NetBox IRM Modeling Rule

Modeling Rule

NetBox

Details

IDNetBox_IRM_modeling_rule
From Version6.10.0
TagsNetBox

Schema

netbox_irm_raw

Field Type Array?
action string —
assigned_object string —
assigned_object_type string —
changed_object string —
changed_object_id string —
changed_object_type string —
comments string —
display string —
kind string —
prechange_data string —
request_id string —
user string —
user_name string —

Source

NetBoxModelingRules_1_3.xif NetBoxModelingRules_1_3.yml NetBoxModelingRules_1_3_schema.json
Download History Raw 
[MODEL: dataset="netbox_irm_raw"]
filter
    user = null
| alter
    xdm.event.description = comments,
    xdm.alert.subcategory = json_extract_scalar(kind, "$.value"),
    xdm.target.resource.id = to_string(json_extract(assigned_object, "$.id")),
    xdm.target.resource.name = json_extract_scalar(assigned_object, "$.name"),
    xdm.target.resource.type = assigned_object_type;

filter
    user != null
| alter
    xdm.event.id = request_id,
    xdm.event.description = display,
    xdm.event.operation = json_extract_scalar(action, "$.value"),
    xdm.target.resource.id = to_string(changed_object_id),
    xdm.target.resource.name = json_extract_scalar(changed_object, "$.display"),
    xdm.target.resource.type = changed_object_type,
    xdm.target.resource_before.name = json_extract_scalar(prechange_data, "$.name"),
    xdm.source.user.username = user_name;