Rules (XIF)
[MODEL: dataset="linux_linux_raw", model="Auth"]
filter _time != null
/* Extracting and calculating facility & severity from PRI value */
| alter pri_value = to_integer(arrayindex(regextract(_raw_log , "^\<(\d{0,2})") ,0))
| alter facility_val = floor(divide(pri_value,8))
| alter severity_val = subtract(pri_value, multiply(facility_val, 8))
| alter severity = if(severity_val = 0 ,"Emergency" ,severity_val = 1 ,"Alert" ,severity_val = 2 ,"Critical" ,severity_val = 3 ,"Error" ,severity_val = 4 ,"Warning" ,severity_val = 5 ,"Notice" ,severity_val = 6 ,"Informational" ,severity_val = 7 ,"Debug")
| alter facility = if(facility_val = 0, "kern" ,facility_val = 1, "user" ,facility_val = 2, "mail" ,facility_val = 3, "daemon" ,facility_val = 4, "auth" ,facility_val = 5, "syslog" ,facility_val = 6, "lpr" ,facility_val = 7, "news" ,facility_val = 8, "uucp" ,facility_val = 9, "cron" ,facility_val = 10, "authpriv" ,facility_val = 11, "ftp" ,facility_val = 12, "ntp" ,facility_val = 13, "security" ,facility_val = 14, "console" ,facility_val = 15, "solaris-cron" ,facility_val = 16, "local")
/*---------------- END ----------------*/
| filter _log_source_file_name in("auth*", "secure") or facility_val in(4,10,13)
| alter current_year = arrayindex(regextract(to_string(current_time()), "\d{4}"), 0)
| alter timestamp = arrayindex(regextract(_raw_log , "\w{3}\s+\d{1,2}\s\d{2}:\d{2}:\d{2}"), 0)
| alter timestamp = format_string("%s %s", current_year , timestamp )
| alter hostname = to_string(arrayindex(regextract(_raw_log , "\d{2}\S\d{2}\S\d{2}\s+(\w+)\s"), 0))
| alter process_name = to_string(arrayindex(regextract(_raw_log , "\w+\s{1,2}\d{1,2}\s\d{2}\S\d{2}\S\d{2}\s+\w+\s([\w|\-\/]+)\[*"), 0))
| alter pid = to_integer(arrayindex(regextract(_raw_log , "^\w+\s{1,2}\d{1,2}\s\d{2}\S\d{2}\S\d{2}\s+\w+\s\w+\S*?(\d*)\]") ,0))
| alter event_description = to_string(arrayindex(regextract(_raw_log , "\w+\s{1,2}\d{1,2}\s\d{2}\S\d{2}\S\d{2}\s+\w+\s\S+\:(.+$)") ,0))
| alter src_ip = to_string(arrayindex(regextract(_raw_log ,"\s(\d{1,3}(?:\.\d{1,3}){3})") ,0))
| alter XDM.Auth.event_timestamp = parse_timestamp("%Y %b %d %H:%M:%S", timestamp)
| alter XDM.Auth.Client.host.hostname = hostname
| alter XDM.Auth.Client.process.name = process_name
| alter XDM.Auth.Client.process.pid = pid
| alter XDM.Auth.original_event_description = event_description
| alter XDM.Auth.Client.ipv4 = src_ip;
[MODEL: dataset="linux_linux_raw", model="Endpoint"]
filter _time != null
/* Extracting and calculating facility & severity from PRI value */
| alter pri_value = to_integer(arrayindex(regextract(_raw_log , "^\<(\d{0,2})") ,0))
| alter facility_val = floor(divide(pri_value,8))
| alter severity_val = subtract(pri_value, multiply(facility_val, 8))
| alter severity = if(severity_val = 0 ,"Emergency" ,severity_val = 1 ,"Alert" ,severity_val = 2 ,"Critical" ,severity_val = 3 ,"Error" ,severity_val = 4 ,"Warning" ,severity_val = 5 ,"Notice" ,severity_val = 6 ,"Informational" ,severity_val = 7 ,"Debug")
| alter facility = if(facility_val = 0, "kern" ,facility_val = 1, "user" ,facility_val = 2, "mail" ,facility_val = 3, "daemon" ,facility_val = 4, "auth" ,facility_val = 5, "syslog" ,facility_val = 6, "lpr" ,facility_val = 7, "news" ,facility_val = 8, "uucp" ,facility_val = 9, "cron" ,facility_val = 10, "authpriv" ,facility_val = 11, "ftp" ,facility_val = 12, "ntp" ,facility_val = 13, "security" ,facility_val = 14, "console" ,facility_val = 15, "solaris-cron" ,facility_val = 16, "local")
/*---------------- END ----------------*/
| filter _log_source_file_name in("syslog*", "messages") or facility_val not in(4,10,13)
| alter current_year = arrayindex(regextract(to_string(current_time()), "\d{4}"), 0)
| alter timestamp = arrayindex(regextract(_raw_log , "\w{3}\s+\d{1,2}\s\d{2}:\d{2}:\d{2}"), 0)
| alter timestamp = format_string("%s %s", current_year , timestamp )
| alter hostname = to_string(arrayindex(regextract(_raw_log , "\d{2}\S\d{2}\S\d{2}\s+(\w+)\s"), 0))
| alter process_name = to_string(arrayindex(regextract(_raw_log , "\w+\s{1,2}\d{1,2}\s\d{2}\S\d{2}\S\d{2}\s+\w+\s([\w|\-\/]+)\[*"), 0))
| alter pid = to_integer(arrayindex(regextract(_raw_log , "^\w+\s{1,2}\d{1,2}\s\d{2}\S\d{2}\S\d{2}\s+\w+\s\w+\S*?(\d*)\]") ,0))
| alter event_description = to_string(arrayindex(regextract(_raw_log , "\w+\s{1,2}\d{1,2}\s\d{2}\S\d{2}\S\d{2}\s+\w+\s\S+\:(.+$)") ,0))
| alter src_ip = to_string(arrayindex(regextract(_raw_log ,"\s(\d{1,3}(?:\.\d{1,3}){3})") ,0))
| alter XDM.Endpoint.event_timestamp = parse_timestamp("%Y %b %d %H:%M:%S", timestamp)
| alter XDM.Endpoint.Target.host.hostname = hostname
| alter XDM.Endpoint.Target.process.name = process_name
| alter XDM.Endpoint.Target.process.pid = pid
| alter XDM.Endpoint.original_event_description = event_description
| alter XDM.Endpoint.original_event_sub_type = facility
| alter XDM.Endpoint.threat.severity = severity;