KnowBe4KMSATEventCollector

Details

ID	`KnowBe4KMSATEventCollector`
From Version	6.10.0
Tags	KnowBe4KMSAT

Rules (XIF)

[MODEL: dataset="knowbe4_kmsat_raw"]
alter xdm.alert.severity=json_extract_scalar(risk, "$.level"),
xdm.source.user.identifier=json_extract(user, "$.id"),
xdm.target.resource.id=external_id,
xdm.alert.original_alert_id=json_extract(event_type, "$.id"),
xdm.alert.name=event_type -> name,
xdm.alert.description=event_type -> description,
xdm.target.resource.parent_id=to_string(account_id),
xdm.event.description=description,
xdm.source.cloud.project=source,
xdm.source.user.username=arrayindex(regextract(json_extract(user, "$.email"),"([\d\w\.]+)\@"),0);

Schema

`knowbe4_kmsat_raw`

Field	Type	Array?
`account_id`	string	—
`description`	string	—
`event_type`	string	—
`external_id`	string	—
`id`	string	—
`occurred_date`	datetime	—
`risk`	string	—
`source`	string	—
`user`	string	—

Raw JSON

{
    "knowbe4_kmsat_raw": {
        "id": {
          "type": "string",
          "is_array": false
        },
        "risk": {
          "type": "string",
          "is_array": false
        },
        "occurred_date": {
            "type": "datetime",
            "is_array": false
          },
        "user": {
            "type": "string",
            "is_array": false
          },
        "external_id": {
          "type": "string",
          "is_array": false
        },
        "event_type": {
          "type": "string",
          "is_array": false
        },
        "account_id": {
          "type": "string",
          "is_array": false
        },
        "description": {
          "type": "string",
          "is_array": false
        },
        "source": {
          "type": "string",
          "is_array": false
        }
    }
  }