Rules (XIF)
[MODEL: dataset=ironscales_ironscales_raw]
alter
ipv4_address = arrayindex(regextract(json_extract_scalar(mail_server, "$.ip"), "(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"),0),
ipv6_address = arrayindex(regextract(json_extract_scalar(mail_server, "$.ip"), "([a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5})"),0)
| alter
xdm.event.id = to_string(incident_id),
xdm.event.outcome_reason = classification,
xdm.email.sender = sender_email,
xdm.email.recipients = arraycreate(name),
xdm.observer.action = themis_verdict,
xdm.alert.subcategory = themis_verdict,
xdm.intermediate.host.hostname = mail_server -> host,
xdm.intermediate.ipv4 = ipv4_address,
xdm.intermediate.ipv6 = ipv6_address,
xdm.source.user.username = name,
xdm.source.user.upn = email,
xdm.email.subject = subject,
xdm.email.data = to_string(original_email_body),
xdm.network.http.http_header.value = to_string(headers),
xdm.network.http.url = to_json_string(arraymap(links -> [], json_extract_scalar("@element","$.url"))),
xdm.email.attachment.filename = to_json_string(arraymap(attachments -> [], json_extract_scalar("@element","$.file_name"))),
xdm.email.attachment.size = to_integer(arraystring(arraymap(attachments -> [], json_extract_scalar("@element","$.file_size")), "")),
xdm.email.attachment.md5 = to_json_string(arraymap(attachments -> [], json_extract_scalar("@element","$.md5")));
Schema
ironscales_ironscales_raw
| Field |
Type |
Array? |
attachments |
string |
— |
classification |
string |
— |
email |
string |
— |
first_reported_date |
string |
— |
headers |
string |
— |
incident_id |
int |
— |
links |
string |
— |
mail_server |
string |
— |
name |
string |
— |
original_email_body |
string |
— |
reports |
string |
— |
sender_email |
string |
— |
subject |
string |
— |
themis_verdict |
string |
— |
Raw JSON
{
"ironscales_ironscales_raw": {
"incident_id": {
"type": "int",
"is_array": false
},
"classification": {
"type": "string",
"is_array": false
},
"first_reported_date": {
"type": "string",
"is_array": false
},
"sender_email": {
"type": "string",
"is_array": false
},
"themis_verdict": {
"type": "string",
"is_array": false
},
"mail_server": {
"type": "string",
"is_array": false
},
"reports": {
"type": "string",
"is_array": false
},
"links": {
"type": "string",
"is_array": false
},
"attachments": {
"type": "string",
"is_array": false
},
"name": {
"type": "string",
"is_array": false
},
"email": {
"type": "string",
"is_array": false
},
"subject": {
"type": "string",
"is_array": false
},
"headers": {
"type": "string",
"is_array": false
},
"original_email_body": {
"type": "string",
"is_array": false
}
}
}