Rules (XIF)
[MODEL: dataset=jamf_pro_raw]
alter
outcome_result = coalesce(json_extract_scalar(Event, "$.successful"), json_extract_scalar(Event, "$.operationSuccessful"))
| alter
xdm.target.resource.name = coalesce(json_extract_scalar(Event, "$.deviceName"), json_extract_scalar(Event, "$.computer.deviceName"), json_extract_scalar(Event, "$.name"), arraystring(arraymap (json_extract_array ("groupAddedDevices","$."), json_extract_scalar ("@element", "$.deviceName")), ","), json_extract_scalar(Event, "$.targetDevice.deviceName"),arraystring(arraymap (json_extract_array ("groupRemovedDevices","$."), json_extract_scalar ("@element", "$.deviceName")), ",")),
xdm.source.ipv4 = coalesce(json_extract_scalar(Event, "$.ipAddress"), json_extract_scalar(Event, "$.computer.ipAddress"), arraystring(arraymap (json_extract_array ("groupAddedDevices","$."), json_extract_scalar ("@element", "$.ipAddress")), ","), arraystring(arraymap (json_extract_array ("groupRemovedDevices","$."), json_extract_scalar ("@element", "$.ipAddress")), ",")),
xdm.target.resource.id = coalesce(json_extract_scalar(Event, "$.jssID"), json_extract_scalar(Event, "$.computer.jssID"), arraystring(arraymap (json_extract_array ("groupAddedDevices","$."), json_extract_scalar ("@element", "$.jssID")), ","), arraystring(arraymap (json_extract_array ("groupRemovedDevices","$."), json_extract_scalar ("@element", "$.jssID")), ",")),
xdm.target.resource.type = coalesce(json_extract_scalar(Event, "$.model"), json_extract_scalar(Event, "$.computer.model"), json_extract_scalar(Event, "$.targetDevice.model"), arraystring(arraymap (json_extract_array ("groupAddedDevices","$."), json_extract_scalar ("@element", "$.model")), ","), arraystring(arraymap (json_extract_array ("groupRemovedDevices","$."), json_extract_scalar ("@element", "$.model")), ",")),
xdm.target.resource.sub_type = coalesce(json_extract_scalar(Event, "$.osVersion"), json_extract_scalar(Event, "$.computer.osVersion"), json_extract_scalar(Event, "$.targetDevice.osVersion"), arraystring(arraymap (json_extract_array ("groupAddedDevices","$."), json_extract_scalar ("@element", "$.osVersion")), ","), arraystring(arraymap (json_extract_array ("groupRemovedDevices","$."), json_extract_scalar ("@element", "$.osVersion")), ",")),
xdm.source.user.username = coalesce(json_extract_scalar(Event, "$.username"), json_extract_scalar(Event, "$.patchPolicyName"), json_extract_scalar(Event, "$.authorizedUsername"), json_extract_scalar(Event, "$.targetUser.username"), arraystring(arraymap (json_extract_array ("groupAddedDevices","$."), json_extract_scalar ("@element", "$.username")), ","), arraystring(arraymap (json_extract_array ("groupRemovedDevices","$."), json_extract_scalar ("@element", "$.username")), ",")),
xdm.event.id = json_extract_scalar(webhook, "$.id"),
xdm.event.description = json_extract_scalar(webhook, "$.name"),
xdm.event.type = json_extract_scalar(webhook, "$.webhookEvent"),
xdm.event.outcome_reason = json_extract_scalar(Event, "$.trigger"),
xdm.source.user.identifier = json_extract_scalar(Event, "$.patchPolicyId"),
xdm.event.outcome = if(outcome_result = "false", XDM_CONST.OUTCOME_FAILED, outcome_result = "true", XDM_CONST.OUTCOME_SUCCESS, outcome_result = null, null, to_string(outcome_result)),
xdm.event.operation_sub_type = json_extract_scalar(Event, "$.restAPIOperationType"),
xdm.target.host.mac_addresses = arraycreate(coalesce(json_extract_scalar(Event, "$.wifiMacAddress"), json_extract_scalar(Event, "$.macAddress"), json_extract_scalar(Event, "$.computer.macAddress"), json_extract_scalar(Event, "$.targetDevice.wifiMacAddress"), "")),
xdm.target.host.device_id = coalesce(json_extract_scalar(Event, "$.serialNumber"), json_extract_scalar(Event, "$.computer.serialNumber"), json_extract_scalar(Event, "$.targetDevice.serialNumber"), arraystring(arraymap (json_extract_array ("groupAddedDevices","$."), json_extract_scalar ("@element", "$.serialNumber")), ","), arraystring(arraymap (json_extract_array ("groupRemovedDevices","$."), json_extract_scalar ("@element", "$.serialNumber")), ",")),
xdm.target.host.hardware_uuid = coalesce(json_extract_scalar(Event, "$.udid"), json_extract_scalar(Event, "$.computer.udid"), arraystring(arraymap (json_extract_array ("groupAddedDevices","$."), json_extract_scalar ("@element", "$.udid")), ","), arraystring(arraymap (json_extract_array ("groupRemovedDevices","$."), json_extract_scalar ("@element", "$.udid")), ","), json_extract_scalar(Event, "$.targetDevice.udid"));