LenelS2 NetBox Modeling Rule

Details

Rules (XIF)

[MODEL: dataset="lenels2_netbox_raw"]
alter reasoncode = to_string(reasoncode)
| alter reason = if(reason = "", null, reason), reasoncode = if(reasoncode = "", null, reasoncode)
| alter
    xdm.event.type = type,
    xdm.event.id = to_string(typecode),
    xdm.alert.original_alert_id = to_string(logkey),
    xdm.event.outcome = if(type in ("Relocked", "Network node timeout", "Portal forced open", "Event acknowledged", "Event normal", "Logged out", "Logged in", "Network node connected", "Request momentary unlock", "Portal restored", "Portal held open", "Access granted", "Event activated", "Network node restored", "Duty log entry", "Momentary unlock"), XDM_CONST.OUTCOME_SUCCESS, type in ("Access not completed", "Failed", "Network node IDENT", "Access denied"), XDM_CONST.OUTCOME_FAILED, XDM_CONST.OUTCOME_UNKNOWN),
    xdm.event.outcome_reason = if(reason != null and reasoncode != null, concat(reasoncode , " - " , reason),
                                  reason != null and reasoncode = null, reason,
                                  reason = null and reasoncode != null, reasoncode),
    xdm.source.user.first_name = firstname,
    xdm.source.user.last_name = lastname,
    xdm.source.user.employee_id = to_string(personid),
    xdm.source.user.badge_id = to_string(personkey),
    xdm.observer.unique_identifier = to_string(portalkey),
    xdm.observer.name = portalname,
    xdm.target.resource.id = to_string(readerkey),
    xdm.target.resource.name = readername,
    xdm.target.resource.parent_id = to_string(partitionkey),
    xdm.target.resource.type = readerpartitionname;

Schema

lenels2_netbox_raw

{
  "lenels2_netbox_raw": {
    "type": {
      "type": "string",
      "is_array": false
    },
    "typecode": {
      "type": "string",
      "is_array": false
    },
    "logkey": {
      "type": "string",
      "is_array": false
    },
    "reason": {
      "type": "string",
      "is_array": false
    },
    "reasoncode": {
      "type": "string",
      "is_array": false
    },
    "firstname": {
      "type": "string",
      "is_array": false
    },
    "lastname": {
      "type": "string",
      "is_array": false
    },
    "personid": {
      "type": "string",
      "is_array": false
    },
    "personkey": {
      "type": "string",
      "is_array": false
    },
    "portalkey": {
      "type": "string",
      "is_array": false
    },
    "portalname": {
      "type": "string",
      "is_array": false
    },
    "readerkey": {
      "type": "string",
      "is_array": false
    },
    "readername": {
      "type": "string",
      "is_array": false
    },
    "partitionkey": {
      "type": "string",
      "is_array": false
    },
    "readerpartitionname": {
      "type": "string",
      "is_array": false
    }
  }
}