ManageEngine-ADAudit Modeling Rule

Modeling Rule

ManageEngine ADAudit Plus

Details

IDManageEngine-ADAudit_modeling_rule
From Version6.10.0
TagsManageEngine-ADAudit

Rules (XIF)

[MODEL: dataset="manageengine_adauditplus_raw"]
alter 
    xdm.session_context_id = coalesce(to_string(cn2),to_string(cn3)),
    xdm.event.id = to_string(cn1),
    xdm.source.ipv4 = if(cs2 ~= "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}",cs2,null),
    xdm.source.host.hostname = shost,
    xdm.alert.subcategory = cs4,
    xdm.alert.description = msg,
    xdm.target.user.identifier = duid,
    xdm.source.user.identifier = suid,
    xdm.event.type = coalesce(cs1,type),
    xdm.target.user.username = duser,
    xdm.source.process.name = sproc,
    xdm.source.user.username = suser,
    xdm.event.outcome_reason = reason,
    xdm.source.user.domain = sntdom,
    xdm.alert.category = coalesce(cefName,cat),
    xdm.event.outcome = outcome,
    xdm.target.file.filename = fileName,
    xdm.target.file.path = filePath,
    xdm.alert.severity = coalesce(cs5,cefSeverity),
    xdm.target.file.directory = fileLocation,
    xdm.observer.vendor = cefDeviceVendor,
    xdm.observer.product = cefDeviceProduct,
    xdm.observer.version = cefDeviceVersion,
    xdm.observer.type = cefDeviceEventClassId,
    xdm.intermediate.host.hostname = cs3;

Schema

manageengine_adauditplus_raw

Field Type Array?
cat string —
cefDeviceEventClassId string —
cefDeviceProduct string —
cefDeviceVendor string —
cefDeviceVersion string —
cefName string —
cefSeverity string —
cn1 string —
cn2 string —
cn3 int —
cs1 string —
cs2 string —
cs3 string —
cs4 string —
cs5 string —
duid string —
duser string —
fileLocation string —
fileName string —
filePath string —
msg string —
outcome string —
reason string —
shost string —
sntdom string —
sproc string —
suid string —
suser string —
type string —
Raw JSON 
{
    "manageengine_adauditplus_raw": {
        "cn2": {
          "type": "string",
          "is_array": false
        },
        "cn3": {
            "type": "int",
            "is_array": false
          },
        "cn1": {
            "type": "string",
            "is_array": false
          },
        "cs2": {
            "type": "string",
            "is_array": false
          },
        "shost": {
            "type": "string",
            "is_array": false
          },
        "cs3": {
            "type": "string",
            "is_array": false
          },
        "cs4": {
            "type": "string",
            "is_array": false
          },
        "msg": {
            "type": "string",
            "is_array": false
          },
        "duid": {
            "type": "string",
            "is_array": false
          },
        "suid": {
            "type": "string",
            "is_array": false
          },
        "cs1": {
            "type": "string",
            "is_array": false
          },
        "type": {
            "type": "string",
            "is_array": false
          },
        "duser": {
            "type": "string",
            "is_array": false
          },              
        "sproc": {
            "type": "string",
            "is_array": false
          }, 
        "suser": {
            "type": "string",
            "is_array": false
          }, 
        "reason": {
            "type": "string",
            "is_array": false
          }, 
        "sntdom": {
            "type": "string",
            "is_array": false
          }, 
        "cefName": {
            "type": "string",
            "is_array": false
          }, 
        "cat": {
            "type": "string",
            "is_array": false
          }, 
        "outcome": {
            "type": "string",
            "is_array": false
          }, 
        "fileName": {
            "type": "string",
            "is_array": false
          }, 
        "filePath": {
            "type": "string",
            "is_array": false
          }, 
        "cs5": {
            "type": "string",
            "is_array": false
          }, 
        "cefSeverity": {
            "type": "string",
            "is_array": false
          }, 
        "fileLocation": {
            "type": "string",
            "is_array": false
          }, 
        "cefDeviceVendor": {
            "type": "string",
            "is_array": false
          },
        "cefDeviceProduct": {
            "type": "string",
            "is_array": false
          }, 
        "cefDeviceVersion": {
            "type": "string",
            "is_array": false
          }, 
        "cefDeviceEventClassId": {
            "type": "string",
            "is_array": false
          }
    }
}