Microsoft Exchange Server Modeling Rule

Details

ID	`Microsoft_Exchange_Server_Modeling_Rule`
From Version	6.8.0
To Version	6.9.9
Tags	microsoft

Rules (XIF)

[MODEL: dataset="msft_exchange_raw", model="Email"]
alter XDM.Email.event_timestamp = date_time
| alter    XDM.Email.Client.host.ipv4_addresses = arraycreate(coalesce(client_ip, "")) 
| alter    XDM.Email.Client.host.hostname = client_hostname
| alter    XDM.Email.Server.host.ipv4_addresses = arraycreate(coalesce(server_ip, ""))
| alter    XDM.Email.Server.host.hostname = server_hostname
| alter    XDM.Email.original_event_type = event_id
| alter    XDM.Email.original_event_id = internal_message_id
| alter    XDM.Email.message_id = message_id
| alter    XDM.Email.session_context_id = network_message_id
| alter    XDM.Email.recipients = arraycreate(coalesce(recipient_address, ""))
| alter    XDM.Email.subject = message_subject
| alter    XDM.Email.sender = sender_address
| alter    XDM.Email.sender = sender_address
| alter    XDM.Email.return_path = return_path
| alter    XDM.Email.original_event_description = message_info
| alter    XDM.Email.Observer.unique_identifier = tenant_id
| alter    XDM.Email.Observer.content_version = schema_version;

Schema

`msft_exchange_raw`

Field	Type	Array?
`client_hostname`	string	—
`client_ip`	string	—
`date_time`	string	—
`event_id`	string	—
`internal_message_id`	string	—
`message_id`	string	—
`message_info`	string	—
`message_subject`	string	—
`network_message_id`	string	—
`recipient_address`	string	—
`return_path`	string	—
`schema_version`	string	—
`sender_address`	string	—
`server_hostname`	string	—
`server_ip`	string	—
`tenant_id`	string	—

Raw JSON

{
    "msft_exchange_raw": {
        "date_time": {
            "type": "string",
            "is_array": false
        },
        "client_ip": {
            "type": "string",
            "is_array": false
        },
        "client_hostname": {
            "type": "string",
            "is_array": false
        },
        "server_ip": {
            "type": "string",
            "is_array": false
        },
        "server_hostname": {
            "type": "string",
            "is_array": false
        },
        "event_id": {
            "type": "string",
            "is_array": false
        },
        "internal_message_id": {
            "type": "string",
            "is_array": false
        },
        "message_id": {
            "type": "string",
            "is_array": false
        },
        "network_message_id": {
            "type": "string",
            "is_array": false
        },
        "recipient_address": {
            "type": "string",
            "is_array": false
        },
        "message_subject": {
            "type": "string",
            "is_array": false
        },
        "sender_address": {
            "type": "string",
            "is_array": false
        },
        "return_path": {
            "type": "string",
            "is_array": false
        },
        "message_info": {
            "type": "string",
            "is_array": false
        },
        "tenant_id": {
            "type": "string",
            "is_array": false
        },
        "schema_version": {
            "type": "string",
            "is_array": false
        }
    }
}