Rules (XIF)
[MODEL: dataset=onelogin_iam_raw]
alter
event_type_id = to_string(event_type_id),
ipv4 = if(ipaddr ~= "^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$", ipaddr, null),
ipv6 = if(ipaddr ~= "\:[a-fA-F\d]{1,4}|[a-fA-F\d]{1,4}\:", ipaddr, null),
target_user_id = to_string(user_id)
| alter
// map event type id according to https://api.onelogin.com/api/1/events/types (https://developers.onelogin.com/api-docs/1/events/event-types)
event_name = if(event_type_id="1", "APP_ADDED_TO_ROLE", event_type_id="2", "APP_REMOVED_FROM_ROLE", event_type_id="3", "USER_ASSUMED_USER", event_type_id="4", "USER_ASSIGNED_ROLE",event_type_id="5", "USER_LOGGED_INTO_ONELOGIN",event_type_id="6", "USER_FAILED_ONELOGIN_LOGIN",event_type_id="7", "USER_LOGGED_OUT_OF_ONELOGIN",event_type_id="8", "USER_LOGGED_INTO_APP",event_type_id="9", "USER_FAILED_APP_LOGIN",event_type_id="10", "USER_REQUESTED_NEW_PASSWORD",event_type_id="11", "USER_CHANGED_PASSWORD",event_type_id="12", "UNLOCKED_USER",event_type_id="13", "CREATED_USER",event_type_id="14", "UPDATED_USER",event_type_id="15", "DEACTIVATED_USER",event_type_id="16", "ACTIVATED_USER",event_type_id="17", "DELETED_USER",event_type_id="18", "ADMIN_APPROVED_PASSWORD_REQUEST",event_type_id="19", "USER_LOCKED",event_type_id="20", "REACHED_USERS_LIMIT",event_type_id="21", "SUSPENDED_USER",event_type_id="22", "USER_ADDED_OTP_DEVICE",event_type_id="23", "USER_BULK_OPERATION",event_type_id="24", "USER_REMOVED_OTP_DEVICE",event_type_id="25", "PROVISIONING_EXCEPTION",event_type_id="26", "PROVISIONING_EVENT",event_type_id="27", "USER_DOWNLOADED_CERT",event_type_id="28", "USER_RECENTLY_REMOVED",event_type_id="29", "USER_LOGGED_OUT_OF_APP",event_type_id="30", "UPDATED_PAYMENT_INFO",event_type_id="31", "FAILED_UPDATE_PAYMENT_INFO",event_type_id="32", "REACTIVATED_USER",event_type_id="33", "USERS_IMPORTED_FROM_DIRECTORY",event_type_id="34", "USER_REQUESTED_APP",event_type_id="35", "USER_LOCKED_OUT_OF_APP",event_type_id="36", "USER_LOST_OTP_DEVICE",event_type_id="37", "USER_JOIN_REQUEST",event_type_id="38", "APP_REACHED_USER_LIMIT",event_type_id="39", "CONNECTOR_BROKEN",event_type_id="40", "USER_UNLOCKED_OTP_DEVICE",event_type_id="41", "AD_CONNECTOR_STARTED",event_type_id="42", "AD_CONNECTOR_STOPPED",event_type_id="43", "AD_CONNECTOR_CONFIG_RELOAD",event_type_id="44", "AD_CONNECTOR_NOTIFICATION",event_type_id="45", "AD_CONNECTOR_EXCEPTION_OLD",event_type_id="46", "AD_CONNECTOR_FAIL_OVER",event_type_id="47", "AD_CONNECTOR_EXCEPTION",event_type_id="48", "IMPORTED_USER",event_type_id="49", "UPDATE_USER_FAILED",event_type_id="50", "REJECTED_USER",event_type_id="51", "USER_CREATED_IN_APP",event_type_id="52", "USER_UPDATED_IN_APP",event_type_id="53", "USER_SUSPENDED_IN_APP",event_type_id="54", "USER_REACTIVATED_IN_APP",event_type_id="55", "USER_DELETED_IN_APP",event_type_id="56", "UNMATCHED_USERS",event_type_id="57", "RABBIT_DOWN",event_type_id="58", "RABBIT_RESTARTED",event_type_id="59", "USER_LINKED_IN_APP",event_type_id="60", "PROVISIONING_DEPROVISIONING_MODE_DO_NOTHING_WARNING",event_type_id="61", "USER_FAILED_SUSPENDING_IN_APP",event_type_id="62", "USER_FAILED_REACTIVATING_IN_APP",event_type_id="63", "USER_FAILED_DELETING_IN_APP",event_type_id="64", "USER_FAILED_CREATING_IN_APP",event_type_id="65", "USER_FAILED_UPDATING_IN_APP",event_type_id="66", "NO_USERS_TO_IMPORT_FROM_DIRECTORY",event_type_id="67", "DIRECTORY_IMPORT_EXCEPTION",event_type_id="68", "USER_AUTHENTICATED_BY_RADIUS",event_type_id="69", "USER_REJECTED_BY_RADIUS",event_type_id="70", "PRIVILEGE_GRANTED_TO_ACCOUNT",event_type_id="71", "PRIVILEGE_REVOKED_FROM_ACCOUNT",event_type_id="72", "PRIVILEGE_GRANTED_TO_USER",event_type_id="73", "PRIVILEGE_REVOKED_FROM_USER",event_type_id="74", "TRUSTED_IDP_ADDED",event_type_id="75", "TRUSTED_IDP_REMOVED",event_type_id="76", "TRUSTED_IDP_MODIFIED",event_type_id="77", "USER_FAILED_PROXY_LOGIN",event_type_id="78", "USER_SUCCEEDED_PROXY_LOGIN",event_type_id="79", "AD_CONNECTOR_PROVISIONING_ERROR",event_type_id="80", "USER_CREATED_IN_DIRECTORY",event_type_id="81", "USER_UPDATED_IN_DIRECTORY",event_type_id="82", "USER_SUSPENDED_IN_DIRECTORY",event_type_id="83", "USER_REACTIVATED_IN_DIRECTORY",event_type_id="84", "USER_DELETED_IN_DIRECTORY",event_type_id="85", "APP_COULD_NOT_AUTHENTICATE",event_type_id="86", "USER_FAILED_REMOTE_AUTHENTICATION",event_type_id="87", "USER_VIEWED_NOTE",event_type_id="88", "USER_EDITED_NOTE",event_type_id="89", "USER_DELETED_NOTE",event_type_id="90", "USER_UNAUTHORIZED_APP_ACCESS",event_type_id="91", "USER_UNDETERMINED_BY_RADIUS",event_type_id="92", "USER_NTHASH_REQUESTED_BY_RADIUS",event_type_id="95", "DIRECTORY_GROUPS_WRITE_BACK_IMPORT_STARTED",event_type_id="96", "DIRECTORY_GROUPS_WRITE_BACK_IMPORT_FINISHED",event_type_id="100", "SELF_REGISTRATION_REQUEST",event_type_id="101", "SELF_REGISTRATION_APPROVED",event_type_id="102", "SELF_REGISTRATION_DENIED",event_type_id="103", "SELF_REGISTRATION_REQUEST_UNVERIFIED",event_type_id="104", "SELF_REGISTRATION_REQUEST_VERIFIED",event_type_id="105", "SMS_FAILURE",event_type_id="106", "USER_CHANGE_PASSWORD_FAILED",event_type_id="110", "APP_LOGINS_UPDATED",event_type_id="111", "APP_LOGINS_UPDATE_FAILED",event_type_id="112", "TRUSTED_IDP_MADE_DEFAULT",event_type_id="113", "DIRECTORY_IMPORT_STARTED",event_type_id="114", "DIRECTORY_IMPORT_FINISHED",event_type_id="115", "USER_INVITED",event_type_id="116", "CREATE_USER_FAILED",event_type_id="117", "DIRECTORY_SYNC_RUN_ID",event_type_id="118", "SAML_ACS_FAILED",event_type_id="119", "TRUSTED_IDP_REMOVED_AS_DEFAULT",event_type_id="120", "UNLOCKED_USER_IN_DIRECTORY",event_type_id="121", "SCRIPTLET_ERROR",event_type_id="122", "USER_AUTHENTICATED_BY_API",event_type_id="123", "USER_REJECTED_BY_API",event_type_id="124", "ENTITLEMENTS_CACHE_ACTION",event_type_id="125", "ENTITLEMENT_ACTION",event_type_id="126", "DIRECTORY_CONNECTOR_ENABLED",event_type_id="127", "DIRECTORY_CONNECTOR_DISABLED",event_type_id="128", "NO_ACTIVE_ACTIVE_DIRECTORY_CONNECTORS",event_type_id="129", "VLDAP_BIND_FAILURE",event_type_id="130", "VLDAP_BIND_SUCCESS",event_type_id="131", "DIRECTORY_EXPORT_STARTED",event_type_id="132", "DIRECTORY_EXPORT_FINISHED",event_type_id="133", "DIRECTORY_EXPORT_EXCEPTION",event_type_id="134", "DIRECTORY_REFRESH_SCHEMA_EXCEPTION",event_type_id="135", "CERTIFICATE_EXPIRES",event_type_id="136", "DIRECTORY_FIELDS_IMPORT_STARTED",event_type_id="137", "USER_APP_REQUEST_APPROVED",event_type_id="138", "USER_APP_REQUEST_DENIED",event_type_id="139", "DIRECTORY_FIELDS_IMPORT_FINISHED",event_type_id="140", "SOCIAL_SIGN_IN",event_type_id="141", "SOCIAL_SIGN_IN_FAILURE",event_type_id="145", "USER_SMART_PASSWORD_UPDATED",event_type_id="146", "USER_SMART_PASSWORD_UPDATE_FAILED",event_type_id="147", "USER_MANUALLY_ADDED_TO_ROLE",event_type_id="148", "USER_MANUALLY_REMOVED_FROM_ROLE",event_type_id="149", "USER_AUTO_ADDED_TO_ROLE",event_type_id="150", "USER_AUTO_REMOVED_FROM_ROLE",event_type_id="151", "USER_ROLE_MANAGEMENT_GRANTED",event_type_id="152", "USER_ROLE_MANAGEMENT_REVOKED",event_type_id="153", "MAC_LOGIN_SUCCESS",event_type_id="154", "MAC_LOGIN_FAILURE",event_type_id="155", "DIRECTORY_FIELDS_IMPORT_EXCEPTION",event_type_id="156", "POLICY_CREATED",event_type_id="157", "POLICY_UPDATED",event_type_id="158", "POLICY_DELETED",event_type_id="159", "PROXY_AGENT_CREATED",event_type_id="160", "PROXY_AGENT_DELETED",event_type_id="161", "RADIUS_CONFIG_CREATED",event_type_id="162", "RADIUS_CONFIG_UPDATED",event_type_id="163", "RADIUS_CONFIG_DELETED",event_type_id="164", "VPN_ENABLED",event_type_id="165", "VPN_SETTINGS_UPDATED",event_type_id="166", "VPN_DISABLED",event_type_id="167", "EMBEDDING_ENABLED",event_type_id="168", "EMBEDDING_SETTINGS_UPDATED",event_type_id="169", "EMBEDDING_DISABLED",event_type_id="170", "AUTHENTICATION_FACTOR_CREATED",event_type_id="171", "AUTHENTICATION_FACTOR_UPDATED",event_type_id="172", "AUTHENTICATION_FACTOR_DELETED",event_type_id="173", "SECURITY_QUESTIONS_UPDATED",event_type_id="174", "DESKTOP_SSO_SETTINGS_UPDATED",event_type_id="175", "DESKTOP_SSO_ENABLED",event_type_id="176", "DESKTOP_SSO_DISABLED",event_type_id="177", "CERTIFICATE_CREATED",event_type_id="178", "CERTIFICATE_DELETED",event_type_id="179", "API_CREDENTIAL_CREATED",event_type_id="180", "API_CREDENTIAL_DELETED",event_type_id="181", "API_CREDENTIAL_ENABLED",event_type_id="182", "API_CREDENTIAL_DISABLED",event_type_id="183", "VLDAP_ENABLED",event_type_id="184", "VLDAP_DISABLED",event_type_id="185", "VLDAP_SETTINGS_UPDATED",event_type_id="186", "BRANDING_ENABLED",event_type_id="187", "BRANDING_DISABLED",event_type_id="188", "BRANDING_UPDATED",event_type_id="189", "MAPPING_ADDED",event_type_id="190", "MAPPING_DELETED",event_type_id="191", "MAPPING_DISABLED",event_type_id="192", "MAPPING_ENABLED",event_type_id="193", "MAPPING_UPDATED",event_type_id="194", "USER_FIELD_ADDED",event_type_id="195", "USER_FIELD_DELETED",event_type_id="196", "COMPANY_INFO_UPDATED",event_type_id="197", "ACCOUNT_SETTINGS_UPDATED",event_type_id="198", "DIRECTORY_CREATED",event_type_id="199", "DIRECTORY_DESTROYED",event_type_id="200", "DIRECTORY_CONNECTOR_INSTANCE_ADDED",event_type_id="201", "DIRECTORY_CONNECTOR_INSTANCE_DELETED",event_type_id="202", "REAPPLIED_MAPPINGS",event_type_id="203", "SELF_REGISTRATION_PROFILE_CREATED",event_type_id="204", "SELF_REGISTRATION_PROFILE_UPDATED",event_type_id="205", "SELF_REGISTRATION_PROFILE_DESTROYED",event_type_id="206", "MANUALLY_ADDED_LOGIN",event_type_id="207", "MANUALLY_REMOVED_LOGIN",event_type_id="208", "RETRIED_PROVISIONING",event_type_id="209", "DIRECTORY_USER_IMPORT_WARNING",event_type_id="210", "LDAP_CONNECTOR_EXCEPTION",event_type_id="211", "ADMIN_CHANGED_USER_PASSWORD",event_type_id="212", "DIRECTORY_LOCKED",event_type_id="213", "PROFILE_PICTURE_UPLOADED",event_type_id="214", "PROFILE_PICTURE_DELETED",event_type_id="215", "ADMIN_CHANGED_ACCOUNT_SETTINGS",event_type_id="216", "JOB_IN_QUEUE",event_type_id="217", "DIRECTORY_IMPORT_LIMIT_REACHED",event_type_id="218", "REAPPLIED_MAPPINGS_FAILED",event_type_id="219", "WORKDAY_REAL_TIME_NOTIFICATION",event_type_id="220", "ADMIN_CREATED_PAYMENT_RECORD",event_type_id="221", "ADMIN_UPDATED_PAYMENT_RECORD",event_type_id="222", "ADMIN_DELETED_PAYMENT_RECORD",event_type_id="223", "USER_UNLICENSED",event_type_id="224", "USER_LICENSED_MANUALLY",event_type_id="225", "USER_UNLICENSED_MANUALLY",event_type_id="226", "USER_UNLICENSED_AUTOMATICALLY",event_type_id="227", "USER_LICENSE_FAILED",event_type_id="228", "USERS_LICENSED_BULK",event_type_id="229", "ACCOUNT_NEAR_LIMIT",event_type_id="230", "ACCOUNT_IN_LIMIT",event_type_id="231", "USERS_IN_UNLICENSED_STATE",event_type_id="232", "USER_AGREED_TERMS",event_type_id="233", "USER_DENIED_TERMS",event_type_id="234", "ADMIN_ENABLED_TERMS",event_type_id="235", "ADMIN_UPDATED_TERMS",event_type_id="236", "ADMIN_DISABLED_TERMS",event_type_id="237", "DELETE_USER_FAILED",event_type_id="238", "USER_REDIRECTED_FOR_PASSWORD_CHANGE",event_type_id="239", "IMPORT_USER_FAILED",event_type_id="240", "USER_REVEALED_PASSWORD",event_type_id="241", "CSV_IMPORT_FAILED",event_type_id="242", "JOB_START_FAILED",event_type_id="243", "JOB_TERMINATED",event_type_id="244", "REPORT_GENERATED",event_type_id="245", "REPORT_GENERATION_FAILED",event_type_id="246", "REPORT_GENERATION_TERMINATED",event_type_id="247", "USER_MAPPINGS_FAILED",event_type_id="248", "USER_MAPPINGS_SUCCEEDED",event_type_id="249", "USER_BULK_OPERATION_FAILED",event_type_id="250", "PROVISIONING_APP_CONFIG_ERROR",event_type_id="251", "PROVISIONING_APP_THROTTLED",event_type_id="252", "USER_REMOVELOGINS_FAILED",event_type_id="253", "ENTITLEMENT_MAPPINGS_FAILED",event_type_id="254", "ENTITLEMENT_MAPPINGS_REAPPLIED",event_type_id="255", "MANUALLY_UPDATED_LOGIN",event_type_id="291", "USER_CREATED_BY_TIDP",event_type_id="300", "LDAP_CONNECTOR_STARTED",event_type_id="301", "LDAP_CONNECTOR_NOTIFICATION",event_type_id="303", "LDAP_CONNECTOR_CONFIG_RELOAD",event_type_id="304", "LDAP_CONNECTOR_STOPPED",event_type_id="305", "LDAP_CONNECTOR_FAIL_OVER",event_type_id="306", "MANUALLY_ADDED_LOGIN_FAILURE",event_type_id="307", "LDAP_CONNECTOR_PROVISIONING_ERROR",event_type_id="330", "USER_DISASSOCIATED_FROM_DIRECTORY",event_type_id="331", "USER_ASSOCIATED_TO_DIRECTORY",event_type_id="332", "USER_DIRECTORY_EXTERNAL_ID_UPDATED",event_type_id="333", "USER_DIRECTORY_EXTERNAL_ID_DELETED",event_type_id="334", "USER_NOT_UPDATED_IN_APP",event_type_id="400", "API_BAD_REQUEST",event_type_id="401", "API_UNAUTHORIZED",event_type_id="402", "MAPPING_SKIPPED",event_type_id="410", "BROADCASTER_CREATED",event_type_id="411", "BROADCASTER_UPDATED",event_type_id="412", "BROADCASTER_DELETED",event_type_id="501", "API_INDEX_ACTION",event_type_id="502", "API_SHOW_ACTION",event_type_id="503", "API_RES_ACTION",event_type_id="510", "API_SET_PWD_SALT",event_type_id="511", "API_SET_PWD_CLEAR_TEXT",event_type_id="512", "API_SET_CUSTOM_ATTRS",event_type_id="513", "API_ADD_ROLES",event_type_id="514", "API_REMOVE_ROLES",event_type_id="515", "API_AUTH_ISSUE_TOKEN",event_type_id="516", "API_LOGOUT",event_type_id="517", "API_SET_PWD_SALT_FAILED",event_type_id="518", "API_SET_PWD_CLEAR_TEXT_FAILED",event_type_id="519", "API_SET_CUSTOM_ATTRS_FAILED",event_type_id="520", "API_ADD_ROLES_FAILED",event_type_id="521", "API_REMOVE_ROLES_FAILED",event_type_id="522", "API_AUTH_ISSUE_TOKEN_FAILED",event_type_id="523", "API_LOGOUT_FAILED",event_type_id="524", "API_DESTROY_USER_FAILED",event_type_id="525", "API_GET_INVITE_LINK_FAILED",event_type_id="526", "API_LOCK_USER_FAILED",event_type_id="527", "API_VERIFY_FACTOR_FAILED",event_type_id="528", "API_VERIFY_FACTOR",event_type_id="529", "API_UPDATE_USER",event_type_id="530", "API_DESTROY_USER",event_type_id="531", "API_LOCK_USER",event_type_id="532", "API_UPDATE_USER_FAILED",event_type_id="533", "API_CREATE_USER",event_type_id="534", "API_CREATE_USER_FAILED",event_type_id="535", "API_GET_INVITE_LINK",event_type_id="536", "API_USER_OTPS_RETRIEVED",event_type_id="537", "API_CONFIRM_FACTOR",event_type_id="538", "API_CONFIRM_FACTOR_FAILED",event_type_id="539", "API_TRIGGER_FACTOR",event_type_id="540", "API_ADDED_OTP_DEVICE",event_type_id="541", "DIRECTORY_UPDATED",event_type_id="542", "DIRECTORY_OUS_CHANGED",event_type_id="545", "API_SEND_INVITE_LINK_FAILED",event_type_id="546", "API_SEND_INVITE_LINK",event_type_id="550", "FORCE_LOGOUT_USER",event_type_id="551", "SUSPENDED_USER_VIA_API",event_type_id="552", "REACTIVATED_USER_VIA_API",event_type_id="553", "USER_LOCKED_VIA_API",event_type_id="554", "UNLOCKED_USER_VIA_API",event_type_id="555", "EXTERNAL_ASSUME_USER",event_type_id="600", "APP_CREATED_BY_USER",event_type_id="601", "APP_UPDATED_BY_USER",event_type_id="602", "APP_DELETED_BY_USER",event_type_id="700", "CONNECTOR_CREATED",event_type_id="701", "CONNECTOR_CREATE_FAILED",event_type_id="702", "CONNECTOR_UPDATED",event_type_id="703", "CONNECTOR_UPDATE_FAILED",event_type_id="704", "CONNECTOR_DELETED",event_type_id="705", "CONNECTOR_DELETE_FAILED",event_type_id="706", "CONNECTOR_STATS_UPDATE",event_type_id="800", "PARAMETER_CREATED",event_type_id="801", "PARAMETER_CREATE_FAILED",event_type_id="802", "PARAMETER_UPDATED",event_type_id="803", "PARAMETER_UPDATE_FAILED",event_type_id="804", "PARAMETER_DELETED",event_type_id="805", "PARAMETER_DELETE_FAILED",event_type_id="900", "ONELOGIN_DESKTOP_MAC_LOGIN_SUCCESS",event_type_id="901", "ONELOGIN_DESKTOP_MAC_LOGIN_FAILURE",event_type_id="902", "ONELOGIN_DESKTOP_DEVICE_DELETED",event_type_id="903", "ONELOGIN_DESKTOP_DEVICE_UNBIND",event_type_id="904", "ONELOGIN_DESKTOP_LOGIN_SUCCESS",event_type_id="905", "ONELOGIN_DESKTOP_LOGIN_FAILURE",event_type_id="906", "ONELOGIN_DESKTOP_USER_FAILED_ONELOGIN_LOGIN",event_type_id="907", "DIRECTORY_EXPORT_SUCCESS",event_type_id="911", "ONELOGIN_DESKTOP_REVOKE_CERT_FOR_USER",event_type_id="912", "ONELOGIN_DESKTOP_REVOKE_CERT_FOR_DEVICE",event_type_id="931", "ADAPTIVE_LOGIN_ENABLED",event_type_id="932", "ADAPTIVE_LOGIN_DISABLED",event_type_id="950", "OL_OTP_PUSH_REJECT",event_type_id="1001", "USER_LOGIN_CHALLENGE",event_type_id="1002", "USER_LOGIN_CHALLENGE_FAILED",event_type_id="1010", "USER_REAUTH_SUCCESS",event_type_id="1100", "TEMP_OTP_TOKEN_GENERATED",event_type_id="1101", "TEMP_OTP_TOKEN_REVOKED",event_type_id="1200", "DELEGATED_APP_PRIVILEGE_DENIED",event_type_id="1201", "DELEGATED_USER_PRIVILEGE_DENIED",event_type_id="1244", "USER_ADDED_PHONE_NUMBER",event_type_id="1245", "USER_UPDATED_PHONE_NUMBER",event_type_id="1300", "API_APP_CREATED",event_type_id="1301", "API_APP_CREATE_FAILED",event_type_id="1302", "API_APP_UPDATED",event_type_id="1303", "API_APP_UPDATE_FAILED",event_type_id="1304", "API_APP_DESTROYED",event_type_id="1305", "API_APP_DESTROY_FAILED",event_type_id="1400", "USER_VERIFIED_OTP_DEVICE",event_type_id="1401", "API_AUTH_APP_CREATE_FAILED",event_type_id="1402", "API_AUTH_APP_UPDATED",event_type_id="1403", "API_AUTH_APP_UPDATE_FAILED",event_type_id="1404", "API_AUTH_APP_DESTROYED",event_type_id="1405", "API_AUTH_APP_DESTROY_FAILED",event_type_id="1406", "API_AUTH_SCOPE_CREATED",event_type_id="1407", "API_AUTH_SCOPE_CREATE_FAILED",event_type_id="1408", "API_AUTH_SCOPE_UPDATED",event_type_id="1409", "API_AUTH_SCOPE_UPDATE_FAILED",event_type_id="1410", "API_AUTH_SCOPE_DESTROYED",event_type_id="1411", "API_AUTH_SCOPE_DESTROY_FAILED",event_type_id="1412", "API_AUTH_CLAIM_CREATED",event_type_id="1413", "API_AUTH_CLAIM_CREATE_FAILED",event_type_id="1414", "API_AUTH_CLAIM_UPDATED",event_type_id="1415", "API_AUTH_CLAIM_UPDATE_FAILED",event_type_id="1416", "API_AUTH_CLAIM_DESTROYED",event_type_id="1417", "API_AUTH_CLAIM_DESTROY_FAILED",event_type_id="1418", "API_AUTH_CLIENT_CREATED",event_type_id="1419", "API_AUTH_CLIENT_CREATE_FAILED",event_type_id="1420", "API_AUTH_CLIENT_UPDATED",event_type_id="1421", "API_AUTH_CLIENT_UPDATE_FAILED",event_type_id="1422", "API_AUTH_CLIENT_DESTROYED",event_type_id="1423", "API_AUTH_CLIENT_DESTROY_FAILED",event_type_id="1424", "API_AUTH_APP_CREATED",event_type_id="1500", "SANDBOX_SYNC_STARTED",event_type_id="1501", "SANDBOX_SYNC_FAILED",event_type_id="1502", "SANDBOX_SYNCED",event_type_id="1503", "SANDBOX_DELETED",event_type_id="1504", "SANDBOX_DELETE_FAILED",event_type_id="1505", "SANDBOX_CREATED",event_type_id="1506", "SANDBOX_CREATION_FAILED",event_type_id="1507", "SANDBOX_UPDATED",event_type_id="1508", "SANDBOX_UPDATE_FAILED",event_type_id="1509", "SANDBOX_DELETED_BY_API",event_type_id="1510", "SANDBOX_DELETE_FAILED_BY_API",event_type_id="1511", "SANDBOX_CREATED_BY_API",event_type_id="1512", "SANDBOX_CREATION_FAILED_BY_API",event_type_id="1513", "SANDBOX_UPDATED_BY_API",event_type_id="1514", "SANDBOX_UPDATE_FAILED_BY_API",event_type_id="1600", "PROFILE_DEVICES_DELETE_DEVICE",event_type_id="1601", "PROFILE_DEVICES_RENAME_DEVICE",event_type_id="1602", "PROFILE_DEVICES_UPDATE_DEFAULT",event_type_id="1603", "PROFILE_SETTINGS_UPDATE_LOCALE",event_type_id="1604", "PROFILE_SETTINGS_UPDATE_PHONE",event_type_id="1605", "PROFILE_SETTINGS_UPDATE_DEFAULT_TAB",event_type_id="1606", "PROFILE_SETTINGS_UPDATE_PROFILE_PHOTO",event_type_id="1607", "PROFILE_SETTINGS_UPDATE_APP_AUTO_DETECT",event_type_id="1608", "PROFILE_CHANGE_PASSWORD",event_type_id="1609", "PROFILE_SETTINGS_UPDATE_SHOW_TABS",event_type_id="1700", "RADIUS_ATTRIBUTE_CREATED",event_type_id="1701", "RADIUS_ATTRIBUTE_UPDATED",event_type_id="1702", "RADIUS_ATTRIBUTE_DELETED",event_type_id="1801", "ROLE_CREATED",event_type_id="1802", "ROLE_DELETED",event_type_id="1900", "API_BRAND_CREATED",event_type_id="1901", "API_BRAND_CREATE_FAILED",event_type_id="1902", "API_BRAND_UPDATED",event_type_id="1903", "API_BRAND_UPDATE_FAILED",event_type_id="1904", "API_BRAND_DESTROYED",event_type_id="1905", "API_BRAND_DESTROY_FAILED",event_type_id="2000", "HOOKS_LIST_FUNCTION",event_type_id="2001", "CUSTOM_SMTP_ERROR",event_type_id="2002", "SMTP_SETTINGS_UPDATED",event_type_id="2003", "HOOKS_CREATE_FUNCTION",event_type_id="2004", "HOOKS_CREATE_FUNCTION_FAILED",event_type_id="2005", "HOOKS_GET_FUNCTION",event_type_id="2006", "HOOKS_GET_FUNCTION_LOGS",event_type_id="2007", "HOOKS_UPDATE_FUNCTION",event_type_id="2008", "HOOKS_UPDATE_FUNCTION_FAILED",event_type_id="2009", "HOOKS_DELETE_FUNCTION",event_type_id="2010", "HOOKS_DELETE_FUNCTION_FAILED",event_type_id="2011", "HOOKS_LIST_ENVVAR",event_type_id="2012", "HOOKS_CREATE_ENVVAR",event_type_id="2013", "HOOKS_CREATE_ENVVAR_FAILED",event_type_id="2014", "HOOKS_GET_ENVVAR",event_type_id="2015", "HOOKS_UPDATE_ENVVAR",event_type_id="2016", "HOOKS_UPDATE_ENVVAR_FAILED",event_type_id="2017", "HOOKS_DELETE_ENVVAR",event_type_id="2018", "HOOKS_DELETE_ENVVAR_FAILED",event_type_id="2100", "DELEGATED_PRIVILEGE_CREATED_VIA_API",event_type_id="2101", "DELEGATED_PRIVILEGE_CREATED_BY_USER",event_type_id="2102", "DELEGATED_PRIVILEGE_UPDATED_VIA_API",event_type_id="2103", "DELEGATED_PRIVILEGE_UPDATED_BY_USER",event_type_id="2104", "DELEGATED_PRIVILEGE_DELETED_VIA_API",event_type_id="2105", "DELEGATED_PRIVILEGE_DELETED_BY_USER",event_type_id="2106", "DELEGATED_PRIVILEGE_ASSIGNED_TO_USER_VIA_API",event_type_id="2107", "DELEGATED_PRIVILEGE_ASSIGNED_TO_USER_BY_USER",event_type_id="2108", "DELEGATED_PRIVILEGE_REMOVED_FROM_USER_VIA_API",event_type_id="2109", "DELEGATED_PRIVILEGE_REMOVED_FROM_USER_BY_USER",event_type_id="2110", "DELEGATED_PRIVILEGE_ASSIGNED_TO_ROLE_VIA_API",event_type_id="2111", "DELEGATED_PRIVILEGE_ASSIGNED_TO_ROLE_BY_USER",event_type_id="2112", "DELEGATED_PRIVILEGE_REMOVED_FROM_ROLE_VIA_API",event_type_id="2113", "DELEGATED_PRIVILEGE_REMOVED_FROM_ROLE_BY_USER",event_type_id="2114", "DELEGATED_ROLE_PRIVILEGE_DENIED",event_type_id="2201", "REPORT_CREATED_BY_USER",event_type_id="2202", "REPORT_UPDATED_BY_USER",event_type_id="2203", "REPORT_CLONED_BY_USER",event_type_id="2204", "REPORT_DESTROYED_BY_USER",event_type_id="3000", "OIDC_GENERAL_FAIL",event_type_id="3001", "OIDC_IMPLICIT_FLOW_SUCCESS",event_type_id="3002", "OIDC_IMPLICIT_FLOW_FAILED",event_type_id="3003", "OIDC_GET_CODE_SUCCESS",event_type_id="3004", "OIDC_GET_CODE_FAILED",event_type_id="3005", "OIDC_AUTHORIZATION_CODE_SUCCESS",event_type_id="3006", "OIDC_AUTHORIZATION_CODE_FAILED",event_type_id="3007", "OIDC_CLIENT_CREDENTIALS_SUCCESS",event_type_id="3008", "OIDC_CLIENT_CREDENTIALS_FAILED",event_type_id="3009", "OIDC_PASSWORD_SUCCESS",event_type_id="3010", "OIDC_PASSWORD_FAILED",event_type_id="3011", "OIDC_REFRESH_TOKEN_SUCCESS",event_type_id="3012", "OIDC_REFRESH_TOKEN_FAILED",event_type_id="3013", "OIDC_VALIDATE_TOKEN_SUCCESS",event_type_id="3014", "OIDC_VALIDATE_TOKEN_FAILED",event_type_id="3015", "OIDC_REVOKE_TOKEN_SUCCESS",event_type_id="3016", "OIDC_REVOKE_TOKEN_FAILED",event_type_id="3017", "OIDC_USER_INFO_SUCCESS",event_type_id="3018", "OIDC_USER_INFO_FAILED",event_type_id="3019", "NOTIFICATION_WAS_SENT",event_type_id="3020", "GROUP_CREATED",event_type_id="3021", "GROUP_UPDATED",event_type_id="3022", "GROUP_DESTROYED",event_type_id="3023", "USER_CREATED_NOTE",event_type_id="3024", "DELEGATED_GROUP_PRIVILEGE_DENIED",event_type_id="3025", "DELEGATED_POLICY_PRIVILEGE_DENIED",event_type_id="3026", "PROFILE_DEVICES_UNSET_DEFAULT",event_type_id="3027", "DELEGATED_REPORT_PRIVILEGE_DENIED",event_type_id="3028", "DELEGATED_TRUSTED_IDP_PRIVILEGE_DENIED",event_type_id="9000", "USER_ENABLED_WORKFLOW",event_type_id="9001", "USER_DISABLED_WORKFLOW",event_type_id="9002", "USER_INITIATED_WORKFLOW",event_type_id="9003", "USER_COMPLETED_TASK",event_type_id="9004", "USER_MARKED_TASK_COMPLETE",event_type_id="9005", "USER_MARKED_WORKFLOW_COMPLETE",event_type_id="9006", "USER_MARKED_TASK_INCOMPLETE",event_type_id="9007", "USER_ENABLED_ONBOARDING",event_type_id="9008", "USER_DISABLED_ONBOARDING",event_type_id="9009", "USER_ENABLED_OFFBOARDING",event_type_id="9010", "USER_DISABLED_OFFBOARDING",event_type_id="9011", "USER_INITIATED_OFFBOARDING",event_type_id="9012", "USER_INITIATED_ONBOARDING",event_type_id="9013", "USER_COMPLETED_WORKFLOW",event_type_id="9014", "APP_RULES_LIST_SUCCESS",event_type_id="9015", "APP_RULES_LIST_FAILED",event_type_id="9016", "APP_RULES_CREATE_SUCCESS",event_type_id="9017", "APP_RULES_CREATE_FAILED",event_type_id="9018", "APP_RULES_UPDATE_SUCCESS",event_type_id="9019", "APP_RULES_UPDATE_FAILED",event_type_id="9020", "APP_RULES_GET_SUCCESS",event_type_id="9021", "APP_RULES_GET_FAILED",event_type_id="9022", "APP_RULES_DRYRUN_SUCCESS",event_type_id="9023", "APP_RULES_DRYRUN_FAILED",event_type_id="9024", "APP_RULES_DELETE_SUCCESS",event_type_id="9025", "APP_RULES_DELETE_FAILED",event_type_id="9026", "APP_RULES_SORT_SUCCESS",event_type_id="9027", "APP_RULES_SORT_FAILED",event_type_id="9028", "APP_RULES_APPLY_SUCCESS",event_type_id="9029", "APP_RULES_APPLY_FAILED",event_type_id="9030", "APP_RULES_REFRESH_ENTITLEMENTS_SUCCESS",event_type_id="9031", "APP_RULES_REFRESH_ENTITLEMENTS_FAILED",event_type_id="9032", "APP_RULES_LIST_CONDITIONS_SUCCESS",event_type_id="9033", "APP_RULES_LIST_CONDITIONS_FAILED",event_type_id="9034", "APP_RULES_LIST_CONDITION_OPERATORS_SUCCESS",event_type_id="9035", "APP_RULES_LIST_CONDITION_OPERATORS_FAILED",event_type_id="9036", "APP_RULES_LIST_ACTIONS_SUCCESS",event_type_id="9037", "APP_RULES_LIST_ACTIONS_FAILED",event_type_id="9038", "APP_RULES_LIST_ACTION_VALUES_SUCCESS",event_type_id="9039", "APP_RULES_LIST_ACTION_VALUES_FAILED",event_type_id="9040", "USER_ROLE_MANAGEMENT_GRANTED_FAILED",event_type_id="9041", "USER_ROLE_MANAGEMENT_REVOKED_FAILED",event_type_id="9042", "APP_ADDED_TO_ROLE_FAILED",event_type_id="9043", "APP_REMOVED_FROM_ROLE_FAILED",event_type_id="9044", "USER_MANUALLY_ADDED_TO_ROLE_FAILED",event_type_id="9045", "USER_MANUALLY_REMOVED_FROM_ROLE_FAILED",event_type_id="9046", "ROLE_CREATE_FAILED",event_type_id="9047", "ROLE_DELETE_FAILED",event_type_id="9048", "ROLE_LIST_SUCCESS",event_type_id="9049", "ROLE_LIST_FAILED",event_type_id="9050", "ROLE_GET_SUCCESS",event_type_id="9051", "ROLE_GET_FAILED",event_type_id="9052", "ROLE_UPDATE_SUCCESS",event_type_id="9053", "ROLE_UPDATE_FAILED",event_type_id="9054", "ROLE_LIST_APPS_SUCCESS",event_type_id="9055", "ROLE_LIST_APPS_FAILED",event_type_id="9056", "ROLE_LIST_USERS_SUCCESS",event_type_id="9057", "ROLE_LIST_USERS_FAILED",event_type_id="9058", "ROLE_LIST_ADMINISTRATORS_SUCCESS",event_type_id="9059", "ROLE_LIST_ADMINISTRATORS_FAILED", event_type_id)
| alter
xdm.event.id = to_string(id),
xdm.event.original_event_type = event_type_id,
xdm.event.type = event_name,
xdm.event.description = notes,
xdm.alert.severity = to_string(risk_score),
xdm.alert.description = risk_reasons,
xdm.network.rule = policy_name,
xdm.source.user.username = actor_user_name,
xdm.source.user.identifier = to_string(actor_user_id),
xdm.source.ipv4 = ipv4,
xdm.source.host.ipv4_addresses = if(ipv4 != null, arraycreate(ipv4), null),
xdm.source.ipv6 = ipv6,
xdm.source.host.ipv6_addresses = if(ipv6 != null, arraycreate(ipv6), null),
xdm.target.user.username = user_name,
xdm.target.user.identifier = target_user_id,
xdm.target.user.employee_id = target_user_id,
xdm.target.application.name = app_name,
xdm.target.ipv4 = ipv4,
xdm.target.host.ipv4_addresses = if(ipv4 != null, arraycreate(ipv4), null),
xdm.target.ipv6 = ipv6,
xdm.target.host.ipv6_addresses = if(ipv6 != null, arraycreate(ipv6), null),
xdm.target.host.hostname = otp_device_name,
xdm.target.host.device_id = to_string(otp_device_id);