Netskope Modeling Rule

Modeling Rule

Details

ID	`Netskope_Modeling_Rule`
From Version	6.10.0
Tags	netskope

Rules (XIF)

[MODEL: dataset=netskope_netskope_raw]
// Page Logs
filter source_log_event = "page"
| alter
	type_cloud = lowercase(if(traffic_type = "CloudApp", site, null)),
	type_web = lowercase(if(traffic_type ~= "[w|W]eb", site, null)),
	lower_c = lowercase(device)
| alter
	xdm.network.http.url_category = category,
	xdm.target.application.name = type_cloud,
	xdm.target.domain = coalesce(domain, type_web),
	xdm.alert.severity = coalesce(severity, ccl),
	xdm.auth.auth_method = access_method,
	xdm.event.duration = conn_duration,
	xdm.event.type = type,
	xdm.network.http.browser = browser,
	xdm.network.http.url = url,
	xdm.network.session_id = to_string(browser_session_id),
	xdm.session_context_id = to_string(app_session_id),
	xdm.source.application.name = app,
	xdm.source.host.hostname = hostname,
	xdm.source.host.ipv4_addresses = arraycreate(srcip),
	xdm.source.host.os = coalesce(os_version, os),
	xdm.source.host.os_family = if(lower_c ~= "android", "ANDROID", lower_c ~= "windows", "WINDOWS", lower_c ~= "mac", "MACOS", lower_c ~= "linux", "LINUX", lower_c ~= "ios", "IOS", lower_c ~= "ubuntu", "UBUNTU", lower_c ~= "debian", "DEBIAN", lower_c ~= "fedora", "FEDORA", lower_c ~= "centos", "CENTOS", lower_c ~= "chrome", "CHROMEOS", lower_c ~= "solaris", "SOLARIS", lower_c ~= "scada", "SCADA", lower_c = null, null, "UNKNOWN"),
	xdm.source.ipv4 = userip,
	xdm.source.location.city = src_location,
	xdm.source.location.country = src_country,
	xdm.source.location.latitude = to_float(src_latitude),
	xdm.source.location.longitude = to_float(src_longitude),
	xdm.source.location.region = src_region,
	xdm.source.location.timezone = src_timezone,
	xdm.source.sent_bytes = client_bytes,
	xdm.source.user.ou = organization_unit,
	xdm.source.user.username = coalesce(user, ur_normalized),
	xdm.source.user_agent = useragent,
	xdm.target.ipv4 = dstip,
	xdm.target.location.city = dst_location,
	xdm.target.location.country = dst_country,
	xdm.target.location.latitude = to_float(dst_latitude),
    xdm.target.location.longitude = to_float(dst_longitude),
	xdm.target.location.region = dst_region,
	xdm.target.location.timezone = dst_timezone,
	xdm.target.port = to_integer(dstport),
	xdm.source.port = to_integer(srcport),	
	xdm.target.sent_bytes = server_bytes,
	xdm.target.url = page,
	xdm.target.user.identifier = userkey;
// Application Logs
filter source_log_event = "application"
| alter
	type_cloud = lowercase(if(traffic_type = "CloudApp", site, null)),
	type_web = lowercase(if(traffic_type ~= "[w|W]eb", site, null)),
	lower_b = lowercase(action),
	lower_c = lowercase(device)
| alter
	xdm.event.duration = session_duration,
	xdm.source.sent_packets = total_packets,
	xdm.network.protocol_layers = arraycreate(protocol),
	xdm.target.application.name = type_cloud,
	xdm.target.domain = coalesce(domain, type_web, dom),
	xdm.event.description = alert_type,
	xdm.alert.name = alert_name,
	xdm.alert.original_threat_id = malware_type,
	xdm.alert.original_threat_name = malware_name,
	xdm.alert.severity = coalesce(severity, malware_severity, ccl, risk_level),
	xdm.auth.auth_method = access_method,
	xdm.event.id = to_string(request_id),
	xdm.observer.action = activity,
	xdm.event.outcome = if(lower_b = "block", XDM_CONST.OUTCOME_FAILED, lower_b = "alert", XDM_CONST.OUTCOME_PARTIAL, lower_b = "allow", XDM_CONST.OUTCOME_SUCCESS, lower_b = "useralert", XDM_CONST.OUTCOME_PARTIAL, lower_b = "Detection", XDM_CONST.OUTCOME_PARTIAL, lower_b = "bypass", XDM_CONST.OUTCOME_SUCCESS, lower_b = "restrictToView", XDM_CONST.OUTCOME_SUCCESS, lower_b = "disableDownload", XDM_CONST.OUTCOME_FAILED, lower_b = "legalHold", XDM_CONST.OUTCOME_UNKNOWN, lower_b = "expireLink", XDM_CONST.OUTCOME_FAILED, lower_b = "restrictAccess", XDM_CONST.OUTCOME_FAILED, lower_b = "delete", XDM_CONST.OUTCOME_SUCCESS, lower_b = "quarantine", XDM_CONST.OUTCOME_SUCCESS, lower_b = "anomaly_detection", XDM_CONST.OUTCOME_PARTIAL, lower_b = "Detection", XDM_CONST.OUTCOME_PARTIAL, lower_b = null, null, to_string(lower_b)),
	xdm.event.outcome_reason = activity_status,
	xdm.event.type = if(type = "nspolicy", coalesce(event_type, type), coalesce(type, event_type)),
	xdm.network.http.browser = browser,
	xdm.network.http.referrer = referer,
	xdm.network.http.url = url,
	xdm.network.session_id = to_string(browser_session_id),
	xdm.session_context_id = to_string(app_session_id),
	xdm.source.application.name = app,
	xdm.source.cloud.region = region_name,
	xdm.source.host.device_id = instance_id,
	xdm.source.host.hostname = hostname,
	xdm.source.host.ipv4_addresses = arraycreate(srcip),
	xdm.source.host.os = coalesce(os_version, os),
	xdm.source.host.os_family = if(lower_c ~= "android", "ANDROID", lower_c ~= "windows", "WINDOWS", lower_c ~= "mac", "MACOS", lower_c ~= "linux", "LINUX", lower_c ~= "ios", "IOS", lower_c ~= "ubuntu", "UBUNTU", lower_c ~= "debian", "DEBIAN", lower_c ~= "fedora", "FEDORA", lower_c ~= "centos", "CENTOS", lower_c ~= "chrome", "CHROMEOS", lower_c ~= "solaris", "SOLARIS", lower_c ~= "scada", "SCADA", lower_c = null, null, "UNKNOWN"),
	xdm.source.ipv4 = userip,
	xdm.source.location.city = src_location,
	xdm.source.location.country = src_country,
	xdm.source.location.latitude = to_float(src_latitude),
    xdm.source.location.longitude = to_float(src_longitude),
	xdm.source.location.region = src_region,
	xdm.source.location.timezone = src_timezone,
	xdm.source.process.executable.file_type = file_type,
	xdm.source.process.executable.filename = coalesce(filename, title),
	xdm.source.process.executable.md5 = md5,
	xdm.source.process.executable.path = file_path,
	xdm.source.sent_bytes = client_bytes,
	xdm.source.user.identifier = account_id,
	xdm.source.user.ou = organization_unit,
	xdm.auth.privilege_level = if(activity_type ~= "[A|a]dmin", "ADMIN", activity_type ~= "[U|u]ser", "USER", "UNKNOWN"),
	xdm.source.user.username = coalesce(user, user_id, ur_normalized),
	xdm.source.user_agent = useragent,
	xdm.target.file.file_type = object_type,
	xdm.target.file.filename = object,
	xdm.target.file.md5 = local_md5,
	xdm.target.file.sha256 = local_sha256,
	xdm.target.host.hostname = dsthost,
	xdm.target.ipv4 = dstip,
	xdm.target.location.city = dst_location,
	xdm.target.location.country = dst_country,
	xdm.target.location.latitude = to_float(dst_latitude),
    xdm.target.location.longitude = to_float(dst_longitude),
	xdm.target.location.region = dst_region,
	xdm.target.location.timezone = dst_timezone,
	xdm.target.port = to_integer(dstport),
	xdm.source.port = to_integer(srcport),	
	xdm.target.sent_bytes = server_bytes,
	xdm.target.url = coalesce(page, web_url),
	xdm.target.user.identifier = userkey;
// Alert logs
filter source_log_event = "alert"
| alter
	type_cloud = lowercase(if(traffic_type = "CloudApp", site, null)),
	type_web = lowercase(if(traffic_type ~= "[w|W]eb", site, null)),
	lower_b = lowercase(action),
	lower_c = lowercase(device)
| alter
	xdm.event.duration = session_duration,
	xdm.source.sent_packets = total_packets,
	xdm.network.protocol_layers = arraycreate(protocol),
	xdm.target.application.name = type_cloud,
	xdm.target.domain = coalesce(domain, type_web, dom),
	xdm.event.description = alert_type,
	xdm.alert.name = alert_name,
	xdm.alert.original_threat_id = malware_type,
	xdm.alert.original_threat_name = malware_name,
	xdm.alert.severity = coalesce(to_string(severity_level), severity, malware_severity, ccl, risk_level),
	xdm.auth.auth_method = access_method,
	xdm.event.id = to_string(request_id),
	xdm.observer.action = activity,
	xdm.event.outcome = if(lower_b = "block", XDM_CONST.OUTCOME_FAILED, lower_b = "alert", XDM_CONST.OUTCOME_PARTIAL, lower_b = "allow", XDM_CONST.OUTCOME_SUCCESS, lower_b = "useralert", XDM_CONST.OUTCOME_PARTIAL, lower_b = "Detection", XDM_CONST.OUTCOME_PARTIAL, lower_b = "bypass", XDM_CONST.OUTCOME_SUCCESS, lower_b = "restrictToView", XDM_CONST.OUTCOME_SUCCESS, lower_b = "disableDownload", XDM_CONST.OUTCOME_FAILED, lower_b = "legalHold", XDM_CONST.OUTCOME_UNKNOWN, lower_b = "expireLink", XDM_CONST.OUTCOME_FAILED, lower_b = "restrictAccess", XDM_CONST.OUTCOME_FAILED, lower_b = "delete", XDM_CONST.OUTCOME_SUCCESS, lower_b = "quarantine", XDM_CONST.OUTCOME_SUCCESS, lower_b = "anomaly_detection", XDM_CONST.OUTCOME_PARTIAL, lower_b = "Detection", XDM_CONST.OUTCOME_PARTIAL, lower_b = null, null, to_string(lower_b)),
	xdm.event.outcome_reason = activity_status,
	xdm.event.type = if(type != "nspolicy", coalesce(type, event_type), coalesce(event_type, type)),
	xdm.network.http.browser = browser,
	xdm.network.http.referrer = referer,
	xdm.network.http.url = url,
	xdm.network.session_id = to_string(browser_session_id),
	xdm.session_context_id = to_string(app_session_id),
	xdm.source.application.name = app,
	xdm.source.cloud.region = region_name,
	xdm.source.host.device_id = instance_id,
	xdm.source.host.hostname = hostname,
	xdm.source.host.ipv4_addresses = arraycreate(srcip),
	xdm.source.host.os = coalesce(os_version, os),
	xdm.source.host.os_family = if(lower_c ~= "android", "ANDROID", lower_c ~= "windows", "WINDOWS", lower_c ~= "mac", "MACOS", lower_c ~= "linux", "LINUX", lower_c ~= "ios", "IOS", lower_c ~= "ubuntu", "UBUNTU", lower_c ~= "debian", "DEBIAN", lower_c ~= "fedora", "FEDORA", lower_c ~= "centos", "CENTOS", lower_c ~= "chrome", "CHROMEOS", lower_c ~= "solaris", "SOLARIS", lower_c ~= "scada", "SCADA", lower_c = null, null, "UNKNOWN"),
	xdm.source.ipv4 = userip,
	xdm.source.location.city = src_location,
	xdm.source.location.country = src_country,
	xdm.source.location.latitude = to_float(src_latitude),
    xdm.source.location.longitude = to_float(src_longitude),
	xdm.source.location.region = src_region,
	xdm.source.location.timezone = src_timezone,
	xdm.source.process.executable.file_type = file_type,
	xdm.source.process.executable.filename = coalesce(filename, title),
	xdm.source.process.executable.md5 = md5,
	xdm.source.process.executable.path = file_path,
	xdm.source.sent_bytes = client_bytes,
	xdm.source.user.identifier = account_id,
	xdm.source.user.ou = organization_unit,
	xdm.auth.privilege_level = if(activity_type ~= "[A|a]dmin", "ADMIN", activity_type ~= "[U|u]ser", "USER", "UNKNOWN"),
	xdm.source.user.username = coalesce(user, user_id, ur_normalized),
	xdm.source.user_agent = useragent,
	xdm.target.file.file_type = object_type,
	xdm.target.file.filename = object,
	xdm.target.file.md5 = local_md5,
	xdm.target.file.sha256 = local_sha256,
	xdm.target.host.hostname = dsthost,
	xdm.target.ipv4 = dstip,
	xdm.target.location.city = dst_location,
	xdm.target.location.country = dst_country,
	xdm.target.location.latitude = to_float(dst_latitude),
    xdm.target.location.longitude = to_float(dst_longitude),
	xdm.target.location.region = dst_region,
	xdm.target.location.timezone = dst_timezone,
	xdm.target.port = to_integer(dstport),
	xdm.source.port = to_integer(srcport),	
	xdm.target.sent_bytes = server_bytes,
	xdm.target.url = coalesce(page, web_url),
	xdm.target.user.identifier = userkey;
// Audit Logs
filter source_log_event = "audit" or type = "admin_audit_logs"
| alter
	xdm.event.type = type,
	xdm.source.user.username = coalesce(user, ur_normalized),
	xdm.source.user.ou = organization_unit,
	xdm.alert.severity = coalesce(to_string(severity_level), ccl),
	xdm.observer.action = audit_log_event,
	xdm.alert.subcategory = if(json_extract_scalar(supporting_data, "$.data_type") = "policy", json_extract_scalar(supporting_data, "$.data_values[0]"), null),
	xdm.event.description = to_string(details);
// Network Logs
filter source_log_event = "network"
| alter
	type_cloud = lowercase(if(traffic_type = "CloudApp", site, null)),
	type_web = lowercase(if(traffic_type ~= "[w|W]eb", site, null)),
	lower_b = lowercase(action),
	lower_c = lowercase(device)
| alter
	xdm.target.url = url,
	xdm.network.ip_protocol = ip_protocol,
	xdm.alert.severity = coalesce(severity, ccl),
	xdm.auth.auth_method = access_method,
	xdm.event.outcome = if(lower_b = "block", XDM_CONST.OUTCOME_FAILED, lower_b = "alert", XDM_CONST.OUTCOME_PARTIAL, lower_b = "allow", XDM_CONST.OUTCOME_SUCCESS, lower_b = "useralert", XDM_CONST.OUTCOME_PARTIAL, lower_b = "Detection", XDM_CONST.OUTCOME_PARTIAL, lower_b = "bypass", XDM_CONST.OUTCOME_SUCCESS, lower_b = "restrictToView", XDM_CONST.OUTCOME_SUCCESS, lower_b = "disableDownload", XDM_CONST.OUTCOME_FAILED, lower_b = "legalHold", XDM_CONST.OUTCOME_UNKNOWN, lower_b = "expireLink", XDM_CONST.OUTCOME_FAILED, lower_b = "restrictAccess", XDM_CONST.OUTCOME_FAILED, lower_b = "delete", XDM_CONST.OUTCOME_SUCCESS, lower_b = "quarantine", XDM_CONST.OUTCOME_SUCCESS, lower_b = "anomaly_detection", XDM_CONST.OUTCOME_PARTIAL, lower_b = "Detection", XDM_CONST.OUTCOME_PARTIAL, lower_b = null, null, to_string(lower_b)),
	xdm.event.type = type,
	xdm.source.application.name = app,
	xdm.source.host.hostname = hostname,
	xdm.source.host.ipv4_addresses = arraycreate(srcip),
	xdm.source.host.os = coalesce(os_version, os),
	xdm.source.host.os_family = if(lower_c ~= "android", "ANDROID", lower_c ~= "windows", "WINDOWS", lower_c ~= "mac", "MACOS", lower_c ~= "linux", "LINUX", lower_c ~= "ios", "IOS", lower_c ~= "ubuntu", "UBUNTU", lower_c ~= "debian", "DEBIAN", lower_c ~= "fedora", "FEDORA", lower_c ~= "centos", "CENTOS", lower_c ~= "chrome", "CHROMEOS", lower_c ~= "solaris", "SOLARIS", lower_c ~= "scada", "SCADA", lower_c = null, null, "UNKNOWN"),
	xdm.source.ipv4 = userip,
	xdm.source.sent_bytes = client_bytes,
	xdm.source.user.ou = organization_unit,
	xdm.source.user.username = coalesce(user, ur_normalized),
	xdm.target.application.name = type_cloud,
	xdm.target.domain = type_web,
	xdm.target.host.hostname = dsthost,
	xdm.target.ipv4 = dstip,
	xdm.target.port = to_integer(dstport),
	xdm.source.port = to_integer(srcport),	
	xdm.target.sent_bytes = server_bytes,
	xdm.target.user.identifier = userkey,
	xdm.network.http.referrer = referer,
	xdm.auth.privilege_level = if(activity_type ~= "[A|a]dmin", "ADMIN", activity_type ~= "[U|u]ser", "USER", "UNKNOWN"),
	xdm.event.description = alert_type,
	xdm.event.outcome_reason = activity_status,
	xdm.network.http.browser = browser,
	xdm.network.http.url = web_url,
	xdm.observer.action = activity,
	xdm.source.host.device_id = instance_id,
	xdm.source.location.city = src_location,
	xdm.source.location.country = src_country,
	xdm.source.location.region = src_region,
	xdm.source.location.timezone = src_timezone,
	xdm.source.process.executable.file_type = file_type,
	xdm.source.process.executable.md5 = md5,
	xdm.source.process.executable.path = file_path,
	xdm.target.file.file_type = object_type,
	xdm.target.file.filename = object,
	xdm.target.file.md5 = local_md5,
	xdm.target.location.city = dst_location,
	xdm.target.location.country = dst_country,
	xdm.target.location.latitude = to_float(dst_latitude),
    xdm.target.location.longitude = to_float(dst_longitude),
	xdm.target.location.region = dst_region;

Schema

`netskope_netskope_raw`

Field	Type	Array?
`access_method`	string	—
`account_id`	string	—
`action`	string	—
`activity`	string	—
`activity_status`	string	—
`activity_type`	string	—
`alert`	string	—
`alert_name`	string	—
`alert_type`	string	—
`app`	string	—
`app_session_id`	string	—
`audit_log_event`	string	—
`browser`	string	—
`browser_session_id`	int	—
`category`	string	—
`ccl`	string	—
`client_bytes`	int	—
`conn_duration`	int	—
`details`	string	—
`device`	string	—
`dom`	string	—
`domain`	string	—
`dst_country`	string	—
`dst_latitude`	string	—
`dst_location`	string	—
`dst_longitude`	string	—
`dst_region`	string	—
`dst_timezone`	string	—
`dsthost`	string	—
`dstip`	string	—
`dstport`	int	—
`event_type`	string	—
`file_path`	string	—
`file_type`	string	—
`filename`	string	—
`hostname`	string	—
`incident_id`	string	—
`instance_id`	string	—
`ip_protocol`	string	—
`local_md5`	string	—
`local_sha256`	string	—
`malware_name`	string	—
`malware_severity`	string	—
`malware_type`	string	—
`managed_app`	string	—
`md5`	string	—
`object`	string	—
`object_type`	string	—
`organization_unit`	string	—
`os`	string	—
`os_version`	string	—
`page`	string	—
`protocol`	string	—
`referer`	string	—
`region_name`	string	—
`request_id`	int	—
`risk_level`	string	—
`server_bytes`	int	—
`session_duration`	int	—
`severity`	string	—
`severity_level`	int	—
`sha256`	string	—
`site`	string	—
`source_log_event`	string	—
`src_country`	string	—
`src_latitude`	string	—
`src_location`	string	—
`src_longitude`	string	—
`src_region`	string	—
`src_timezone`	string	—
`srcip`	string	—
`srcport`	int	—
`supporting_data`	string	—
`timestamp`	int	—
`title`	string	—
`total_packets`	int	—
`traffic_type`	string	—
`type`	string	—
`ur_normalized`	string	—
`url`	string	—
`user`	string	—
`user_id`	string	—
`useragent`	string	—
`userip`	string	—
`userkey`	string	—
`web_url`	string	—

Raw JSON

{
  "netskope_netskope_raw": {
    "action": {
      "type": "string",
      "is_array": false    
    },
    "device": {
      "type": "string",
      "is_array": false
    },
    "dsthost": {
      "type": "string",
      "is_array": false
    },
    "dstip": {
      "type": "string",
      "is_array": false
    },
    "request_id": {
      "type": "int",
      "is_array": false
    },
    "dstport": {
      "type": "int",
      "is_array": false
    },
    "hostname": {
      "type": "string",
      "is_array": false
    },
    "ip_protocol": {
      "type": "string",
      "is_array": false
    },
    "os": {
      "type": "string",
      "is_array": false
    },
    "protocol": {
      "type": "string",
      "is_array": false
    },
    "session_duration": {
      "type": "int",
      "is_array": false
    },
    "conn_duration": {
      "type": "int",
      "is_array": false
    },
    "srcip": {
      "type": "string",
      "is_array": false
    },
    "srcport": {
      "type": "int",
      "is_array": false
    },
    "timestamp": {
      "type": "int",
      "is_array": false
    },
    "total_packets": {
      "type": "int",
      "is_array": false
    },
    "client_bytes": {
      "type": "int",
      "is_array": false
    },
    "user": {
      "type": "string",
      "is_array": false
    },
    "userkey": {
      "type": "string",
      "is_array": false
    },
    "severity_level": {
      "type": "int",
      "is_array": false
    },
    "audit_log_event": {
      "type": "string",
      "is_array": false
    },
    "activity": {
      "type": "string",
      "is_array": false
    },
    "type": {
      "type": "string",
      "is_array": false
    },
    "alert": {
      "type": "string",
      "is_array": false
    },
    "incident_id": {
      "type": "string",
      "is_array": false
    },
    "src_location": {
      "type": "string",
      "is_array": false
    },
    "src_country": {
      "type": "string",
      "is_array": false
    },
    "src_region": {
      "type": "string",
      "is_array": false
    },
    "access_method": {
      "type": "string",
      "is_array": false
    },
    "app": {
      "type": "string",
      "is_array": false
    },
    "file_type": {
      "type": "string",
      "is_array": false
    },
    "managed_app": {
      "type": "string",
      "is_array": false
    },
    "md5": {
      "type": "string",
      "is_array": false
    },
    "useragent": {
      "type": "string",
      "is_array": false
    },
    "url": {
      "type": "string",
      "is_array": false
    },
    "sha256": {
      "type": "string",
      "is_array": false
    },
    "malware_type": {
      "type": "string",
      "is_array": false
    },
    "malware_name": {
      "type": "string",
      "is_array": false
    },
    "severity": {
      "type": "string",
      "is_array": false
    },
    "malware_severity": {
      "type": "string",
      "is_array": false
    },
    "risk_level": {
      "type": "string",
      "is_array": false
    },
    "region_name": {
      "type": "string",
      "is_array": false
    },
    "activity_status": {
      "type": "string",
      "is_array": false
    },
    "details": {
      "type": "string",
      "is_array": false
    },
    "domain": {
      "type": "string",
      "is_array": false
    },
    "web_url": {
      "type": "string",
      "is_array": false
    },
    "supporting_data": {
      "type": "string",
      "is_array": false
    },
    "local_md5": {
      "type": "string",
      "is_array": false
    },
    "local_sha256": {
      "type": "string",
      "is_array": false
    },
    "object": {
      "type": "string",
      "is_array": false
    },
    "ur_normalized": {
      "type": "string",
      "is_array": false
    },
    "user_id": {
      "type": "string",
      "is_array": false
    },
    "event_type": {
      "type": "string",
      "is_array": false
    },
    "activity_type": {
      "type": "string",
      "is_array": false
    },
    "account_id": {
      "type": "string",
      "is_array": false
    },
    "file_path": {
      "type": "string",
      "is_array": false
    },
    "title": {
      "type": "string",
      "is_array": false
    },
    "filename": {
      "type": "string",
      "is_array": false
    },
    "source_log_event": {
      "type": "string",
      "is_array": false
    },
    "page": {
      "type": "string",
      "is_array": false
    },
    "traffic_type": {
      "type": "string",
      "is_array": false
    },
    "category": {
      "type": "string",
      "is_array": false 
    }, 
    "ccl": {
      "type": "string",
      "is_array": false
    },   
    "browser": {
      "type": "string",
      "is_array": false
    },      
    "browser_session_id": {
      "type": "int",
        "is_array": false
    },      
    "app_session_id": {
      "type": "string",
      "is_array": false   
    },      
    "os_version": {
      "type": "string",
      "is_array": false
    },      
    "userip": {
      "type": "string",
      "is_array": false
    },
      "src_latitude": {
        "type": "string",
        "is_array": false        
    },
      "src_longitude": {
        "type": "string",
        "is_array": false
    },
      "src_timezone": {
        "type": "string",
        "is_array": false
    },
      "organization_unit": {
        "type": "string",
        "is_array": false      
    },
      "dst_location": {
        "type": "string",
        "is_array": false
    },
      "dst_country": {
        "type": "string",
        "is_array": false
    },
      "dst_latitude": {
        "type": "string",
        "is_array": false
    },
      "dst_longitude": {
          "type": "string",
          "is_array": false
    },
        "dst_region": {
          "type": "string",
          "is_array": false
    },
        "dst_timezone": {
          "type": "string",
          "is_array": false
    },
        "server_bytes": {
          "type": "int",
          "is_array": false
    },
        "dom": {
          "type": "string",
          "is_array": false
    },
        "alert_type": {
          "type": "string",
          "is_array": false
    },
        "alert_name": {
          "type": "string",
          "is_array": false
    },
        "referer": {
          "type": "string",
          "is_array": false
    },
        "instance_id": {
          "type": "string",
          "is_array": false
    },
        "object_type": {
          "type": "string",
          "is_array": false  
    },
        "site": {
          "type": "string",
          "is_array": false
    }
  }
}