Rules (XIF)
/* ----------------------------------- Infoblox ----------------------------------- */
[MODEL: dataset="infoblox_infoblox_raw", model="Network"]
filter _raw_log ~= "client" and _raw_log ~="infoblox-responses" and _raw_log ~="named"
| alter event_timestamps = parse_timestamp("%d-%b-%Y %H:%M:%E3S",arrayindex(regextract(_raw_log, "[0-3]\d-[A-Za-z]{3}-\d{4}\s\d{2}:\d{2}:\d{2}[.]\d{3}"), 0))
| alter process_pid = arrayindex(regextract(_raw_log , "\s\w+\[\d+\]") ,0)
| alter Source_ipv4 = arrayindex(regextract(_raw_log, "\s(\d{1,3}(?:\.\d{1,3}){3})\#") ,0)
| alter Source_ports = arrayindex(regextract(_raw_log, "#(\d+)") ,0)
| alter protocol_layers = regextract(_raw_log, "#(?:\d+):\s([A-Z]+)")
| alter dns_question_name = arrayindex(regextract(_raw_log, "query:\s+(\S*)?\s"), 0)
| alter dns_question_type = arrayindex(regextract(_raw_log, "query:\s+\S*?\sIN\s(\S*?)\s"), 0)
| alter dns_response_code = arrayindex(regextract(_raw_log, "response\:\s(.*?)\s"), 0)
| alter dns_resource_record_name = arrayindex(regextract(_raw_log, "(\S*?)\s\d*?\sIN\s\w*?\s\S*?[;]$"), 0)
| alter dns_resource_record_type = arrayindex(regextract(_raw_log, "response:\s+.*?\s+(A\s|AAAA\s)"), 0)
| alter dns_resource_record_value = arrayindex(regextract(_raw_log, "response:.*?A\s(\S*)[;]$"), 0)
| alter XDM.Network.event_timestamp = event_timestamps
| alter XDM.Network.Source.process.pid = to_number(process_pid)
| alter XDM.Network.Source.ipv4 = Source_ipv4
| alter XDM.Network.Source.port = to_number(Source_ports)
| alter XDM.Network.protocol_layers = protocol_layers
| alter XDM.Network.dns.dns_question.name = dns_question_name
| alter XDM.Network.dns.dns_question.type = dns_question_type
| alter XDM.Network.dns.response_code = dns_response_code
| alter XDM.Network.dns.dns_resource_record.name = dns_resource_record_name
| alter XDM.Network.dns.dns_resource_record.type = dns_resource_record_type
| alter XDM.Network.dns.dns_resource_record.value = dns_resource_record_value;
[MODEL: dataset="infoblox_infoblox_raw", model="Auth"]
filter _raw_log ~= "httpd"
| alter event_timestamps = parse_timestamp("%Y-%m-%d %H:%M:%E3S", arrayindex(regextract(_raw_log, "\d{4}-\d{2}-[0-3]\d\s\d{2}:\d{2}:\d{2}[.]\d{3}"), 0)),
Client_user_username = arrayindex(regextract(_raw_log, "\[(.*?)\]"), 0),
original_event_type = arrayindex(regextract(_raw_log, ":\s.*?:\s(.*?)\s-\s-"), 0),
Server_process_name = arrayindex(regextract(_raw_log, "to=(.*?)\s"), 0),
Client_ipv4 = arrayindex(regextract(_raw_log, "ip=(.*?)\s"), 0),
auth_methods = arrayindex(regextract(_raw_log, "auth=(.*?)\s"), 0),
Client_user_groups = arrayindex(regextract(_raw_log, "group=(.*?)\s"), 0),
application_protocols = arrayindex(regextract(_raw_log, "apparently_via=(.*?)$"), 0)
| alter XDM.Auth.event_timestamp = event_timestamps
| alter XDM.Auth.Client.user.username = Client_user_username
| alter XDM.Auth.original_event_type = original_event_type
| alter XDM.Auth.Server.process.name = Server_process_name
| alter XDM.Auth.Client.ipv4 = Client_ipv4
| alter XDM.Auth.auth_method = auth_methods
| alter XDM.Auth.Client.user.groups = arraycreate(coalesce(Client_user_groups, ""))
| alter XDM.Auth.application_protocol = application_protocols;