KnowBe4KMSATEventCollector

Details

ID	`KnowBe4KMSATEventCollector`
From Version	6.10.0
Tags	KnowBe4KMSAT

Schema

`knowbe4_kmsat_raw`

Field	Type	Array?
`account_id`	string	—
`description`	string	—
`event_type`	string	—
`external_id`	string	—
`id`	string	—
`occurred_date`	datetime	—
`risk`	string	—
`source`	string	—
`user`	string	—

Source

KnowBe4KMSATEventCollector_1_3.xif KnowBe4KMSATEventCollector_1_3.yml KnowBe4KMSATEventCollector_1_3_schema.json

Download History Raw

[MODEL: dataset="knowbe4_kmsat_raw"]
alter xdm.alert.severity=json_extract_scalar(risk, "$.level"),
xdm.source.user.identifier=json_extract(user, "$.id"),
xdm.target.resource.id=external_id,
xdm.alert.original_alert_id=json_extract(event_type, "$.id"),
xdm.alert.name=event_type -> name,
xdm.alert.description=event_type -> description,
xdm.target.resource.parent_id=to_string(account_id),
xdm.event.description=description,
xdm.source.cloud.project=source,
xdm.source.user.username=arrayindex(regextract(json_extract(user, "$.email"),"([\d\w\.]+)\@"),0);