OneLogin Modeling Rule

Details

ID	`onelogin_modeling_rule`
From Version	6.8.0
To Version	6.9.9
Tags	onelogin

Rules (XIF)

[MODEL: dataset=onelogin_iam_raw, model=Auth]
alter XDM.Auth.original_event_id = to_string(id),
    XDM.Auth.original_event_description = notes,
    XDM.Auth.original_event_type = event_type_name,
    XDM.Auth.event_timestamp = created_at,
    XDM.Auth.Target.user.employee_id = to_string(user_id),
    XDM.Auth.Target.host.ipv4_addresses = arraycreate(ipaddr),
    XDM.Auth.Target.user.username = user_name,
    XDM.Auth.threat.severity = risk_score,
    XDM.Auth.threat.description = risk_reasons,
    XDM.Auth.Client.application.name = app_name,
    XDM.Auth.Client.user.user_type = to_string(actor_user_id),
    XDM.Auth.Server.host.hostname = otp_device_name,
    XDM.Auth.Server.host.device_id = otp_device_id;

Schema

`onelogin_iam_raw`

Field	Type	Array?
`actor_user_id`	int	—
`app_name`	string	—
`created_at`	string	—
`event_type_name`	string	—
`id`	int	—
`ipaddr`	string	—
`notes`	string	—
`otp_device_id`	int	—
`otp_device_name`	string	—
`risk_reasons`	string	—
`risk_score`	int	—
`user_id`	int	Yes
`user_name`	string	—

Raw JSON

{
  "onelogin_iam_raw": {
    "id": {
      "type": "int",
      "is_array": false
    },
    "notes": {
      "type": "string",
      "is_array": false
    },
    "event_type_name": {
      "type": "string",
      "is_array": false
    },
    "created_at": {
      "type": "string",
      "is_array": false
    },
    "user_id": {
      "type": "int",
      "is_array": true
    },
    "ipaddr": {
      "type": "string",
      "is_array": false
    },
    "user_name": {
      "type": "string",
      "is_array": false
    },
    "risk_score": {
      "type": "int",
      "is_array": false
    },
    "risk_reasons": {
      "type": "string",
      "is_array": false
    },
    "app_name": {
      "type": "string",
      "is_array": false
    },
    "actor_user_id": {
      "type": "int",
      "is_array": false
    },
    "otp_device_name": {
      "type": "string",
      "is_array": false
    },
    "otp_device_id": {
      "type": "int",
      "is_array": false
    }
  }
}