ManageEngine ADSelfService Plus Modeling Rule

Details

Rules (XIF)

[MODEL: dataset="manageengine_adssp_raw"]
alter
        status = lowercase(arrayindex(regextract(msg, "STATUS=([^\]]+)"), 0)),
        name = arrayindex(regextract(msg, "\[NAME=([^\]]+)"), 0),
        login_name = arrayindex(regextract(msg, "LOGIN NAME=([^\]]+)"), 0),
        reason_for_restriction = arrayindex(regextract(msg, "REASON_FOR_RESTRICTION=([^\]]+)"), 0)
| alter
        status = if(status contains "success", "success", status contains "invalid" or status contains "denied" or status contains "failed" or status contains "incorrect" or status contains "not found" or status contains "cannot","failed", to_string(status))
| alter
        xdm.observer.name = dvchost,
        xdm.observer.unique_identifier = dvc,
        xdm.event.outcome = if(status contains "success", XDM_CONST.OUTCOME_SUCCESS, status contains "failed", XDM_CONST.OUTCOME_FAILED, to_string(status)),
        xdm.event.outcome_reason = if(status != "success" and status != "failed" and (status != null and status != ""), status, status = null or status = "", reason_for_restriction, null),
        xdm.source.ipv4 = arrayindex(regextract(msg, "IP=(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"), 0),
        xdm.source.ipv6 = arrayindex(regextract(msg, "IP=([a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5})"), 0),
        xdm.source.host.hostname = arrayindex(regextract(msg, "HOST=([^\]]+)"), 0),
        xdm.source.user.domain = arrayindex(regextract(msg, "DOMAIN[_\s]?NAME=([^\]]+)"), 0),
        xdm.source.user.username = if(name != null and name != "", name, login_name != null and login_name != "", login_name, null),
        xdm.auth.service = arrayindex(regextract(msg, "ACCESS_MODE=([^\]]+)"), 0),
        xdm.event.type = arrayindex(regextract(msg, "ACTION_NAME=([^\]]+)"), 0),
        xdm.target.user.username = replex(to_string(arrayindex(regextract(msg, "USERS_LIST=\[([^\]]+)"), 0)), "\"", ""),
        xdm.alert.severity = cefSeverity;

Schema

manageengine_adssp_raw

{
    "manageengine_adssp_raw": {
        "msg": {
            "type": "string",
            "is_array": false
        },
        "dvchost": {
            "type": "string",
            "is_array": false
        },
        "dvc": {
            "type": "string",
            "is_array": false
        },
        "cefSeverity": {
            "type": "string",
            "is_array": false
        }
    }
}