KnowBe4KMSATEventCollector

Details

ID	`KnowBe4KMSATEventCollector`
From Version	6.8.0
To Version	6.9.9

Rules (XIF)

[MODEL:model="Audit", dataset="knowbe4_kmsat_raw"]
alter XDM.Audit.threat.severity=json_extract(risk, "$.level"),
XDM.Audit.TriggeredBy.identity.uuid=json_extract(user, "$.id"),
XDM.Audit.event_timestamp=occurred_date,
XDM.Audit.audited_resource.id=external_id,
XDM.Audit.threat.original_threat_id=json_extract(event_type, "$.id"),
XDM.Audit.threat.name=event_type -> name,
XDM.Audit.threat.description=event_type -> description,
XDM.Audit.audited_resource.parent_id=to_string(account_id),
XDM.Audit.original_event_description=description,
XDM.Audit.TriggeredBy.project=source;

Schema

`knowbe4_kmsat_raw`

Field	Type	Array?
`account_id`	string	—
`description`	string	—
`event_type`	string	—
`external_id`	string	—
`id`	string	—
`occurred_date`	datetime	—
`risk`	int	—
`source`	string	—
`user`	string	—

Raw JSON

{
    "knowbe4_kmsat_raw": {
        "id": {
          "type": "string",
          "is_array": false
        },
        "risk": {
          "type": "int",
          "is_array": false
        },
        "occurred_date": {
            "type": "datetime",
            "is_array": false
          },
        "user": {
            "type": "string",
            "is_array": false
          },
        "external_id": {
          "type": "string",
          "is_array": false
        },
        "event_type": {
          "type": "string",
          "is_array": false
        },
        "account_id": {
          "type": "string",
          "is_array": false
        },
        "description": {
          "type": "string",
          "is_array": false
        },
        "source": {
          "type": "string",
          "is_array": false
        }
    }
  }