OracleCloudInfrastructure Modeling Rule

Details

Rules (XIF)

[MODEL: dataset="oracle_cloud_infrastructure_raw"]
alter xdm.source.agent.content_version = cloudEventsVersion,
    xdm.network.http.content_type = contentType,
    xdm.event.id = eventId,
    xdm.event.type = eventType,
    xdm.source.application.version = eventTypeVersion,
    xdm.event.description = json_extract(data, "$.additionalDetails"),
    xdm.target.domain = json_extract_scalar(data, "$.availabilityDomain"),
    xdm.event.operation_sub_type = json_extract_scalar(data, "$.eventName"),
    xdm.target.resource.id = json_extract_scalar(data, "$.resourceId"),
    xdm.target.resource.name = json_extract_scalar(data, "$.resourceName"),
    xdm.auth.auth_method = json_extract_scalar(data, "$.identity.authType"),
    xdm.source.user.identifier = json_extract_scalar(data, "$.identity.callerId"),
    xdm.source.user.username = json_extract_scalar(data, "$.identity.callerName"),
    xdm.source.ipv4 = json_extract_scalar(data, "$.identity.ipAddress"),
    xdm.intermediate.user.identifier = json_extract_scalar(data, "$.identity.principalId"),
    xdm.observer.unique_identifier = json_extract_scalar(data, "$.identity.tenantId"),
    xdm.source.user_agent = json_extract_scalar(data, "$.identity.userAgent"),
    xdm.network.http.method=if(json_extract_scalar(data, "$.request.action")="GET", XDM_CONST.HTTP_METHOD_GET, json_extract_scalar(data, "$.request.action")),
    xdm.network.http.http_header.value = json_extract_scalar(data, "$.request.headers"),
    xdm.session_context_id = json_extract_scalar(data, "$.request.id"),
    xdm.network.http.url = json_extract_scalar(data, "$.request.path"),
    xdm.event.outcome_reason = json_extract_scalar(data, "$.response.message"),
    xdm.network.http.response_code = if(json_extract_scalar(data, "$.response.status")="200", XDM_CONST.HTTP_RSP_CODE_OK, json_extract_scalar(data, "$.response.status")),
    xdm.target.resource.value = json_extract_scalar(data, "$.stateChange.current"),
    xdm.target.resource_before.value = json_extract_scalar(data, "$.stateChange.previous");

Schema

oracle_cloud_infrastructure_raw

{
  "oracle_cloud_infrastructure_raw": {
    "cloudEventsVersion": {
      "type": "string",
      "is_array": false
    },
    "contentType": {
      "type": "string",
      "is_array": false
    },
    "eventId": {
      "type": "string",
      "is_array": false
    },
    "eventTime": {
      "type": "string",
      "is_array": false
    },
    "eventType": {
      "type": "string",
      "is_array": false
    },
    "eventTypeVersion": {
      "type": "string",
      "is_array": false
    },
    "data": {
      "type": "string",
      "is_array": false
    }
  }
}