ManageEngine-ADManager Modeling Rule

Details

Rules (XIF)

[MODEL: dataset="manageengine_admanager_raw"]
filter _raw_log ~= "\<\d+\>"
|alter observername=arrayindex(regextract(_raw_log ,"\d{2}\:\d{2}\:\d{2}\s([a-zA-Z0-9\-\_\s\.]+)\s"),0),
status = arrayindex(regextract(_raw_log ,"Status\=([a-zA-Z0-9\-\_\s\.]+)\]?"),0),
operation = arrayindex(regextract(_raw_log ,"Task\=([a-zA-Z0-9\-\_\s\.]+)\]"),0),
action= arrayindex(regextract(_raw_log ,"ACTION\=([a-zA-Z0-9\-\_\s\.]+)\]"),0),
domainName=arrayindex(regextract(_raw_log ,"Domain Name\=([a-zA-Z0-9\-\_\s\.]+)\]"),0),
objectName=arrayindex(regextract(_raw_log ,"Object Name\=([a-zA-Z0-9\-\_\s\.]+)\]"),0),
sourceUserFirstName=arrayindex(regextract(_raw_log ,"TechnicianName\=([a-zA-Z0-9\-\_\s\.]+)\s"),0),
sourceUserLastName=arrayindex(regextract(_raw_log ,"TechnicianName\=[a-zA-Z0-9\-\_\s\.]+\s(\w+)\]"),0),
targetUserName=arrayindex(regextract(_raw_log ,"Alias\=(\w+)\]"),0),
country=arrayindex(regextract(_raw_log ,"Country\=([\w\s]+)\]"),0),
city=arrayindex(regextract(_raw_log ,"City\=([\w\s]+)\]"),0)
|alter xdm.observer.vendor=_vendor,
xdm.observer.product=_product,
xdm.observer.name=observername,
xdm.event.outcome=status,
xdm.event.type=action,
xdm.event.operation=operation,
xdm.target.domain=domainName,
xdm.source.user.first_name=sourceUserFirstName,
xdm.source.user.last_name=sourceUserLastName,
xdm.target.user.username=targetUserName,
xdm.target.location.country=country,
xdm.target.location.city=city;
filter _raw_log !~= "\<\d+\>"
|alter description=arrayindex(regextract(_raw_log,"^([A-Za-z\_\-0-9\:\,\'\s\.\"]+)\]"),0),
observername=arrayindex(regextract(_raw_log ,"\d{2}\:\d{2}\:\d{2}\s([a-zA-Z0-9\-\_\s\.]+)\s"),0),
status = arrayindex(regextract(_raw_log ,"Status\=([a-zA-Z0-9\-\_\s\.]+)\]?"),0),
operation = arrayindex(regextract(_raw_log ,"Task\=([a-zA-Z0-9\-\_\s\.]+)\]"),0),
action= arrayindex(regextract(_raw_log ,"ACTION\=([a-zA-Z0-9\-\_\s\.]+)\]"),0),
domainName=arrayindex(regextract(_raw_log ,"Domain Name\=([a-zA-Z0-9\-\_\s\.]+)\]"),0),
objectName=arrayindex(regextract(_raw_log ,"Object Name\=([a-zA-Z0-9\-\_\s\.]+)\]"),0),
sourceUserFirstName=arrayindex(regextract(_raw_log ,"TechnicianName\=([a-zA-Z0-9\-\_\s\.]+)\s"),0),
sourceUserLastName=arrayindex(regextract(_raw_log ,"TechnicianName\=[a-zA-Z0-9\-\_\s\.]+\s(\w+)\]"),0),
targetUserName=arrayindex(regextract(_raw_log ,"Alias\=(\w+)\]"),0),
country=arrayindex(regextract(_raw_log ,"Country\=([\w\s]+)\]"),0),
city=arrayindex(regextract(_raw_log ,"City\=([\w\s]+)\]"),0)
|alter xdm.observer.vendor=_vendor,
xdm.observer.product=_product,
xdm.observer.name=observername,
xdm.event.outcome=status,
xdm.event.type=action,
xdm.event.operation=operation,
xdm.target.domain=domainName,
xdm.source.user.first_name=sourceUserFirstName,
xdm.source.user.last_name=sourceUserLastName,
xdm.event.description=description,
xdm.target.user.username=targetUserName,
xdm.target.location.country=country,
xdm.target.location.city=city;

Schema

manageengine_admanager_raw

{
    "manageengine_admanager_raw": {
    "_raw_log": {
        "type": "string",
        "is_array": false
    },
    "_vendor": {
      "type": "string",
      "is_array": false
    },
    "_product": {
      "type": "string",
      "is_array": false
    }
  }
}