Rules (XIF)
[MODEL: dataset=illusive_illusive_raw]
filter
cefname = "Audit" or cefname = "Violation"
| alter
xdm.event.type = cat,
xdm.source.ipv4 = dvc,
xdm.event.description = if(cefName = "Violation", cs2, cefName = "Audit", msg),
xdm.target.user.username = duser,
xdm.event.outcome = if(outcome ~= "fail", XDM_CONST.OUTCOME_FAILED, outcome = "SUCCESS", XDM_CONST.OUTCOME_SUCCESS, outcome = null, null, to_string(outcome)),
xdm.event.operation_sub_type = cefName,
xdm.alert.severity = cefSeverity,
xdm.source.cloud.project = cefDeviceProduct,
xdm.source.agent.version = cefDeviceVersion,
xdm.alert.description = if(cefName = "Violation", msg),
xdm.source.user.user_type = if(cs1 = "USER_CREDENTIALS", cs3),
xdm.target.resource.name = if(cs1 = "CROWN_JEWEL_CREDENTIALS", cs3),
xdm.target.resource.type = cs4;
filter
cat = "illusive:alerts"
| alter
xdm.event.type = cat,
xdm.target.host.ipv4_addresses = arraycreate(dvc),
xdm.event.description = msg,
xdm.event.id = to_string(cn2),
xdm.target.module.path = cs1,
xdm.alert.name = destinationServiceName,
xdm.target.host.hostname = dhost,
xdm.target.user.username = duser,
xdm.source.host.hostname = shost,
xdm.source.process.name = sproc,
xdm.source.host.ipv4_addresses = arraycreate(src),
xdm.event.operation_sub_type = cefName,
xdm.observer.version = cefVersion,
xdm.alert.severity = cefSeverity,
xdm.target.agent.version = cefDeviceVersion;
Schema
illusive_illusive_raw
| Field |
Type |
Array? |
cat |
string |
— |
cefDeviceProduct |
string |
— |
cefDeviceVersion |
string |
— |
cefSeverity |
string |
— |
cefVersion |
string |
— |
cefname |
string |
— |
cn2 |
int |
— |
cs1 |
string |
— |
cs2 |
string |
— |
cs3 |
string |
— |
cs4 |
string |
— |
cs5 |
string |
— |
destinationServiceName |
string |
— |
dhost |
string |
— |
duser |
string |
— |
dvc |
string |
— |
msg |
string |
— |
outcome |
string |
— |
shost |
string |
— |
sproc |
string |
— |
src |
string |
— |
Raw JSON
{
"illusive_illusive_raw": {
"cat": {
"type": "string",
"is_array": false
},
"cefDeviceProduct": {
"type": "string",
"is_array": false
},
"cefVersion": {
"type": "string",
"is_array": false
},
"dvc": {
"type": "string",
"is_array": false
},
"msg": {
"type": "string",
"is_array": false
},
"duser": {
"type": "string",
"is_array": false
},
"outcome": {
"type": "string",
"is_array": false
},
"cefname": {
"type": "string",
"is_array": false
},
"cefSeverity": {
"type": "string",
"is_array": false
},
"cefDeviceVersion": {
"type": "string",
"is_array": false
},
"cs1": {
"type": "string",
"is_array": false
},
"cs2": {
"type": "string",
"is_array": false
},
"cs3": {
"type": "string",
"is_array": false
},
"cs4": {
"type": "string",
"is_array": false
},
"cs5": {
"type": "string",
"is_array": false
},
"cn2": {
"type": "int",
"is_array": false
},
"destinationServiceName": {
"type": "string",
"is_array": false
},
"dhost": {
"type": "string",
"is_array": false
},
"shost": {
"type": "string",
"is_array": false
},
"sproc": {
"type": "string",
"is_array": false
},
"src": {
"type": "string",
"is_array": false
}
}
}