Rules (XIF)
[MODEL: dataset = mcafee_database_security_raw]
alter act = uppercase(act)
| alter
xdm.database.operation = if(act = "QUERY", XDM_CONST.DB_OPERATION_QUERY, act = "UPDATE", XDM_CONST.DB_OPERATION_UPDATE, act = "CREATE", XDM_CONST.DB_OPERATION_CREATE, act = "DELETE", XDM_CONST.DB_OPERATION_DELETE, act = "ALTER", XDM_CONST.DB_OPERATION_ALTER, to_string(act)),
xdm.source.ipv4 = if(src ~= "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}", src, null),
xdm.source.ipv6 = if(src ~= "[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}", src, null),
xdm.source.agent.identifier = dst,
xdm.target.process.name = dproc,
xdm.target.user.username = duser,
xdm.source.host.hostname = shost,
xdm.source.user.username = suser,
xdm.event.type = cefDeviceEventClassId,
xdm.event.id = externalId,
xdm.event.description = cefName,
xdm.alert.severity = cefSeverity,
xdm.database.name = if(cs1Label = "DBMS", cs1, null),
xdm.database.statement = if(cs2Label = "SqlStatement", cs2, null),
xdm.target.resource.name = if(cs3Label contains "AccessedObjects", cs3, null);
Schema
mcafee_database_security_raw
| Field |
Type |
Array? |
act |
string |
— |
cefDeviceEventClassId |
string |
— |
cefName |
string |
— |
cefSeverity |
string |
— |
cs1 |
string |
— |
cs1Label |
string |
— |
cs2 |
string |
— |
cs2Label |
string |
— |
cs3 |
string |
— |
cs3Label |
string |
— |
dproc |
string |
— |
dst |
string |
— |
duser |
string |
— |
externalId |
string |
— |
shost |
string |
— |
src |
string |
— |
suser |
string |
— |
Raw JSON
{
"mcafee_database_security_raw": {
"act": {
"type": "string",
"is_array": false
},
"src": {
"type": "string",
"is_array": false
},
"dst": {
"type": "string",
"is_array": false
},
"dproc": {
"type": "string",
"is_array": false
},
"duser": {
"type": "string",
"is_array": false
},
"shost": {
"type": "string",
"is_array": false
},
"suser": {
"type": "string",
"is_array": false
},
"cefDeviceEventClassId": {
"type": "string",
"is_array": false
},
"externalId": {
"type": "string",
"is_array": false
},
"cefName": {
"type": "string",
"is_array": false
},
"cefSeverity": {
"type": "string",
"is_array": false
},
"cs1Label": {
"type": "string",
"is_array": false
},
"cs1": {
"type": "string",
"is_array": false
},
"cs2Label": {
"type": "string",
"is_array": false
},
"cs2": {
"type": "string",
"is_array": false
},
"cs3Label": {
"type": "string",
"is_array": false
},
"cs3": {
"type": "string",
"is_array": false
}
}
}