Illusive Networks

Details

ID	`illusove_networks_modeling_rule`
From Version	6.10.0
Tags	Illusive Networks

Schema

`illusive_illusive_raw`

Field	Type	Array?
`cat`	string	—
`cefDeviceProduct`	string	—
`cefDeviceVersion`	string	—
`cefSeverity`	string	—
`cefVersion`	string	—
`cefname`	string	—
`cn2`	int	—
`cs1`	string	—
`cs2`	string	—
`cs3`	string	—
`cs4`	string	—
`cs5`	string	—
`destinationServiceName`	string	—
`dhost`	string	—
`duser`	string	—
`dvc`	string	—
`msg`	string	—
`outcome`	string	—
`shost`	string	—
`sproc`	string	—
`src`	string	—

Source

IllusiveNetworks_1_3.xif IllusiveNetworks_1_3.yml IllusiveNetworks_1_3_schema.json

Download History Raw

[MODEL: dataset=illusive_illusive_raw]
filter
    cefname = "Audit" or cefname = "Violation"
| alter
    xdm.event.type = cat,
    xdm.source.ipv4 = dvc,
    xdm.event.description = if(cefName = "Violation", cs2, cefName = "Audit", msg),
    xdm.target.user.username = duser,
    xdm.event.outcome = if(outcome ~= "fail", XDM_CONST.OUTCOME_FAILED, outcome = "SUCCESS", XDM_CONST.OUTCOME_SUCCESS, outcome = null, null, to_string(outcome)),
    xdm.event.operation_sub_type = cefName,
    xdm.alert.severity = cefSeverity,
    xdm.source.cloud.project = cefDeviceProduct,
    xdm.source.agent.version = cefDeviceVersion,
    xdm.alert.description = if(cefName = "Violation", msg),
    xdm.source.user.user_type = if(cs1 = "USER_CREDENTIALS", cs3),
    xdm.target.resource.name = if(cs1 = "CROWN_JEWEL_CREDENTIALS", cs3),
    xdm.target.resource.type = cs4;

filter
    cat = "illusive:alerts"
| alter
    xdm.event.type = cat,
    xdm.target.host.ipv4_addresses = arraycreate(dvc),
    xdm.event.description = msg,
    xdm.event.id = to_string(cn2),
    xdm.target.module.path = cs1,
    xdm.alert.name = destinationServiceName,
    xdm.target.host.hostname = dhost,
    xdm.target.user.username = duser,
    xdm.source.host.hostname = shost,
    xdm.source.process.name = sproc,
    xdm.source.host.ipv4_addresses = arraycreate(src),
    xdm.event.operation_sub_type = cefName,
    xdm.observer.version = cefVersion,
    xdm.alert.severity = cefSeverity,
    xdm.target.agent.version = cefDeviceVersion;