Microsoft Exchange Server Modeling Rule

Details

ID	`microsoft_exchange_server_modeling_rule`
From Version	6.10.0
Tags	microsoft

Rules (XIF)

[MODEL: dataset="msft_exchange_raw"]
//alter _time = date_time
alter  xdm.source.host.ipv4_addresses = arraycreate(coalesce(client_ip, "")),
	xdm.source.host.hostname = client_hostname,
	xdm.target.host.ipv4_addresses = arraycreate(coalesce(server_ip, "")),
	xdm.target.host.hostname = server_hostname,
	xdm.event.type = event_id,
	xdm.event.id = internal_message_id,
	xdm.email.message_id = message_id,
	xdm.session_context_id = network_message_id,
	xdm.email.recipients = arraycreate(coalesce(recipient_address, "")),
	xdm.email.subject = message_subject,
	xdm.email.sender = sender_address,
	xdm.email.return_path = if(return_path = "<>",null,return_path),
	xdm.event.description = message_info,
	xdm.observer.unique_identifier = tenant_id,
	xdm.observer.content_version = schema_version;

Schema

`msft_exchange_raw`

Field	Type	Array?
`client_hostname`	string	—
`client_ip`	string	—
`date_time`	datetime	—
`event_id`	string	—
`internal_message_id`	string	—
`message_id`	string	—
`message_info`	string	—
`message_subject`	string	—
`network_message_id`	string	—
`recipient_address`	string	—
`return_path`	string	—
`schema_version`	string	—
`sender_address`	string	—
`server_hostname`	string	—
`server_ip`	string	—
`tenant_id`	string	—

Raw JSON

{
    "msft_exchange_raw": {
        "date_time": {
            "type": "datetime",
            "is_array": false
        },
        "client_ip": {
            "type": "string",
            "is_array": false
        },
        "client_hostname": {
            "type": "string",
            "is_array": false
        },
        "server_ip": {
            "type": "string",
            "is_array": false
        },
        "server_hostname": {
            "type": "string",
            "is_array": false
        },
        "event_id": {
            "type": "string",
            "is_array": false
        },
        "internal_message_id": {
            "type": "string",
            "is_array": false
        },
        "message_id": {
            "type": "string",
            "is_array": false
        },
        "network_message_id": {
            "type": "string",
            "is_array": false
        },
        "recipient_address": {
            "type": "string",
            "is_array": false
        },
        "message_subject": {
            "type": "string",
            "is_array": false
        },
        "sender_address": {
            "type": "string",
            "is_array": false
        },
        "return_path": {
            "type": "string",
            "is_array": false
        },
        "message_info": {
            "type": "string",
            "is_array": false
        },
        "tenant_id": {
            "type": "string",
            "is_array": false
        },
        "schema_version": {
            "type": "string",
            "is_array": false
        }
    }
}