCOL_NETBLT, proto="31",XDM_CONST.IP_PROTOCOL_MFE_NSP, proto="32",XDM_CONST.IP_PROTOCOL_MERIT_INP, proto="33",XDM_CONST.IP_PROTOCOL_DCCP, proto="34",XDM_CONST.IP_PROTOCOL_3PC, proto="35",XDM_CONST.IP_PROTOCOL_IDPR, proto="36",XDM_CONST.IP_PROTOCOL_XTP, proto="37",XDM_CONST.IP_PROTOCOL_DDP, proto="38",XDM_CONST.IP_PROTOCOL_IDPR_CMTP, proto="39",XDM_CONST.IP_PROTOCOL_TP, proto="40",XDM_CONST.IP_PROTOCOL_IL, proto="41",XDM_CONST.IP_PROTOCOL_IPV6, proto="42",XDM_CONST.IP_PROTOCOL_SDRP, proto="43",XDM_CONST.IP_PROTOCOL_IPV6_ROUTE, proto="44",XDM_CONST.IP_PROTOCOL_IPV6_FRAG, proto="45",XDM_CONST.IP_PROTOCOL_IDRP, proto="46",XDM_CONST.IP_PROTOCOL_RSVP, proto="47",XDM_CONST.IP_PROTOCOL_GRE, proto="48",XDM_CONST.IP_PROTOCOL_DSR, proto="49",XDM_CONST.IP_PROTOCOL_BNA, proto="50",XDM_CONST.IP_PROTOCOL_ESP, proto="51",XDM_CONST.IP_PROTOCOL_AH, proto="52",XDM_CONST.IP_PROTOCOL_I_NLSP, proto="53",XDM_CONST.IP_PROTOCOL_SWIPE, proto="54",XDM_CONST.IP_PROTOCOL_NARP, proto="55",XDM_CONST.IP_PROTOCOL_MOBILE, proto="56",XDM_CONST.IP_PROTOCOL_TLSP, proto="57",XDM_CONST.IP_PROTOCOL_SKIP, proto="58",XDM_CONST.IP_PROTOCOL_IPV6_ICMP, proto="59",XDM_CONST.IP_PROTOCOL_IPV6_NONXT, proto="60",XDM_CONST.IP_PROTOCOL_IPV6_OPTS, proto="62",XDM_CONST.IP_PROTOCOL_CFTP, proto="64",XDM_CONST.IP_PROTOCOL_SAT_EXPAK, proto="65",XDM_CONST.IP_PROTOCOL_KRYPTOLAN, proto="66",XDM_CONST.IP_PROTOCOL_RVD, proto="67",XDM_CONST.IP_PROTOCOL_IPPC, proto="69",XDM_CONST.IP_PROTOCOL_SAT_MON, proto="70",XDM_CONST.IP_PROTOCOL_VISA, proto="71",XDM_CONST.IP_PROTOCOL_IPCV, proto="72",XDM_CONST.IP_PROTOCOL_CPNX, proto="73",XDM_CONST.IP_PROTOCOL_CPHB, proto="74",XDM_CONST.IP_PROTOCOL_WSN, proto="75",XDM_CONST.IP_PROTOCOL_PVP, proto="76",XDM_CONST.IP_PROTOCOL_BR_SAT_MON, proto="77",XDM_CONST.IP_PROTOCOL_SUN_ND, proto="78",XDM_CONST.IP_PROTOCOL_WB_MON, proto="79",XDM_CONST.IP_PROTOCOL_WB_EXPAK, proto="80",XDM_CONST.IP_PROTOCOL_ISO_IP, proto="81",XDM_CONST.IP_PROTOCOL_VMTP, proto="82",XDM_CONST.IP_PROTOCOL_SECURE_VMTP, proto="83",XDM_CONST.IP_PROTOCOL_VINES, proto="84",XDM_CONST.IP_PROTOCOL_TTP, proto="85",XDM_CONST.IP_PROTOCOL_NSFNET_IGP, proto="86",XDM_CONST.IP_PROTOCOL_DGP, proto="87",XDM_CONST.IP_PROTOCOL_TCF, proto="88",XDM_CONST.IP_PROTOCOL_EIGRP, proto="89",XDM_CONST.IP_PROTOCOL_OSPFIGP, proto="90",XDM_CONST.IP_PROTOCOL_SPRITE_RPC, proto="91",XDM_CONST.IP_PROTOCOL_LARP, proto="92",XDM_CONST.IP_PROTOCOL_MTP, proto="93",XDM_CONST.IP_PROTOCOL_AX25, proto="94",XDM_CONST.IP_PROTOCOL_IPIP, proto="95",XDM_CONST.IP_PROTOCOL_MICP, proto="96",XDM_CONST.IP_PROTOCOL_SCC_SP, proto="97",XDM_CONST.IP_PROTOCOL_ETHERIP, proto="98",XDM_CONST.IP_PROTOCOL_ENCAP, proto="100",XDM_CONST.IP_PROTOCOL_GMTP, proto="101",XDM_CONST.IP_PROTOCOL_IFMP, proto="102",XDM_CONST.IP_PROTOCOL_PNNI, proto="103",XDM_CONST.IP_PROTOCOL_PIM, proto="104",XDM_CONST.IP_PROTOCOL_ARIS, proto="105",XDM_CONST.IP_PROTOCOL_SCPS, proto="106",XDM_CONST.IP_PROTOCOL_QNX, proto="107",XDM_CONST.IP_PROTOCOL_AN, proto="108",XDM_CONST.IP_PROTOCOL_IPCOMP, proto="109",XDM_CONST.IP_PROTOCOL_SNP, proto="110",XDM_CONST.IP_PROTOCOL_COMPAQ_PEER, proto="111",XDM_CONST.IP_PROTOCOL_IPX_IN_IP, proto="112",XDM_CONST.IP_PROTOCOL_VRRP, proto="113",XDM_CONST.IP_PROTOCOL_PGM, proto="115",XDM_CONST.IP_PROTOCOL_L2TP, proto="116",XDM_CONST.IP_PROTOCOL_DDX, proto="117",XDM_CONST.IP_PROTOCOL_IATP, proto="118",XDM_CONST.IP_PROTOCOL_STP, proto="119",XDM_CONST.IP_PROTOCOL_SRP, proto="120",XDM_CONST.IP_PROTOCOL_UTI, proto="121",XDM_CONST.IP_PROTOCOL_SMP, proto="122",XDM_CONST.IP_PROTOCOL_SM, proto="123",XDM_CONST.IP_PROTOCOL_PTP, proto="124",XDM_CONST.IP_PROTOCOL_ISIS, proto="125",XDM_CONST.IP_PROTOCOL_FIRE, proto="126",XDM_CONST.IP_PROTOCOL_CRTP, proto="127",XDM_CONST.IP_PROTOCOL_CRUDP, proto="128",XDM_CONST.IP_PROTOCOL_SSCOPMCE, proto="129",XDM_CONST.IP_PROTOCOL_IPLT, proto="130",XDM_CONST.IP_PROTOCOL_SPS, proto="131",XDM_CONST.IP_PROTOCOL_PIPE, proto="132",XDM_CONST.IP_PROTOCOL_SCTP, proto="133",XDM_CONST.IP_PROTOCOL_FC, proto="134",XDM_CONST.IP_PROTOCOL_RSVP_E2E_IGNORE, proto="135",XDM_CONST.IP_PROTOCOL_MOBILITY, proto="136",XDM_CONST.IP_PROTOCOL_UDPLITE, proto="137",XDM_CONST.IP_PROTOCOL_MPLS_IN_IP, proto="138",XDM_CONST.IP_PROTOCOL_MANET, proto="139",XDM_CONST.IP_PROTOCOL_HIP, proto="140",XDM_CONST.IP_PROTOCOL_SHIM6, proto="141",XDM_CONST.IP_PROTOCOL_WESP, proto="142",XDM_CONST.IP_PROTOCOL_ROHC, proto="255",XDM_CONST.IP_PROTOCOL_RESERVED, tmp_ip_proto)
// regular mapping
| alter xdm.observer.action = act, 
    xdm.alert.subcategory = cat,
    xdm.target.port = to_integer(dpt),
    xdm.source.port = to_integer(spt),
    xdm.target.user.username = duser,
    xdm.source.user.username = suser,
    xdm.event.description = msg,
    xdm.source.process.name = sproc,
    xdm.network.application_protocol = app,
    xdm.alert.severity = if(cs1label = "Severity", cs1, null),
    xdm.target.host.image = if(cs2label = "Server Type", cs2, null),
    xdm.event.type = cefname,
    xdm.event.id = cefdeviceeventclassid,
    xdm.source.ipv4 = tmp_src_ipv4,
    xdm.source.ipv6 = tmp_src_ipv6,
    xdm.target.ipv4 = tmp_dst_ipv4,
    xdm.target.ipv6 = tmp_dst_ipv6;

[MODEL: dataset="ibm_guardium_dsc_raw"]
alter
    low_activity = lowercase(Activity),
    low_action_taken = lowercase(Action_taken),
    low_context = lowercase(Context)
| alter
    get_outcome = if(
        low_activity = "failed", XDM_CONST.OUTCOME_FAILED, low_activity = "succeeded", XDM_CONST.OUTCOME_SUCCESS, low_action_taken = "create" and low_activity not contains "failed", XDM_CONST.OUTCOME_SUCCESS, low_action_taken = "delete" and low_activity not contains "failed", XDM_CONST.OUTCOME_SUCCESS, low_action_taken = "updateuser" and low_activity not contains "failed", XDM_CONST.OUTCOME_SUCCESS, low_action_taken = "run report" and low_activity not contains "failed", XDM_CONST.OUTCOME_SUCCESS,low_action_taken = "delete" and low_activity not contains "failed", XDM_CONST.OUTCOME_SUCCESS, low_action_taken = "login" and low_activity not contains "failed", XDM_CONST.OUTCOME_SUCCESS, low_action_taken = "Stop query" and low_activity not contains "failed", XDM_CONST.OUTCOME_SUCCESS, low_action_taken = "addmember" and low_activity not contains "failed", XDM_CONST.OUTCOME_SUCCESS, low_action_taken = "deletemember" and low_activity not contains "failed", XDM_CONST.OUTCOME_SUCCESS, low_action_taken = "createuser" and low_activity not contains "failed", XDM_CONST.OUTCOME_SUCCESS, low_action_taken = "update" and low_activity not contains "failed", XDM_CONST.OUTCOME_SUCCESS, XDM_CONST.OUTCOME_UNKNOWN
        ), // Checks the event's outcome.
    get_username = if(
        Performed_by != "", Performed_by, null
        ),
    get_upn = if(
        Audit_trail_ID ~= "[A-Za-z0-9_-]+?@[A-Za-z0-9_-]+?\.[\w+\.]+",Audit_trail_ID,null
        ),
    get_operation = if(
        low_action_taken = "create", XDM_CONST.OPERATION_TYPE_CREATE, low_action_taken = "delete", XDM_CONST.OPERATION_TYPE_DELETE, low_action_taken = "updateuser", XDM_CONST.OPERATION_TYPE_UPDATE, low_action_taken = "run report", XDM_CONST.OPERATION_TYPE_READ,low_action_taken = "login", XDM_CONST.OPERATION_TYPE_AUTH_LOGIN, low_action_taken = "update", XDM_CONST.OPERATION_TYPE_UPDATE, low_action_taken = "createuser", XDM_CONST.OPERATION_TYPE_CREATE, low_action_taken = "deletemember", XDM_CONST.OPERATION_TYPE_DELETE, low_action_taken = "addmember", XDM_CONST.OPERATION_TYPE_CREATE,null
        ),
    check_report_status = if(
        low_context = "reports runner",concat(Context," - ",Action_taken," ",Activity),null
        ),
    check_login_success_event = if(
        low_action_taken = "login" AND low_activity = "succeeded" AND Context_description ~= "[A-Za-z0-9_-]+?@[A-Za-z0-9_-]+?\.[\w+\.]+", concat(Performed_by," ","(",Context_description,")"," ",Action_taken," ",Activity),null
        ),
    check_desc_api_keys = if(
        low_context = "api keys", concat(Action_taken," ",Context," ",Activity),null
        ),
    check_activity_create_group = if(
        low_context = "groups" AND low_action_taken = "create",arraycreate(arrayindex(regextract(Activity,"group\s([^\$]+)"),0)),null
        ),
    get_alert_rule_name = if(
        low_action_taken = "Create" or low_action_taken = "delete" or low_action_taken = "update" AND low_context = "alert rule",arrayindex(regextract(Context_description, "Workflow\srule\:\s([^\$]+)"),0),null
        ),
    check_alert_rule_update_value = if(
        low_action_taken = "update" AND low_context = "alert rule", Activity, null
        ),
    get_desc_workflow = if(
        low_context = "alert rule" and Performed_by != null, concat(Performed_by, " ",Action_taken," ",Context_description),low_context = "alert rule" and Performed_by != null,concat(Action_taken," ",Context_description),null
        ),
    get_notification_upn = if(
        low_context = "notifications" AND low_action_taken = "create", arrayindex(regextract(Activity,"\(([^\)]+)"),0),null
        ),
    get_notification_username = if(
        low_context = "notifications" AND low_action_taken = "create", arrayindex(regextract(Activity,"Welcome\s([^\(]+)"),0),null
        ),
    get_desc_datasets = if(
        low_context = "datasets" and Performed_by != null, concat(Performed_by, " ",Action_taken," ",Context,": ",Audit_trail_ID),low_context = "datasets" and Performed_by != null,concat(Action_taken," ",Context,": ",Audit_trail_ID),null
        ),
    get_datasets_resource_name = if(
        low_context = "datasets" AND low_action_taken = "create" or low_context = "datasets" AND low_action_taken = "delete", Activity, null
        ),
    get_variant_resource_name = if(
        low_context = "variants" AND low_action_taken = "create" or low_context = "variants" AND low_action_taken = "delete", arrayindex(regextract(Activity,"\S+\s\S+\s([^\$]+)"),0), null
        ),
    get_dashboard_name = if(
        low_action_taken = "create" or low_action_taken = "delete" or low_action_taken = "update" AND low_context = "dashboards",arrayindex(regextract(Activity, "^Dashboard\s([^\$]+)"),0),null
        )
| alter
    xdm.event.type = coalesce(uppercase(concat(Context," - ",Action_taken)),"GENERAL"),
    xdm.target.resource.type = Context,
    xdm.target.resource.id = if(Audit_trail_ID ~= "[A-Za-z0-9_-]+?@[A-Za-z0-9_-]+?\.[\w+\.]+",null,Audit_trail_ID), // Excluded source user upn.
    xdm.target.resource.name = coalesce(get_alert_rule_name, get_datasets_resource_name,get_variant_resource_name, get_dashboard_name),
    xdm.target.resource.value = check_alert_rule_update_value,
    xdm.target.user.groups = check_activity_create_group,
    xdm.event.operation = get_operation,
    xdm.event.description = coalesce(check_report_status, check_desc_api_keys, check_login_success_event, get_desc_datasets, get_desc_workflow, Activity),
    xdm.event.outcome = get_outcome,
    xdm.database.name = Database_name,
    xdm.source.application.name = Source_application,
    xdm.source.user.username = coalesce(get_username, get_notification_username,DB_user),
    xdm.source.user.upn = coalesce(get_upn, get_notification_upn),
    // Checks weather the Source IP is IPv4 / IPv6
    xdm.source.ipv4 = if(is_ipv4(Client_IP), Client_IP, null),
    xdm.source.ipv6 = if(is_ipv6(Client_IP), Client_IP, null),
    // Checks weather the Target IP is IPv4 / IPv6
    xdm.target.ipv4 = if(is_ipv4(Server_IP), Server_IP, null),
    xdm.target.ipv6 = if(is_ipv6(Server_IP), Server_IP, null);

Schema

ibm_guardium_raw

Field Type Array?
act string
app string
cat string
cefDeviceEventClassId string
cefName string
cs1 string
cs1label string
cs2 string
cs2label string
dpt string
dst string
duser string
msg string
proto string
rt string
sproc string
spt string
src string
suser string

ibm_guardium_dsc_raw

Field Type Array?
Action_taken string
Activity string
Audit_trail_ID string
Client_IP string
Context string
Context_description string
DB_user string
Database_name string
Performed_by string
Server_IP string
Source_application string
Raw JSON
{
    "ibm_guardium_raw": {
        "cat": {
            "type": "string",
            "is_array": false
        },
        "cefDeviceEventClassId": {
            "type": "string",
            "is_array": false
        },
        "cefName": {
            "type": "string",
            "is_array": false
        },
        "cs1": {
            "type": "string",
            "is_array": false
        },
        "cs1label": {
            "type": "string",
            "is_array": false
        },
        "cs2": {
            "type": "string",
            "is_array": false
        },
        "cs2label": {
            "type": "string",
            "is_array": false
        },
        "dst": {
            "type": "string",
            "is_array": false
        },
        "msg": {
            "type": "string",
            "is_array": false
        },
        "src": {
            "type": "string",
            "is_array": false
        },
        "act": {
            "type": "string",
            "is_array": false
        },
        "dpt": {
            "type": "string",
            "is_array": false
        },
        "spt": {
            "type": "string",
            "is_array": false
        },
        "duser": {
            "type": "string",
            "is_array": false
        },
        "suser": {
            "type": "string",
            "is_array": false
        },
        "proto": {
            "type": "string",
            "is_array": false
        },
        "sproc": {
            "type": "string",
            "is_array": false
        },
        "app": {
            "type": "string",
            "is_array": false
        },
        "rt": {
            "type": "string",
            "is_array": false
        }
    },
    
    "ibm_guardium_dsc_raw": {
        "Context": {
            "type": "string",
            "is_array": false
        },
        "Activity": {
            "type": "string",
            "is_array": false
        },
        "Action_taken": {
            "type": "string",
            "is_array": false
        },
        "Performed_by": {
            "type": "string",
            "is_array": false
        },
        "Audit_trail_ID": {
            "type": "string",
            "is_array": false
        },
        "Context_description": {
            "type": "string",
            "is_array": false
        },
        "DB_user": {
            "type": "string",
            "is_array": false
        },
        "Client_IP": {
            "type": "string",
            "is_array": false
        },
        "Server_IP": {
            "type": "string",
            "is_array": false
        },
        "Database_name": {
            "type": "string",
            "is_array": false
        },
        "Source_application": {
            "type": "string",
            "is_array": false
        }
    }
}