Rules (XIF)
[MODEL:dataset="infoblox_bloxone_threat_defense_raw"]
alter
xdm.source.ipv4 = if(qip ~= "(\d{1,3}\.){3}\d{1,3}", qip),
xdm.target.ipv4 = if(rip ~= "(\d{1,3}\.){3}\d{1,3}", rip),
xdm.source.host.ipv4_addresses = arraymap(split(private_ip, ","), if("@element" ~= "(\d{1,3}\.){3}\d{1,3}", "@element")) |
alter
xdm.source.ipv6 = if(xdm.source.ipv4 = null and qip ~= "([a-fA-F0-9]{1,4}\:){7}[a-fA-F0-9]{1,4}", qip),
xdm.target.ipv6 = if(xdm.target.ipv4 = null and rip ~= "([a-fA-F0-9]{1,4}\:){7}[a-fA-F0-9]{1,4}", rip),
xdm.source.host.ipv6_addresses = if(array_length(xdm.source.host.ipv4_addresses) = 0, arraymap(split(private_ip, ","), if("@element" ~= "([a-fA-F0-9]{1,4}\:){7}[a-fA-F0-9]{1,4}", "@element"))),
xdm.source.user.groups = split(user_groups, ","),
xdm.source.host.mac_addresses = split(mac_address, ","),
xdm.network.dns.dns_question.name = rtrim(qname, "."),
xdm.network.dns.dns_question.type = qtype,
xdm.network.dns.response_code = rcode,
xdm.source.user.username = user,
xdm.network.dns.dns_resource_record.value = rdata,
xdm.source.host.hostname = device,
xdm.alert.subcategory = tclass,
xdm.target.location.country = country,
xdm.source.zone = network,
xdm.source.application.name = app_name,
xdm.event.description = category,
xdm.alert.severity = severity,
xdm.alert.name = feed_name,
xdm.alert.description = feed_type,
xdm.source.host.os = os_version,
xdm.network.rule = policy_name,
xdm.observer.action = policy_action;
Schema
infoblox_bloxone_threat_defense_raw
| Field |
Type |
Array? |
app_name |
string |
— |
category |
string |
— |
country |
string |
— |
device |
string |
— |
feed_name |
string |
— |
feed_type |
string |
— |
mac_address |
string |
— |
network |
string |
— |
os_version |
string |
— |
policy_action |
string |
— |
policy_name |
string |
— |
private_ip |
string |
— |
qip |
string |
— |
qname |
string |
— |
qtype |
string |
— |
rcode |
string |
— |
rdata |
string |
— |
rip |
string |
— |
severity |
string |
— |
tclass |
string |
— |
user |
string |
— |
user_groups |
string |
— |
Raw JSON
{
"infoblox_bloxone_threat_defense_raw": {
"qip": {
"type": "string",
"is_array": false
},
"rip": {
"type": "string",
"is_array": false
},
"private_ip": {
"type": "string",
"is_array": false
},
"qtype": {
"type": "string",
"is_array": false
},
"rcode": {
"type": "string",
"is_array": false
},
"user_groups": {
"type": "string",
"is_array": false
},
"mac_address": {
"type": "string",
"is_array": false
},
"qname": {
"type": "string",
"is_array": false
},
"user": {
"type": "string",
"is_array": false
},
"rdata": {
"type": "string",
"is_array": false
},
"device": {
"type": "string",
"is_array": false
},
"tclass": {
"type": "string",
"is_array": false
},
"country": {
"type": "string",
"is_array": false
},
"network": {
"type": "string",
"is_array": false
},
"app_name": {
"type": "string",
"is_array": false
},
"category": {
"type": "string",
"is_array": false
},
"severity": {
"type": "string",
"is_array": false
},
"feed_name": {
"type": "string",
"is_array": false
},
"feed_type": {
"type": "string",
"is_array": false
},
"os_version": {
"type": "string",
"is_array": false
},
"policy_name": {
"type": "string",
"is_array": false
},
"policy_action": {
"type": "string",
"is_array": false
}
}
}