Rules (XIF)
[MODEL: dataset="iis_iis_raw"]
call microsoft_iis_modeling;
[RULE: microsoft_iis_modeling]
alter // extract pre-parsed fields from the parsed_fields JSON object
c_ip = parsed_fields -> c_ip, // The IP address of the affected client that can be either an IPv4 address or an IPv6 address. If the client IP address is an IPv6 address, the ScopeId field is also included in the address.
c_port = parsed_fields -> c_port, // The port number for the affected client.
cs_bytes = parsed_fields -> cs_bytes, // The number of bytes received and processed by the server.
cs_cookie = parsed_fields -> cs_cookie, // the content of the cookie sent or received, if any.
cs_host = parsed_fields -> cs_host, // The host header name, if any.
cs_method = parsed_fields -> cs_method, // The requested verb, for example, a GET method.
cs_referer = parsed_fields -> cs_referer, // The site that the user last visited. This site provided a link to the current site.
cs_uri = parsed_fields -> cs_uri, // The URL and any query associated with it are logged as one field, separated by a question mark (0x3F). This field is truncated at its length limit of 4096 bytes. Relevant for error logs.
cs_uri_query = parsed_fields -> cs_uri_query, // The query, if any, that the client was trying to perform. Relevant for access logs.
cs_uri_stem = parsed_fields -> cs_uri_stem, // The target of the verb, for example, Default.htm. Relevant for access logs.
cs_user_agent = parsed_fields -> cs_user_agent, // the browser type or http client that the client used.
cs_username = parsed_fields -> cs_username, // The name of the authenticated user that accessed the server. Anonymous users are indicated by a hyphen.
cs_version = parsed_fields -> cs_version, // The HTTP protocol version that the client used.
log_type = parsed_fields -> log_type,
s_computername = parsed_fields -> s_computername, // The name of the server on which the log file entry was generated.
s_ip = parsed_fields -> s_ip, // The IP address of the affected server that can be either an IPv4 address or an IPv6 address. If the server IP address is an IPv6 address, the ScopeId field is also included in the address.
s_port = parsed_fields -> s_port, // The port number of the affected server.
s_reason = parsed_fields -> s_reason, // This field contains a string that identifies the kind of error that is being logged. It is never left empty.
s_siteid = parsed_fields -> s_siteid,
s_sitename = parsed_fields -> s_sitename, // the site instance number that fulfilled the request.
sc_bytes = parsed_fields -> sc_bytes, // The number of bytes sent by the server.
sc_status = parsed_fields -> sc_status, // The HTTP status code.
sc_substatus = parsed_fields -> sc_substatus,
sc_win32_status = parsed_fields -> sc_win32_status, // the Windows status code
streamid = parsed_fields -> streamid, // The Stream Id.
time_taken = parsed_fields -> time_taken, // The length of time that the action took, in milliseconds.
transport = parsed_fields -> transport
| alter // post-extraction validations, cleanning and reformatting
c_ipv4 = arrayindex(regextract(c_ip, "((?:\d{1,3}\.){3}\d{1,3})"), 0),
c_ipv6 = arrayindex(regextract(c_ip, "(?:[a-fA-F\d]{0,4}\:){1,7}[a-fA-F\d]{0,4}"), 0),
s_ipv4 = arrayindex(regextract(s_ip, "((?:\d{1,3}\.){3}\d{1,3})"), 0),
s_ipv6 = arrayindex(regextract(s_ip, "(?:[a-fA-F\d]{0,4}\:){1,7}[a-fA-F\d]{0,4}"), 0),
sc_status_int = to_integer(sc_status),
sc_win32_status_int = to_integer(sc_win32_status),
sc_full_status = concat(sc_status, ".", sc_substatus), // for e.g. 403.14
streamid = if(streamid != "-", streamid), // clean empty values
s_siteid = if(s_siteid != "-", s_siteid), // clean empty values
sc_status = if(sc_status != "-", sc_status), // clean empty values
target_resource = arrayindex(regextract(arrayindex(split(coalesce(cs_uri,cs_uri_stem), "?"), 0), "\/([^\/]+)"), -1),
target_uri = if(
cs_uri != null and cs_uri != "-", cs_uri, // error logs
cs_uri_query != null and cs_uri_query != "-", concat(cs_uri_stem, "?", cs_uri_query), cs_uri_stem), // access logs
user_domain = if(cs_username != null and cs_username != "-", coalesce(arrayindex(regextract(cs_username, "(.+)\\.+"), 0), arrayindex(split(cs_username, "@"), 1)))
| alter
full_status_code = concat(sc_full_status, ".", sc_win32_status),
is_successful = if(sc_win32_status_int = 0 and sc_status_int < 400),
sc_status_reason = if( // https://learn.microsoft.com/en-us/troubleshoot/developer/webapps/iis/www-administration-management/http-status-code#introduction
sc_status = null or sc_status_int < 400, null, sc_full_status = "400.1", "Invalid Destination Header", sc_full_status = "400.2", "Invalid Depth Header", sc_full_status = "400.3", "Invalid If Header", sc_full_status = "400.4", "Invalid Overwrite Header", sc_full_status = "400.5", "Invalid Translate Header", sc_full_status = "400.6", "Invalid Request Body", sc_full_status = "400.7", "Invalid Content Length", sc_full_status = "400.8", "Invalid Timeout", sc_full_status = "400.9", "Invalid Lock Token", sc_full_status = "400.10", "Invalid X-Forwarded-For (XFF) header", sc_full_status = "400.11", "Invalid WebSocket request", sc_full_status = "400.601", "Bad client request (ARR)", sc_full_status = "400.602", "Invalid time format (ARR)", sc_full_status = "400.603", "Parse range error (ARR)", sc_full_status = "400.604", "Client gone (ARR)", sc_full_status = "400.605", "Maximum number of forwards (ARR)", sc_full_status = "400.606", "Asynchronous competition error (ARR)", sc_full_status = "401.1", "Logon failed", sc_full_status = "401.2", "Logon failed due to server configuration", sc_full_status = "401.3", "Unauthorized due to ACL on resource", sc_full_status = "401.4", "Authorization failed by filter", sc_full_status = "401.5", "Authorization failed by ISAPI/CGI application", sc_full_status = "401.501", "Access denied: concurrent request rate limit reached", sc_full_status = "401.502", "Access denied: maximum request rate limit reached", sc_full_status = "401.503", "Access denied: IP address denied", sc_full_status = "401.504", "Access denied: host name denied", sc_full_status = "403.1", "Execute access forbidden", sc_full_status = "403.2", "Read access forbidden", sc_full_status = "403.3", "Write access forbidden", sc_full_status = "403.4", "SSL required", sc_full_status = "403.5", "SSL 128 required", sc_full_status = "403.6", "IP address rejected", sc_full_status = "403.7", "Client certificate required", sc_full_status = "403.8", "Site access denied", sc_full_status = "403.9", "Concurrent connections exceeded", sc_full_status = "403.1", "Forbidden: Execute access denied", sc_full_status = "403.11", "Forbidden: Password changed", sc_full_status = "403.12", "Mapper denied access", sc_full_status = "403.13", "Client certificate revoked", sc_full_status = "403.14", "Directory listing denied", sc_full_status = "403.15", "Client access licenses exceeded", sc_full_status = "403.16", "Client certificate is untrusted or invalid", sc_full_status = "403.17", "Client certificate has expired or is not yet valid", sc_full_status = "403.18", "Cannot execute requested URL in the current application pool", sc_full_status = "403.19", "Cannot execute CGI applications for the client browser in this application pool", sc_full_status = "403.2", "Forbidden: Passport logon failed", sc_full_status = "403.21", "Forbidden: Source access denied", sc_full_status = "403.22", "Forbidden: Infinite depth is denied", sc_full_status = "403.501", "Forbidden: concurrent request rate limit reached", sc_full_status = "403.502", "Forbidden: maximum request rate limit reached", sc_full_status = "403.503", "Forbidden: IP address denied", sc_full_status = "403.504", "Forbidden: host name denied", sc_full_status = "404.0", "Not found", sc_full_status = "404.1", "Site Not Found", sc_full_status = "404.2", "ISAPI or CGI restriction.", sc_full_status = "404.3", "MIME type restriction.", sc_full_status = "404.4", "No handler configured.", sc_full_status = "404.5", "Denied by request filtering configuration.", sc_full_status = "404.6", "Verb denied.", sc_full_status = "404.7", "File extension denied.", sc_full_status = "404.8", "Hidden namespace.", sc_full_status = "404.9", "Files attribute hidden.", sc_full_status = "404.1", "Request header too long.", sc_full_status = "404.11", "Request contains double escape sequence.", sc_full_status = "404.12", "Request contains high-bit characters.", sc_full_status = "404.13", "Content length too large.", sc_full_status = "404.14", "Request URL too long.", sc_full_status = "404.15", "Query string too long.", sc_full_status = "404.16", "WebDAV request sent to the static file handler", sc_full_status = "404.17", "Dynamic content mapped to the static file handler", sc_full_status = "404.18", "Query string sequence denied", sc_full_status = "404.19", "Denied by filtering rule", sc_full_status = "404.2", "Too Many URL Segments", sc_full_status = "404.501", "Not found: concurrent request rate limit reached", sc_full_status = "404.502", "Not found: maximum request rate limit reached", sc_full_status = "404.503", "Not found: IP address denied", sc_full_status = "404.504", "Not found: host name denied", sc_full_status = "405", "Method not allowed.", sc_full_status = "406", "Not acceptable.", sc_full_status = "408", "Request timed out.", sc_full_status = "412", "Precondition failed.", sc_full_status = "413", "Request entity too large.", sc_full_status = "500.0", "Module or ISAPI error occurred.", sc_full_status = "500.11", "Application is shutting down on the web server.", sc_full_status = "500.12", "Application is busy restarting on the web server.", sc_full_status = "500.13", "Web server is too busy.", sc_full_status = "500.15", "Direct requests for Global.asax aren't allowed.", sc_full_status = "500.19", "Configuration data is invalid.", sc_full_status = "500.21", "Module not recognized.", sc_full_status = "500.22", "An ASP.NET httpModules configuration does not apply in Managed Pipeline mode.", sc_full_status = "500.23", "An ASP.NET httpHandlers configuration does not apply in Managed Pipeline mode.", sc_full_status = "500.24", "An ASP.NET impersonation configuration does not apply in Managed Pipeline mode.", sc_full_status = "500.5", "A rewrite error occurred during RQ_BEGIN_REQUEST notification handling. A configuration or inbound rule execution error occurred.", sc_full_status = "500.51", "A rewrite error occurred during GL_PRE_BEGIN_REQUEST notification handling. A global configuration or global rule execution error occurred.", sc_full_status = "500.52", "A rewrite error occurred during RQ_SEND_RESPONSE notification handling. An outbound rule execution occurred.", sc_full_status = "500.53", "A rewrite error occurred during RQ_RELEASE_REQUEST_STATE notification handling. An outbound rule execution error occurred. The rule is configured to be executed before the output user cache gets updated.", sc_full_status = "500.1", "Internal ASP error.", sc_full_status = "502.1", "CGI application timeout.", sc_full_status = "502.2", "Bad gateway: Premature Exit.", sc_full_status = "502.3", "Bad Gateway: Forwarder Connection Error (ARR).", sc_full_status = "502.4", "Bad Gateway: No Server (ARR).", sc_full_status = "502.2", "Map request failure (ARR)", sc_full_status = "502.3", "WinHTTP asynchronous completion failure (ARR)", sc_full_status = "502.4", "No server (ARR)", sc_full_status = "502.5", "WebSocket failure (ARR)", sc_full_status = "502.6", "Forwarded request failure (ARR)", sc_full_status = "502.7", "Execute request failure (ARR)", sc_full_status = "503", "Application pool unavailable.", sc_full_status = "503.2", "Concurrent request limit exceeded.", sc_full_status = "503.3", "ASP.NET queue full", sc_full_status = "503.4", "FastCGI queue full"),
sc_win32_status_reason = if( // https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-erref/18d8fbe8-a967-4f1c-ae50-99ca8e491d2d
sc_win32_status = null or sc_win32_status_int = 0, null, sc_win32_status_int = 1, "ERROR_INVALID_FUNCTION", sc_win32_status_int = 2, "ERROR_FILE_NOT_FOUND", sc_win32_status_int = 3, "ERROR_PATH_NOT_FOUND", sc_win32_status_int = 4, "ERROR_TOO_MANY_OPEN_FILES", sc_win32_status_int = 5, "ERROR_ACCESS_DENIED", sc_win32_status_int = 6, "ERROR_INVALID_HANDLE", sc_win32_status_int = 7, "ERROR_ARENA_TRASHED", sc_win32_status_int = 8, "ERROR_NOT_ENOUGH_MEMORY", sc_win32_status_int = 9, "ERROR_INVALID_BLOCK", sc_win32_status_int = 10, "ERROR_BAD_ENVIRONMENT", sc_win32_status_int = 11, "ERROR_BAD_FORMAT", sc_win32_status_int = 12, "ERROR_INVALID_ACCESS", sc_win32_status_int = 13, "ERROR_INVALID_DATA", sc_win32_status_int = 14, "ERROR_OUTOFMEMORY", sc_win32_status_int = 15, "ERROR_INVALID_DRIVE", sc_win32_status_int = 16, "ERROR_CURRENT_DIRECTORY", sc_win32_status_int = 17, "ERROR_NOT_SAME_DEVICE", sc_win32_status_int = 18, "ERROR_NO_MORE_FILES", sc_win32_status_int = 19, "ERROR_WRITE_PROTECT", sc_win32_status_int = 20, "ERROR_BAD_UNIT", sc_win32_status_int = 21, "ERROR_NOT_READY", sc_win32_status_int = 22, "ERROR_BAD_COMMAND", sc_win32_status_int = 23, "ERROR_CRC", sc_win32_status_int = 24, "ERROR_BAD_LENGTH", sc_win32_status_int = 25, "ERROR_SEEK", sc_win32_status_int = 26, "ERROR_NOT_DOS_DISK", sc_win32_status_int = 27, "ERROR_SECTOR_NOT_FOUND", sc_win32_status_int = 28, "ERROR_OUT_OF_PAPER", sc_win32_status_int = 29, "ERROR_WRITE_FAULT", sc_win32_status_int = 30, "ERROR_READ_FAULT", sc_win32_status_int = 31, "ERROR_GEN_FAILURE", sc_win32_status_int = 32, "ERROR_SHARING_VIOLATION", sc_win32_status_int = 33, "ERROR_LOCK_VIOLATION", sc_win32_status_int = 34, "ERROR_WRONG_DISK", sc_win32_status_int = 36, "ERROR_SHARING_BUFFER_EXCEEDED", sc_win32_status_int = 38, "ERROR_HANDLE_EOF", sc_win32_status_int = 39, "ERROR_HANDLE_DISK_FULL", sc_win32_status_int = 50, "ERROR_NOT_SUPPORTED", sc_win32_status_int = 51, "ERROR_REM_NOT_LIST", sc_win32_status_int = 52, "ERROR_DUP_NAME", sc_win32_status_int = 53, "ERROR_BAD_NETPATH", sc_win32_status_int = 54, "ERROR_NETWORK_BUSY", sc_win32_status_int = 55, "ERROR_DEV_NOT_EXIST", sc_win32_status_int = 56, "ERROR_TOO_MANY_CMDS", sc_win32_status_int = 57, "ERROR_ADAP_HDW_ERR", sc_win32_status_int = 58, "ERROR_BAD_NET_RESP", sc_win32_status_int = 59, "ERROR_UNEXP_NET_ERR", sc_win32_status_int = 60, "ERROR_BAD_REM_ADAP", sc_win32_status_int = 61, "ERROR_PRINTQ_FULL", sc_win32_status_int = 62, "ERROR_NO_SPOOL_SPACE", sc_win32_status_int = 63, "ERROR_PRINT_CANCELED", sc_win32_status_int = 64, "ERROR_NETNAME_DELETED", sc_win32_status_int = 65, "ERROR_NETWORK_ACCESS_DENIED", sc_win32_status_int = 66, "ERROR_BAD_DEV_TYPE", sc_win32_status_int = 67, "ERROR_BAD_NET_NAME", sc_win32_status_int = 68, "ERROR_TOO_MANY_NAMES", sc_win32_status_int = 69, "ERROR_TOO_MANY_SESS", sc_win32_status_int = 70, "ERROR_SHARING_PAUSED", sc_win32_status_int = 71, "ERROR_REQ_NOT_ACCEP", sc_win32_status_int = 72, "ERROR_REDIR_PAUSED", sc_win32_status_int = 80, "ERROR_FILE_EXISTS", sc_win32_status_int = 82, "ERROR_CANNOT_MAKE", sc_win32_status_int = 83, "ERROR_FAIL_I24", sc_win32_status_int = 84, "ERROR_OUT_OF_STRUCTURES", sc_win32_status_int = 85, "ERROR_ALREADY_ASSIGNED", sc_win32_status_int = 86, "ERROR_INVALID_PASSWORD", sc_win32_status_int = 87, "ERROR_INVALID_PARAMETER", sc_win32_status_int = 88, "ERROR_NET_WRITE_FAULT", sc_win32_status_int = 89, "ERROR_NO_PROC_SLOTS", sc_win32_status_int = 100, "ERROR_TOO_MANY_SEMAPHORES", sc_win32_status_int = 101, "ERROR_EXCL_SEM_ALREADY_OWNED", sc_win32_status_int = 102, "ERROR_SEM_IS_SET", sc_win32_status_int = 103, "ERROR_TOO_MANY_SEM_REQUESTS", sc_win32_status_int = 104, "ERROR_INVALID_AT_INTERRUPT_TIME", sc_win32_status_int = 105, "ERROR_SEM_OWNER_DIED", sc_win32_status_int = 106, "ERROR_SEM_USER_LIMIT", sc_win32_status_int = 107, "ERROR_DISK_CHANGE", sc_win32_status_int = 108, "ERROR_DRIVE_LOCKED", sc_win32_status_int = 109, "ERROR_BROKEN_PIPE", sc_win32_status_int = 110, "ERROR_OPEN_FAILED", sc_win32_status_int = 111, "ERROR_BUFFER_OVERFLOW", sc_win32_status_int = 112, "ERROR_DISK_FULL", sc_win32_status_int = 113, "ERROR_NO_MORE_SEARCH_HANDLES", sc_win32_status_int = 114, "ERROR_INVALID_TARGET_HANDLE", sc_win32_status_int = 117, "ERROR_INVALID_CATEGORY", sc_win32_status_int = 118, "ERROR_INVALID_VERIFY_SWITCH", sc_win32_status_int = 119, "ERROR_BAD_DRIVER_LEVEL", sc_win32_status_int = 120, "ERROR_CALL_NOT_IMPLEMENTED", sc_win32_status_int = 121, "ERROR_SEM_TIMEOUT", sc_win32_status_int = 122, "ERROR_INSUFFICIENT_BUFFER", sc_win32_status_int = 123, "ERROR_INVALID_NAME", sc_win32_status_int = 124, "ERROR_INVALID_LEVEL", sc_win32_status_int = 125, "ERROR_NO_VOLUME_LABEL", sc_win32_status_int = 126, "ERROR_MOD_NOT_FOUND", sc_win32_status_int = 127, "ERROR_PROC_NOT_FOUND", sc_win32_status_int = 128, "ERROR_WAIT_NO_CHILDREN", sc_win32_status_int = 129, "ERROR_CHILD_NOT_COMPLETE", sc_win32_status_int = 130, "ERROR_DIRECT_ACCESS_HANDLE", sc_win32_status_int = 131, "ERROR_NEGATIVE_SEEK", sc_win32_status_int = 132, "ERROR_SEEK_ON_DEVICE", sc_win32_status_int = 133, "ERROR_IS_JOIN_TARGET", sc_win32_status_int = 134, "ERROR_IS_JOINED", sc_win32_status_int = 135, "ERROR_IS_SUBSTED", sc_win32_status_int = 136, "ERROR_NOT_JOINED", sc_win32_status_int = 137, "ERROR_NOT_SUBSTED", sc_win32_status_int = 138, "ERROR_JOIN_TO_JOIN", sc_win32_status_int = 139, "ERROR_SUBST_TO_SUBST", sc_win32_status_int = 140, "ERROR_JOIN_TO_SUBST", sc_win32_status_int = 141, "ERROR_SUBST_TO_JOIN", sc_win32_status_int = 142, "ERROR_BUSY_DRIVE", sc_win32_status_int = 143, "ERROR_SAME_DRIVE", sc_win32_status_int = 144, "ERROR_DIR_NOT_ROOT", sc_win32_status_int = 145, "ERROR_DIR_NOT_EMPTY", sc_win32_status_int = 146, "ERROR_IS_SUBST_PATH", sc_win32_status_int = 147, "ERROR_IS_JOIN_PATH", sc_win32_status_int = 148, "ERROR_PATH_BUSY", sc_win32_status_int = 149, "ERROR_IS_SUBST_TARGET", sc_win32_status_int = 150, "ERROR_SYSTEM_TRACE", sc_win32_status_int = 151, "ERROR_INVALID_EVENT_COUNT", sc_win32_status_int = 152, "ERROR_TOO_MANY_MUXWAITERS", sc_win32_status_int = 153, "ERROR_INVALID_LIST_FORMAT", sc_win32_status_int = 154, "ERROR_LABEL_TOO_LONG", sc_win32_status_int = 155, "ERROR_TOO_MANY_TCBS", sc_win32_status_int = 156, "ERROR_SIGNAL_REFUSED", sc_win32_status_int = 157, "ERROR_DISCARDED", sc_win32_status_int = 158, "ERROR_NOT_LOCKED", sc_win32_status_int = 159, "ERROR_BAD_THREADID_ADDR", sc_win32_status_int = 160, "ERROR_BAD_ARGUMENTS", sc_win32_status_int = 161, "ERROR_BAD_PATHNAME", sc_win32_status_int = 162, "ERROR_SIGNAL_PENDING", sc_win32_status_int = 164, "ERROR_MAX_THRDS_REACHED", sc_win32_status_int = 167, "ERROR_LOCK_FAILED", sc_win32_status_int = 170, "ERROR_BUSY", sc_win32_status_int = 173, "ERROR_CANCEL_VIOLATION", sc_win32_status_int = 174, "ERROR_ATOMIC_LOCKS_NOT_SUPPORTED", sc_win32_status_int = 180, "ERROR_INVALID_SEGMENT_NUMBER", sc_win32_status_int = 182, "ERROR_INVALID_ORDINAL", sc_win32_status_int = 183, "ERROR_ALREADY_EXISTS", sc_win32_status_int = 186, "ERROR_INVALID_FLAG_NUMBER", sc_win32_status_int = 187, "ERROR_SEM_NOT_FOUND", sc_win32_status_int = 188, "ERROR_INVALID_STARTING_CODESEG", sc_win32_status_int = 189, "ERROR_INVALID_STACKSEG", sc_win32_status_int = 190, "ERROR_INVALID_MODULETYPE", sc_win32_status_int = 191, "ERROR_INVALID_EXE_SIGNATURE", sc_win32_status_int = 192, "ERROR_EXE_MARKED_INVALID", sc_win32_status_int = 193, "ERROR_BAD_EXE_FORMAT", sc_win32_status_int = 194, "ERROR_ITERATED_DATA_EXCEEDS_64k", sc_win32_status_int = 195, "ERROR_INVALID_MINALLOCSIZE", sc_win32_status_int = 196, "ERROR_DYNLINK_FROM_INVALID_RING", sc_win32_status_int = 197, "ERROR_IOPL_NOT_ENABLED", sc_win32_status_int = 198, "ERROR_INVALID_SEGDPL", sc_win32_status_int = 199, "ERROR_AUTODATASEG_EXCEEDS_64k", sc_win32_status_int = 200, "ERROR_RING2SEG_MUST_BE_MOVABLE", sc_win32_status_int = 201, "ERROR_RELOC_CHAIN_XEEDS_SEGLIM", sc_win32_status_int = 202, "ERROR_INFLOOP_IN_RELOC_CHAIN", sc_win32_status_int = 203, "ERROR_ENVVAR_NOT_FOUND", sc_win32_status_int = 205, "ERROR_NO_SIGNAL_SENT", sc_win32_status_int = 206, "ERROR_FILENAME_EXCED_RANGE", sc_win32_status_int = 207, "ERROR_RING2_STACK_IN_USE", sc_win32_status_int = 208, "ERROR_META_EXPANSION_TOO_LONG", sc_win32_status_int = 209, "ERROR_INVALID_SIGNAL_NUMBER", sc_win32_status_int = 210, "ERROR_THREAD_1_INACTIVE", sc_win32_status_int = 212, "ERROR_LOCKED", sc_win32_status_int = 214, "ERROR_TOO_MANY_MODULES", sc_win32_status_int = 215, "ERROR_NESTING_NOT_ALLOWED", sc_win32_status_int = 216, "ERROR_EXE_MACHINE_TYPE_MISMATCH", sc_win32_status_int = 230, "ERROR_BAD_PIPE", sc_win32_status_int = 231, "ERROR_PIPE_BUSY", sc_win32_status_int = 232, "ERROR_NO_DATA", sc_win32_status_int = 233, "ERROR_PIPE_NOT_CONNECTED", sc_win32_status_int = 234, "ERROR_MORE_DATA", sc_win32_status_int = 240, "ERROR_VC_DISCONNECTED", sc_win32_status_int = 254, "ERROR_INVALID_EA_NAME", sc_win32_status_int = 255, "ERROR_EA_LIST_INCONSISTENT", sc_win32_status_int = 258, "WAIT_TIMEOUT", sc_win32_status_int = 259, "ERROR_NO_MORE_ITEMS", sc_win32_status_int = 266, "ERROR_CANNOT_COPY", sc_win32_status_int = 267, "ERROR_DIRECTORY", sc_win32_status_int = 275, "ERROR_EAS_DIDNT_FIT", sc_win32_status_int = 276, "ERROR_EA_FILE_CORRUPT", sc_win32_status_int = 277, "ERROR_EA_TABLE_FULL", sc_win32_status_int = 278, "ERROR_INVALID_EA_HANDLE", sc_win32_status_int = 282, "ERROR_EAS_NOT_SUPPORTED", sc_win32_status_int = 288, "ERROR_NOT_OWNER", sc_win32_status_int = 298, "ERROR_TOO_MANY_POSTS", sc_win32_status_int = 299, "ERROR_PARTIAL_COPY", sc_win32_status_int = 300, "ERROR_OPLOCK_NOT_GRANTED", sc_win32_status_int = 301, "ERROR_INVALID_OPLOCK_PROTOCOL", sc_win32_status_int = 317, "ERROR_MR_MID_NOT_FOUND", sc_win32_status_int = 487, "ERROR_INVALID_ADDRESS", sc_win32_status_int = 534, "ERROR_ARITHMETIC_OVERFLOW", sc_win32_status_int = 535, "ERROR_PIPE_CONNECTED", sc_win32_status_int = 536, "ERROR_PIPE_LISTENING", sc_win32_status_int = 994, "ERROR_EA_ACCESS_DENIED", sc_win32_status_int = 995, "ERROR_OPERATION_ABORTED", sc_win32_status_int = 996, "ERROR_IO_INCOMPLETE", sc_win32_status_int = 997, "ERROR_IO_PENDING", sc_win32_status_int = 998, "ERROR_NOACCESS", sc_win32_status_int = 999, "ERROR_SWAPERROR")
| alter // XDM mappings
xdm.event.duration = to_integer(time_taken),
xdm.event.outcome = if(
is_successful, XDM_CONST.OUTCOME_SUCCESS,
log_type = "Error Log" or (sc_status_int >= 400 and sc_status_int <= 599), XDM_CONST.OUTCOME_FAILED,
sc_win32_status_int > 0 and sc_status_int < 400, XDM_CONST.OUTCOME_PARTIAL),
xdm.event.outcome_reason = if(not is_successful and sc_status != null, arraystring(arraycreate(coalesce(full_status_code, sc_status), sc_win32_status_reason, sc_status_reason, s_reason), "; ")),
xdm.event.type = log_type,
xdm.observer.name = s_computername,
xdm.network.application_protocol = if(cs_version != "-", cs_version),
xdm.network.http.http_header.header = if(cs_cookie != null and cs_cookie != "-", "Cookie"),
xdm.network.http.http_header.value = if(cs_cookie != "-", cs_cookie),
xdm.network.http.method = if(cs_method = "-" or cs_method = null, null, cs_method = "GET", XDM_CONST.HTTP_METHOD_GET, cs_method = "POST", XDM_CONST.HTTP_METHOD_POST,cs_method = "PUT", XDM_CONST.HTTP_METHOD_PUT, cs_method = "PATCH", XDM_CONST.HTTP_METHOD_PATCH, cs_method = "OPTIONS", XDM_CONST.HTTP_METHOD_OPTIONS, cs_method = "HEAD", XDM_CONST.HTTP_METHOD_HEAD, cs_method = "ACL", XDM_CONST.HTTP_METHOD_ACL, cs_method = "BASELINE_CONTROL", XDM_CONST.HTTP_METHOD_BASELINE_CONTROL, cs_method = "BIND", XDM_CONST.HTTP_METHOD_BIND, cs_method = "CHECKIN", XDM_CONST.HTTP_METHOD_CHECKIN, cs_method = "CHECKOUT", XDM_CONST.HTTP_METHOD_CHECKOUT, cs_method = "CONNECT", XDM_CONST.HTTP_METHOD_CONNECT, cs_method = "COPY", XDM_CONST.HTTP_METHOD_COPY, cs_method = "DELETE", XDM_CONST.HTTP_METHOD_DELETE, cs_method = "LABEL", XDM_CONST.HTTP_METHOD_LABEL, cs_method = "LINK", XDM_CONST.HTTP_METHOD_LINK, cs_method = "LOCK", XDM_CONST.HTTP_METHOD_LOCK, cs_method = "MERGE", XDM_CONST.HTTP_METHOD_MERGE, cs_method = "MKACTIVITY", XDM_CONST.HTTP_METHOD_MKACTIVITY, cs_method = "MKCALENDAR", XDM_CONST.HTTP_METHOD_MKCALENDAR, cs_method = "MKCOL", XDM_CONST.HTTP_METHOD_MKCOL, cs_method = "MKREDIRECTREF", XDM_CONST.HTTP_METHOD_MKREDIRECTREF, cs_method = "MKWORKSPACE", XDM_CONST.HTTP_METHOD_MKWORKSPACE, cs_method = "MOVE", XDM_CONST.HTTP_METHOD_MOVE, cs_method = "ORDERPATCH", XDM_CONST.HTTP_METHOD_ORDERPATCH, cs_method = "PRI", XDM_CONST.HTTP_METHOD_PRI, cs_method = "PROPFIND", XDM_CONST.HTTP_METHOD_PROPFIND, cs_method = "PROPPATCH", XDM_CONST.HTTP_METHOD_PROPPATCH, cs_method = "REBIND", XDM_CONST.HTTP_METHOD_REBIND, cs_method = "REPORT", XDM_CONST.HTTP_METHOD_REPORT, cs_method = "SEARCH", XDM_CONST.HTTP_METHOD_SEARCH, cs_method = "TRACE", XDM_CONST.HTTP_METHOD_TRACE, cs_method = "UNBIND", XDM_CONST.HTTP_METHOD_UNBIND, cs_method = "UNCHECKOUT", XDM_CONST.HTTP_METHOD_UNCHECKOUT, cs_method = "UNLINK", XDM_CONST.HTTP_METHOD_UNLINK, cs_method = "UNLOCK", XDM_CONST.HTTP_METHOD_UNLOCK, cs_method = "UPDATE", XDM_CONST.HTTP_METHOD_UPDATE, cs_method = "UPDATEREDIRECTREF", XDM_CONST.HTTP_METHOD_UPDATEREDIRECTREF, cs_method = "VERSION_CONTROL", XDM_CONST.HTTP_METHOD_VERSION_CONTROL, cs_method),
xdm.network.http.referrer = if(cs_referer != "-", cs_referer),
xdm.network.http.response_code = if(sc_status = "-", null, sc_status = "200", XDM_CONST.HTTP_RSP_CODE_OK, sc_status = "201", XDM_CONST.HTTP_RSP_CODE_CREATED, sc_status = "500", XDM_CONST.HTTP_RSP_CODE_INTERNAL_SERVER_ERROR, sc_status = "501", XDM_CONST.HTTP_RSP_CODE_NOT_IMPLEMENTED, sc_status = "502", XDM_CONST.HTTP_RSP_CODE_BAD_GATEWAY, sc_status = "503", XDM_CONST.HTTP_RSP_CODE_SERVICE_UNAVAILABLE, sc_status = "504", XDM_CONST.HTTP_RSP_CODE_GATEWAY_TIMEOUT, sc_status = "505", XDM_CONST.HTTP_RSP_CODE_HTTP_VERSION_NOT_SUPPORTED, sc_status = "506", XDM_CONST.HTTP_RSP_CODE_VARIANT_ALSO_NEGOTIATES, sc_status = "507", XDM_CONST.HTTP_RSP_CODE_INSUFFICIENT_STORAGE, sc_status = "508", XDM_CONST.HTTP_RSP_CODE_LOOP_DETECTED, sc_status = "511", XDM_CONST.HTTP_RSP_CODE_NETWORK_AUTHENTICATION_REQUIRED, sc_status = "400", XDM_CONST.HTTP_RSP_CODE_BAD_REQUEST, sc_status = "401", XDM_CONST.HTTP_RSP_CODE_UNAUTHORIZED, sc_status = "402", XDM_CONST.HTTP_RSP_CODE_PAYMENT_REQUIRED, sc_status = "403", XDM_CONST.HTTP_RSP_CODE_FORBIDDEN, sc_status = "404", XDM_CONST.HTTP_RSP_CODE_NOT_FOUND, sc_status = "405", XDM_CONST.HTTP_RSP_CODE_METHOD_NOT_ALLOWED, sc_status = "406", XDM_CONST.HTTP_RSP_CODE_NOT_ACCEPTABLE, sc_status = "407", XDM_CONST.HTTP_RSP_CODE_PROXY_AUTHENTICATION_REQUIRED, sc_status = "408", XDM_CONST.HTTP_RSP_CODE_REQUEST_TIMEOUT, sc_status = "409", XDM_CONST.HTTP_RSP_CODE_CONFLICT, sc_status = "410", XDM_CONST.HTTP_RSP_CODE_GONE, sc_status = "411", XDM_CONST.HTTP_RSP_CODE_LENGTH_REQUIRED, sc_status = "412", XDM_CONST.HTTP_RSP_CODE_PRECONDITION_FAILED, sc_status = "413", XDM_CONST.HTTP_RSP_CODE_CONTENT_TOO_LARGE, sc_status = "414", XDM_CONST.HTTP_RSP_CODE_URI_TOO_LONG, sc_status = "415", XDM_CONST.HTTP_RSP_CODE_UNSUPPORTED_MEDIA_TYPE, sc_status = "416", XDM_CONST.HTTP_RSP_CODE_RANGE_NOT_SATISFIABLE, sc_status = "417", XDM_CONST.HTTP_RSP_CODE_EXPECTATION_FAILED, sc_status = "421", XDM_CONST.HTTP_RSP_CODE_MISDIRECTED_REQUEST, sc_status = "422", XDM_CONST.HTTP_RSP_CODE_UNPROCESSABLE_CONTENT, sc_status = "423", XDM_CONST.HTTP_RSP_CODE_LOCKED, sc_status = "424", XDM_CONST.HTTP_RSP_CODE_FAILED_DEPENDENCY, sc_status = "425", XDM_CONST.HTTP_RSP_CODE_TOO_EARLY, sc_status = "426", XDM_CONST.HTTP_RSP_CODE_UPGRADE_REQUIRED, sc_status = "428", XDM_CONST.HTTP_RSP_CODE_PRECONDITION_REQUIRED, sc_status = "429", XDM_CONST.HTTP_RSP_CODE_TOO_MANY_REQUESTS, sc_status = "431", XDM_CONST.HTTP_RSP_CODE_REQUEST_HEADER_FIELDS_TOO_LARGE, sc_status = "451", XDM_CONST.HTTP_RSP_CODE_UNAVAILABLE_FOR_LEGAL_REASONS, sc_status = "100", XDM_CONST.HTTP_RSP_CODE_CONTINUE, sc_status = "101", XDM_CONST.HTTP_RSP_CODE_SWITCHING_PROTOCOLS, sc_status = "102", XDM_CONST.HTTP_RSP_CODE_PROCESSING, sc_status = "103", XDM_CONST.HTTP_RSP_CODE_EARLY_HINTS, sc_status = "202", XDM_CONST.HTTP_RSP_CODE_ACCEPTED, sc_status = "203", XDM_CONST.HTTP_RSP_CODE_NON__AUTHORITATIVE_INFORMATION, sc_status = "204", XDM_CONST.HTTP_RSP_CODE_NO_CONTENT, sc_status = "205", XDM_CONST.HTTP_RSP_CODE_RESET_CONTENT, sc_status = "206", XDM_CONST.HTTP_RSP_CODE_PARTIAL_CONTENT, sc_status = "207", XDM_CONST.HTTP_RSP_CODE_MULTI__STATUS, sc_status = "208", XDM_CONST.HTTP_RSP_CODE_ALREADY_REPORTED, sc_status = "226", XDM_CONST.HTTP_RSP_CODE_IM_USED, sc_status = "300", XDM_CONST.HTTP_RSP_CODE_MULTIPLE_CHOICES, sc_status = "301", XDM_CONST.HTTP_RSP_CODE_MOVED_PERMANENTLY, sc_status = "302", XDM_CONST.HTTP_RSP_CODE_FOUND, sc_status = "303", XDM_CONST.HTTP_RSP_CODE_SEE_OTHER, sc_status = "304", XDM_CONST.HTTP_RSP_CODE_NOT_MODIFIED, sc_status = "305", XDM_CONST.HTTP_RSP_CODE_USE_PROXY, sc_status = "307", XDM_CONST.HTTP_RSP_CODE_TEMPORARY_REDIRECT, sc_status = "308", XDM_CONST.HTTP_RSP_CODE_PERMANENT_REDIRECT, sc_status),
xdm.network.http.url = target_uri,
xdm.network.ip_protocol = if(transport = "-" or transport = null, null, transport="TCP", XDM_CONST.IP_PROTOCOL_TCP, transport="UDP", XDM_CONST.IP_PROTOCOL_UDP, transport),
xdm.network.session_id = streamid,
xdm.session_context_id = streamid,
xdm.source.host.ipv4_public_addresses = if(c_ipv4 != null and not incidr(c_ipv4, "10.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12, 127.0.0.0/8, 169.254.0.0/16, 100.64.0.0/10"), arraycreate(c_ipv4)),
xdm.source.ipv4 = c_ipv4,
xdm.source.ipv6 = c_ipv6,
xdm.source.port = to_integer(c_port),
xdm.source.sent_bytes = to_integer(cs_bytes),
xdm.source.user_agent = if(cs_user_agent != "-", replace(cs_user_agent, "+", " ")),
xdm.source.user.username = if(cs_username != "-", cs_username),
xdm.source.user.domain = user_domain,
xdm.target.application.name = coalesce(s_sitename, s_siteid),
xdm.target.host.fqdn = cs_host,
xdm.target.host.hostname = s_computername,
xdm.target.host.ipv4_public_addresses = if(s_ipv4 != null and not incidr(s_ipv4, "10.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12, 127.0.0.0/8, 169.254.0.0/16, 100.64.0.0/10"), arraycreate(s_ipv4)),
xdm.target.ipv4 = s_ipv4,
xdm.target.ipv6 = s_ipv6,
xdm.target.port = to_integer(s_port),
xdm.target.resource.name = target_resource,
xdm.target.sent_bytes = to_integer(sc_bytes),
xdm.target.url = target_uri;