Mimecast Modeling Rule

Details

ID	`Mimecast_ModelingRule`
From Version	6.10.0
Tags	mimecast

Rules (XIF)

[MODEL: dataset = mimecast_mimecast_raw]
filter
    xsiem_classifier = "audit_event"
| alter
    
    xdm.event.operation_sub_type = category,
    xdm.event.description = eventInfo,
    xdm.event.type = auditType,
    xdm.source.user.username = user,
    xdm.event.id = id;

filter
    xsiem_classifier = "siem_log"
| alter
    rcpt_array = arraymap(json_extract_array(rcpt, "$."), trim("@element", "\"")),
    recipient_array = arraymap(json_extract_array(Recipient, "$."), trim("@element", "\"")),
    ip_array = arraymap(json_extract_array(IP , "$."), trim("@element", "\"")),
    src_ip_array = arraymap(json_extract_array(SourceIP , "$."), trim("@element", "\""))
| alter
    xdm.observer.unique_identifier = acc,
    xdm.event.id = aCode,
    xdm.email.attachment.filename = AttNames,
    xdm.email.recipients = arrayconcat(rcpt_array, recipient_array),
    xdm.email.message_id = MsgId,
    xdm.email.sender = Sender,
    xdm.email.subject = Subject,
    xdm.alert.name = Virus,
    xdm.email.attachment.extension = fileExt,
    xdm.email.attachment.file_type = fileMime,
    xdm.email.attachment.md5 = md5,
    xdm.email.attachment.sha256 = sha256,
    xdm.event.description = ScanResultInfo,
    xdm.event.type = coalesce(Action, Act),
    xdm.target.host.ipv4_addresses = arrayconcat(ip_array, src_ip_array);

Schema

`mimecast_mimecast_raw`

Field	Type	Array?
`Act`	string	—
`Action`	string	—
`AttNames`	string	—
`IP`	string	—
`MsgId`	string	—
`Rcpt`	string	—
`Recipient`	string	—
`ScanResultInfo`	string	—
`Sender`	string	—
`SourceIP`	string	—
`Subject`	string	—
`Virus`	string	—
`aCode`	string	—
`acc`	string	—
`auditType`	string	—
`category`	string	—
`datetime`	datetime	—
`eventInfo`	string	—
`eventTime`	datetime	—
`fileExt`	string	—
`fileMime`	string	—
`id`	string	—
`md5`	string	—
`sha256`	string	—
`user`	string	—
`xsiem_classifier`	string	—

Raw JSON

{
    "mimecast_mimecast_raw": {
        "category": {
            "type": "string",
            "is_array": false
        },
        "eventInfo": {
            "type": "string",
            "is_array": false
        },
        "auditType": {
            "type": "string",
            "is_array": false
        },
        "user": {
            "type": "string",
            "is_array": false
        },
        "id": {
            "type": "string",
            "is_array": false
        },
        "acc": {
            "type": "string",
            "is_array": false
        },
        "aCode": {
            "type": "string",
            "is_array": false
        },
        "Act": {
            "type": "string",
            "is_array": false
        },
        "AttNames": {
            "type": "string",
            "is_array": false
        },
        "datetime": {
            "type": "datetime",
            "is_array": false
        },
        "IP": {
            "type": "string",
            "is_array": false
        },
        "MsgId": {
            "type": "string",
            "is_array": false
        },
        "Sender": {
            "type": "string",
            "is_array": false
        },
        "Subject": {
            "type": "string",
            "is_array": false
        },
        "Virus": {
            "type": "string",
            "is_array": false
        },
        "fileExt": {
            "type": "string",
            "is_array": false
        },
        "fileMime": {
            "type": "string",
            "is_array": false
        },
        "md5": {
            "type": "string",
            "is_array": false
        },
        "sha256": {
            "type": "string",
            "is_array": false
        },
        "SourceIP": {
            "type": "string",
            "is_array": false
        },
        "ScanResultInfo": {
            "type": "string",
            "is_array": false
        },
        "Action": {
            "type": "string",
            "is_array": false
        },
        "Rcpt": {
            "type": "string",
            "is_array": false
        },
        "Recipient": {
            "type": "string",
            "is_array": false
        },
        "xsiem_classifier": {
            "type": "string",
            "is_array": false
        },
        "eventTime": {
            "type": "datetime",
            "is_array": false
        }
    }
}