Rules (XIF)
[MODEL:dataset="ibm_guardium_raw"]
// extract source ipv4 and ipv6
alter tmp_src_ipv4 = if(src ~= "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}", src),
tmp_src_ipv6 = if(src ~= "([a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5})", src)
// extract target ipv4 and ipv6
| alter tmp_dst_ipv4 = if(dst ~= "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}", dst),
tmp_dst_ipv6 = if(dst ~= "([a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5})", dst)
// mapping ip protocol
| alter tmp_ip_proto = proto
| alter xdm.network.ip_protocol = if(proto="0",XDM_CONST.IP_PROTOCOL_HOPOPT, proto="1",XDM_CONST.IP_PROTOCOL_ICMP, proto="2",XDM_CONST.IP_PROTOCOL_IGMP, proto="3",XDM_CONST.IP_PROTOCOL_GGP, proto="4",XDM_CONST.IP_PROTOCOL_IP, proto="5",XDM_CONST.IP_PROTOCOL_ST, proto="6",XDM_CONST.IP_PROTOCOL_TCP, proto="7",XDM_CONST.IP_PROTOCOL_CBT, proto="8",XDM_CONST.IP_PROTOCOL_EGP, proto="9",XDM_CONST.IP_PROTOCOL_IGP, proto="10",XDM_CONST.IP_PROTOCOL_BBN_RCC_MON, proto="11",XDM_CONST.IP_PROTOCOL_NVP_II, proto="12",XDM_CONST.IP_PROTOCOL_PUP, proto="13",XDM_CONST.IP_PROTOCOL_ARGUS, proto="14",XDM_CONST.IP_PROTOCOL_EMCON, proto="15",XDM_CONST.IP_PROTOCOL_XNET, proto="16",XDM_CONST.IP_PROTOCOL_CHAOS, proto="17",XDM_CONST.IP_PROTOCOL_UDP, proto="18",XDM_CONST.IP_PROTOCOL_MUX, proto="19",XDM_CONST.IP_PROTOCOL_DCN_MEAS, proto="20",XDM_CONST.IP_PROTOCOL_HMP, proto="21",XDM_CONST.IP_PROTOCOL_PRM, proto="22",XDM_CONST.IP_PROTOCOL_XNS_IDP, proto="23",XDM_CONST.IP_PROTOCOL_TRUNK_1, proto="24",XDM_CONST.IP_PROTOCOL_TRUNK_2, proto="25",XDM_CONST.IP_PROTOCOL_LEAF_1, proto="26",XDM_CONST.IP_PROTOCOL_LEAF_2, proto="27",XDM_CONST.IP_PROTOCOL_RDP, proto="28",XDM_CONST.IP_PROTOCOL_IRTP, proto="29",XDM_CONST.IP_PROTOCOL_ISO_TP4, proto="30",XDM_CONST.IP_PROTOCOL_NETBLT, proto="31",XDM_CONST.IP_PROTOCOL_MFE_NSP, proto="32",XDM_CONST.IP_PROTOCOL_MERIT_INP, proto="33",XDM_CONST.IP_PROTOCOL_DCCP, proto="34",XDM_CONST.IP_PROTOCOL_3PC, proto="35",XDM_CONST.IP_PROTOCOL_IDPR, proto="36",XDM_CONST.IP_PROTOCOL_XTP, proto="37",XDM_CONST.IP_PROTOCOL_DDP, proto="38",XDM_CONST.IP_PROTOCOL_IDPR_CMTP, proto="39",XDM_CONST.IP_PROTOCOL_TP, proto="40",XDM_CONST.IP_PROTOCOL_IL, proto="41",XDM_CONST.IP_PROTOCOL_IPV6, proto="42",XDM_CONST.IP_PROTOCOL_SDRP, proto="43",XDM_CONST.IP_PROTOCOL_IPV6_ROUTE, proto="44",XDM_CONST.IP_PROTOCOL_IPV6_FRAG, proto="45",XDM_CONST.IP_PROTOCOL_IDRP, proto="46",XDM_CONST.IP_PROTOCOL_RSVP, proto="47",XDM_CONST.IP_PROTOCOL_GRE, proto="48",XDM_CONST.IP_PROTOCOL_DSR, proto="49",XDM_CONST.IP_PROTOCOL_BNA, proto="50",XDM_CONST.IP_PROTOCOL_ESP, proto="51",XDM_CONST.IP_PROTOCOL_AH, proto="52",XDM_CONST.IP_PROTOCOL_I_NLSP, proto="53",XDM_CONST.IP_PROTOCOL_SWIPE, proto="54",XDM_CONST.IP_PROTOCOL_NARP, proto="55",XDM_CONST.IP_PROTOCOL_MOBILE, proto="56",XDM_CONST.IP_PROTOCOL_TLSP, proto="57",XDM_CONST.IP_PROTOCOL_SKIP, proto="58",XDM_CONST.IP_PROTOCOL_IPV6_ICMP, proto="59",XDM_CONST.IP_PROTOCOL_IPV6_NONXT, proto="60",XDM_CONST.IP_PROTOCOL_IPV6_OPTS, proto="62",XDM_CONST.IP_PROTOCOL_CFTP, proto="64",XDM_CONST.IP_PROTOCOL_SAT_EXPAK, proto="65",XDM_CONST.IP_PROTOCOL_KRYPTOLAN, proto="66",XDM_CONST.IP_PROTOCOL_RVD, proto="67",XDM_CONST.IP_PROTOCOL_IPPC, proto="69",XDM_CONST.IP_PROTOCOL_SAT_MON, proto="70",XDM_CONST.IP_PROTOCOL_VISA, proto="71",XDM_CONST.IP_PROTOCOL_IPCV, proto="72",XDM_CONST.IP_PROTOCOL_CPNX, proto="73",XDM_CONST.IP_PROTOCOL_CPHB, proto="74",XDM_CONST.IP_PROTOCOL_WSN, proto="75",XDM_CONST.IP_PROTOCOL_PVP, proto="76",XDM_CONST.IP_PROTOCOL_BR_SAT_MON, proto="77",XDM_CONST.IP_PROTOCOL_SUN_ND, proto="78",XDM_CONST.IP_PROTOCOL_WB_MON, proto="79",XDM_CONST.IP_PROTOCOL_WB_EXPAK, proto="80",XDM_CONST.IP_PROTOCOL_ISO_IP, proto="81",XDM_CONST.IP_PROTOCOL_VMTP, proto="82",XDM_CONST.IP_PROTOCOL_SECURE_VMTP, proto="83",XDM_CONST.IP_PROTOCOL_VINES, proto="84",XDM_CONST.IP_PROTOCOL_TTP, proto="85",XDM_CONST.IP_PROTOCOL_NSFNET_IGP, proto="86",XDM_CONST.IP_PROTOCOL_DGP, proto="87",XDM_CONST.IP_PROTOCOL_TCF, proto="88",XDM_CONST.IP_PROTOCOL_EIGRP, proto="89",XDM_CONST.IP_PROTOCOL_OSPFIGP, proto="90",XDM_CONST.IP_PROTOCOL_SPRITE_RPC, proto="91",XDM_CONST.IP_PROTOCOL_LARP, proto="92",XDM_CONST.IP_PROTOCOL_MTP, proto="93",XDM_CONST.IP_PROTOCOL_AX25, proto="94",XDM_CONST.IP_PROTOCOL_IPIP, proto="95",XDM_CONST.IP_PROTOCOL_MICP, proto="96",XDM_CONST.IP_PROTOCOL_SCC_SP, proto="97",XDM_CONST.IP_PROTOCOL_ETHERIP, proto="98",XDM_CONST.IP_PROTOCOL_ENCAP, proto="100",XDM_CONST.IP_PROTOCOL_GMTP, proto="101",XDM_CONST.IP_PROTOCOL_IFMP, proto="102",XDM_CONST.IP_PROTOCOL_PNNI, proto="103",XDM_CONST.IP_PROTOCOL_PIM, proto="104",XDM_CONST.IP_PROTOCOL_ARIS, proto="105",XDM_CONST.IP_PROTOCOL_SCPS, proto="106",XDM_CONST.IP_PROTOCOL_QNX, proto="107",XDM_CONST.IP_PROTOCOL_AN, proto="108",XDM_CONST.IP_PROTOCOL_IPCOMP, proto="109",XDM_CONST.IP_PROTOCOL_SNP, proto="110",XDM_CONST.IP_PROTOCOL_COMPAQ_PEER, proto="111",XDM_CONST.IP_PROTOCOL_IPX_IN_IP, proto="112",XDM_CONST.IP_PROTOCOL_VRRP, proto="113",XDM_CONST.IP_PROTOCOL_PGM, proto="115",XDM_CONST.IP_PROTOCOL_L2TP, proto="116",XDM_CONST.IP_PROTOCOL_DDX, proto="117",XDM_CONST.IP_PROTOCOL_IATP, proto="118",XDM_CONST.IP_PROTOCOL_STP, proto="119",XDM_CONST.IP_PROTOCOL_SRP, proto="120",XDM_CONST.IP_PROTOCOL_UTI, proto="121",XDM_CONST.IP_PROTOCOL_SMP, proto="122",XDM_CONST.IP_PROTOCOL_SM, proto="123",XDM_CONST.IP_PROTOCOL_PTP, proto="124",XDM_CONST.IP_PROTOCOL_ISIS, proto="125",XDM_CONST.IP_PROTOCOL_FIRE, proto="126",XDM_CONST.IP_PROTOCOL_CRTP, proto="127",XDM_CONST.IP_PROTOCOL_CRUDP, proto="128",XDM_CONST.IP_PROTOCOL_SSCOPMCE, proto="129",XDM_CONST.IP_PROTOCOL_IPLT, proto="130",XDM_CONST.IP_PROTOCOL_SPS, proto="131",XDM_CONST.IP_PROTOCOL_PIPE, proto="132",XDM_CONST.IP_PROTOCOL_SCTP, proto="133",XDM_CONST.IP_PROTOCOL_FC, proto="134",XDM_CONST.IP_PROTOCOL_RSVP_E2E_IGNORE, proto="135",XDM_CONST.IP_PROTOCOL_MOBILITY, proto="136",XDM_CONST.IP_PROTOCOL_UDPLITE, proto="137",XDM_CONST.IP_PROTOCOL_MPLS_IN_IP, proto="138",XDM_CONST.IP_PROTOCOL_MANET, proto="139",XDM_CONST.IP_PROTOCOL_HIP, proto="140",XDM_CONST.IP_PROTOCOL_SHIM6, proto="141",XDM_CONST.IP_PROTOCOL_WESP, proto="142",XDM_CONST.IP_PROTOCOL_ROHC, proto="255",XDM_CONST.IP_PROTOCOL_RESERVED, tmp_ip_proto)
// regular mapping
| alter xdm.observer.action = act,
xdm.alert.subcategory = cat,
xdm.target.port = to_integer(dpt),
xdm.source.port = to_integer(spt),
xdm.target.user.username = duser,
xdm.source.user.username = suser,
xdm.event.description = msg,
xdm.source.process.name = sproc,
xdm.network.application_protocol = app,
xdm.alert.severity = if(cs1label = "Severity", cs1, null),
xdm.target.host.image = if(cs2label = "Server Type", cs2, null),
xdm.event.type = cefname,
xdm.event.id = cefdeviceeventclassid,
xdm.source.ipv4 = tmp_src_ipv4,
xdm.source.ipv6 = tmp_src_ipv6,
xdm.target.ipv4 = tmp_dst_ipv4,
xdm.target.ipv6 = tmp_dst_ipv6;
[MODEL: dataset="ibm_guardium_dsc_raw"]
alter
low_activity = lowercase(Activity),
low_action_taken = lowercase(Action_taken),
low_context = lowercase(Context)
| alter
get_outcome = if(
low_activity = "failed", XDM_CONST.OUTCOME_FAILED, low_activity = "succeeded", XDM_CONST.OUTCOME_SUCCESS, low_action_taken = "create" and low_activity not contains "failed", XDM_CONST.OUTCOME_SUCCESS, low_action_taken = "delete" and low_activity not contains "failed", XDM_CONST.OUTCOME_SUCCESS, low_action_taken = "updateuser" and low_activity not contains "failed", XDM_CONST.OUTCOME_SUCCESS, low_action_taken = "run report" and low_activity not contains "failed", XDM_CONST.OUTCOME_SUCCESS,low_action_taken = "delete" and low_activity not contains "failed", XDM_CONST.OUTCOME_SUCCESS, low_action_taken = "login" and low_activity not contains "failed", XDM_CONST.OUTCOME_SUCCESS, low_action_taken = "Stop query" and low_activity not contains "failed", XDM_CONST.OUTCOME_SUCCESS, low_action_taken = "addmember" and low_activity not contains "failed", XDM_CONST.OUTCOME_SUCCESS, low_action_taken = "deletemember" and low_activity not contains "failed", XDM_CONST.OUTCOME_SUCCESS, low_action_taken = "createuser" and low_activity not contains "failed", XDM_CONST.OUTCOME_SUCCESS, low_action_taken = "update" and low_activity not contains "failed", XDM_CONST.OUTCOME_SUCCESS, XDM_CONST.OUTCOME_UNKNOWN
), // Checks the event's outcome.
get_username = if(
Performed_by != "", Performed_by, null
),
get_upn = if(
Audit_trail_ID ~= "[A-Za-z0-9_-]+?@[A-Za-z0-9_-]+?\.[\w+\.]+",Audit_trail_ID,null
),
get_operation = if(
low_action_taken = "create", XDM_CONST.OPERATION_TYPE_CREATE, low_action_taken = "delete", XDM_CONST.OPERATION_TYPE_DELETE, low_action_taken = "updateuser", XDM_CONST.OPERATION_TYPE_UPDATE, low_action_taken = "run report", XDM_CONST.OPERATION_TYPE_READ,low_action_taken = "login", XDM_CONST.OPERATION_TYPE_AUTH_LOGIN, low_action_taken = "update", XDM_CONST.OPERATION_TYPE_UPDATE, low_action_taken = "createuser", XDM_CONST.OPERATION_TYPE_CREATE, low_action_taken = "deletemember", XDM_CONST.OPERATION_TYPE_DELETE, low_action_taken = "addmember", XDM_CONST.OPERATION_TYPE_CREATE,null
),
check_report_status = if(
low_context = "reports runner",concat(Context," - ",Action_taken," ",Activity),null
),
check_login_success_event = if(
low_action_taken = "login" AND low_activity = "succeeded" AND Context_description ~= "[A-Za-z0-9_-]+?@[A-Za-z0-9_-]+?\.[\w+\.]+", concat(Performed_by," ","(",Context_description,")"," ",Action_taken," ",Activity),null
),
check_desc_api_keys = if(
low_context = "api keys", concat(Action_taken," ",Context," ",Activity),null
),
check_activity_create_group = if(
low_context = "groups" AND low_action_taken = "create",arraycreate(arrayindex(regextract(Activity,"group\s([^\$]+)"),0)),null
),
get_alert_rule_name = if(
low_action_taken = "Create" or low_action_taken = "delete" or low_action_taken = "update" AND low_context = "alert rule",arrayindex(regextract(Context_description, "Workflow\srule\:\s([^\$]+)"),0),null
),
check_alert_rule_update_value = if(
low_action_taken = "update" AND low_context = "alert rule", Activity, null
),
get_desc_workflow = if(
low_context = "alert rule" and Performed_by != null, concat(Performed_by, " ",Action_taken," ",Context_description),low_context = "alert rule" and Performed_by != null,concat(Action_taken," ",Context_description),null
),
get_notification_upn = if(
low_context = "notifications" AND low_action_taken = "create", arrayindex(regextract(Activity,"\(([^\)]+)"),0),null
),
get_notification_username = if(
low_context = "notifications" AND low_action_taken = "create", arrayindex(regextract(Activity,"Welcome\s([^\(]+)"),0),null
),
get_desc_datasets = if(
low_context = "datasets" and Performed_by != null, concat(Performed_by, " ",Action_taken," ",Context,": ",Audit_trail_ID),low_context = "datasets" and Performed_by != null,concat(Action_taken," ",Context,": ",Audit_trail_ID),null
),
get_datasets_resource_name = if(
low_context = "datasets" AND low_action_taken = "create" or low_context = "datasets" AND low_action_taken = "delete", Activity, null
),
get_variant_resource_name = if(
low_context = "variants" AND low_action_taken = "create" or low_context = "variants" AND low_action_taken = "delete", arrayindex(regextract(Activity,"\S+\s\S+\s([^\$]+)"),0), null
),
get_dashboard_name = if(
low_action_taken = "create" or low_action_taken = "delete" or low_action_taken = "update" AND low_context = "dashboards",arrayindex(regextract(Activity, "^Dashboard\s([^\$]+)"),0),null
)
| alter
xdm.event.type = coalesce(uppercase(concat(Context," - ",Action_taken)),"GENERAL"),
xdm.target.resource.type = Context,
xdm.target.resource.id = if(Audit_trail_ID ~= "[A-Za-z0-9_-]+?@[A-Za-z0-9_-]+?\.[\w+\.]+",null,Audit_trail_ID), // Excluded source user upn.
xdm.target.resource.name = coalesce(get_alert_rule_name, get_datasets_resource_name,get_variant_resource_name, get_dashboard_name),
xdm.target.resource.value = check_alert_rule_update_value,
xdm.target.user.groups = check_activity_create_group,
xdm.event.operation = get_operation,
xdm.event.description = coalesce(check_report_status, check_desc_api_keys, check_login_success_event, get_desc_datasets, get_desc_workflow, Activity),
xdm.event.outcome = get_outcome,
xdm.database.name = Database_name,
xdm.source.application.name = Source_application,
xdm.source.user.username = coalesce(get_username, get_notification_username,DB_user),
xdm.source.user.upn = coalesce(get_upn, get_notification_upn),
// Checks weather the Source IP is IPv4 / IPv6
xdm.source.ipv4 = if(is_ipv4(Client_IP), Client_IP, null),
xdm.source.ipv6 = if(is_ipv6(Client_IP), Client_IP, null),
// Checks weather the Target IP is IPv4 / IPv6
xdm.target.ipv4 = if(is_ipv4(Server_IP), Server_IP, null),
xdm.target.ipv6 = if(is_ipv6(Server_IP), Server_IP, null);