Rules (XIF)
[MODEL: dataset=jamf_pro_raw, model=Audit]
alter XDM.Audit.audited_resource.name = coalesce(json_extract_scalar(Event, "$.deviceName"), json_extract_scalar(Event, "$.computer.deviceName"), json_extract_scalar(Event, "$.name"), arraystring(arraymap (json_extract_array ("groupAddedDevices","$."), json_extract_scalar ("@element", "$.deviceName")), ","), json_extract_scalar(Event, "$.targetDevice.deviceName"),arraystring(arraymap (json_extract_array ("groupRemovedDevices","$."), json_extract_scalar ("@element", "$.deviceName")), ",")),
XDM.Audit.TriggeredBy.ipv4 = coalesce(json_extract_scalar(Event, "$.ipAddress"), json_extract_scalar(Event, "$.computer.ipAddress"), arraystring(arraymap (json_extract_array ("groupAddedDevices","$."), json_extract_scalar ("@element", "$.ipAddress")), ","), arraystring(arraymap (json_extract_array ("groupRemovedDevices","$."), json_extract_scalar ("@element", "$.ipAddress")), ",")),
XDM.Audit.audited_resource.id = coalesce(json_extract_scalar(Event, "$.jssID"), json_extract_scalar(Event, "$.computer.jssID"), arraystring(arraymap (json_extract_array ("groupAddedDevices","$."), json_extract_scalar ("@element", "$.jssID")), ","), arraystring(arraymap (json_extract_array ("groupRemovedDevices","$."), json_extract_scalar ("@element", "$.jssID")), ",")),
XDM.Audit.audited_resource.type = coalesce(json_extract_scalar(Event, "$.model"), json_extract_scalar(Event, "$.computer.model"), json_extract_scalar(Event, "$.targetDevice.model"), arraystring(arraymap (json_extract_array ("groupAddedDevices","$."), json_extract_scalar ("@element", "$.model")), ","), arraystring(arraymap (json_extract_array ("groupRemovedDevices","$."), json_extract_scalar ("@element", "$.model")), ",")),
XDM.Audit.audited_resource.sub_type = coalesce(json_extract_scalar(Event, "$.osVersion"), json_extract_scalar(Event, "$.computer.osVersion"), json_extract_scalar(Event, "$.targetDevice.osVersion"), arraystring(arraymap (json_extract_array ("groupAddedDevices","$."), json_extract_scalar ("@element", "$.osVersion")), ","), arraystring(arraymap (json_extract_array ("groupRemovedDevices","$."), json_extract_scalar ("@element", "$.osVersion")), ",")),
XDM.Audit.TriggeredBy.identity.name = coalesce(json_extract_scalar(Event, "$.username"), json_extract_scalar(Event, "$.patchPolicyName"), json_extract_scalar(Event, "$.authorizedUsername"), json_extract_scalar(Event, "$.targetUser.username"), arraystring(arraymap (json_extract_array ("groupAddedDevices","$."), json_extract_scalar ("@element", "$.username")), ","), arraystring(arraymap (json_extract_array ("groupRemovedDevices","$."), json_extract_scalar ("@element", "$.username")), ",")),
XDM.Audit.event_timestamp = to_timestamp(to_integer(json_extract_scalar(Webhook, "$.eventTimestamp")), "MILLIS"),
XDM.Audit.original_event_id = json_extract_scalar(Webhook, "$.id"),
XDM.Audit.original_event_description = json_extract_scalar(Webhook, "$.name"),
XDM.Audit.original_event_type = json_extract_scalar(Webhook, "$.webhookEvent"),
XDM.Audit.TriggeredBy.identity.type = json_extract_scalar(Event, "$.trigger"),
XDM.Audit.TriggeredBy.identity.uuid = json_extract_scalar(Event, "$.patchPolicyId"),
XDM.Audit.outcome = coalesce(json_extract_scalar(Event, "$.successful"), json_extract_scalar(Event, "$.operationSuccessful")),
XDM.Audit.operation_type = json_extract_scalar(Event, "$.restAPIOperationType");
[MODEL: dataset=jamf_pro_raw, model=Asset]
alter XDM.Asset.host.mac_addresses = arraycreate(coalesce(json_extract_scalar(Event, "$.wifiMacAddress"), json_extract_scalar(Event, "$.macAddress"), json_extract_scalar(Event, "$.computer.macAddress"), json_extract_scalar(Event, "$.targetDevice.wifiMacAddress"), "")),
XDM.Asset.host.device_id = coalesce(json_extract_scalar(Event, "$.serialNumber"), json_extract_scalar(Event, "$.computer.serialNumber"), json_extract_scalar(Event, "$.targetDevice.serialNumber"), arraystring(arraymap (json_extract_array ("groupAddedDevices","$."), json_extract_scalar ("@element", "$.serialNumber")), ","), arraystring(arraymap (json_extract_array ("groupRemovedDevices","$."), json_extract_scalar ("@element", "$.serialNumber")), ",")),
XDM.Asset.host.hardware_uuid = coalesce(json_extract_scalar(Event, "$.udid"), json_extract_scalar(Event, "$.computer.udid"), arraystring(arraymap (json_extract_array ("groupAddedDevices","$."), json_extract_scalar ("@element", "$.udid")), ","), arraystring(arraymap (json_extract_array ("groupRemovedDevices","$."), json_extract_scalar ("@element", "$.udid")), ","), json_extract_scalar(Event, "$.targetDevice.udid"));