Rules (XIF)
[MODEL: dataset = apple_macos_raw]
alter
get_hostname = arraystring(regextract(_raw_log, "<\d+>[^\s]+\s+\d+\s+\d{2}:\d{2}:\d{2}\s([^\s]+)"), ""),
get_process = arraystring(regextract(_raw_log, "<\d+>[^\s]+\s+\d+\s+\d{2}:\d{2}:\d{2}\s[^\s]+\s([^\[]+)"), ""),
get_pid = arraystring(regextract(_raw_log, "<\d+>[^\s]+\s+\d+\s+\d{2}:\d{2}:\d{2}\s[^\s]+\s[^\[]+\[([^\]]+)"), ""),
get_description = arraystring(regextract(_raw_log, "<\d+>[^\s]+\s+\d+\s+\d{2}:\d{2}:\d{2}\s[^\s]+\s[^\[]+\[[^\]]+\]:(.*)"), ""),
get_des_pid = arraystring(regextract(_raw_log, "pid[\s|=]+(\d+)"), ""),
get_des_uid = arraystring(regextract(_raw_log, "uid[\s|=]+(\d+)"), ""),
get_des_path = arraystring(regextract(_raw_log, "path[\s|=]+([^,]+)"), ""),
get_des_macos_error_code = arraystring(regextract(_raw_log, "[C|c]ode[\s|=](\d+)"), ""),
get_nsurl = arraystring(regextract(_raw_log, "NSURL[\s|=]([^,]+)"), ""),
get_pkinstallpackageidentifier = arraystring(regextract(_raw_log, "PKInstallPackageIdentifier[\s|=]([^,]+)"), ""),
get_nslocalizeddescription = arraystring(regextract(_raw_log, "NSLocalizedDescription[\s|=]([^,}]+)"), "")
| alter
xdm.source.host.os_family = XDM_CONST.OS_FAMILY_MACOS,
xdm.source.host.hostname = get_hostname,
xdm.source.process.name = get_process,
xdm.source.process.parent_id = get_pid,
xdm.event.description = get_description,
xdm.source.process.pid = to_integer(get_des_pid),
xdm.source.process.identifier = get_des_uid,
xdm.source.process.executable.path = get_des_path,
xdm.network.http.response_code = get_des_macos_error_code,
xdm.source.process.executable.directory = get_nsurl,
xdm.source.process.executable.signer = get_pkinstallpackageidentifier,
xdm.alert.description = get_nslocalizeddescription;