Rules (XIF)
[MODEL: dataset = microsoft_defender_for_cloud_raw]
// XDM mapping based on the alerts API schema (https://learn.microsoft.com/en-us/rest/api/defenderforcloud-composite/alerts?view=rest-defenderforcloud-composite-latest&preserve-view=true).
filter properties != null
// Fields extractions
| alter
Entities = json_extract_array(properties, "$.entities")
| alter
azureId = arraystring(arraymap(Entities, json_extract_scalar("@element", "$.azureID")), ","),
commandLine = arraystring(arraymap(Entities, json_extract_scalar("@element", "$.commandLine")), ","),
address = arraymap(Entities, json_extract_scalar("@element", "$.address")),
clientIPAddress = arraycreate(json_extract_scalar(properties, "$.extendedProperties.client IP Address")),
hostname = arraystring(arraymap(Entities, json_extract_scalar("@element", "$.hostName")), ",")
// Fields mapping
| alter
xdm.observer.unique_identifier = id,
xdm.observer.name = name,
xdm.alert.name = json_extract_scalar(properties, "$.alertDisplayName"),
xdm.alert.category = json_extract_scalar(properties, "$.alertType"),
xdm.alert.description = json_extract_scalar(properties, "$.description"),
xdm.source.user.domain = json_extract_scalar(properties, "$.extendedProperties.domain name"),
xdm.source.user.username = json_extract_scalar(properties, "$.extendedProperties.user name"),
xdm.source.process.pid = to_number(json_extract_scalar(properties, "$.extendedProperties.suspicious Process Id")),
xdm.source.process.name = json_extract_scalar(properties, "$.extendedProperties.suspicious Process"),
xdm.source.process.command_line = json_extract_scalar(properties, "$.extendedProperties.suspicious Command Line"),
xdm.alert.mitre_tactics = arraycreate(json_extract_scalar(properties, "$.extendedProperties.killChainIntent")),
xdm.source.host.ipv4_addresses = arraycreate(json_extract_scalar(properties, "$.extendedProperties.attacker IP Address")),
xdm.target.process.name = json_extract_scalar(properties, "$.extendedProperties.process name"),
xdm.target.process.pid = to_number(json_extract_scalar(properties, "$.extendedProperties.process id")),
xdm.target.process.parent_id = json_extract_scalar(properties, "$.extendedProperties.parent process id"),
xdm.observer.product = json_extract_scalar(properties, "$.productName"),
xdm.alert.severity = json_extract_scalar(properties, "$.severity"),
xdm.event.outcome_reason = json_extract_scalar(properties, "$.status"),
xdm.alert.original_alert_id = json_extract_scalar(properties, "$.systemAlertId"),
xdm.alert.mitre_techniques = json_extract_array(properties, "$.techniques"),
xdm.observer.vendor = json_extract_scalar(properties, "$.vendorName"),
xdm.observer.version = json_extract_scalar(properties, "$.version"),
xdm.observer.type = type,
xdm.target.resource.id = arraystring(arraymap(Entities, json_extract_scalar("@element", """$['$id']""")), ","),
xdm.target.host.fqdn = arraystring(arraymap(Entities, json_extract_scalar("@element", "$.dnsDomain")), ","),
xdm.target.host.os = arraystring(arraymap(Entities, json_extract_scalar("@element", "$.OsVersion")), ","),
xdm.target.host.os_family = arraystring(arraymap(Entities, json_extract_scalar("@element", "$.osFamily")), ","),
xdm.target.file.path = arraystring(arraymap(Entities, json_extract_scalar("@element", "$.directory")), ","),
xdm.target.file.filename = arraystring(arraymap(Entities, json_extract_scalar("@element", "$.name")), ","),
xdm.target.process.identifier = arraystring(arraymap(Entities, json_extract_scalar("@element", "$.processId")), ","),
xdm.target.agent.type = arraystring(arraymap(Entities, json_extract_scalar("@element", "$.type")), ","),
xdm.target.host.device_id = coalesce(azureId, json_extract_scalar(properties, "$.resourceIdentifiers.id")),
xdm.target.process.command_line = coalesce(commandLine, json_extract_scalar(properties, "$.extendedProperties.command line")),
xdm.target.host.ipv4_addresses = coalesce(address, clientIPAddress),
xdm.target.host.hostname = coalesce(json_extract_scalar(properties, "$.compromisedEntity"), hostname);
// XDM mapping based on the SecurityAlert schema (https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/SecurityAlert).
filter ExtendedProperties != null
| alter
Entities = Entities ->[],
ResourceIdentifiers = ResourceIdentifiers -> []
// Entities values
| alter
Entities_account_username = arraystring(arraymap(Entities, if(json_extract_scalar("@element", "$.Type") = "account" and json_extract_scalar("@element", "$.Name") not in ("", null), json_extract_scalar("@element", "$.Name"), json_extract_scalar("@element", "$.Type") = "account" and json_extract_scalar("@element", "$.Name") in ("", null), "-", null)), ", "),
Entities_account_Identifier = arraystring(arraymap(Entities, if(json_extract_scalar("@element", "$.Type") = "account" and json_extract_scalar("@element", "$.Sid") not in ("", null), json_extract_scalar("@element", "$.Sid"), json_extract_scalar("@element", "$.Type") = "account" and json_extract_scalar("@element", "$.AadUserId") not in ("", null), json_extract_scalar("@element", "$.AadUserId"), json_extract_scalar("@element", "$.Type") = "account" and json_extract_scalar("@element", "$.Id") not in ("", null), json_extract_scalar("@element", "$.Id"), json_extract_scalar("@element", "$.Type") = "account" and json_extract_scalar("@element", "$.Sid") in ("", null) and json_extract_scalar("@element", "$.Id") in ("", null) and json_extract_scalar("@element", "$.AadUserId") in ("", null), "-", null)), ", "),
Entities_account_LogonId = arraystring(arraymap(Entities, if(json_extract_scalar("@element", "$.Type") = "account" and json_extract_scalar("@element", "$.LogonId") not in ("", null), json_extract_scalar("@element", "$.LogonId"), json_extract_scalar("@element", "$.Type") = "account" and json_extract_scalar("@element", "$.LogonId") in ("", null), "-", null)), ", "),
Entities_host_HostName = arraystring(arraymap(Entities, if(json_extract_scalar("@element", "$.Type") = "host" and json_extract_scalar("@element", "$.HostName") not in ("", null), json_extract_scalar("@element", "$.HostName"), json_extract_scalar("@element", "$.Type") = "host" and json_extract_scalar("@element", "$.HostName") in ("", null), "-", null)), ", "),
Entities_host_OS = arraystring(arraymap(Entities, if(json_extract_scalar("@element", "$.Type") = "host" and json_extract_scalar("@element", "$.OSFamily") not in ("", null) and json_extract_scalar("@element", "$.OSVersion") not in ("", null), concat(json_extract_scalar("@element", "$.OSFamily"), " ", json_extract_scalar("@element", "$.OSVersion")), json_extract_scalar("@element", "$.Type") = "host" and json_extract_scalar("@element", "$.OSFamily") not in ("", null), json_extract_scalar("@element", "$.OSFamily"), json_extract_scalar("@element", "$.Type") = "host" and json_extract_scalar("@element", "$.OSFamily") in ("", null), "-", null)), ", "),
Entities_ip_address = arraymap(Entities, if(json_extract_scalar("@element", "$.Type") = "ip" and json_extract_scalar("@element", "$.Address") not in ("", null), json_extract_scalar("@element", "$.Address"), json_extract_scalar("@element", "$.Type") = "ip" and json_extract_scalar("@element", "$.Address") in ("", null), "-", null)),
Entities_process_id = arraystring(arraymap(Entities, if(json_extract_scalar("@element", "$.Type") = "process" and json_extract_scalar("@element", "$.ProcessId") not in ("", null), json_extract_scalar("@element", "$.ProcessId"), json_extract_scalar("@element", "$.Type") = "process" and json_extract_scalar("@element", "$.ProcessId") in ("", null), "-", null)), ", "),
Entities_process_commandline = arraystring(arraymap(Entities, if(json_extract_scalar("@element", "$.Type") = "process" and json_extract_scalar("@element", "$.CommandLine") not in ("", null), json_extract_scalar("@element", "$.CommandLine"), json_extract_scalar("@element", "$.Type") = "process" and json_extract_scalar("@element", "$.CommandLine") in ("", null), "-", null)), ", "),
Entities_process_image_filename = arraystring(arraymap(Entities, if(json_extract_scalar("@element", "$.Type") = "process" and json_extract_scalar("@element", "$.ImageFile.Name") not in ("", null), json_extract_scalar("@element", "$.ImageFile.Name"), json_extract_scalar("@element", "$.Type") = "process" and json_extract_scalar("@element", "$.ImageFile.Name") in ("", null), "-", null)), ", "),
Entities_process_image_directory = arraystring(arraymap(Entities, if(json_extract_scalar("@element", "$.Type") = "process" and json_extract_scalar("@element", "$.ImageFile.Directory") not in ("", null), json_extract_scalar("@element", "$.ImageFile.Directory"), json_extract_scalar("@element", "$.Type") = "process" and json_extract_scalar("@element", "$.ImageFile.Directory") in ("", null), "-", null)), ", "),
Entities_file_Name = arraystring(arraymap(Entities, if(json_extract_scalar("@element", "$.Type") = "file" and json_extract_scalar("@element", "$.Name") not in ("", null), json_extract_scalar("@element", "$.Name"), json_extract_scalar("@element", "$.Type") = "file" and json_extract_scalar("@element", "$.Name") in ("", null), "-", null)), ", "),
Entities_file_Directory = arraystring(arraymap(Entities, if(json_extract_scalar("@element", "$.Type") = "file" and json_extract_scalar("@element", "$.Directory") not in ("", null), json_extract_scalar("@element", "$.Directory"), json_extract_scalar("@element", "$.Type") = "file" and json_extract_scalar("@element", "$.Directory") in ("", null), "-", null)), ", "),
Entities_filehash_md5 = arraystring(arraymap(Entities, if(json_extract_scalar("@element", "$.Type") = "filehash" and json_extract_scalar("@element", "$.Value") not in ("", null) and json_extract_scalar("@element", "$.Algorithm") = "MD5", json_extract_scalar("@element", "$.Value"), json_extract_scalar("@element", "$.Type") = "filehash" and json_extract_scalar("@element", "$.Value") in ("", null) and json_extract_scalar("@element", "$.Algorithm") = "MD5", "-", null)), ", "),
Entities_filehash_sha256 = arraystring(arraymap(Entities, if(json_extract_scalar("@element", "$.Type") = "filehash" and json_extract_scalar("@element", "$.Value") not in ("", null) and json_extract_scalar("@element", "$.Algorithm") = "SHA256", json_extract_scalar("@element", "$.Value"), json_extract_scalar("@element", "$.Type") = "filehash" and json_extract_scalar("@element", "$.Value") in ("", null) and json_extract_scalar("@element", "$.Algorithm") = "SHA256", "-", null)), ", ")
// Entities IP fields filtering
| alter
Entities_ip_address_local_v4 = arraymap(Entities_ip_address, if(incidr("@element","10.0.0.0/8") or incidr("@element","127.0.0.0/8") or incidr("@element","169.254.0.0/16") or incidr("@element","172.16.0.0/12") or incidr("@element","192.168.0.0/16"), "@element", "-")),
//Entities_ip_address_local_v6 = arraymap(Entities_ip_address, if(incidr6("@element","fc00::/7") or incidr6("@element","fd00::/7") or incidr6("@element","fe80::/64") or incidr6("@element","::/128") or incidr6("@element","::1/128"), "@element", "-")),
Entities_ip_address_public_v4 = arraymap(Entities_ip_address, if(not incidr("@element","10.0.0.0/8") or not incidr("@element","127.0.0.0/8") or not incidr("@element","169.254.0.0/16") or not incidr("@element","172.16.0.0/12") or not incidr("@element","192.168.0.0/16"), "@element", "-")),
//Entities_ip_address_public_v6 = arraymap(Entities_ip_address, if(not incidr6("@element","fc00::/7") or not incidr6("@element","fd00::/7") or not incidr6("@element","fe80::/64") or not incidr6("@element","::/128") or not incidr6("@element","::1/128"), "@element", "-")),
Entities_ip_address_v6 = arraymap(Entities_ip_address, if("@element" ~= "(?:[a-fA-F\d]{0,4}\:){1,7}[a-fA-F\d]{0,4}", "@element", "-"))
// Remove empty entities fields values
| alter
Entities_account_username = if(Entities_account_username ~= "^[\,\s\-]+$" or Entities_account_username = "", null, Entities_account_username),
Entities_account_Identifier = if(Entities_account_Identifier ~= "^[\,\s\-]+$" or Entities_account_Identifier = "", null, Entities_account_Identifier),
Entities_account_LogonId = if(Entities_account_LogonId ~= "^[\,\s\-]+$" or Entities_account_LogonId = "", null, Entities_account_LogonId),
Entities_host_HostName = if(Entities_host_HostName ~= "^[\,\s\-]+$" or Entities_host_HostName = "", null, Entities_host_HostName),
Entities_host_OS = if(Entities_host_OS ~= "^[\,\s\-]+$" or Entities_host_OS = "", null, Entities_host_OS),
Entities_ip_address_local_v4 = if(arraystring(Entities_ip_address_local_v4, ",") ~= "^[\,\s\-]+$" or Entities_ip_address_local_v4 = "", null, Entities_ip_address_local_v4),
Entities_ip_address_public_v4 = if(arraystring(Entities_ip_address_public_v4, ",") ~= "^[\,\s\-]+$" or Entities_ip_address_public_v4 = "", null, Entities_ip_address_public_v4),
Entities_ip_address_v6 = if(arraystring(Entities_ip_address_v6, ",") ~= "^[\,\s\-]+$" or Entities_ip_address_v6 = "", null, Entities_ip_address_v6),
Entities_process_id = if(Entities_process_id ~= "^[\,\s\-]+$" or Entities_process_id = "", null, Entities_process_id),
Entities_process_commandline = if(Entities_process_commandline ~= "^[\,\s\-]+$" or Entities_process_commandline = "", null, Entities_process_commandline),
Entities_process_image_filename = if(Entities_process_image_filename ~= "^[\,\s\-]+$" or Entities_process_image_filename = "", null, Entities_process_image_filename),
Entities_process_image_directory = if(Entities_process_image_directory ~= "^[\,\s\-]+$" or Entities_process_image_directory = "", null, Entities_process_image_directory),
Entities_file_Name = if(Entities_file_Name ~= "^[\,\s\-]+$" or Entities_file_Name = "", null, Entities_file_Name),
Entities_file_Directory = if(Entities_file_Directory ~= "^[\,\s\-]+$" or Entities_file_Directory = "", null, Entities_file_Directory),
Entities_filehash_md5 = if(Entities_filehash_md5 ~= "^[\,\s\-]+$" or Entities_filehash_md5 = "", null, Entities_filehash_md5),
Entities_filehash_sha256 = if(Entities_filehash_sha256 ~= "^[\,\s\-]+$" or Entities_filehash_sha256 = "", null, Entities_filehash_sha256)
// ExtendedProperties values
| alter
ExtendedProperties_AAD_user_id = json_extract_scalar(ExtendedProperties, "$.AAD user ID"),
ExtendedProperties_Account_Session_Id = json_extract_scalar(ExtendedProperties, "$.Account Session Id"),
ExtendedProperties_Activity_type = json_extract_scalar(ExtendedProperties, "$.Activity type"),
ExtendedProperties_Application = json_extract_scalar(ExtendedProperties, "$.Application"),
ExtendedProperties_Application_name = json_extract_scalar(ExtendedProperties, "$.Application name"),
ExtendedProperties_Attacker_IP_Address_v4 = if(json_extract_scalar(ExtendedProperties, "$.Attacker IP Address") ~= "(?:\d{1,3}\.){3}\d{1,3}", json_extract_scalar(ExtendedProperties, "$.Attacker IP Address"), null),
ExtendedProperties_Attacker_IP_Address_v6 = if(json_extract_scalar(ExtendedProperties, "$.Attacker IP Address") ~= "(?:[a-fA-F\d]{0,4}\:){1,7}[a-fA-F\d]{0,4}", json_extract_scalar(ExtendedProperties, "$.Attacker IP Address"), null),
ExtendedProperties_Authentication_type = json_extract_scalar(ExtendedProperties, "$.Authentication type"),
ExtendedProperties_Client_Application = if(json_extract_scalar(ExtendedProperties, "$.Client Application") != null, json_extract_scalar(ExtendedProperties, "$.Client Application"), json_extract_scalar(ExtendedProperties, "$.Client application") != null, json_extract_scalar(ExtendedProperties, "$.Client application"), null),
ExtendedProperties_Client_Hostname = json_extract_scalar(ExtendedProperties, "$.Client Hostname"),
ExtendedProperties_Client_IP_Address_v4 = if(json_extract_scalar(ExtendedProperties, "$.Client IP Address") ~= "(?:\d{1,3}\.){3}\d{1,3}", json_extract_scalar(ExtendedProperties, "$.Client IP Address"), json_extract_scalar(ExtendedProperties, "$.Client IP address") ~= "(?:\d{1,3}\.){3}\d{1,3}", json_extract_scalar(ExtendedProperties, "$.Client IP address"), null),
ExtendedProperties_Client_IP_Address_v6 = if(json_extract_scalar(ExtendedProperties, "$.Client IP Address") ~= "(?:[a-fA-F\d]{0,4}\:){1,7}[a-fA-F\d]{0,4}", json_extract_scalar(ExtendedProperties, "$.Client IP Address"), json_extract_scalar(ExtendedProperties, "$.Client IP address") ~= "(?:[a-fA-F\d]{0,4}\:){1,7}[a-fA-F\d]{0,4}", json_extract_scalar(ExtendedProperties, "$.Client IP address"), null),
ExtendedProperties_Client_Principal_Name = if(json_extract_scalar(ExtendedProperties, "$.Client Principal Name") != null, json_extract_scalar(ExtendedProperties, "$.Client Principal Name"), json_extract_scalar(ExtendedProperties, "$.Client principal name") != null, json_extract_scalar(ExtendedProperties, "$.Client principal name"), null),
ExtendedProperties_Command = json_extract_scalar(ExtendedProperties, "$.Command"),
ExtendedProperties_Compromised_Host = json_extract_scalar(ExtendedProperties, "$.Compromised Host"),
ExtendedProperties_CompromisedEntity = json_extract_scalar(ExtendedProperties, "$.CompromisedEntity"),
ExtendedProperties_Database = json_extract_scalar(ExtendedProperties, "$.Database"),
ExtendedProperties_Database_name = json_extract_scalar(ExtendedProperties, "$.Database name"),
ExtendedProperties_file = json_extract_scalar(ExtendedProperties, "$.File"),
ExtendedProperties_IP_address_v4 = if(json_extract_scalar(ExtendedProperties, "$.IP address") ~= "(?:\d{1,3}\.){3}\d{1,3}", json_extract_scalar(ExtendedProperties, "$.IP address"), null),
ExtendedProperties_IP_address_v6 = if(json_extract_scalar(ExtendedProperties, "$.IP address") ~= "(?:[a-fA-F\d]{0,4}\:){1,7}[a-fA-F\d]{0,4}", json_extract_scalar(ExtendedProperties, "$.IP address"), null),
ExtendedProperties_Image_Name = if(json_extract_scalar(ExtendedProperties, "$.Image Name") != null, json_extract_scalar(ExtendedProperties, "$.Image Name"), json_extract_scalar(ExtendedProperties, "$.ImageName") != null, json_extract_scalar(ExtendedProperties, "$.ImageName"), null),
ExtendedProperties_Payload_size = multiply(to_number(arrayindex(regextract(json_extract_scalar(ExtendedProperties, "$['Payload Size (KB)']"), "(\d+)\.?\d*"),0)), 1024),
ExtendedProperties_Port = to_number(json_extract_scalar(ExtendedProperties, "$.Port")),
ExtendedProperties_Process_Id = json_extract_scalar(ExtendedProperties, "$.Process Id"),
ExtendedProperties_Process_Name = json_extract_scalar(ExtendedProperties, "$.Process Name"),
ExtendedProperties_Request_status = json_extract_scalar(ExtendedProperties, "$.Request status"),
ExtendedProperties_Resource_name = json_extract_scalar(ExtendedProperties, "$.Resource name"),
ExtendedProperties_Resource_Type = if(json_extract_scalar(ExtendedProperties, "$.Resource type") != null, json_extract_scalar(ExtendedProperties, "$.Resource type"), json_extract_scalar(ExtendedProperties, "$.resourceType") != null, json_extract_scalar(ExtendedProperties, "$.resourceType"), json_extract_scalar(ExtendedProperties, "$.ResourceType") != null, json_extract_scalar(ExtendedProperties, "$.ResourceType"), null),
ExtendedProperties_ResourceId = json_extract_scalar(ExtendedProperties, "$.ResourceId"),
ExtendedProperties_Result_Signature = json_extract_scalar(ExtendedProperties, "$.Result Signature"),
ExtendedProperties_SHA_256 = json_extract_scalar(ExtendedProperties, "$.SHA-256"),
ExtendedProperties_Source_IP_address_v4 = if(json_extract_scalar(ExtendedProperties, "$.Source IP address") ~= "(?:\d{1,3}\.){3}\d{1,3}", json_extract_scalar(ExtendedProperties, "$.Source IP address"), null),
ExtendedProperties_Source_IP_address_v6 = if(json_extract_scalar(ExtendedProperties, "$.Source IP address") ~= "(?:[a-fA-F\d]{0,4}\:){1,7}[a-fA-F\d]{0,4}", json_extract_scalar(ExtendedProperties, "$.Source IP address"), null),
ExtendedProperties_Status_Code = json_extract_scalar(ExtendedProperties, "$.Status Code"),
ExtendedProperties_Suspicious_Command_Line = if(json_extract_scalar(ExtendedProperties, "$.Suspicious Command Line") != null, json_extract_scalar(ExtendedProperties, "$.Suspicious Command Line"), json_extract_scalar(ExtendedProperties, "$.Suspicious command") != null, json_extract_scalar(ExtendedProperties, "$.Suspicious command"), null),
ExtendedProperties_Suspicious_Process = json_extract_scalar(ExtendedProperties, "$.Suspicious Process"),
ExtendedProperties_Suspicious_Process_Id = json_extract_scalar(ExtendedProperties, "$.Suspicious Process Id"),
ExtendedProperties_Top_anomalous_queries = json_extract_scalar(ExtendedProperties, "$.Top anomalous queries"),
ExtendedProperties_Top_suspicious_queries = json_extract_scalar(ExtendedProperties, "$.Top suspicious queries"),
ExtendedProperties_Known_Port = json_extract_scalar(ExtendedProperties, "$.Known Port"),
ExtendedProperties_URL = json_extract_scalar(ExtendedProperties, "$.URL"),
ExtendedProperties_Sensor_Id = json_extract_scalar(ExtendedProperties, "$.SensorId"),
ExtendedProperties_Device_Id = json_extract_scalar(ExtendedProperties, "$.DeviceId"),
ExtendedProperties_Source_Device = json_extract_scalar(extendedproperties, "$.SourceDevice"),
ExtendedProperties_Category = json_extract_scalar(ExtendedProperties, "$.Category"),
ExtendedProperties_Destination_Device = json_extract_scalar(extendedproperties, "$.DestinationDevice"),
ExtendedProperties_User_Principal_Name = json_extract_scalar(ExtendedProperties, "$.userprincipalname"),
ExtendedProperties_User_Name = if(json_extract_scalar(ExtendedProperties, "$.User Name") != null, json_extract_scalar(ExtendedProperties, "$.User Name"), json_extract_scalar(ExtendedProperties, "$.Username") != null, json_extract_scalar(ExtendedProperties, "$.Username"), null),
ExtendedProperties_User_Agent = json_extract_scalar(ExtendedProperties, "$.User agent"),
ExtendedProperties_Protocol = json_extract_scalar(ExtendedProperties, "$.Protocol"),
ExtendedProperties_Http_Method = json_extract_scalar(ExtendedProperties, "$['HTTP Request Method']")
// XDM fields
| alter
// Common fields
xdm.source.agent.identifier = if(AgentId != "", AgentId, null),
xdm.alert.name = coalesce(AlertDisplayName,AlertName),
xdm.alert.subcategory = AlertType,
xdm.session_context_id = if(CorrelationKey != "", CorrelationKey, null),
xdm.alert.description = Description,
xdm.alert.severity = coalesce(Severity,AlertSeverity),
xdm.alert.original_alert_id = SystemAlertId,
xdm.source.cloud.project_id = arraystring(arraymap(ResourceIdentifiers, if(json_extract_scalar("@element", "$.AzureResourceTenantId") != null, json_extract_scalar("@element", "$.AzureResourceTenantId"), json_extract_scalar("@element", "$.AadTenantId") != null, json_extract_scalar("@element", "$.AadTenantId"), json_extract_scalar("@element", "$.workspaceId") != null, json_extract_scalar("@element", "$.workspaceId"), "-")), ", "),
// Entities and Extended Properties fields
xdm.source.user.identifier = coalesce(ExtendedProperties_AAD_user_id, Entities_account_Identifier),
xdm.logon.logon_guid = coalesce(ExtendedProperties_Account_Session_Id, Entities_account_LogonId),
xdm.event.operation_sub_type = ExtendedProperties_Activity_type,
xdm.source.application.name = coalesce(ExtendedProperties_Application, ExtendedProperties_Application_name, ExtendedProperties_Client_Application),
xdm.source.ipv4 = coalesce(ExtendedProperties_Attacker_IP_Address_v4, ExtendedProperties_Source_IP_address_v4, SourceDeviceAddress),
xdm.source.ipv6 = coalesce(ExtendedProperties_Attacker_IP_Address_v6, ExtendedProperties_Source_IP_address_v6),
xdm.auth.service = ExtendedProperties_Authentication_type,
xdm.target.host.hostname = coalesce(ExtendedProperties_Client_Hostname, ExtendedProperties_Compromised_Host, Entities_host_HostName, ExtendedProperties_Destination_Device),
xdm.target.ipv4 = coalesce(ExtendedProperties_Client_IP_Address_v4, ExtendedProperties_IP_address_v4, DestinationDeviceAddress),
xdm.target.ipv6 = coalesce(ExtendedProperties_Client_IP_Address_v6, ExtendedProperties_IP_address_v6),
xdm.source.user.username = coalesce(ExtendedProperties_Client_Principal_Name, ExtendedProperties_User_Name, Entities_account_username, ExtendedProperties_User_Principal_Name),
xdm.source.process.command_line = coalesce(ExtendedProperties_Command, ExtendedProperties_Suspicious_Command_Line, Entities_process_commandline),
xdm.target.resource.name = coalesce(ExtendedProperties_CompromisedEntity, ExtendedProperties_Resource_name),
xdm.target.resource.type = ExtendedProperties_Resource_Type,
xdm.target.resource.id = ExtendedProperties_ResourceId,
xdm.observer.unique_identifier = ExtendedProperties_Device_Id,
xdm.database.name = coalesce(ExtendedProperties_Database, ExtendedProperties_Database_name),
xdm.target.file.filename = coalesce(ExtendedProperties_file, Entities_file_Name),
xdm.target.host.image = ExtendedProperties_Image_Name,
xdm.observer.name = ExtendedProperties_Sensor_Id,
xdm.source.host.hostname = ExtendedProperties_Source_Device,
xdm.target.sent_bytes = to_integer(ExtendedProperties_Payload_size),
xdm.target.port = coalesce(ExtendedProperties_Port, to_integer(arrayindex(regextract(ExtendedProperties_Known_Port,"\((\d+)\)$"),0))),
xdm.source.process.identifier = coalesce(ExtendedProperties_Process_Id, ExtendedProperties_Suspicious_Process_Id, Entities_process_id),
xdm.source.process.name = coalesce(ExtendedProperties_Process_Name, ExtendedProperties_Suspicious_Process),
xdm.event.outcome = if(lowercase(ExtendedProperties_Request_status) contains "succ", XDM_CONST.OUTCOME_SUCCESS, lowercase(ExtendedProperties_Request_status) contains "fail", XDM_CONST.OUTCOME_FAILED, lowercase(ExtendedProperties_Result_Signature) contains "ok", XDM_CONST.OUTCOME_SUCCESS, lowercase(ExtendedProperties_Result_Signature) contains "unauth" or lowercase(ExtendedProperties_Result_Signature) contains " not ", XDM_CONST.OUTCOME_FAILED, null),
xdm.target.file.sha256 = coalesce(ExtendedProperties_SHA_256, Entities_filehash_sha256),
xdm.network.http.response_code = if(ExtendedProperties_Status_Code = "100", XDM_CONST.HTTP_RSP_CODE_CONTINUE, ExtendedProperties_Status_Code = "101", XDM_CONST.HTTP_RSP_CODE_SWITCHING_PROTOCOLS, ExtendedProperties_Status_Code = "102", XDM_CONST.HTTP_RSP_CODE_PROCESSING, ExtendedProperties_Status_Code = "103", XDM_CONST.HTTP_RSP_CODE_EARLY_HINTS, ExtendedProperties_Status_Code = "200", XDM_CONST.HTTP_RSP_CODE_OK, ExtendedProperties_Status_Code = "201", XDM_CONST.HTTP_RSP_CODE_CREATED, ExtendedProperties_Status_Code = "202", XDM_CONST.HTTP_RSP_CODE_ACCEPTED, ExtendedProperties_Status_Code = "203", XDM_CONST.HTTP_RSP_CODE_NON__AUTHORITATIVE_INFORMATION, ExtendedProperties_Status_Code = "204", XDM_CONST.HTTP_RSP_CODE_NO_CONTENT, ExtendedProperties_Status_Code = "205", XDM_CONST.HTTP_RSP_CODE_RESET_CONTENT, ExtendedProperties_Status_Code = "206", XDM_CONST.HTTP_RSP_CODE_PARTIAL_CONTENT, ExtendedProperties_Status_Code = "207", XDM_CONST.HTTP_RSP_CODE_MULTI__STATUS, ExtendedProperties_Status_Code = "208", XDM_CONST.HTTP_RSP_CODE_ALREADY_REPORTED, ExtendedProperties_Status_Code = "226", XDM_CONST.HTTP_RSP_CODE_IM_USED, ExtendedProperties_Status_Code = "300", XDM_CONST.HTTP_RSP_CODE_MULTIPLE_CHOICES, ExtendedProperties_Status_Code = "301", XDM_CONST.HTTP_RSP_CODE_MOVED_PERMANENTLY, ExtendedProperties_Status_Code = "302", XDM_CONST.HTTP_RSP_CODE_FOUND, ExtendedProperties_Status_Code = "303", XDM_CONST.HTTP_RSP_CODE_SEE_OTHER, ExtendedProperties_Status_Code = "304", XDM_CONST.HTTP_RSP_CODE_NOT_MODIFIED, ExtendedProperties_Status_Code = "305", XDM_CONST.HTTP_RSP_CODE_USE_PROXY, ExtendedProperties_Status_Code = "307", XDM_CONST.HTTP_RSP_CODE_TEMPORARY_REDIRECT, ExtendedProperties_Status_Code = "308", XDM_CONST.HTTP_RSP_CODE_PERMANENT_REDIRECT, ExtendedProperties_Status_Code = "400", XDM_CONST.HTTP_RSP_CODE_BAD_REQUEST, ExtendedProperties_Status_Code = "401", XDM_CONST.HTTP_RSP_CODE_UNAUTHORIZED, ExtendedProperties_Status_Code = "402", XDM_CONST.HTTP_RSP_CODE_PAYMENT_REQUIRED, ExtendedProperties_Status_Code = "403", XDM_CONST.HTTP_RSP_CODE_FORBIDDEN, ExtendedProperties_Status_Code = "404", XDM_CONST.HTTP_RSP_CODE_NOT_FOUND, ExtendedProperties_Status_Code = "405", XDM_CONST.HTTP_RSP_CODE_METHOD_NOT_ALLOWED, ExtendedProperties_Status_Code = "406", XDM_CONST.HTTP_RSP_CODE_NOT_ACCEPTABLE, ExtendedProperties_Status_Code = "407", XDM_CONST.HTTP_RSP_CODE_PROXY_AUTHENTICATION_REQUIRED, ExtendedProperties_Status_Code = "408", XDM_CONST.HTTP_RSP_CODE_REQUEST_TIMEOUT, ExtendedProperties_Status_Code = "409", XDM_CONST.HTTP_RSP_CODE_CONFLICT, ExtendedProperties_Status_Code = "410", XDM_CONST.HTTP_RSP_CODE_GONE, ExtendedProperties_Status_Code = "411", XDM_CONST.HTTP_RSP_CODE_LENGTH_REQUIRED, ExtendedProperties_Status_Code = "412", XDM_CONST.HTTP_RSP_CODE_PRECONDITION_FAILED, ExtendedProperties_Status_Code = "413", XDM_CONST.HTTP_RSP_CODE_CONTENT_TOO_LARGE, ExtendedProperties_Status_Code = "414", XDM_CONST.HTTP_RSP_CODE_URI_TOO_LONG, ExtendedProperties_Status_Code = "415", XDM_CONST.HTTP_RSP_CODE_UNSUPPORTED_MEDIA_TYPE, ExtendedProperties_Status_Code = "416", XDM_CONST.HTTP_RSP_CODE_RANGE_NOT_SATISFIABLE, ExtendedProperties_Status_Code = "417", XDM_CONST.HTTP_RSP_CODE_EXPECTATION_FAILED, ExtendedProperties_Status_Code = "421", XDM_CONST.HTTP_RSP_CODE_MISDIRECTED_REQUEST, ExtendedProperties_Status_Code = "422", XDM_CONST.HTTP_RSP_CODE_UNPROCESSABLE_CONTENT, ExtendedProperties_Status_Code = "423", XDM_CONST.HTTP_RSP_CODE_LOCKED, ExtendedProperties_Status_Code = "424", XDM_CONST.HTTP_RSP_CODE_FAILED_DEPENDENCY, ExtendedProperties_Status_Code = "425", XDM_CONST.HTTP_RSP_CODE_TOO_EARLY, ExtendedProperties_Status_Code = "426", XDM_CONST.HTTP_RSP_CODE_UPGRADE_REQUIRED, ExtendedProperties_Status_Code = "428", XDM_CONST.HTTP_RSP_CODE_PRECONDITION_REQUIRED, ExtendedProperties_Status_Code = "429", XDM_CONST.HTTP_RSP_CODE_TOO_MANY_REQUESTS, ExtendedProperties_Status_Code = "431", XDM_CONST.HTTP_RSP_CODE_REQUEST_HEADER_FIELDS_TOO_LARGE, ExtendedProperties_Status_Code = "451", XDM_CONST.HTTP_RSP_CODE_UNAVAILABLE_FOR_LEGAL_REASONS, ExtendedProperties_Status_Code = "500", XDM_CONST.HTTP_RSP_CODE_INTERNAL_SERVER_ERROR, ExtendedProperties_Status_Code = "501", XDM_CONST.HTTP_RSP_CODE_NOT_IMPLEMENTED, ExtendedProperties_Status_Code = "502", XDM_CONST.HTTP_RSP_CODE_BAD_GATEWAY, ExtendedProperties_Status_Code = "503", XDM_CONST.HTTP_RSP_CODE_SERVICE_UNAVAILABLE, ExtendedProperties_Status_Code = "504", XDM_CONST.HTTP_RSP_CODE_GATEWAY_TIMEOUT, ExtendedProperties_Status_Code = "505", XDM_CONST.HTTP_RSP_CODE_HTTP_VERSION_NOT_SUPPORTED, ExtendedProperties_Status_Code = "506", XDM_CONST.HTTP_RSP_CODE_VARIANT_ALSO_NEGOTIATES, ExtendedProperties_Status_Code = "507", XDM_CONST.HTTP_RSP_CODE_INSUFFICIENT_STORAGE, ExtendedProperties_Status_Code = "508", XDM_CONST.HTTP_RSP_CODE_LOOP_DETECTED, ExtendedProperties_Status_Code = "511", XDM_CONST.HTTP_RSP_CODE_NETWORK_AUTHENTICATION_REQUIRED, ExtendedProperties_Status_Code = null, null, to_string(ExtendedProperties_Status_Code)),
xdm.database.statement = coalesce(ExtendedProperties_Top_anomalous_queries, ExtendedProperties_Top_suspicious_queries),
xdm.target.url = ExtendedProperties_URL,
xdm.source.user_agent = ExtendedProperties_User_Agent,
xdm.network.ip_protocol = arrayindex(regextract(ExtendedProperties_Known_Port,"^(\w+)\s*\(\d+\)$"),0),
xdm.target.file.directory = Entities_file_Directory,
xdm.network.application_protocol_category = ExtendedProperties_Protocol,
xdm.target.file.md5 = Entities_filehash_md5,
xdm.event.description = if(ProductName = "Azure Security Center for IoT", object_create("HasMultipleViolations",json_extract_scalar(extendedproperties, "$.HasMultipleViolations"),"isNew",json_extract_scalar(extendedproperties, "$.isNew"),"ProcessedBySentinel",json_extract_scalar(extendedproperties, "$.ProcessedBySentinel"),"isLearnable",json_extract_scalar(extendedproperties, "$.isLearnable")), null),
xdm.target.host.ipv4_addresses = Entities_ip_address_local_v4,
xdm.event.operation = ExtendedProperties_Category,
//xdm.target.host.ipv6_addresses = Entities_ip_address_local_v6,
xdm.target.host.ipv4_public_addresses = Entities_ip_address_public_v4,
//xdm.target.host.ipv6_public_addresses = Entities_ip_address_public_v6,
xdm.target.host.ipv6_addresses = Entities_ip_address_v6,
xdm.source.process.executable.directory = Entities_process_image_directory,
xdm.source.process.executable.filename = Entities_process_image_filename,
xdm.event.type = type,
xdm.source.host.device_id = VendorOriginalId,
xdm.alert.mitre_tactics = arraymap(Tactics -> [], if( "@element" ~= "Collection", XDM_CONST.MITRE_TACTIC_COLLECTION, "@element" ~= "CommandAndControl", XDM_CONST.MITRE_TACTIC_COMMAND_AND_CONTROL, "@element" ~= "CredentialAccess", XDM_CONST.MITRE_TACTIC_CREDENTIAL_ACCESS, "@element" ~= "DefenceEvasion", XDM_CONST.MITRE_TACTIC_DEFENSE_EVASION, "@element" ~= "Discovery", XDM_CONST.MITRE_TACTIC_DISCOVERY, "@element" ~= "Execution", XDM_CONST.MITRE_TACTIC_EXECUTION, "@element" ~= "Exfiltration", XDM_CONST.MITRE_TACTIC_EXFILTRATION, "@element" ~= "Impact", XDM_CONST.MITRE_TACTIC_IMPACT, "@element" ~= "InitialAccess", XDM_CONST.MITRE_TACTIC_INITIAL_ACCESS, "@element" ~= "LateralMovement", XDM_CONST.MITRE_TACTIC_LATERAL_MOVEMENT, "@element" ~= "Persistence", XDM_CONST.MITRE_TACTIC_PERSISTENCE, "@element" ~= "PrivilegeEscalation", XDM_CONST.MITRE_TACTIC_PRIVILEGE_ESCALATION, "@element" ~= "Reconnaissance", XDM_CONST.MITRE_TACTIC_RECONNAISSANCE, "@element" ~= "ResourceDevelopment", XDM_CONST.MITRE_TACTIC_RESOURCE_DEVELOPMENT, "@element")),
xdm.alert.mitre_techniques = arraymap(Techniques -> [], if("@element"~="T0800","ACTIVATE_FIRMWARE_UPDATE_MODE", "@element"~="T0830","ADVERSARY_IN_THE_MIDDLE", "@element"~="T0878","ALARM_SUPPRESSION", "@element"~="T0802","AUTOMATED_COLLECTION", "@element"~="T0895","AUTORUN_IMAGE", "@element"~="T0803","BLOCK_COMMAND_MESSAGE", "@element"~="T0804","BLOCK_REPORTING_MESSAGE", "@element"~="T0805","BLOCK_SERIAL_COM", "@element"~="T0806","BRUTE_FORCE_I/O", "@element"~="T0892","CHANGE_CREDENTIAL", "@element"~="T0858","CHANGE_OPERATING_MODE", "@element"~="T0807","COMMAND_LINE_INTERFACE", "@element"~="T0885","COMMONLY_USED_PORT", "@element"~="T0884","CONNECTION_PROXY", "@element"~="T0879","DAMAGE_TO_PROPERTY", "@element"~="T0809","DATA_DESTRUCTION", "@element"~="T0811","DATA_FROM_INFORMATION_REPOSITORIES", "@element"~="T0893","DATA_FROM_LOCAL_SYSTEM", "@element"~="T0812","DEFAULT_CREDENTIALS", "@element"~="T0813","DENIAL_OF_CONTROL", "@element"~="T0814","DENIAL_OF_SERVICE", "@element"~="T0815","DENIAL_OF_VIEW", "@element"~="T0868","DETECT_OPERATING_MODE", "@element"~="T0816","DEVICE_RESTART/SHUTDOWN", "@element"~="T0817","DRIVE_BY_COMPROMISE", "@element"~="T0871","EXECUTION_THROUGH_API", "@element"~="T0819","EXPLOIT_PUBLIC_FACING_APPLICATION", "@element"~="T0860","WIRELESS_COMPROMISE", "@element"~="T0887","WIRELESS_SNIFFING", "@element"~="T0820","EXPLOITATION_FOR_EVASION", "@element"~="T0890","EXPLOITATION_FOR_PRIVILEGE_ESCALATION", "@element"~="T0866","EXPLOITATION_OF_REMOTE_SERVICES", "@element"~="T0822","EXTERNAL_REMOTE_SERVICES", "@element"~="T0823","GRAPHICAL_USER_INTERFACE", "@element"~="T0891","HARDCODED_CREDENTIALS", "@element"~="T0874","HOOKING", "@element"~="T0877","I/O_IMAGE", "@element"~="T0872","INDICATOR_REMOVAL_ON_HOST", "@element"~="T0883","INTERNET_ACCESSIBLE_DEVICE", "@element"~="T0867","LATERAL_TOOL_TRANSFER", "@element"~="T0826","LOSS_OF_AVAILABILITY", "@element"~="T0827","LOSS_OF_CONTROL", "@element"~="T0828","LOSS_OF_PRODUCTIVITY_AND_REVENUE", "@element"~="T0837","LOSS_OF_PROTECTION", "@element"~="T0880","LOSS_OF_SAFETY", "@element"~="T0829","LOSS_OF_VIEW", "@element"~="T0835","MANIPULATE_I/O_IMAGE", "@element"~="T0831","MANIPULATION_OF_CONTROL", "@element"~="T0832","MANIPULATION_OF_VIEW", "@element"~="T0849","MASQUERADING", "@element"~="T0838","MODIFY_ALARM_SETTINGS", "@element"~="T0821","MODIFY_CONTROLLER_TASKING", "@element"~="T0836","MODIFY_PARAMETER", "@element"~="T0889","MODIFY_PROGRAM", "@element"~="T0839","MODULE_FIRMWARE", "@element"~="T0801","MONITOR_PROCESS_STATE", "@element"~="T0834","NATIVE_API", "@element"~="T0840","NETWORK_CONNECTION_ENUMERATION", "@element"~="T0842","NETWORK_SNIFFING", "@element"~="T0861","POINT&TAG_IDENTIFICATION", "@element"~="T0843","PROGRAM_DOWNLOAD", "@element"~="T0845","PROGRAM_UPLOAD", "@element"~="T0873","PROJECT_FILE_INFECTION", "@element"~="T0886","REMOTE_SERVICES", "@element"~="T0846","REMOTE_SYSTEM_DISCOVERY", "@element"~="T0888","REMOTE_SYSTEM_INFORMATION_DISCOVERY", "@element"~="T0847","REPLICATION_THROUGH_REMOVABLE_MEDIA", "@element"~="T0848","ROGUE_MASTER", "@element"~="T0851","ROOTKIT", "@element"~="T0852","SCREEN_CAPTURE", "@element"~="T0853","SCRIPTING", "@element"~="T0881","SERVICE_STOP", "@element"~="T0865","SPEARPHISHING_ATTACHMENT", "@element"~="T0856","SPOOF_REPORTING_MESSAGE", "@element"~="T0869","STANDARD_APPLICATION_LAYER_PROTOCOL", "@element"~="T0862","SUPPLY_CHAIN_COMPROMISE", "@element"~="T0894","SYSTEM_BINARY_PROXY_EXECUTION", "@element"~="T0857","SYSTEM_FIRMWARE", "@element"~="T0882","THEFT_OF_OPERATIONAL_INFORMATION", "@element"~="T0864","TRANSIENT_CYBER_ASSET", "@element"~="T0855","UNAUTHORIZED_COMMAND_MESSAGE", "@element"~="T0863","USER_EXECUTION", "@element"~="T0859","VALID_ACCOUNTS","@element")),
xdm.alert.category = ProductComponentName,
xdm.event.original_event_type = ProviderName,
xdm.network.http.method = if(ExtendedProperties_Http_Method = "GET", XDM_CONST.Http_Method_GET, ExtendedProperties_Http_Method = "POST", XDM_CONST.Http_Method_POST, ExtendedProperties_Http_Method = "PUT", XDM_CONST.Http_Method_PUT, ExtendedProperties_Http_Method = "OPTIONS", XDM_CONST.Http_Method_OPTIONS, ExtendedProperties_Http_Method = "CONNECT", XDM_CONST.Http_Method_CONNECT, ExtendedProperties_Http_Method = "ACL", XDM_CONST.Http_Method_ACL, ExtendedProperties_Http_Method = "BASELINE_CONTROL", XDM_CONST.Http_Method_BASELINE_CONTROL, ExtendedProperties_Http_Method = "BIND", XDM_CONST.Http_Method_BIND, ExtendedProperties_Http_Method = "CHECKIN", XDM_CONST.Http_Method_CHECKIN, ExtendedProperties_Http_Method = "CHECKOUT", XDM_CONST.Http_Method_CHECKOUT, ExtendedProperties_Http_Method = "COPY", XDM_CONST.Http_Method_COPY, ExtendedProperties_Http_Method = "DELETE", XDM_CONST.Http_Method_DELETE, ExtendedProperties_Http_Method = "HEAD", XDM_CONST.Http_Method_HEAD, ExtendedProperties_Http_Method = "LABEL", XDM_CONST.Http_Method_LABEL, ExtendedProperties_Http_Method = "LINK", XDM_CONST.Http_Method_LINK, ExtendedProperties_Http_Method = "LOCK", XDM_CONST.Http_Method_LOCK, ExtendedProperties_Http_Method = "MERGE", XDM_CONST.Http_Method_MERGE, ExtendedProperties_Http_Method = "MKACTIVITY", XDM_CONST.Http_Method_MKACTIVITY, ExtendedProperties_Http_Method = "MKCALENDAR", XDM_CONST.Http_Method_MKCALENDAR, ExtendedProperties_Http_Method = "MKCOL", XDM_CONST.Http_Method_MKCOL, ExtendedProperties_Http_Method = "MKREDIRECTREF", XDM_CONST.Http_Method_MKREDIRECTREF, ExtendedProperties_Http_Method = "MKWORKSPACE", XDM_CONST.Http_Method_MKWORKSPACE, ExtendedProperties_Http_Method = "MOVE", XDM_CONST.Http_Method_MOVE, ExtendedProperties_Http_Method = "ORDERPATCH", XDM_CONST.Http_Method_ORDERPATCH, ExtendedProperties_Http_Method = "PATCH", XDM_CONST.Http_Method_PATCH, ExtendedProperties_Http_Method = "PRI", XDM_CONST.Http_Method_PRI, ExtendedProperties_Http_Method = "PROPFIND", XDM_CONST.Http_Method_PROPFIND, ExtendedProperties_Http_Method = "PROPPATCH", XDM_CONST.Http_Method_PROPPATCH, ExtendedProperties_Http_Method = "REBIND", XDM_CONST.Http_Method_REBIND, ExtendedProperties_Http_Method = "REPORT", XDM_CONST.Http_Method_REPORT, ExtendedProperties_Http_Method = "SEARCH", XDM_CONST.Http_Method_SEARCH, ExtendedProperties_Http_Method = "TRACE", XDM_CONST.Http_Method_TRACE, ExtendedProperties_Http_Method = "UNBIND", XDM_CONST.Http_Method_UNBIND, ExtendedProperties_Http_Method = "UNCHECKOUT", XDM_CONST.Http_Method_UNCHECKOUT, ExtendedProperties_Http_Method = "UNLINK", XDM_CONST.Http_Method_UNLINK, ExtendedProperties_Http_Method = "UNLOCK", XDM_CONST.Http_Method_UNLOCK, ExtendedProperties_Http_Method = "UPDATE", XDM_CONST.Http_Method_UPDATE, ExtendedProperties_Http_Method = "UPDATEREDIRECTREF", XDM_CONST.Http_Method_UPDATEREDIRECTREF, ExtendedProperties_Http_Method = "VERSION_CONTROL", XDM_CONST.Http_Method_VERSION_CONTROL, null),
xdm.target.host.os = Entities_host_OS;