Rules (XIF)
[MODEL: dataset = microsoft_sysmon_raw]
alter
get_processthreadid_int = to_integer(process_thread_id),
get_processpid_int = to_integer(process_pid),
get_eventid_str = to_string(event_id),
get_task_str = to_string(task),
get_user_type = user -> type,
get_user_sid = user -> identifier,
get_user_domain = user -> domain,
get_user_name = user -> name,
get_eventdata_eventtype = event_data -> EventType,
get_eventdata_ProcessId = to_integer(event_data -> ProcessId),
get_eventdata_Image = event_data -> Image,
get_eventdata_User = event_data -> User,
get_eventdata_RuleName = event_data -> RuleName,
get_eventdata_SourceUser = event_data -> SourceUser,
get_eventdata_TargetProcessId = event_data -> TargetProcessId,
get_eventdata_SourceImage = event_data -> SourceImage,
get_eventdata_CallTrace = event_data -> CallTrace,
get_eventdata_TargetUser = event_data -> TargetUser,
get_eventdata_SourceProcessId = to_integer(event_data -> SourceProcessId),
get_eventdata_SourceThreadId = to_integer(event_data -> SourceThreadId),
get_eventdata_TargetImage = event_data -> TargetImage,
get_eventdata_TargetObject = event_data -> TargetObject,
get_eventdata_Details = event_data -> Details,
get_eventdata_TargetFilename = event_data -> TargetFilename,
get_eventdata_Hashes_sha256 = arraystring(regextract(event_data -> Hashes, "SHA256=([^\,]+)"), ""),
get_eventdata_Protocol = uppercase(event_data -> Protocol),
get_eventdata_DestinationIp = event_data -> DestinationIp,
get_eventdata_DestinationHostname = event_data -> DestinationHostname,
get_eventdata_SourceHostname = event_data -> SourceHostname,
get_eventdata_SourceIp = event_data -> SourceIp,
get_eventdata_SourcePort = to_integer(event_data -> SourcePort),
get_eventdata_DestinationPort = to_integer(event_data -> DestinationPort),
get_eventdata_CommandLine = event_data -> CommandLine,
get_eventdata_IntegrityLevel = event_data -> IntegrityLevel,
get_eventdata_OriginalFileName = event_data -> OriginalFileName,
get_eventdata_LogonGuid = event_data -> LogonGuid,
get_eventdata_Description = event_data -> Description,
get_eventdata_TerminalSessionId = event_data -> TerminalSessionId,
get_eventdata_FileVersion = event_data -> FileVersion,
get_eventdata_ParentProcessId = event_data -> ParentProcessId,
get_eventdata_ImageLoaded = event_data -> ImageLoaded,
get_eventdata_Signed = to_string(event_data -> Signed),
get_eventdata_Signature = event_data -> Signature,
get_eventdata_SignatureStatus = lowercase(event_data -> SignatureStatus),
get_eventdata_QueryName = event_data -> QueryName,
get_eventdata_QueryResults = event_data -> QueryResults,
get_eventdata_QueryStatus = to_string(event_data -> QueryStatus)
| alter
check_avilable_ip = get_eventdata_DestinationIp,
check_avilable_ip2 = get_eventdata_SourceIp,
check_eventdata_SourceIp_v4 = if(get_eventdata_SourceIp ~= ":", null, get_eventdata_SourceIp),
check_eventdata_SourceIp_v6 = if(get_eventdata_SourceIp ~= ":", get_eventdata_SourceIp, null),
check_eventdata_DestinationIp_v4 = if(get_eventdata_DestinationIp ~= ":", null, get_eventdata_DestinationIp),
check_eventdata_DestinationIp_v6 = if(get_eventdata_DestinationIp ~= ":", get_eventdata_DestinationIp, null),
check_eventid_name = if(get_eventid_str = "1", "Process creation", get_eventid_str = "2", "A process changed a file creation time", get_eventid_str = "3", "Network connection", get_eventid_str = "5", "Process terminated", get_eventid_str = "6", "Driver loaded", get_eventid_str = "7", "Image loaded", get_eventid_str = "8", "CreateRemoteThread", get_eventid_str = "9", "RawAccessRead", get_eventid_str = "10", "ProcessAccess", get_eventid_str = "11", "FileCreate", get_eventid_str = "12", "RegistryEvent: Object create and delete", get_eventid_str = "13", "RegistryEvent: Value Set", get_eventid_str = "14", "RegistryEvent: Key and Value Rename", get_eventid_str = "15", "FileCreateStreamHash", get_eventid_str = "17", "PipeEvent: Pipe Created", get_eventid_str = "18", "PipeEvent: Pipe Connected", get_eventid_str = "19", "WmiEvent: WmiEventFilter activity detected", get_eventid_str = "20", "WmiEvent: WmiEventConsumer activity detected", get_eventid_str = "21", "WmiEvent: WmiEventConsumerToFilter activity detected", get_eventid_str = "22", "DNSEvent: DNS query", get_eventid_str = "23", "FileDelete (File Delete archived)", get_eventid_str = "24", "ClipboardChange: New content in the clipboard", get_eventid_str = "25", "ProcessTampering: Process image change", get_eventid_str = "26", "FileDeleteDetected: File Delete logged", get_eventid_str),
check_task_registry = if(get_task_str !~= "Registry object added or deleted", null, get_eventdata_eventtype = "DeleteKey", "DeleteKey", get_eventdata_eventtype = "DeleteValue", "DeleteValue", get_eventdata_eventtype = "CreateKey", "CreateKey", null),
check_eventdata_Image_exe = arraystring(regextract(get_eventdata_Image, "[^\\]+\.[a-z]+$"), ""),
check_eventdata_User_domain = if(get_eventdata_User = null, null, arraystring(regextract(get_eventdata_User, "^([^\\]+)\\[\s\S]+"), "")),
check_eventdata_User_name = if(get_eventdata_User = null, null, arraystring(regextract(get_eventdata_User, "^[^\\]+\\([\s\S]+)"), "")),
check_eventdata_RuleName = if(get_eventdata_RuleName = "-", null, get_eventdata_RuleName),
check_eventdata_SourceUser_domain = if(get_eventdata_SourceUser = null, null, arraystring(regextract(get_eventdata_SourceUser, "^([^\\]+)\\[\s\S]+"), "")),
check_eventdata_SourceUser_name = if(get_eventdata_SourceUser = null, null, arraystring(regextract(get_eventdata_SourceUser, "^[^\\]+\\([\s\S]+)"), "")),
check_eventdata_SourceImage_exe = arraystring(regextract(get_eventdata_SourceImage, "[^\\]+\.[a-z]+$"), ""),
check_eventdata_TargetUser_domain = if(get_eventdata_TargetUser = null, null, arraystring(regextract(get_eventdata_TargetUser, "^([^\\]+)\\[\s\S]+"), "")),
check_eventdata_TargetUser_name = if(get_eventdata_TargetUser = null, null, arraystring(regextract(get_eventdata_TargetUser, "^[^\\]+\\([\s\S]+)"), "")),
check_eventdata_TargetImage_exe = arraystring(regextract(get_eventdata_TargetImage, "[^\\]+\.[a-z]+$"), ""),
check_eventdata_IntegrityLevel = to_integer(if(get_eventdata_IntegrityLevel = "Untrusted", "0", get_eventdata_IntegrityLevel = "Low", "1", get_eventdata_IntegrityLevel = "Medium", "2", get_eventdata_IntegrityLevel = "High", "3", get_eventdata_IntegrityLevel = "System", "4", null))
| alter
clean_task = lowercase(get_task_str),
clean_log_level = if(to_string(log_level) ~= "^\d+$", null, lowercase(log_level)),
clean_eventdata_details = lowercase(get_eventdata_Details),
clean_target_localip_10 = incidr(check_avilable_ip,"10.0.0.0/8"),
clean_target_localip_127 = incidr(check_avilable_ip,"127.0.0.0/8"),
clean_target_localip_169 = incidr(check_avilable_ip,"169.254.0.0/16"),
clean_target_localip_172 = incidr(check_avilable_ip,"172.16.0.0/12"),
clean_target_localip_192 = incidr(check_avilable_ip,"192.168.0.0/16"),
clean_source_localip_10 = incidr(check_avilable_ip2,"10.0.0.0/8"),
clean_source_localip_127 = incidr(check_avilable_ip2,"127.0.0.0/8"),
clean_source_localip_169 = incidr(check_avilable_ip,"169.254.0.0/16"),
clean_source_localip_172 = incidr(check_avilable_ip2,"172.16.0.0/12"),
clean_source_localip_192 = incidr(check_avilable_ip2,"192.168.0.0/16")
| alter
xdm.source.host.os_family = XDM_CONST.OS_FAMILY_WINDOWS,
xdm.observer.type = provider_name,
xdm.observer.unique_identifier = replex(provider_guid, "\{|\}", ""),
xdm.network.dns.dns_resource_record.value = if(get_eventdata_QueryResults = "-", null, get_eventdata_QueryResults),
xdm.network.dns.dns_question.name = get_eventdata_QueryName,
xdm.network.dns.response_code = if(get_eventdata_QueryStatus = "0", XDM_CONST.DNS_RESPONSE_CODE_NO_ERROR, get_eventdata_QueryStatus = "9001", XDM_CONST.DNS_RESPONSE_CODE_FORMAT_ERROR, get_eventdata_QueryStatus = "9002", XDM_CONST.DNS_RESPONSE_CODE_SERVER_FAILURE, get_eventdata_QueryStatus = "9003", XDM_CONST.DNS_RESPONSE_CODE_NON_EXISTENT_DOMAIN, get_eventdata_QueryStatus = "9004", XDM_CONST.DNS_RESPONSE_CODE_NOT_IMPLEMENTED, get_eventdata_QueryStatus = "9005", XDM_CONST.DNS_RESPONSE_CODE_QUERY_REFUSED, get_eventdata_QueryStatus = "9006", XDM_CONST.DNS_RESPONSE_CODE_NAME_EXISTS_WHEN_IT_SHOULD_NOT, get_eventdata_QueryStatus = "9007", XDM_CONST.DNS_RESPONSE_CODE_RR_SET_EXISTS_WHEN_IT_SHOULD_NOT, get_eventdata_QueryStatus = "9008", XDM_CONST.DNS_RESPONSE_CODE_RR_SET_THAT_SHOULD_EXIST_DOES_NOT, get_eventdata_QueryStatus = "9009", XDM_CONST.DNS_RESPONSE_CODE_SERVER_NOT_AUTHORITATIVE_FOR_ZONE, get_eventdata_QueryStatus = "9010", XDM_CONST.DNS_RESPONSE_CODE_NAME_NOT_CONTAINED_IN_ZONE, get_eventdata_QueryStatus = "9016", XDM_CONST.DNS_RESPONSE_CODE_TSIG_SIGNATURE_FAILURE, get_eventdata_QueryStatus = "9017", XDM_CONST.DNS_RESPONSE_CODE_KEY_NOT_RECOGNIZED, get_eventdata_QueryStatus = "9018", XDM_CONST.DNS_RESPONSE_CODE_SIGNATURE_OUT_OF_TIME_WINDOW, get_eventdata_QueryStatus = "9101", "DNS_ERROR_KEYMASTER_REQUIRED", get_eventdata_QueryStatus = "9102", "DNS_ERROR_NOT_ALLOWED_ON_SIGNED_ZONE", get_eventdata_QueryStatus = "9103", "DNS_ERROR_NSEC3_INCOMPATIBLE_WITH_RSA_SHA1", get_eventdata_QueryStatus = "9104", "DNS_ERROR_NOT_ENOUGH_SIGNING_KEY_DESCRIPTORS", get_eventdata_QueryStatus = "9105", "DNS_ERROR_UNSUPPORTED_ALGORITHM", get_eventdata_QueryStatus = "9106", "DNS_ERROR_INVALID_KEY_SIZE", get_eventdata_QueryStatus = "9107", "DNS_ERROR_SIGNING_KEY_NOT_ACCESSIBLE", get_eventdata_QueryStatus = "9108", "DNS_ERROR_KSP_DOES_NOT_SUPPORT_PROTECTION", get_eventdata_QueryStatus = "9109", "DNS_ERROR_UNEXPECTED_DATA_PROTECTION_ERROR", get_eventdata_QueryStatus = "9110", "DNS_ERROR_UNEXPECTED_CNG_ERROR", get_eventdata_QueryStatus = "9111", "DNS_ERROR_UNKNOWN_SIGNING_PARAMETER_VERSION", get_eventdata_QueryStatus = "9112", "DNS_ERROR_KSP_NOT_ACCESSIBLE", get_eventdata_QueryStatus = "9113", "DNS_ERROR_TOO_MANY_SKDS", get_eventdata_QueryStatus = "9114", "DNS_ERROR_INVALID_ROLLOVER_PERIOD", get_eventdata_QueryStatus = "9115", "DNS_ERROR_INVALID_INITIAL_ROLLOVER_OFFSET", get_eventdata_QueryStatus = "9116", "DNS_ERROR_ROLLOVER_IN_PROGRESS", get_eventdata_QueryStatus = "9117", "DNS_ERROR_STANDBY_KEY_NOT_PRESENT", get_eventdata_QueryStatus = "9118", "DNS_ERROR_NOT_ALLOWED_ON_ZSK", get_eventdata_QueryStatus = "9119", "DNS_ERROR_NOT_ALLOWED_ON_ACTIVE_SKD", get_eventdata_QueryStatus = "9120", "DNS_ERROR_ROLLOVER_ALREADY_QUEUED", get_eventdata_QueryStatus = "9121", "DNS_ERROR_NOT_ALLOWED_ON_UNSIGNED_ZONE", get_eventdata_QueryStatus = "9122", "DNS_ERROR_BAD_KEYMASTER", get_eventdata_QueryStatus = "9123", "DNS_ERROR_INVALID_SIGNATURE_VALIDITY_PERIOD", get_eventdata_QueryStatus = "9124", "DNS_ERROR_INVALID_NSEC3_ITERATION_COUNT", get_eventdata_QueryStatus = "9125", "DNS_ERROR_DNSSEC_IS_DISABLED", get_eventdata_QueryStatus = "9126", "DNS_ERROR_INVALID_XML", get_eventdata_QueryStatus = "9127", "DNS_ERROR_NO_VALID_TRUST_ANCHORS", get_eventdata_QueryStatus = "9128", "DNS_ERROR_ROLLOVER_NOT_POKEABLE", get_eventdata_QueryStatus = "9129", "DNS_ERROR_NSEC3_NAME_COLLISION", get_eventdata_QueryStatus = "9130", "DNS_ERROR_NSEC_INCOMPATIBLE_WITH_NSEC3_RSA_SHA1", get_eventdata_QueryStatus = "9501", "DNS_INFO_NO_RECORDS", get_eventdata_QueryStatus = "9502", "DNS_ERROR_BAD_PACKET", get_eventdata_QueryStatus = "9503", "DNS_ERROR_NO_PACKET", get_eventdata_QueryStatus = "9504", "DNS_ERROR_RCODE", get_eventdata_QueryStatus = "9505", "DNS_ERROR_UNSECURE_PACKET", get_eventdata_QueryStatus = "9506", "DNS_REQUEST_PENDING", get_eventdata_QueryStatus = "9551", "DNS_ERROR_INVALID_TYPE", get_eventdata_QueryStatus = "9552", "DNS_ERROR_INVALID_IP_ADDRESS", get_eventdata_QueryStatus = "9553", "DNS_ERROR_INVALID_PROPERTY", get_eventdata_QueryStatus = "9554", "DNS_ERROR_TRY_AGAIN_LATER", get_eventdata_QueryStatus = "9555", "DNS_ERROR_NOT_UNIQUE", get_eventdata_QueryStatus = "9556", "DNS_ERROR_NON_RFC_NAME", get_eventdata_QueryStatus = "9557", "DNS_STATUS_FQDN", get_eventdata_QueryStatus = "9558", "DNS_STATUS_DOTTED_NAME", get_eventdata_QueryStatus = "9559", "DNS_STATUS_SINGLE_PART_NAME", get_eventdata_QueryStatus = "9560", "DNS_ERROR_INVALID_NAME_CHAR", get_eventdata_QueryStatus = "9561", "DNS_ERROR_NUMERIC_NAME", get_eventdata_QueryStatus = "9562", "DNS_ERROR_NOT_ALLOWED_ON_ROOT_SERVER", get_eventdata_QueryStatus = "9563", "DNS_ERROR_NOT_ALLOWED_UNDER_DELEGATION", get_eventdata_QueryStatus = "9564", "DNS_ERROR_CANNOT_FIND_ROOT_HINTS", get_eventdata_QueryStatus = "9565", "DNS_ERROR_INCONSISTENT_ROOT_HINTS", get_eventdata_QueryStatus = "9566", "DNS_ERROR_DWORD_VALUE_TOO_SMALL", get_eventdata_QueryStatus = "9567", "DNS_ERROR_DWORD_VALUE_TOO_LARGE", get_eventdata_QueryStatus = "9568", "DNS_ERROR_BACKGROUND_LOADING", get_eventdata_QueryStatus = "9569", "DNS_ERROR_NOT_ALLOWED_ON_RODC", get_eventdata_QueryStatus = "9570", "DNS_ERROR_NOT_ALLOWED_UNDER_DNAME", get_eventdata_QueryStatus = "9571", "DNS_ERROR_DELEGATION_REQUIRED", get_eventdata_QueryStatus = "9572", "DNS_ERROR_INVALID_POLICY_TABLE", get_eventdata_QueryStatus = "9601", "DNS_ERROR_ZONE_DOES_NOT_EXIST", get_eventdata_QueryStatus = "9602", "DNS_ERROR_NO_ZONE_INFO", get_eventdata_QueryStatus = "9603", "DNS_ERROR_INVALID_ZONE_OPERATION", get_eventdata_QueryStatus = "9604", "DNS_ERROR_ZONE_CONFIGURATION_ERROR", get_eventdata_QueryStatus = "9605", "DNS_ERROR_ZONE_HAS_NO_SOA_RECORD", get_eventdata_QueryStatus = "9606", "DNS_ERROR_ZONE_HAS_NO_NS_RECORDS", get_eventdata_QueryStatus = "9607", "DNS_ERROR_ZONE_LOCKED", get_eventdata_QueryStatus = "9608", "DNS_ERROR_ZONE_CREATION_FAILED", get_eventdata_QueryStatus = "9609", "DNS_ERROR_ZONE_ALREADY_EXISTS", get_eventdata_QueryStatus = "9610", "DNS_ERROR_AUTOZONE_ALREADY_EXISTS", get_eventdata_QueryStatus = "9611", "DNS_ERROR_INVALID_ZONE_TYPE", get_eventdata_QueryStatus = "9612", "DNS_ERROR_SECONDARY_REQUIRES_MASTER_IP", get_eventdata_QueryStatus = "9613", "DNS_ERROR_ZONE_NOT_SECONDARY", get_eventdata_QueryStatus = "9614", "DNS_ERROR_NEED_SECONDARY_ADDRESSES", get_eventdata_QueryStatus = "9615", "DNS_ERROR_WINS_INIT_FAILED", get_eventdata_QueryStatus = "9616", "DNS_ERROR_NEED_WINS_SERVERS", get_eventdata_QueryStatus = "9617", "DNS_ERROR_NBSTAT_INIT_FAILED", get_eventdata_QueryStatus = "9618", "DNS_ERROR_SOA_DELETE_INVALID", get_eventdata_QueryStatus = "9619", "DNS_ERROR_FORWARDER_ALREADY_EXISTS", get_eventdata_QueryStatus = "9620", "DNS_ERROR_ZONE_REQUIRES_MASTER_IP", get_eventdata_QueryStatus = "9621", "DNS_ERROR_ZONE_IS_SHUTDOWN", get_eventdata_QueryStatus = "9622", "DNS_ERROR_ZONE_LOCKED_FOR_SIGNING", get_eventdata_QueryStatus = "9651", "DNS_ERROR_PRIMARY_REQUIRES_DATAFILE", get_eventdata_QueryStatus = "9652", "DNS_ERROR_INVALID_DATAFILE_NAME", get_eventdata_QueryStatus = "9653", "DNS_ERROR_DATAFILE_OPEN_FAILURE", get_eventdata_QueryStatus = "9654", "DNS_ERROR_FILE_WRITEBACK_FAILED", get_eventdata_QueryStatus = "9655", "DNS_ERROR_DATAFILE_PARSING", get_eventdata_QueryStatus = "9701", "DNS_ERROR_RECORD_DOES_NOT_EXIST", get_eventdata_QueryStatus = "9702", "DNS_ERROR_RECORD_FORMAT", get_eventdata_QueryStatus = "9703", "DNS_ERROR_NODE_CREATION_FAILED", get_eventdata_QueryStatus = "9704", "DNS_ERROR_UNKNOWN_RECORD_TYPE", get_eventdata_QueryStatus = "9705", "DNS_ERROR_RECORD_TIMED_OUT", get_eventdata_QueryStatus = "9706", "DNS_ERROR_NAME_NOT_IN_ZONE", get_eventdata_QueryStatus = "9707", "DNS_ERROR_CNAME_LOOP", get_eventdata_QueryStatus = "9708", "DNS_ERROR_NODE_IS_CNAME", get_eventdata_QueryStatus = "9709", "DNS_ERROR_CNAME_COLLISION", get_eventdata_QueryStatus = "9710", "DNS_ERROR_RECORD_ONLY_AT_ZONE_ROOT", get_eventdata_QueryStatus = "9711", "DNS_ERROR_RECORD_ALREADY_EXISTS", get_eventdata_QueryStatus = "9712", "DNS_ERROR_SECONDARY_DATA", get_eventdata_QueryStatus = "9713", "DNS_ERROR_NO_CREATE_CACHE_DATA", get_eventdata_QueryStatus = "9714", "DNS_ERROR_NAME_DOES_NOT_EXIST", get_eventdata_QueryStatus = "9715", "DNS_WARNING_PTR_CREATE_FAILED", get_eventdata_QueryStatus = "9716", "DNS_WARNING_DOMAIN_UNDELETED", get_eventdata_QueryStatus = "9717", "DNS_ERROR_DS_UNAVAILABLE", get_eventdata_QueryStatus = "9718", "DNS_ERROR_DS_ZONE_ALREADY_EXISTS", get_eventdata_QueryStatus = "9719", "DNS_ERROR_NO_BOOTFILE_IF_DS_ZONE", get_eventdata_QueryStatus = "9720", "DNS_ERROR_NODE_IS_DNAME", get_eventdata_QueryStatus = "9721", "DNS_ERROR_DNAME_COLLISION", get_eventdata_QueryStatus = "9722", "DNS_ERROR_ALIAS_LOOP", get_eventdata_QueryStatus = "9751", "DNS_INFO_AXFR_COMPLETE", get_eventdata_QueryStatus = "9752", "DNS_ERROR_AXFR", get_eventdata_QueryStatus = "9753", "DNS_INFO_ADDED_LOCAL_WINS", get_eventdata_QueryStatus = "9801", "DNS_STATUS_CONTINUE_NEEDED", get_eventdata_QueryStatus = "9851", "DNS_ERROR_NO_TCPIP", get_eventdata_QueryStatus = "9852", "DNS_ERROR_NO_DNS_SERVERS", get_eventdata_QueryStatus = "9901", "DNS_ERROR_DP_DOES_NOT_EXIST", get_eventdata_QueryStatus = "9902", "DNS_ERROR_DP_ALREADY_EXISTS", get_eventdata_QueryStatus = "9903", "DNS_ERROR_DP_NOT_ENLISTED", get_eventdata_QueryStatus = "9904", "DNS_ERROR_DP_ALREADY_ENLISTED", get_eventdata_QueryStatus = "9905", "DNS_ERROR_DP_NOT_AVAILABLE", get_eventdata_QueryStatus = "9906", "DNS_ERROR_DP_FSMO_ERROR", get_eventdata_QueryStatus = null, null, to_string(get_eventdata_QueryStatus)),
xdm.source.process.executable.signature_status = if(get_eventdata_SignatureStatus = "valid", XDM_CONST.SIGNATURE_STATUS_SIGNED_VERIFIED, get_eventdata_SignatureStatus = "unavailable", XDM_CONST.SIGNATURE_STATUS_STATUS_UNKNOWN, get_eventdata_SignatureStatus = "expired", XDM_CONST.SIGNATURE_STATUS_SIGNED_INVALID, get_eventdata_SignatureStatus = null, null, to_string(get_eventdata_SignatureStatus)),
xdm.source.process.executable.signer = if(get_eventdata_Signature = "-", null, get_eventdata_Signature),
xdm.source.process.executable.is_signed = to_boolean(get_eventdata_Signed),
xdm.source.process.parent_id = get_eventdata_ParentProcessId,
xdm.source.process.executable.file_type = if(get_eventdata_FileVersion = "-", null, get_eventdata_FileVersion),
xdm.source.agent.identifier = get_eventdata_TerminalSessionId,
xdm.source.process.executable.path = coalesce(get_eventdata_ImageLoaded, get_eventdata_CallTrace),
xdm.source.process.is_injected = if(get_eventid_str = "25", to_boolean("true"), null),
xdm.event.id = get_eventid_str,
xdm.event.type = channel,
xdm.event.original_event_type = check_eventid_name,
xdm.session_context_id = to_string(record_id),
xdm.source.process.pid = coalesce(get_eventdata_SourceProcessId, get_eventdata_ProcessId, get_processpid_int),
xdm.source.process.thread_id = coalesce(get_eventdata_SourceThreadId, get_processthreadid_int),
xdm.event.operation = if(clean_task ~= "process create", XDM_CONST.OPERATION_TYPE_PROCESS_CREATE, clean_task ~= "file created", XDM_CONST.OPERATION_TYPE_FILE_CREATE, clean_task ~= "registry value set", XDM_CONST.OPERATION_TYPE_REGISTRY_SET_VALUE, clean_task ~= "file delete logged", XDM_CONST.OPERATION_TYPE_REGISTRY_SET_VALUE, check_task_registry = "DeleteKey", XDM_CONST.OPERATION_TYPE_REGISTRY_DELETE_KEY, check_task_registry = "DeleteValue", XDM_CONST.OPERATION_TYPE_REGISTRY_DELETE_VALUE, check_task_registry = "CreateKey", XDM_CONST.OPERATION_TYPE_REGISTRY_CREATE_KEY, clean_task ~= "image loaded", XDM_CONST.OPERATION_TYPE_IMAGE_LOAD, get_eventid_str = "5", XDM_CONST.OPERATION_TYPE_PROCESS_TERMINATE, get_eventid_str = "23", XDM_CONST.OPERATION_TYPE_FILE_REMOVE, get_eventid_str = "26", XDM_CONST.OPERATION_TYPE_FILE_REMOVE, task = null, null, to_string(task)),
xdm.source.user.user_type = if(get_user_type contains "User", XDM_CONST.USER_TYPE_REGULAR, get_user_type contains "Service", XDM_CONST.USER_TYPE_SERVICE_ACCOUNT , get_user_type contains "Computer", XDM_CONST.USER_TYPE_MACHINE_ACCOUNT , get_user_type),
xdm.source.user.identifier = get_user_sid,
xdm.source.user.domain = coalesce(check_eventdata_SourceUser_domain, check_eventdata_User_domain, get_user_domain),
xdm.source.user.username = coalesce(check_eventdata_SourceUser_name, check_eventdata_User_name, get_user_name),
xdm.event.log_level = if(clean_log_level = "information", XDM_CONST.LOG_LEVEL_INFORMATIONAL, clean_log_level = "error", XDM_CONST.LOG_LEVEL_ERROR, clean_log_level = "warning", XDM_CONST.LOG_LEVEL_WARNING, clean_log_level = "critical", XDM_CONST.LOG_LEVEL_CRITICAL, coalesce(to_string(opcode), to_string(log_level))),
xdm.event.description = message,
xdm.alert.description = event_data,
xdm.source.process.executable.directory = coalesce(get_eventdata_SourceImage, get_eventdata_Image),
xdm.source.process.name = coalesce(check_eventdata_SourceImage_exe, check_eventdata_Image_exe),
xdm.network.rule = check_eventdata_RuleName,
xdm.event.operation_sub_type = get_eventdata_eventtype,
xdm.target.process.pid = to_integer(get_eventdata_TargetProcessId),
xdm.target.user.username = check_eventdata_TargetUser_name,
xdm.target.user.domain = check_eventdata_TargetUser_domain,
xdm.target.process.name = check_eventdata_TargetImage_exe,
xdm.target.process.executable.directory = get_eventdata_TargetImage,
xdm.target.registry.key = get_eventdata_TargetObject,
xdm.target.registry.value = get_eventdata_Details,
xdm.target.registry.value_type = if(clean_eventdata_details ~= "binary", XDM_CONST.REGISTRY_VALUE_TYPE_REG_BINARY, clean_eventdata_details ~= "dword" and clean_eventdata_details ~= "little", XDM_CONST.REGISTRY_VALUE_TYPE_REG_DWORD_LITTLE_ENDIAN, clean_eventdata_details ~= "dword" and clean_eventdata_details ~= "big", XDM_CONST.REGISTRY_VALUE_TYPE_REG_DWORD_BIG_ENDIAN, clean_eventdata_details ~= "dword", XDM_CONST.REGISTRY_VALUE_TYPE_REG_DWORD, clean_eventdata_details ~= "link", XDM_CONST.REGISTRY_VALUE_TYPE_REG_LINK, clean_eventdata_details ~= "none", XDM_CONST.REGISTRY_VALUE_TYPE_REG_NONE, clean_eventdata_details ~= "qword" and clean_eventdata_details ~= "little", XDM_CONST.REGISTRY_VALUE_TYPE_REG_QWORD_LITTLE_ENDIAN, clean_eventdata_details ~= "qword", XDM_CONST.REGISTRY_VALUE_TYPE_REG_QWORD, clean_eventdata_details ~= "expand", XDM_CONST.REGISTRY_VALUE_TYPE_REG_EXPAND_SZ, clean_eventdata_details ~= "multi", XDM_CONST.REGISTRY_VALUE_TYPE_REG_MULTI_SZ, clean_eventdata_details ~= "sz", XDM_CONST.REGISTRY_VALUE_TYPE_REG_SZ, clean_eventdata_details = null, null, to_string(clean_eventdata_details)),
xdm.target.file.path = get_eventdata_TargetFilename,
xdm.source.process.executable.sha256 = get_eventdata_Hashes_sha256,
xdm.network.ip_protocol = if(get_eventdata_Protocol = "HOPOPT" , XDM_CONST.IP_PROTOCOL_HOPOPT, get_eventdata_Protocol = "ICMP" , XDM_CONST.IP_PROTOCOL_ICMP, get_eventdata_Protocol = "IGMP" , XDM_CONST.IP_PROTOCOL_IGMP, get_eventdata_Protocol = "GGP" , XDM_CONST.IP_PROTOCOL_GGP, get_eventdata_Protocol = "IP" , XDM_CONST.IP_PROTOCOL_IP, get_eventdata_Protocol = "ST" , XDM_CONST.IP_PROTOCOL_ST, get_eventdata_Protocol = "TCP" , XDM_CONST.IP_PROTOCOL_TCP, get_eventdata_Protocol = "CBT" , XDM_CONST.IP_PROTOCOL_CBT, get_eventdata_Protocol = "EGP" , XDM_CONST.IP_PROTOCOL_EGP, get_eventdata_Protocol = "IGP" , XDM_CONST.IP_PROTOCOL_IGP, get_eventdata_Protocol = "BBN_RCC_MON" , XDM_CONST.IP_PROTOCOL_BBN_RCC_MON, get_eventdata_Protocol = "NVP_II" , XDM_CONST.IP_PROTOCOL_NVP_II, get_eventdata_Protocol = "PUP" , XDM_CONST.IP_PROTOCOL_PUP, get_eventdata_Protocol = "ARGUS" , XDM_CONST.IP_PROTOCOL_ARGUS, get_eventdata_Protocol = "EMCON" , XDM_CONST.IP_PROTOCOL_EMCON, get_eventdata_Protocol = "XNET" , XDM_CONST.IP_PROTOCOL_XNET, get_eventdata_Protocol = "CHAOS" , XDM_CONST.IP_PROTOCOL_CHAOS, get_eventdata_Protocol = "UDP" , XDM_CONST.IP_PROTOCOL_UDP, get_eventdata_Protocol = "MUX" , XDM_CONST.IP_PROTOCOL_MUX, get_eventdata_Protocol = "DCN_MEAS" , XDM_CONST.IP_PROTOCOL_DCN_MEAS, get_eventdata_Protocol = "HMP" , XDM_CONST.IP_PROTOCOL_HMP, get_eventdata_Protocol = "PRM" , XDM_CONST.IP_PROTOCOL_PRM, get_eventdata_Protocol = "XNS_IDP" , XDM_CONST.IP_PROTOCOL_XNS_IDP, get_eventdata_Protocol = "TRUNK_1" , XDM_CONST.IP_PROTOCOL_TRUNK_1, get_eventdata_Protocol = "TRUNK_2" , XDM_CONST.IP_PROTOCOL_TRUNK_2, get_eventdata_Protocol = "LEAF_1" , XDM_CONST.IP_PROTOCOL_LEAF_1, get_eventdata_Protocol = "LEAF_2" , XDM_CONST.IP_PROTOCOL_LEAF_2, get_eventdata_Protocol = "RDP" , XDM_CONST.IP_PROTOCOL_RDP, get_eventdata_Protocol = "IRTP" , XDM_CONST.IP_PROTOCOL_IRTP, get_eventdata_Protocol = "ISO_TP4" , XDM_CONST.IP_PROTOCOL_ISO_TP4, get_eventdata_Protocol = "NETBLT" , XDM_CONST.IP_PROTOCOL_NETBLT, get_eventdata_Protocol = "MFE_NSP" , XDM_CONST.IP_PROTOCOL_MFE_NSP, get_eventdata_Protocol = "MERIT_INP" , XDM_CONST.IP_PROTOCOL_MERIT_INP, get_eventdata_Protocol = "DCCP" , XDM_CONST.IP_PROTOCOL_DCCP, get_eventdata_Protocol = "3PC" , XDM_CONST.IP_PROTOCOL_3PC, get_eventdata_Protocol = "IDPR" , XDM_CONST.IP_PROTOCOL_IDPR, get_eventdata_Protocol = "XTP" , XDM_CONST.IP_PROTOCOL_XTP, get_eventdata_Protocol = "DDP" , XDM_CONST.IP_PROTOCOL_DDP, get_eventdata_Protocol = "IDPR_CMTP" , XDM_CONST.IP_PROTOCOL_IDPR_CMTP, get_eventdata_Protocol = "TP" , XDM_CONST.IP_PROTOCOL_TP, get_eventdata_Protocol = "IL" , XDM_CONST.IP_PROTOCOL_IL, get_eventdata_Protocol = "IPV6" , XDM_CONST.IP_PROTOCOL_IPV6, get_eventdata_Protocol = "SDRP" , XDM_CONST.IP_PROTOCOL_SDRP, get_eventdata_Protocol = "IPV6_ROUTE" , XDM_CONST.IP_PROTOCOL_IPV6_ROUTE, get_eventdata_Protocol = "IPV6_FRAG" , XDM_CONST.IP_PROTOCOL_IPV6_FRAG, get_eventdata_Protocol = "IDRP" , XDM_CONST.IP_PROTOCOL_IDRP, get_eventdata_Protocol = "RSVP" , XDM_CONST.IP_PROTOCOL_RSVP, get_eventdata_Protocol = "GRE" , XDM_CONST.IP_PROTOCOL_GRE, get_eventdata_Protocol = "DSR" , XDM_CONST.IP_PROTOCOL_DSR, get_eventdata_Protocol = "BNA" , XDM_CONST.IP_PROTOCOL_BNA, get_eventdata_Protocol = "ESP" , XDM_CONST.IP_PROTOCOL_ESP, get_eventdata_Protocol = "AH" , XDM_CONST.IP_PROTOCOL_AH, get_eventdata_Protocol = "I_NLSP" , XDM_CONST.IP_PROTOCOL_I_NLSP, get_eventdata_Protocol = "SWIPE" , XDM_CONST.IP_PROTOCOL_SWIPE, get_eventdata_Protocol = "NARP" , XDM_CONST.IP_PROTOCOL_NARP, get_eventdata_Protocol = "MOBILE" , XDM_CONST.IP_PROTOCOL_MOBILE, get_eventdata_Protocol = "TLSP" , XDM_CONST.IP_PROTOCOL_TLSP, get_eventdata_Protocol = "SKIP" , XDM_CONST.IP_PROTOCOL_SKIP, get_eventdata_Protocol = "IPV6_ICMP" , XDM_CONST.IP_PROTOCOL_IPV6_ICMP, get_eventdata_Protocol = "IPV6_NONXT" , XDM_CONST.IP_PROTOCOL_IPV6_NONXT, get_eventdata_Protocol = "IPV6_OPTS" , XDM_CONST.IP_PROTOCOL_IPV6_OPTS, get_eventdata_Protocol = "CFTP" , XDM_CONST.IP_PROTOCOL_CFTP, get_eventdata_Protocol = "SAT_EXPAK" , XDM_CONST.IP_PROTOCOL_SAT_EXPAK, get_eventdata_Protocol = "KRYPTOLAN" , XDM_CONST.IP_PROTOCOL_KRYPTOLAN, get_eventdata_Protocol = "RVD" , XDM_CONST.IP_PROTOCOL_RVD, get_eventdata_Protocol = "IPPC" , XDM_CONST.IP_PROTOCOL_IPPC, get_eventdata_Protocol = "SAT_MON" , XDM_CONST.IP_PROTOCOL_SAT_MON, get_eventdata_Protocol = "VISA" , XDM_CONST.IP_PROTOCOL_VISA, get_eventdata_Protocol = "IPCV" , XDM_CONST.IP_PROTOCOL_IPCV, get_eventdata_Protocol = "CPNX" , XDM_CONST.IP_PROTOCOL_CPNX, get_eventdata_Protocol = "CPHB" , XDM_CONST.IP_PROTOCOL_CPHB, get_eventdata_Protocol = "WSN" , XDM_CONST.IP_PROTOCOL_WSN, get_eventdata_Protocol = "PVP" , XDM_CONST.IP_PROTOCOL_PVP, get_eventdata_Protocol = "BR_SAT_MON" , XDM_CONST.IP_PROTOCOL_BR_SAT_MON, get_eventdata_Protocol = "SUN_ND" , XDM_CONST.IP_PROTOCOL_SUN_ND, get_eventdata_Protocol = "WB_MON" , XDM_CONST.IP_PROTOCOL_WB_MON, get_eventdata_Protocol = "WB_EXPAK" , XDM_CONST.IP_PROTOCOL_WB_EXPAK, get_eventdata_Protocol = "ISO_IP" , XDM_CONST.IP_PROTOCOL_ISO_IP, get_eventdata_Protocol = "VMTP" , XDM_CONST.IP_PROTOCOL_VMTP, get_eventdata_Protocol = "SECURE_VMTP" , XDM_CONST.IP_PROTOCOL_SECURE_VMTP, get_eventdata_Protocol = "VINES" , XDM_CONST.IP_PROTOCOL_VINES, get_eventdata_Protocol = "TTP" , XDM_CONST.IP_PROTOCOL_TTP, get_eventdata_Protocol = "NSFNET_IGP" , XDM_CONST.IP_PROTOCOL_NSFNET_IGP, get_eventdata_Protocol = "DGP" , XDM_CONST.IP_PROTOCOL_DGP, get_eventdata_Protocol = "TCF" , XDM_CONST.IP_PROTOCOL_TCF, get_eventdata_Protocol = "EIGRP" , XDM_CONST.IP_PROTOCOL_EIGRP, get_eventdata_Protocol = "OSPFIGP" , XDM_CONST.IP_PROTOCOL_OSPFIGP, get_eventdata_Protocol = "SPRITE_RPC" , XDM_CONST.IP_PROTOCOL_SPRITE_RPC, get_eventdata_Protocol = "LARP" , XDM_CONST.IP_PROTOCOL_LARP, get_eventdata_Protocol = "MTP" , XDM_CONST.IP_PROTOCOL_MTP, get_eventdata_Protocol = "AX25" , XDM_CONST.IP_PROTOCOL_AX25, get_eventdata_Protocol = "IPIP" , XDM_CONST.IP_PROTOCOL_IPIP, get_eventdata_Protocol = "MICP" , XDM_CONST.IP_PROTOCOL_MICP, get_eventdata_Protocol = "SCC_SP" , XDM_CONST.IP_PROTOCOL_SCC_SP, get_eventdata_Protocol = "ETHERIP" , XDM_CONST.IP_PROTOCOL_ETHERIP, get_eventdata_Protocol = "ENCAP" , XDM_CONST.IP_PROTOCOL_ENCAP, get_eventdata_Protocol = "GMTP" , XDM_CONST.IP_PROTOCOL_GMTP, get_eventdata_Protocol = "IFMP" , XDM_CONST.IP_PROTOCOL_IFMP, get_eventdata_Protocol = "PNNI" , XDM_CONST.IP_PROTOCOL_PNNI, get_eventdata_Protocol = "PIM" , XDM_CONST.IP_PROTOCOL_PIM, get_eventdata_Protocol = "ARIS" , XDM_CONST.IP_PROTOCOL_ARIS, get_eventdata_Protocol = "SCPS" , XDM_CONST.IP_PROTOCOL_SCPS, get_eventdata_Protocol = "QNX" , XDM_CONST.IP_PROTOCOL_QNX, get_eventdata_Protocol = "AN" , XDM_CONST.IP_PROTOCOL_AN, get_eventdata_Protocol = "IPCOMP" , XDM_CONST.IP_PROTOCOL_IPCOMP, get_eventdata_Protocol = "SNP" , XDM_CONST.IP_PROTOCOL_SNP, get_eventdata_Protocol = "COMPAQ_PEER" , XDM_CONST.IP_PROTOCOL_COMPAQ_PEER, get_eventdata_Protocol = "IPX_IN_IP" , XDM_CONST.IP_PROTOCOL_IPX_IN_IP, get_eventdata_Protocol = "VRRP" , XDM_CONST.IP_PROTOCOL_VRRP, get_eventdata_Protocol = "PGM" , XDM_CONST.IP_PROTOCOL_PGM, get_eventdata_Protocol = "L2TP" , XDM_CONST.IP_PROTOCOL_L2TP, get_eventdata_Protocol = "DDX" , XDM_CONST.IP_PROTOCOL_DDX, get_eventdata_Protocol = "IATP" , XDM_CONST.IP_PROTOCOL_IATP, get_eventdata_Protocol = "STP" , XDM_CONST.IP_PROTOCOL_STP, get_eventdata_Protocol = "SRP" , XDM_CONST.IP_PROTOCOL_SRP, get_eventdata_Protocol = "UTI" , XDM_CONST.IP_PROTOCOL_UTI, get_eventdata_Protocol = "SMP" , XDM_CONST.IP_PROTOCOL_SMP, get_eventdata_Protocol = "SM" , XDM_CONST.IP_PROTOCOL_SM, get_eventdata_Protocol = "PTP" , XDM_CONST.IP_PROTOCOL_PTP, get_eventdata_Protocol = "ISIS" , XDM_CONST.IP_PROTOCOL_ISIS, get_eventdata_Protocol = "FIRE" , XDM_CONST.IP_PROTOCOL_FIRE, get_eventdata_Protocol = "CRTP" , XDM_CONST.IP_PROTOCOL_CRTP, get_eventdata_Protocol = "CRUDP" , XDM_CONST.IP_PROTOCOL_CRUDP, get_eventdata_Protocol = "SSCOPMCE" , XDM_CONST.IP_PROTOCOL_SSCOPMCE, get_eventdata_Protocol = "IPLT" , XDM_CONST.IP_PROTOCOL_IPLT, get_eventdata_Protocol = "SPS" , XDM_CONST.IP_PROTOCOL_SPS, get_eventdata_Protocol = "PIPE" , XDM_CONST.IP_PROTOCOL_PIPE, get_eventdata_Protocol = "SCTP" , XDM_CONST.IP_PROTOCOL_SCTP, get_eventdata_Protocol = "FC" , XDM_CONST.IP_PROTOCOL_FC, get_eventdata_Protocol = "RSVP_E2E_IGNORE" , XDM_CONST.IP_PROTOCOL_RSVP_E2E_IGNORE, get_eventdata_Protocol = "MOBILITY" , XDM_CONST.IP_PROTOCOL_MOBILITY, get_eventdata_Protocol = "UDPLITE" , XDM_CONST.IP_PROTOCOL_UDPLITE, get_eventdata_Protocol = "MPLS_IN_IP" , XDM_CONST.IP_PROTOCOL_MPLS_IN_IP, get_eventdata_Protocol = "MANET" , XDM_CONST.IP_PROTOCOL_MANET, get_eventdata_Protocol = "HIP" , XDM_CONST.IP_PROTOCOL_HIP, get_eventdata_Protocol = "SHIM6" , XDM_CONST.IP_PROTOCOL_SHIM6, get_eventdata_Protocol = "WESP" , XDM_CONST.IP_PROTOCOL_WESP, get_eventdata_Protocol = "ROHC" , XDM_CONST.IP_PROTOCOL_ROHC, get_eventdata_Protocol = "RESERVED" , XDM_CONST.IP_PROTOCOL_RESERVED, get_eventdata_Protocol = null, null, to_string(get_eventdata_Protocol)),
xdm.target.ipv4 = check_eventdata_DestinationIp_v4,
xdm.target.ipv6 = check_eventdata_DestinationIp_v6,
xdm.target.is_internal_ip = if(get_eventdata_DestinationIp = null, null, clean_target_localip_10 = false and clean_target_localip_172 = false and clean_target_localip_192 = false and clean_target_localip_127 = false and clean_target_localip_169 = false, to_boolean("false"), to_boolean("true")),
xdm.target.host.hostname = if(get_eventdata_DestinationHostname = "-", null, get_eventdata_DestinationHostname),
xdm.source.host.hostname = if(get_eventdata_SourceHostname = "-", null, coalesce(get_eventdata_SourceHostname, host_name, computer_name)),
xdm.source.ipv4 = check_eventdata_SourceIp_v4,
xdm.source.ipv6 = check_eventdata_SourceIp_v6,
xdm.source.is_internal_ip = if(get_eventdata_SourceIp = null, null, clean_source_localip_10 = false and clean_source_localip_172 = false and clean_source_localip_192 = false and clean_source_localip_127 = false and clean_source_localip_169 = false, to_boolean("false"), to_boolean("true")),
xdm.source.port = get_eventdata_SourcePort,
xdm.target.port = get_eventdata_DestinationPort,
xdm.source.process.command_line = get_eventdata_CommandLine,
xdm.source.process.integrity_level = check_eventdata_IntegrityLevel,
xdm.source.process.executable.filename = get_eventdata_OriginalFileName,
xdm.logon.logon_guid = get_eventdata_LogonGuid,
xdm.alert.subcategory = get_eventdata_Description;