Microsoft Exchange Server Modeling Rule

Details

ID	`microsoft_exchange_server_modeling_rule`
From Version	6.10.0
Tags	microsoft

Schema

`msft_exchange_raw`

Field	Type	Array?
`client_hostname`	string	—
`client_ip`	string	—
`date_time`	datetime	—
`event_id`	string	—
`internal_message_id`	string	—
`message_id`	string	—
`message_info`	string	—
`message_subject`	string	—
`network_message_id`	string	—
`recipient_address`	string	—
`return_path`	string	—
`schema_version`	string	—
`sender_address`	string	—
`server_hostname`	string	—
`server_ip`	string	—
`tenant_id`	string	—

Source

MicrosoftExchangeServerModeling_1_3.xif MicrosoftExchangeServerModeling_1_3.yml MicrosoftExchangeServerModeling_1_3_schema.json

Download History Raw

[MODEL: dataset="msft_exchange_raw"]
//alter _time = date_time
alter  xdm.source.host.ipv4_addresses = arraycreate(coalesce(client_ip, "")),
	xdm.source.host.hostname = client_hostname,
	xdm.target.host.ipv4_addresses = arraycreate(coalesce(server_ip, "")),
	xdm.target.host.hostname = server_hostname,
	xdm.event.type = event_id,
	xdm.event.id = internal_message_id,
	xdm.email.message_id = message_id,
	xdm.session_context_id = network_message_id,
	xdm.email.recipients = arraycreate(coalesce(recipient_address, "")),
	xdm.email.subject = message_subject,
	xdm.email.sender = sender_address,
	xdm.email.return_path = if(return_path = "<>",null,return_path),
	xdm.event.description = message_info,
	xdm.observer.unique_identifier = tenant_id,
	xdm.observer.content_version = schema_version;