Rules (XIF)
[MODEL: dataset="kubernetes_kubernetes_raw"]
alter
traffic_status = arraystring(regextract(_raw_log, "\"stage\":\"([^,]+)\""), ""),
method_extracted = uppercase(arraystring(regextract(_raw_log, "verb\\":\\"([^,]+)\\""), "")),
ip1_check = arraystring(regextract(_raw_log, "sourceIPs\":\[\"([^,]+)\""), ""),
ip2_check = arraystring(regextract(_raw_log, "sourceIPs\":\[\"[^,]+\",\"([^,]+)\""), ""),
ip3_check = arraystring(regextract(_raw_log, "sourceIPs\":\[\"[^,]+\",\"[^,]+\",\"([^,]+)\""), ""),
group1 = arraystring(regextract(_raw_log, "groups\":\[\"([^,]+)\""), ""),
group2 = arraystring(regextract(_raw_log, "groups\":\[\"[^,]+\",\"([^,]+)\""), ""),
group3 = arraystring(regextract(_raw_log, "groups\":\[\"[^,]+\",\"[^,]+\",\"([^,]+)\""), ""),
status_code = arraystring(regextract(_raw_log, "responseStatus\":\{.*\"code\":([\d]+)"), ""),
outcome_result = lowercase(arraystring(regextract(_raw_log, "responseStatus\":\{.*\"message\":\"([^,]+)\""), "")),
decision_result = arraystring(regextract(_raw_log, "authorization\.k8s\.io\/decision\":\"([^,]+)\""), ""),
objectrefrence_uid = arraystring(regextract(_raw_log, "objectRef\":\{.*\"uid\":\"([^,]+)\""), ""),
responsestatus_details_uid = arraystring(regextract(_raw_log, "\"details\":\{.*\"uid\":\"([^,]+)\""), ""),
objectrefrence_name = arraystring(regextract(_raw_log, "objectRef\":\{.*\"name\":\"([^,]+)\""), ""),
responsestatus_details_name = arraystring(regextract(_raw_log, "\"details\":\{.*\"name\":\"([^,]+)\""), "")
| alter
ip1_ipv4 = if(ip1_check !~= ":", ip1_check, null),
ip1_ipv6 = if(ip1_check ~= ":", ip1_check, null),
ip2_ipv4 = if(ip2_check !~= ":", ip2_check, null),
ip2_ipv6 = if(ip2_check ~= ":", ip2_check, null),
ip3_ipv4 = if(ip3_check !~= ":", ip3_check, null),
ip3_ipv6 = if(ip3_check ~= ":", ip3_check, null)
| alter
xdm.observer.version = arraystring(regextract(_raw_log, "\"apiVersion\":\"([^,]+)\""), ""),
xdm.event.id = arraystring(regextract(_raw_log, "\"auditID\":\"([^,]+)\""), ""),
xdm.event.is_completed = if(traffic_status = "ResponseComplete", to_boolean("true"), to_boolean("false")),
xdm.network.http.url = arraystring(regextract(_raw_log, "requestURI\\":\"([^,]+)\""), ""),
xdm.network.http.method = if(method_extracted = "ACL", XDM_CONST.HTTP_METHOD_ACL, method_extracted = "BASELINE_CONTROL", XDM_CONST.HTTP_METHOD_BASELINE_CONTROL , method_extracted = "BIND", XDM_CONST.HTTP_METHOD_BIND, method_extracted = "CHECKIN", XDM_CONST.HTTP_METHOD_CHECKIN, method_extracted = "CHECKOUT", XDM_CONST.HTTP_METHOD_CHECKOUT, method_extracted = "CONNECT", XDM_CONST.HTTP_METHOD_CONNECT, method_extracted = "COPY", XDM_CONST.HTTP_METHOD_COPY, method_extracted = "DELETE", XDM_CONST.HTTP_METHOD_DELETE, method_extracted = "GET", XDM_CONST.HTTP_METHOD_GET, method_extracted = "HEAD", XDM_CONST.HTTP_METHOD_HEAD, method_extracted = "LABEL", XDM_CONST.HTTP_METHOD_LABEL, method_extracted = "LINK", XDM_CONST.HTTP_METHOD_LINK, method_extracted = "LOCK", XDM_CONST.HTTP_METHOD_LOCK, method_extracted = "MERGE", XDM_CONST.HTTP_METHOD_MERGE, method_extracted = "MKACTIVITY", XDM_CONST.HTTP_METHOD_MKACTIVITY, method_extracted = "MKCALENDAR", XDM_CONST.HTTP_METHOD_MKCALENDAR, method_extracted = "MKCOL", XDM_CONST.HTTP_METHOD_MKCOL, method_extracted = "MKREDIRECTREF", XDM_CONST.HTTP_METHOD_MKREDIRECTREF, method_extracted = "MKWORKSPACE", XDM_CONST.HTTP_METHOD_MKWORKSPACE, method_extracted = "MOVE", XDM_CONST.HTTP_METHOD_MOVE, method_extracted = "OPTIONS", XDM_CONST.HTTP_METHOD_OPTIONS, method_extracted = "ORDERPATCH", XDM_CONST.HTTP_METHOD_ORDERPATCH, method_extracted = "PATCH", XDM_CONST.HTTP_METHOD_PATCH, method_extracted = "POST", XDM_CONST.HTTP_METHOD_POST, method_extracted = "PRI", XDM_CONST.HTTP_METHOD_PRI, method_extracted = "PROPFIND", XDM_CONST.HTTP_METHOD_PROPFIND, method_extracted = "PROPPATCH", XDM_CONST.HTTP_METHOD_PROPPATCH, method_extracted = "PUT", XDM_CONST.HTTP_METHOD_PUT, method_extracted = "REBIND", XDM_CONST.HTTP_METHOD_REBIND, method_extracted = "REPORT", XDM_CONST.HTTP_METHOD_REPORT, method_extracted = "SEARCH", XDM_CONST.HTTP_METHOD_SEARCH, method_extracted = "TRACE", XDM_CONST.HTTP_METHOD_TRACE, method_extracted = "UNBIND", XDM_CONST.HTTP_METHOD_UNBIND, method_extracted = "UNCHECKOUT", XDM_CONST.HTTP_METHOD_UNCHECKOUT, method_extracted = "UNLINK", XDM_CONST.HTTP_METHOD_UNLINK, method_extracted = "UNLOCK", XDM_CONST.HTTP_METHOD_UNLOCK, method_extracted = "UPDATE", XDM_CONST.HTTP_METHOD_UPDATE, method_extracted = "UPDATEREDIRECTREF", XDM_CONST.HTTP_METHOD_UPDATEREDIRECTREF, method_extracted = "VERSION_CONTROL", XDM_CONST.HTTP_METHOD_VERSION_CONTROL, method_extracted = null, null, to_string(method_extracted)),
xdm.source.host.ipv4_addresses = arraycreate(ip1_ipv4, ip2_ipv4, ip3_ipv4),
xdm.source.host.ipv6_addresses = arraycreate(ip1_ipv6, ip2_ipv6, ip3_ipv6),
xdm.source.host.hostname = arraystring(regextract(_raw_log, "authentication\.kubernetes\.io\/pod-name\":\[\"([^,]+)\""), ""),
xdm.source.agent.identifier = arraystring(regextract(_raw_log, "authentication\.kubernetes\.io\/pod-uid\":\[\"([^,]+)\""), ""),
xdm.source.user.groups = arraycreate(group1, group2, group3),
xdm.source.user.identifier = arraystring(regextract(_raw_log, "\"user\"\:\{.*\"uid\":\"([^,]+)\""), ""),
xdm.source.user.username = arraystring(regextract(_raw_log, "\"user\"\:\{.*\"username\":\"([^,]+)\""), ""),
xdm.source.user_agent = arraystring(regextract(_raw_log, "userAgent\":\"([^,]+)\",\""), ""),
xdm.target.host.device_category = arraystring(regextract(_raw_log, "objectRef\":\{.*resource\":\"([^,]+)\""), ""),
xdm.target.host.device_model = arraystring(regextract(_raw_log, "objectRef\":\{.*\\"namespace\":\"([^,]+)\""), ""),
xdm.target.host.hostname = coalesce(objectrefrence_name, responsestatus_details_name),
xdm.target.host.device_id = coalesce(objectrefrence_uid, responsestatus_details_uid),
xdm.target.agent.content_version = arraystring(regextract(_raw_log, "objectRef\":\{.*\"subresource\":\"([^,]+)\""), ""),
xdm.network.http.response_code = if(status_code = "100", XDM_CONST.HTTP_RSP_CODE_CONTINUE, status_code = "101", XDM_CONST.HTTP_RSP_CODE_SWITCHING_PROTOCOLS, status_code = "102", XDM_CONST.HTTP_RSP_CODE_PROCESSING, status_code = "103", XDM_CONST.HTTP_RSP_CODE_EARLY_HINTS, status_code = "200", XDM_CONST.HTTP_RSP_CODE_OK, status_code = "201", XDM_CONST.HTTP_RSP_CODE_CREATED, status_code = "202", XDM_CONST.HTTP_RSP_CODE_ACCEPTED, status_code = "203", XDM_CONST.HTTP_RSP_CODE_NON__AUTHORITATIVE_INFORMATION, status_code = "204", XDM_CONST.HTTP_RSP_CODE_NO_CONTENT, status_code = "205", XDM_CONST.HTTP_RSP_CODE_RESET_CONTENT, status_code = "206", XDM_CONST.HTTP_RSP_CODE_PARTIAL_CONTENT, status_code = "207", XDM_CONST.HTTP_RSP_CODE_MULTI__STATUS, status_code = "208", XDM_CONST.HTTP_RSP_CODE_ALREADY_REPORTED, status_code = "226", XDM_CONST.HTTP_RSP_CODE_IM_USED, status_code = "300", XDM_CONST.HTTP_RSP_CODE_MULTIPLE_CHOICES, status_code = "301", XDM_CONST.HTTP_RSP_CODE_MOVED_PERMANENTLY, status_code = "302", XDM_CONST.HTTP_RSP_CODE_FOUND, status_code = "303", XDM_CONST.HTTP_RSP_CODE_SEE_OTHER, status_code = "304", XDM_CONST.HTTP_RSP_CODE_NOT_MODIFIED, status_code = "305", XDM_CONST.HTTP_RSP_CODE_USE_PROXY, status_code = "307", XDM_CONST.HTTP_RSP_CODE_TEMPORARY_REDIRECT, status_code = "308", XDM_CONST.HTTP_RSP_CODE_PERMANENT_REDIRECT, status_code = "400", XDM_CONST.HTTP_RSP_CODE_BAD_REQUEST, status_code = "401", XDM_CONST.HTTP_RSP_CODE_UNAUTHORIZED, status_code = "402", XDM_CONST.HTTP_RSP_CODE_PAYMENT_REQUIRED, status_code = "403", XDM_CONST.HTTP_RSP_CODE_FORBIDDEN, status_code = "404", XDM_CONST.HTTP_RSP_CODE_NOT_FOUND, status_code = "405", XDM_CONST.HTTP_RSP_CODE_METHOD_NOT_ALLOWED, status_code = "406", XDM_CONST.HTTP_RSP_CODE_NOT_ACCEPTABLE, status_code = "407", XDM_CONST.HTTP_RSP_CODE_PROXY_AUTHENTICATION_REQUIRED, status_code = "408", XDM_CONST.HTTP_RSP_CODE_REQUEST_TIMEOUT, status_code = "409", XDM_CONST.HTTP_RSP_CODE_CONFLICT, status_code = "410", XDM_CONST.HTTP_RSP_CODE_GONE, status_code = "411", XDM_CONST.HTTP_RSP_CODE_LENGTH_REQUIRED, status_code = "412", XDM_CONST.HTTP_RSP_CODE_PRECONDITION_FAILED, status_code = "413", XDM_CONST.HTTP_RSP_CODE_CONTENT_TOO_LARGE, status_code = "414", XDM_CONST.HTTP_RSP_CODE_URI_TOO_LONG, status_code = "415", XDM_CONST.HTTP_RSP_CODE_UNSUPPORTED_MEDIA_TYPE, status_code = "416", XDM_CONST.HTTP_RSP_CODE_RANGE_NOT_SATISFIABLE, status_code = "417", XDM_CONST.HTTP_RSP_CODE_EXPECTATION_FAILED, status_code = "421", XDM_CONST.HTTP_RSP_CODE_MISDIRECTED_REQUEST, status_code = "422", XDM_CONST.HTTP_RSP_CODE_UNPROCESSABLE_CONTENT, status_code = "423", XDM_CONST.HTTP_RSP_CODE_LOCKED, status_code = "424", XDM_CONST.HTTP_RSP_CODE_FAILED_DEPENDENCY, status_code = "425", XDM_CONST.HTTP_RSP_CODE_TOO_EARLY, status_code = "426", XDM_CONST.HTTP_RSP_CODE_UPGRADE_REQUIRED, status_code = "428", XDM_CONST.HTTP_RSP_CODE_PRECONDITION_REQUIRED, status_code = "429", XDM_CONST.HTTP_RSP_CODE_TOO_MANY_REQUESTS, status_code = "431", XDM_CONST.HTTP_RSP_CODE_REQUEST_HEADER_FIELDS_TOO_LARGE, status_code = "451", XDM_CONST.HTTP_RSP_CODE_UNAVAILABLE_FOR_LEGAL_REASONS, status_code = "500", XDM_CONST.HTTP_RSP_CODE_INTERNAL_SERVER_ERROR, status_code = "501", XDM_CONST.HTTP_RSP_CODE_NOT_IMPLEMENTED, status_code = "502", XDM_CONST.HTTP_RSP_CODE_BAD_GATEWAY, status_code = "503", XDM_CONST.HTTP_RSP_CODE_SERVICE_UNAVAILABLE, status_code = "504", XDM_CONST.HTTP_RSP_CODE_GATEWAY_TIMEOUT, status_code = "505", XDM_CONST.HTTP_RSP_CODE_HTTP_VERSION_NOT_SUPPORTED, status_code = "506", XDM_CONST.HTTP_RSP_CODE_VARIANT_ALSO_NEGOTIATES, status_code = "507", XDM_CONST.HTTP_RSP_CODE_INSUFFICIENT_STORAGE, status_code = "508", XDM_CONST.HTTP_RSP_CODE_LOOP_DETECTED, status_code = "511", XDM_CONST.HTTP_RSP_CODE_NETWORK_AUTHENTICATION_REQUIRED, status_code = null, null, to_string(status_code)),
xdm.alert.description = arraystring(regextract(_raw_log, "responseStatus\":\{.*\"causes\"\[\"[^,]+\",\"([^,]+)\""), ""),
xdm.event.description = arraystring(regextract(_raw_log, "responseStatus\":\{.*\"message\":\"([^,]+)\""), ""),
xdm.event.outcome_reason = arraystring(regextract(_raw_log, "responseStatus\":\{.*\"reason\":\"([^,]+)\""), ""),
xdm.event.outcome = if(outcome_result = "success", XDM_CONST.OUTCOME_SUCCESS, outcome_result = "failure", XDM_CONST.OUTCOME_FAILED, outcome_result = "unknown", XDM_CONST.OUTCOME_UNKNOWN, decision_result = "allow", XDM_CONST.OUTCOME_SUCCESS, decision_result = "reject", XDM_CONST.OUTCOME_FAILED, decision_result = "forbid", XDM_CONST.OUTCOME_FAILED, decision_result = null, null, coalesce(to_string(outcome_result), to_string(decision_result))),
xdm.observer.action = decision_result,
xdm.network.tls.client_certificate.subject = arraystring(regextract(_raw_log, "missing-san\.invalid-cert\.kubernetes\.io\/[^,]+\":\"([^,]+)\""), "");