Rules (XIF)
[MODEL: dataset="mongodb_atlas_raw"]
filter source_log_type = "alerts"
| alter
xdm.event.type = source_log_type,
xdm.alert.description = acknowledgementComment,
xdm.alert.original_alert_id = coalesce(alertConfigId, id),
xdm.event.original_event_type = eventTypeName,
xdm.source.user.groups = arraycreate(groupId),
xdm.observer.unique_identifier = arraystring(arraydistinct(arraymap(links -> [], "@element" -> href)), "|");
filter source_log_type = "events"
| alter
get_linkToDetails = arraycreate(linkToDetails),
get_links_href = arraydistinct(arraymap(links -> [], "@element" -> href))
| alter
check_remoteAddress_ipv4 = if(remoteAddress ~= "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}", remoteAddress),
check_remoteAddress_ipv6 = if(remoteAddress ~= "(?:[a-fA-F\d]{0,4}\:){1,7}[a-fA-F\d]{0,4}", remoteAddress),
check_links = arraystring(arrayconcat(get_linkToDetails, get_links_href), "|")
| alter
xdm.event.type = source_log_type,
xdm.alert.original_alert_id = coalesce(alertConfigId, id),
xdm.event.original_event_type = eventTypeName,
xdm.source.user.groups = arraycreate(groupId),
xdm.observer.unique_identifier = if(check_links ~= "^\s*\|\s*$", null, check_links ~= "^\|", ltrim(check_links, "|"), check_links ~= "\|$", rtrim(check_links, "|"), check_links),
xdm.source.user.username = username,
xdm.auth.privilege_level = if(to_boolean(isGlobalAdmin) = true, XDM_CONST.PRIVILEGE_LEVEL_ADMIN),
xdm.source.ipv4 = check_remoteAddress_ipv4,
xdm.source.ipv6 = check_remoteAddress_ipv6,
xdm.target.user.username = targetUsername,
xdm.source.user.identifier = userId,
xdm.database.name = database,
xdm.target.host.hostname = hostname,
xdm.target.port = to_integer(port),
xdm.target.application.name = applicationName,
xdm.observer.action = to_string(diffs),
xdm.target.resource.type = if(replicaSetName != null, "replicaSetName"),
xdm.target.resource.name = if(replicaSetName != null, replicaSetName),
xdm.database.operation = if(opType ~= "query", XDM_CONST.DB_OPERATION_QUERY, opType ~= "update", XDM_CONST.DB_OPERATION_UPDATE, opType ~= "create", XDM_CONST.DB_OPERATION_CREATE, opType ~= "delete", XDM_CONST.DB_OPERATION_DELETE, opType ~= "alter", XDM_CONST.DB_OPERATION_ALTER, opType = null, null, to_string(opType)),
xdm.alert.description = to_string(object_create("apiKeyId", apiKeyId, "publicKey", publicKey, "targetPublicKey", targetPublicKey, "collection", collection, "userAlias", userAlias, "clusterName", clusterName, "whitelistEntry", whitelistEntry, "dbUserUsername", dbUserUsername));
Schema
mongodb_atlas_raw
| Field |
Type |
Array? |
_ENTRY_STATUS |
string |
— |
acknowledgementComment |
string |
— |
acknowledgingUsername |
string |
— |
alertConfigId |
string |
— |
alertId |
string |
— |
apiKeyId |
string |
— |
applicationId |
string |
— |
applicationName |
string |
— |
clusterName |
string |
— |
collection |
string |
— |
database |
string |
— |
dbUserUsername |
string |
— |
diffs |
string |
— |
eventTypeName |
string |
— |
groupId |
string |
— |
hostname |
string |
— |
id |
string |
— |
isGlobalAdmin |
string |
— |
linkToDetails |
string |
— |
links |
string |
— |
opType |
string |
— |
port |
string |
— |
publicKey |
string |
— |
remoteAddress |
string |
— |
replicaSetName |
string |
— |
source_log_type |
string |
— |
status |
string |
— |
targetPublicKey |
string |
— |
targetUsername |
string |
— |
userAlias |
string |
— |
userId |
string |
— |
username |
string |
— |
whitelistEntry |
string |
— |
Raw JSON
{
"mongodb_atlas_raw": {
"source_log_type": {
"type": "string",
"is_array": false
},
"acknowledgementComment": {
"type": "string",
"is_array": false
},
"acknowledgingUsername": {
"type": "string",
"is_array": false
},
"alertConfigId": {
"type": "string",
"is_array": false
},
"eventTypeName": {
"type": "string",
"is_array": false
},
"groupId": {
"type": "string",
"is_array": false
},
"id": {
"type": "string",
"is_array": false
},
"links": {
"type": "string",
"is_array": false
},
"status": {
"type": "string",
"is_array": false
},
"_ENTRY_STATUS": {
"type": "string",
"is_array": false
},
"apiKeyId": {
"type": "string",
"is_array": false
},
"isGlobalAdmin": {
"type": "string",
"is_array": false
},
"publicKey": {
"type": "string",
"is_array": false
},
"remoteAddress": {
"type": "string",
"is_array": false
},
"targetPublicKey": {
"type": "string",
"is_array": false
},
"userId": {
"type": "string",
"is_array": false
},
"username": {
"type": "string",
"is_array": false
},
"targetUsername": {
"type": "string",
"is_array": false
},
"alertId": {
"type": "string",
"is_array": false
},
"collection": {
"type": "string",
"is_array": false
},
"database": {
"type": "string",
"is_array": false
},
"opType": {
"type": "string",
"is_array": false
},
"hostname": {
"type": "string",
"is_array": false
},
"port": {
"type": "string",
"is_array": false
},
"replicaSetName": {
"type": "string",
"is_array": false
},
"userAlias": {
"type": "string",
"is_array": false
},
"clusterName": {
"type": "string",
"is_array": false
},
"whitelistEntry": {
"type": "string",
"is_array": false
},
"applicationId": {
"type": "string",
"is_array": false
},
"applicationName": {
"type": "string",
"is_array": false
},
"linkToDetails": {
"type": "string",
"is_array": false
},
"diffs": {
"type": "string",
"is_array": false
},
"dbUserUsername": {
"type": "string",
"is_array": false
}
}
}