Menlo Security Modeling Rule

Modeling Rule

Menlo Security

Details

IDMenlo_Security_ModelingRule
From Version8.4.0

Schema

menlo_security_ip_raw

Field Type Array?
action string
audit_actions string
bytes int
categories string
ccl_ids string
content_type string
delivered_to string
document_type string
domain string
dst string
dst_from_port int
dst_ip string
dst_url string
egress_ip string
file_size string
file_type string
filename string
from string
hostname string
message_id string
name string
next_hop_reason string
origin_country string
origin_ip string
pe_action string
pe_rulename string
protocol string
reason string
referer string
region string
reply_to string
request_type string
response_code string
risk_score string
rule_name string
sha256 string
source_log_type string
src_ip string
src_port int
sub_event_type string
subject string
threat_types string
threats string
to string
uid string
url string
user_agent string
userid string
version string
x_client_ip string
[MODEL: dataset = menlo_security_ip_raw]
alter
    tmp_request_type = uppercase(to_string(request_type)),
    tmp_action = lowercase(to_string(coalesce(pe_action, action))),
    tmp_risk_score = lowercase(to_string(risk_score)),
    tmp_protocol = uppercase(to_string(protocol)),
    // `dst` is a string column holding either a JSON-array-string of IPs or a single bare IP;
    // regextract handles both forms uniformly.
    tmp_dst_ipv4_list = regextract(to_string(dst), "(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})")
| alter
    xdm.event.type = source_log_type,
    xdm.event.original_event_type = coalesce(name, audit_actions, sub_event_type),
    xdm.event.outcome_reason = coalesce(next_hop_reason, reason),
    xdm.source.ipv4 = coalesce(x_client_ip, src_ip),
    xdm.source.port = to_integer(src_port),
    xdm.source.user.username = coalesce(userid, uid),
    xdm.source.user_agent = user_agent,
    xdm.intermediate.ipv4 = egress_ip,
    xdm.intermediate.is_proxy = if(egress_ip != null and egress_ip != "", true), 
    xdm.intermediate.cloud.region = region,
    xdm.target.ipv4 = coalesce(origin_ip, dst_ip),
    xdm.target.port = to_integer(dst_from_port),
    xdm.target.host.ipv4_addresses = tmp_dst_ipv4_list,
    xdm.target.url = coalesce(url, dst_url),
    xdm.target.domain = domain,
    xdm.target.location.country = origin_country,
    xdm.target.file.filename = filename,
    xdm.target.file.sha256 = sha256,
    xdm.target.file.size = coalesce(to_integer(file_size), to_integer(bytes)),
    xdm.target.file.file_type = coalesce(file_type, document_type),
    xdm.email.sender = coalesce(from, reply_to),
    xdm.email.recipients = arraycreate(coalesce(to, delivered_to)),
    xdm.email.subject = subject,
    xdm.email.message_id = message_id,
    xdm.network.application_protocol = tmp_protocol,
    xdm.network.rule = coalesce(pe_rulename, rule_name),
    xdm.network.http.method = if(tmp_request_type = "GET", XDM_CONST.HTTP_METHOD_GET, tmp_request_type = "POST", XDM_CONST.HTTP_METHOD_POST, tmp_request_type = "PUT", XDM_CONST.HTTP_METHOD_PUT, tmp_request_type = "DELETE", XDM_CONST.HTTP_METHOD_DELETE, tmp_request_type = "PATCH", XDM_CONST.HTTP_METHOD_PATCH, tmp_request_type = "HEAD", XDM_CONST.HTTP_METHOD_HEAD, tmp_request_type = "OPTIONS", XDM_CONST.HTTP_METHOD_OPTIONS, tmp_request_type = "CONNECT", XDM_CONST.HTTP_METHOD_CONNECT, tmp_request_type = "TRACE", XDM_CONST.HTTP_METHOD_TRACE, null),
    xdm.network.http.url = coalesce(url, dst_url),
    xdm.network.http.url_category = categories,
    xdm.network.http.content_type = content_type,
    xdm.network.http.referrer = referer,
    xdm.network.http.response_code = to_string(response_code),
    xdm.observer.action = if(tmp_action = "block", "Block", tmp_action = "allow", "Allow", tmp_action = "isolate", "Redirect", tmp_action = "direct", "Allow", tmp_action = "ssl_exception", "Allow", tmp_action = "log", "Alert", null),
    xdm.intermediate.host.hostname = hostname,
    xdm.observer.version = version,
    xdm.alert.name = threats,
    xdm.alert.category = coalesce(threat_types, ccl_ids),
    xdm.alert.severity = if(tmp_risk_score = "high", "High", tmp_risk_score = "medium", "Medium", tmp_risk_score = "low", "Low", null);