JiraEventCollector

Details

Rules (XIF)

[MODEL: dataset=atlassian_jira_raw]
alter
	jira_status_change = json_extract_scalar(changedValues, "$.changedTo")
| alter
	xdm.event.operation = summary,
	xdm.source.ipv4 = remoteAddress,
	xdm.source.user.username = authorKey,
	xdm.source.user.identifier = authorAccountId,
	xdm.event.operation_sub_type = category,
	xdm.target.user.identifier = json_extract_scalar(objectItem, "$.id"),
	xdm.target.user.username = json_extract_scalar(objectItem, "$.name"),
	xdm.target.resource.type = json_extract_scalar(objectItem, "$.typeName"),
	xdm.event.outcome = if(jira_status_change != null, XDM_CONST.OUTCOME_SUCCESS, jira_status_change = null, null),
	xdm.event.outcome_reason = jira_status_change;

Schema

atlassian_jira_raw

{
    "atlassian_jira_raw": {
      "summary": {
        "type": "string",
        "is_array": false
      },
      "remoteAddress": {
        "type": "string",
        "is_array": false
      },
      "authorKey": {
        "type": "string",
        "is_array": false
      },
      "authorAccountId": {
        "type": "string",
        "is_array": false
      },
      "created": {
        "type": "datetime",
        "is_array": false
      },
      "category": {
        "type": "string",
        "is_array": false
      },
      "objectItem": {
        "type": "string",
        "is_array": false
      },
      "changedValues": {
        "type": "string",
        "is_array": false
      }
    }
  }