ManageEngine-ADAudit Modeling Rule

Details

ID	`ManageEngine-ADAudit_ModelingRule`
From Version	8.15.0
Tags	ManageEngine-ADAudit

Schema

`manageengine_adauditplus_raw`

Field	Type	Array?
`cat`	string	—
`cefDeviceEventClassId`	string	—
`cefDeviceProduct`	string	—
`cefDeviceVendor`	string	—
`cefDeviceVersion`	string	—
`cefName`	string	—
`cefSeverity`	string	—
`cn1`	string	—
`cn2`	string	—
`cn3`	int	—
`cs1`	string	—
`cs2`	string	—
`cs3`	string	—
`cs4`	string	—
`cs5`	string	—
`duid`	string	—
`duser`	string	—
`fileLocation`	string	—
`fileName`	string	—
`filePath`	string	—
`msg`	string	—
`outcome`	string	—
`reason`	string	—
`shost`	string	—
`sntdom`	string	—
`sproc`	string	—
`suid`	string	—
`suser`	string	—
`type`	string	—

Source

ManageEngine-ADAudit_2_11.xif ManageEngine-ADAudit_2_11.yml ManageEngine-ADAudit_2_11_schema.json

Download History Raw

[MODEL: dataset="manageengine_adauditplus_raw"]
alter 
    xdm.session_context_id = coalesce(to_string(cn2),to_string(cn3)),
    xdm.event.id = to_string(cn1),
    xdm.source.ipv4 = if(cs2 ~= "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}",cs2,null),
    xdm.source.host.hostname = shost,
    xdm.alert.subcategory = cs4,
    xdm.alert.description = msg,
    xdm.target.user.identifier = duid,
    xdm.target.identity.identifier = duid,
    xdm.source.user.identifier = suid,
    xdm.source.identity.identifier = suid,
    xdm.event.type = coalesce(cs1,type),
    xdm.target.user.username = duser,
    xdm.target.identity.username = duser,
    xdm.source.process.name = sproc,
    xdm.source.user.username = suser,
    xdm.source.identity.username = suser,
    xdm.event.outcome_reason = reason,
    xdm.source.user.domain = sntdom,
    xdm.source.identity.domain = sntdom,
    xdm.alert.category = coalesce(cefName,cat),
    xdm.event.outcome = outcome,
    xdm.target.file.filename = fileName,
    xdm.target.file.path = filePath,
    xdm.alert.severity = coalesce(cs5,cefSeverity),
    xdm.target.file.directory = fileLocation,
    xdm.observer.version = cefDeviceVersion,
    xdm.observer.type = cefDeviceEventClassId,
    xdm.intermediate.host.hostname = cs3;