Rules (XIF)
[MODEL: dataset="ibm_aix_raw"]
filter _raw_log ~= "\d{2}:\d{2}:\d{2}\s+Message\s+forwarded\s+from\s+\S+\:\s+syslog:"
| alter
xdm.source.host.hostname = arraystring(regextract(_raw_log, "\d{2}:\d{2}:\d{2}\s+Message\s+forwarded\s+from\s+(\S+)\:"), ""),
xdm.source.process.name = arraystring(regextract(_raw_log, "\d{2}:\d{2}:\d{2}\s+Message\s+forwarded\s+from\s+\S+\:\s+(\S+):"), ""),
xdm.source.process.command_line = arraystring(regextract(_raw_log, "\d{2}:\d{2}:\d{2}\s+Message\s+forwarded\s+from\s+\S+\:\s+syslog:\s+(.*)"), "");
filter _raw_log ~= "\d{2}:\d{2}:\d{2}\s+Message\s+forwarded\s+from\s+\S+\:\s+sshd\["
| alter
get_description = arraystring(regextract(_raw_log, "\d{2}:\d{2}:\d{2}\s+Message\s+forwarded\s+from\s+\S+\:\s+\S+\[[^\]]+\]:\s+(.*)"), ""),
get_error = arraystring(regextract(_raw_log, "\d{2}:\d{2}:\d{2}\s+Message\s+forwarded\s+from\s+\S+\:\s+\S+\[[^\]]+\]:\s+(error):"), ""),
get_ssh_ip = arraystring(regextract(_raw_log, "\d{2}:\d{2}:\d{2}\s+Message\s+forwarded\s+from\s+\S+\:\s+\S+\[[^\]]+\]:\s+Accepted\s+publickey\s+for\s+aging\s+from\s+(\S+)"), "")
| alter
src_ip_v4 = if(get_ssh_ip !~= ":", get_ssh_ip, null),
src_ip_v6 = if(get_ssh_ip ~= ":", get_ssh_ip, null)
| alter
xdm.source.ipv4 = src_ip_v4,
xdm.source.ipv6 = src_ip_v6,
xdm.source.host.hostname = arraystring(regextract(_raw_log, "\d{2}:\d{2}:\d{2}\s+Message\s+forwarded\s+from\s+(\S+)\:"), ""),
xdm.source.process.name = arraystring(regextract(_raw_log, "\d{2}:\d{2}:\d{2}\s+Message\s+forwarded\s+from\s+\S+\:\s+(\S+)\["), ""),
xdm.source.process.pid = to_integer(arraystring(regextract(_raw_log, "\d{2}:\d{2}:\d{2}\s+Message\s+forwarded\s+from\s+\S+\:\s+\S+\[([^\]]+)\]"), "")),
xdm.event.log_level = if(get_error = "error", XDM_CONST.LOG_LEVEL_ERROR, null),
xdm.event.description = if(get_error = "error", arraystring(regextract(_raw_log, "\d{2}:\d{2}:\d{2}\s+Message\s+forwarded\s+from\s+\S+\:\s+\S+\[[^\]]+\]:\s+error:\s+(.*)"), ""), get_description),
xdm.source.port = to_integer(arraystring(regextract(_raw_log, "\d{2}:\d{2}:\d{2}\s+Message\s+forwarded\s+from\s+\S+\:\s+\S+\[[^\]]+\]:\s+Accepted\s+publickey\s+for\s+aging\s+from\s+\S+\s+port\s+(\d+)"), "")),
xdm.source.process.executable.sha256 = arraystring(regextract(_raw_log, "\d{2}:\d{2}:\d{2}\s+Message\s+forwarded\s+from\s+\S+\:\s+\S+\[[^\]]+\]:\s+Accepted\s+publickey\s+for\s+aging\s+from\s+\S+\s+port\s+\d+[\s\S]+SHA256:([^\s]+)"), "");
filter _raw_log ~= "\d{2}:\d{2}:\d{2}\s+Message\s+forwarded\s+from\s+\S+\:\s+unix:"
| alter
xdm.source.host.hostname = arraystring(regextract(_raw_log, "\d{2}:\d{2}:\d{2}\s+Message\s+forwarded\s+from\s+(\S+)\:"), ""),
xdm.source.process.name = arraystring(regextract(_raw_log, "\d{2}:\d{2}:\d{2}\s+Message\s+forwarded\s+from\s+\S+\:\s+(\S+):"), ""),
xdm.event.description = arraystring(regextract(_raw_log, "\d{2}:\d{2}:\d{2}\s+Message\s+forwarded\s+from\s+\S+\:\s+\S+:\s+(.*)"), ""),
xdm.source.process.command_line = arraystring(regextract(_raw_log, "The\s+privilege\s+command\s+([^\,]+)\,"), ""),
xdm.source.user.identifier = arraystring(regextract(_raw_log, "executed\s+by\s+user\s+with\s+id\s+(\d+)"), "");
filter _raw_log ~= "\d{2}:\d{2}:\d{2}\s+Message\s+forwarded\s+from\s+\S+\:\s+iib\["
| alter
xdm.source.host.hostname = arraystring(regextract(_raw_log, "\d{2}:\d{2}:\d{2}\s+Message\s+forwarded\s+from\s+(\S+)\:"), ""),
xdm.source.process.name = arraystring(regextract(_raw_log, "\d{2}:\d{2}:\d{2}\s+Message\s+forwarded\s+from\s+\S+\:\s+(\S+)\["), ""),
xdm.source.process.pid = to_integer(arraystring(regextract(_raw_log, "\d{2}:\d{2}:\d{2}\s+Message\s+forwarded\s+from\s+\S+\:\s+\S+\[([^\]]+)\]"), "")),
xdm.event.description = arraystring(regextract(_raw_log, "\d{2}:\d{2}:\d{2}\s+Message\s+forwarded\s+from\s+\S+\:\s+\S+\[[^\]]+\]:\s+(.*)"), "");
filter _raw_log ~= "\d{2}:\d{2}:\d{2}\s+Message\s+forwarded\s+from\s+\S+\:\s+rmsock:"
| alter
xdm.source.host.hostname = arraystring(regextract(_raw_log, "\d{2}:\d{2}:\d{2}\s+Message\s+forwarded\s+from\s+(\S+)\:"), ""),
xdm.source.process.name = arraystring(regextract(_raw_log, "\d{2}:\d{2}:\d{2}\s+Message\s+forwarded\s+from\s+\S+\:\s+(\S+):"), ""),
xdm.event.description = arraystring(regextract(_raw_log, "\d{2}:\d{2}:\d{2}\s+Message\s+forwarded\s+from\s+\S+\:\s+\S+:\s+(.*)"), ""),
xdm.target.process.pid = to_integer(arraystring(regextract(_raw_log, "held\s+by\s+process\s+(\d+)\s+\([^\)]+\)"), "")),
xdm.target.process.name = rtrim(ltrim(arraystring(regextract(_raw_log, "held\s+by\s+process\s+\d+\s+([^\s]+)"), ""), "("), ")");
filter _raw_log ~= "\d{2}:\d{2}:\d{2}\s+Message\s+forwarded\s+from\s+\S+\:\s+Oracle\s+Audit\["
| alter
get_client_ip = arraystring(regextract(_raw_log, "CLIENT\sADDRESS\:\[\d+\]\s+\'([^\']+)\'"), "")
| alter
src_ip_v4 = if(get_client_ip !~= ":", get_client_ip, null),
src_ip_v6 = if(get_client_ip ~= ":", get_client_ip, null)
| alter
xdm.source.ipv4 = src_ip_v4,
xdm.source.ipv6 = src_ip_v6,
xdm.source.host.hostname = arraystring(regextract(_raw_log, "\d{2}:\d{2}:\d{2}\s+Message\s+forwarded\s+from\s+(\S+)\:"), ""),
xdm.source.process.name = arraystring(regextract(_raw_log, "\d{2}:\d{2}:\d{2}\s+Message\s+forwarded\s+from\s+\S+\:\s+([^\[]+)"), ""),
xdm.source.process.pid = to_integer(arraystring(regextract(_raw_log, "\d{2}:\d{2}:\d{2}\s+Message\s+forwarded\s+from\s+\S+\:\s+[^\[]+\[(\d+)\]"), "")),
xdm.event.description = arraystring(regextract(_raw_log, "\d{2}:\d{2}:\d{2}\s+Message\s+forwarded\s+from\s+\S+\:\s+[^\[]+\[\d+\]:\s+(.*)"), ""),
xdm.source.sent_bytes = to_integer(arraystring(regextract(_raw_log, "LENGTH\s+:\s+\'(\d+)\'"), "")),
xdm.event.operation = arraystring(regextract(_raw_log, "ACTION\s+:\[\d+\]\s+\'([^\']+)\'"), ""),
xdm.auth.privilege_level = arraystring(regextract(_raw_log, "PRIVILEGE\s+\:\[\d+\]\s+\'([^\']+)\'"), ""),
xdm.source.user.username = arraystring(regextract(_raw_log, "CLIENT\s+USER\:\[\d+\]\s+\'([^\']+)\'"), ""),
xdm.source.agent.identifier = arraystring(regextract(_raw_log, "CLIENT\s+TERMINAL\:\[\d+\]\s+\'[^\']\'"), ""),
xdm.session_context_id = arraystring(regextract(_raw_log, "SESSIONID\:\[\d+\]\s+\'([^\']+)\'"), "");
filter _raw_log ~= "\d{2}:\d{2}:\d{2}\s+Message\s+forwarded\s+from\s+\S+\:\s+bootpd\["
| alter
xdm.source.host.hostname = arraystring(regextract(_raw_log, "\d{2}:\d{2}:\d{2}\s+Message\s+forwarded\s+from\s+(\S+)\:"), ""),
xdm.source.process.name = arraystring(regextract(_raw_log, "\d{2}:\d{2}:\d{2}\s+Message\s+forwarded\s+from\s+\S+\:\s+(\S+)\["), ""),
xdm.source.process.pid = to_integer(arraystring(regextract(_raw_log, "\d{2}:\d{2}:\d{2}\s+Message\s+forwarded\s+from\s+\S+\:\s+\S+\[([^\]]+)\]"), "")),
xdm.event.description = arraystring(regextract(_raw_log, "\d{2}:\d{2}:\d{2}\s+Message\s+forwarded\s+from\s+\S+\:\s+\S+\[[^\]]+\]:\s+(.*)"), ""),
xdm.target.host.mac_addresses =regextract(_raw_log, "hardware\s+address\s+not\s+found:\s+(\S+)");
filter _raw_log ~= ":\s+last\s+message\s+repeated.*"
| alter
xdm.source.host.hostname = arraystring(regextract(_raw_log, "\d{2}:\d{2}:\d{2}\s+Message\s+forwarded\s+from\s+(\S+)\:"), ""),
xdm.event.description = arraystring(regextract(_raw_log, "last\s+message\s+repeated.*"), "");