Rules (XIF)
[MODEL: dataset=msft_nps_raw]
alter packet_type = regextract(_raw_log,"\<Packet\-Type\sdata_type\=\"\d+\"\>([^\<]+)\<")
| alter extract_timestamp = arrayindex(regextract(_raw_log,"\<Timestamp\sdata_type\=\"\d+\"\>([^\<]+)\<"),0)
| alter change_format_timestamp = parse_timestamp("%m/%d/%Y %H:%M:%E3S", extract_timestamp)
,hostname = arrayindex(regextract(_raw_log,"\<Computer\-Name\sdata_type\=\"\d+\"\>([^\<]+)\<"),0)
,original_event_type = if(packet_type ="1","Access-Request",packet_type ="2","Access-Accept",packet_type ="3","Access-Reject",packet_type ="4","Accounting-Request",null)
,Client_username = arrayindex(regextract(_raw_log,"(?:Id\><|-)User\-Name\sdata_type\=\"\d+\"\>([^\<]+)\<"),0)
,host_device_id = arrayindex(regextract(_raw_log,"\<Called\-Station\-Id\sdata_type\=\"\d+\"\>([^\<]+)\<"),0)
,host_ipv4_addresses = regextract(_raw_log,"\<Client\-IP\-Address\sdata_type\=\"\d+\"\>([^\<]+)\<")
,Client_port = arrayindex(regextract(_raw_log,"\<NAS\-Port\sdata_type\=\"\d+\"\>([^\<]+)\<"),0)
,reason = arrayindex(regextract(_raw_log,"\<Reason\-Code\sdata_type\=\"\d+\"\>([^\<]+)\<"),0)
// map the fields to the Auth
| alter
xdm.intermediate.host.hostname = hostname,
xdm.event.type = original_event_type,
xdm.source.user.username = Client_username,
xdm.target.host.device_id = host_device_id,
xdm.source.host.ipv4_addresses = host_ipv4_addresses,
xdm.source.port = to_number(Client_port),
xdm.event.outcome_reason = reason;