NetBox IRM Modeling Rule

Details

ID	`NetBox_IRM_modeling_rule`
From Version	6.10.0
Tags	NetBox

Rules (XIF)

[MODEL: dataset="netbox_irm_raw"]
filter
    user = null
| alter
    xdm.event.description = comments,
    xdm.alert.subcategory = json_extract_scalar(kind, "$.value"),
    xdm.target.resource.id = to_string(json_extract(assigned_object, "$.id")),
    xdm.target.resource.name = json_extract_scalar(assigned_object, "$.name"),
    xdm.target.resource.type = assigned_object_type;

filter
    user != null
| alter
    xdm.event.id = request_id,
    xdm.event.description = display,
    xdm.event.operation = json_extract_scalar(action, "$.value"),
    xdm.target.resource.id = to_string(changed_object_id),
    xdm.target.resource.name = json_extract_scalar(changed_object, "$.display"),
    xdm.target.resource.type = changed_object_type,
    xdm.target.resource_before.name = json_extract_scalar(prechange_data, "$.name"),
    xdm.source.user.username = user_name;

Schema

`netbox_irm_raw`

Field	Type	Array?
`action`	string	—
`assigned_object`	string	—
`assigned_object_type`	string	—
`changed_object`	string	—
`changed_object_id`	string	—
`changed_object_type`	string	—
`comments`	string	—
`display`	string	—
`kind`	string	—
`prechange_data`	string	—
`request_id`	string	—
`user`	string	—
`user_name`	string	—

Raw JSON

{
  "netbox_irm_raw": {
    "user": {
      "type": "string",
      "is_array": false
    },
    "comments": {
      "type": "string",
      "is_array": false
    },
    "kind": {
      "type": "string",
      "is_array": false
    },
    "assigned_object": {
      "type": "string",
      "is_array": false
    },
    "assigned_object_type": {
      "type": "string",
      "is_array": false
    },
    "request_id": {
      "type": "string",
      "is_array": false
    },
    "display": {
      "type": "string",
      "is_array": false
    },
    "action": {
      "type": "string",
      "is_array": false
    },
    "changed_object_id": {
      "type": "string",
      "is_array": false
    },
    "changed_object": {
      "type": "string",
      "is_array": false
    },
    "changed_object_type": {
      "type": "string",
      "is_array": false
    },
    "prechange_data": {
      "type": "string",
      "is_array": false
    },
    "user_name": {
      "type": "string",
      "is_array": false
    }
  }
}