Microsoft DHCP Modeling Rule

Details

Rules (XIF)

[MODEL: dataset="microsoft_dhcp_raw"]
alter
    xdm.event.description = description,
    xdm.source.ipv4 = ipAddress,
    xdm.source.host.hostname = hostName,
    xdm.source.host.mac_addresses = arraycreate(coalesce(macAddress,"")),
    xdm.source.user.username = userName,
    xdm.event.operation_sub_type = id,
    xdm.session_context_id = transactionID,
    xdm.event.outcome = if(qResult="6",XDM_CONST.OUTCOME_SUCCESS ,qResult="0",XDM_CONST.OUTCOME_SUCCESS,XDM_CONST.OUTCOME_FAILED),
    xdm.event.outcome_reason = if(qResult="6","No Quarantine",qResult="0","NoQuarantine",qResult="1", "Quarantine", qResult="2", "Drop Packet", qResult="3", "Probation",qResult),
    xdm.target.host.hostname = json_extract_scalar(fb_host,"$.hostname"),
    xdm.target.ipv4 = arrayindex(regextract(to_string(json_extract(fb_host, "$.ip")), "(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"), 0),
    xdm.target.ipv6 = arrayindex(regextract(to_string(json_extract(fb_host, "$.ip")), "([a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5})"), 0);

Schema

microsoft_dhcp_raw

{
  "microsoft_dhcp_raw": {
    "description": {
      "type": "string",
      "is_array": false
    },
    "ipAddress": {
      "type": "string",
      "is_array": false
    },      
    "fb_host": {
      "type": "string",
      "is_array": false
    },
    "hostName": {
      "type": "string",
      "is_array": false
    },
    "macAddress": {
      "type": "string",
      "is_array": false
    },
    "userName": {
      "type": "string",
      "is_array": false
    },
    "id": {
      "type": "string",
      "is_array": false
    },
    "transactionID": {
      "type": "string",
      "is_array": false
    },
    "qResult": {
      "type": "string",
      "is_array": false
    }
  }
}