[MODEL: dataset = "mcafee_epo_raw"]
alter
agent_ipv4 = if(IPAddress ~= "(?:\d{1,3}\.){3}\d{1,3}", IPAddress),
analyzer_mac = uppercase(arraystring(regextract(AnalyzerMAC, "(\w{2})"), ":")),
os = lowercase(OSType),
source_mac = uppercase(arraystring(regextract(SourceMAC, "(\w{2})"), ":")),
target_directory = coalesce(TargetPath, arrayindex(regextract(TargetFileName, "^(.+?)\\[^\\]+$"), 0)),
target_file_name = coalesce(TargetName, arrayindex(regextract(TargetFileName, "\\([^\\]+)$"), 0)),
target_mac = uppercase(arraystring(regextract(TargetMAC, "(\w{2})"), ":")),
target_process_name = arrayindex(regextract(TargetProcessName, "\\([^\\]+)$"), 0),
target_process_signer = arrayindex(regextract(TargetSigner, "CN=([^,]+)"), 0),
threat_event_id = to_string(ThreatEventID),
threat_name = if(ThreatName != "_", ThreatName)
| alter
xdm.alert.category = ThreatCategory,
xdm.alert.name = threat_name,
xdm.alert.original_alert_id = to_string(AutoID),
xdm.alert.original_threat_id = threat_event_id,
xdm.alert.original_threat_name = threat_name,
xdm.alert.severity = to_string(ThreatSeverity),
xdm.event.id = threat_event_id,
xdm.event.is_completed = to_boolean(ThreatHandled),
xdm.network.rule = AnalyzerRuleName,
xdm.observer.action = if(ThreatActionTaken != "", ThreatActionTaken),
xdm.observer.content_version = AnalyzerContentVersion,
xdm.observer.name = AnalyzerHostName,
xdm.observer.type = AnalyzerName,
xdm.observer.unique_identifier = AgentGUID,
xdm.observer.version = AnalyzerVersion,
xdm.source.host.device_category = OSPlatform,
xdm.source.host.fqdn = IPHostName,
xdm.source.host.hostname = coalesce(SourceHostName, NodeName, IPHostName, AnalyzerHostName),
xdm.source.host.mac_addresses = if(source_mac != null or analyzer_mac != null, arraydistinct(arraycreate(source_mac, analyzer_mac))),
xdm.source.host.os = OSType,
xdm.source.host.os_family = if(os contains "windows", XDM_CONST.OS_FAMILY_WINDOWS, os contains "mac", XDM_CONST.OS_FAMILY_MACOS, os contains "linux", XDM_CONST.OS_FAMILY_LINUX, os contains "android", XDM_CONST.OS_FAMILY_ANDROID, os contains "ios", XDM_CONST.OS_FAMILY_IOS, os contains "ubuntu", XDM_CONST.OS_FAMILY_UBUNTU, os contains "debian", XDM_CONST.OS_FAMILY_DEBIAN, os contains "fedora", XDM_CONST.OS_FAMILY_FEDORA, os contains "centos", XDM_CONST.OS_FAMILY_CENTOS, os contains "chrome", XDM_CONST.OS_FAMILY_CHROMEOS, os contains "solaris", XDM_CONST.OS_FAMILY_SOLARIS, os contains "scada", XDM_CONST.OS_FAMILY_SCADA),
xdm.source.interface = coalesce(source_mac, analyzer_mac),
xdm.source.ipv4 = agent_ipv4,
xdm.source.port = to_integer(SourcePort),
xdm.source.process.executable.directory = SourceFilePath,
xdm.source.process.executable.extension = arrayindex(regextract(SourceProcessName, "\.(.+)"), 0),
xdm.source.process.executable.filename = SourceProcessName,
xdm.source.process.executable.md5 = SourceProcessHash,
xdm.source.process.executable.path = concat(SourceFilePath, "\\", SourceProcessName),
xdm.source.process.parent_id = SourceParentProcessName,
xdm.source.user.username = SourceUserName,
xdm.source.identity.username = SourceUserName,
xdm.target.file.directory = target_directory,
xdm.target.file.extension = arrayindex(split(TargetFileName, "."), -1),
xdm.target.file.filename = target_file_name,
xdm.target.file.md5 = coalesce(TargetHash, FileMD5Hash),
xdm.target.file.path = TargetFileName,
xdm.target.host.hostname = TargetHostName,
xdm.target.host.mac_addresses = if(target_mac != null, arraycreate(target_mac)),
xdm.target.interface = target_mac,
xdm.target.port = to_integer(TargetPort),
xdm.target.process.executable.extension = arrayindex(split(TargetProcessName, "."), -1),
xdm.target.process.executable.filename = target_process_name,
xdm.target.process.executable.is_signed = to_boolean(TargetSigned),
xdm.target.process.executable.path = TargetProcessName,
xdm.target.process.executable.signer = target_process_signer,
xdm.target.url = TargetURL,
xdm.target.user.username = TargetUserName, xdm.target.identity.username = TargetUserName;