Rules (XIF)
[MODEL: dataset = "oracle_oam_raw"]
alter
IAU_EVENTSTATUS_int = to_integer(IAU_EVENTSTATUS),
IAU_REMOTEIP_ipv4 = if(IAU_REMOTEIP ~= "(?:\d{1,3}\.){3}\d{1,3}", IAU_REMOTEIP),
IAU_REMOTEIP_ipv6 = if(IAU_REMOTEIP ~= "(?:[a-fA-F\d]{0,4}\:){2,7}[a-fA-F\d]{0,4}", IAU_REMOTEIP),
IAU_HOSTNWADDR_ipv4 = if(IAU_HOSTNWADDR ~= "(?:\d{1,3}\.){3}\d{1,3}", IAU_HOSTNWADDR),
IAU_HOSTNWADDR_ipv6 = if(IAU_HOSTNWADDR ~= "(?:[a-fA-F\d]{0,4}\:){2,7}[a-fA-F\d]{0,4}", IAU_HOSTNWADDR),
IAU_CLIENTIPADDRESS_ipv4 = if(IAU_CLIENTIPADDRESS ~= "(?:\d{1,3}\.){3}\d{1,3}", IAU_CLIENTIPADDRESS),
IAU_CLIENTIPADDRESS_ipv6 = if(IAU_CLIENTIPADDRESS ~= "(?:[a-fA-F\d]{0,4}\:){2,7}[a-fA-F\d]{0,4}", IAU_CLIENTIPADDRESS)
| alter
xdm.source.application.name = coalesce(IAU_APPLICATIONNAME, IAU_APPLICATIONDOMAINNAME),
xdm.observer.name = IAU_COMPONENTTYPE,
xdm.source.zone = coalesce(IAU_IDENTITYDOMAIN, IAU_DOMAINNAME),
xdm.session_context_id = IAU_ECID,
xdm.event.original_event_type = IAU_EVENTCATEGORY,
xdm.event.outcome = if(IAU_EVENTSTATUS_int = 0, XDM_CONST.OUTCOME_FAILED, IAU_EVENTSTATUS_int = 1, XDM_CONST.OUTCOME_SUCCESS),
xdm.event.type = IAU_EVENTTYPE,
xdm.source.host.device_id = coalesce(IAU_RESOURCEHOST, IAU_HOSTID),
xdm.source.host.hostname = IAU_SERVERNAME,
xdm.event.id = coalesce(to_string(IAU_THREADID), to_string(IAU_REQUESTID)),
xdm.source.user.identifier = coalesce(IAU_INITIATOR, IAU_USERID),
xdm.target.resource.name = IAU_RESOURCE,
xdm.source.user.username = IAU_AUDITUSER,
xdm.event.description = coalesce(IAU_MESSAGETEXT, IAU_ADDITIONALINFO),
xdm.auth.auth_method = coalesce(IAU_AUTHENTICATIONMETHOD, IAU_AUTHENTICATIONSCHEMEID),
xdm.event.outcome_reason = if(IAU_EVENTSTATUS_int = 0, IAU_FAILURECODE),
xdm.alert.description = object_create("IAU_COMPONENTDATA", IAU_COMPONENTDATA, "IAU_COMPONENTID", IAU_COMPONENTID, "IAU_COMPONENTNAME", IAU_COMPONENTNAME, "IAU_CONTEXTFIELDS", IAU_CONTEXTFIELDS),
xdm.observer.type = IAU_ORACLEHOME,
xdm.source.process.pid = to_integer(IAU_PROCESSID),
xdm.network.session_id = IAU_SESSIONID,
xdm.target.user.identifier = IAU_TARGET,
xdm.target.resource.type = IAU_TARGETCOMPONENTTYPE,
xdm.target.host.device_id = IAU_TENANTID,
xdm.source.ipv4 = coalesce(IAU_REMOTEIP_ipv4, IAU_CLIENTIPADDRESS_ipv4),
xdm.source.ipv6 = coalesce(IAU_REMOTEIP_ipv6, IAU_CLIENTIPADDRESS_ipv6),
xdm.source.host.ipv4_addresses = if(
incidr(IAU_HOSTNWADDR_ipv4, "10.0.0.0/8")
or incidr(IAU_HOSTNWADDR_ipv4, "172.16.0.0/12")
or incidr(IAU_HOSTNWADDR_ipv4, "192.168.0.0/16")
or incidr(IAU_HOSTNWADDR_ipv4, "127.0.0.0/8")
or incidr(IAU_HOSTNWADDR_ipv4, "169.254.0.0/16")
or incidr(IAU_HOSTNWADDR_ipv4, "100.64.0.0/10"),
arraycreate(IAU_HOSTNWADDR_ipv4)
),
xdm.source.host.ipv4_public_addresses = if(
incidr(IAU_HOSTNWADDR_ipv4, "10.0.0.0/8")
or incidr(IAU_HOSTNWADDR_ipv4, "172.16.0.0/12")
or incidr(IAU_HOSTNWADDR_ipv4, "192.168.0.0/16")
or incidr(IAU_HOSTNWADDR_ipv4, "127.0.0.0/8")
or incidr(IAU_HOSTNWADDR_ipv4, "169.254.0.0/16")
or incidr(IAU_HOSTNWADDR_ipv4, "100.64.0.0/10"),
null , arraycreate(IAU_HOSTNWADDR_ipv4)
),
xdm.source.host.ipv6_addresses = arraycreate(IAU_HOSTNWADDR_ipv6),
xdm.source.agent.identifier = IAU_AGENTID,
xdm.target.resource_before.value = coalesce(IAU_OLDATTRIBUTES, IAU_OLDSETTINGS),
xdm.target.resource.value = coalesce(IAU_NEWATTRIBUTES, IAU_NEWSETTINGS),
xdm.target.url = IAU_RESOURCEURI,
xdm.auth.service = IAU_SERVICEURI;
Schema
oracle_oam_raw
| Field |
Type |
Array? |
IAU_ADDITIONALINFO |
string |
— |
IAU_AGENTID |
string |
— |
IAU_APPLICATIONDOMAINNAME |
string |
— |
IAU_APPLICATIONNAME |
string |
— |
IAU_AUDITUSER |
string |
— |
IAU_AUTHENTICATIONMETHOD |
string |
— |
IAU_AUTHENTICATIONSCHEMEID |
string |
— |
IAU_CLIENTIPADDRESS |
string |
— |
IAU_COMPONENTDATA |
string |
— |
IAU_COMPONENTID |
string |
— |
IAU_COMPONENTNAME |
string |
— |
IAU_COMPONENTTYPE |
string |
— |
IAU_CONTEXTFIELDS |
string |
— |
IAU_DOMAINNAME |
string |
— |
IAU_ECID |
string |
— |
IAU_EVENTCATEGORY |
string |
— |
IAU_EVENTSTATUS |
int |
— |
IAU_EVENTTYPE |
string |
— |
IAU_FAILURECODE |
string |
— |
IAU_HOMEINSTANCE |
string |
— |
IAU_HOSTID |
string |
— |
IAU_HOSTNWADDR |
string |
— |
IAU_IDENTITYDOMAIN |
string |
— |
IAU_INITIATOR |
string |
— |
IAU_MESSAGETEXT |
string |
— |
IAU_NEWATTRIBUTES |
string |
— |
IAU_NEWSETTINGS |
string |
— |
IAU_OLDATTRIBUTES |
string |
— |
IAU_OLDSETTINGS |
string |
— |
IAU_ORACLEHOME |
string |
— |
IAU_PROCESSID |
string |
— |
IAU_REMOTEIP |
string |
— |
IAU_REQUESTID |
string |
— |
IAU_RESOURCE |
string |
— |
IAU_RESOURCEHOST |
string |
— |
IAU_RESOURCEURI |
string |
— |
IAU_ROLES |
string |
— |
IAU_SERVERNAME |
string |
— |
IAU_SERVICEURI |
string |
— |
IAU_SESSIONID |
string |
— |
IAU_TARGET |
string |
— |
IAU_TARGETCOMPONENTTYPE |
string |
— |
IAU_TENANTID |
string |
— |
IAU_THREADID |
int |
— |
IAU_TSTZORIGINATING |
datetime |
— |
IAU_USERID |
string |
— |
Raw JSON
{
"oracle_oam_raw": {
"IAU_APPLICATIONNAME": {
"type": "string",
"is_array": false
},
"IAU_COMPONENTTYPE": {
"type": "string",
"is_array": false
},
"IAU_DOMAINNAME": {
"type": "string",
"is_array": false
},
"IAU_ECID": {
"type": "string",
"is_array": false
},
"IAU_EVENTCATEGORY": {
"type": "string",
"is_array": false
},
"IAU_EVENTTYPE": {
"type": "string",
"is_array": false
},
"IAU_HOSTID": {
"type": "string",
"is_array": false
},
"IAU_HOSTNWADDR": {
"type": "string",
"is_array": false
},
"IAU_SERVERNAME": {
"type": "string",
"is_array": false
},
"IAU_TSTZORIGINATING": {
"type": "datetime",
"is_array": false
},
"IAU_REMOTEIP": {
"type": "string",
"is_array": false
},
"IAU_INITIATOR": {
"type": "string",
"is_array": false
},
"IAU_RESOURCE": {
"type": "string",
"is_array": false
},
"IAU_AUDITUSER": {
"type": "string",
"is_array": false
},
"IAU_MESSAGETEXT": {
"type": "string",
"is_array": false
},
"IAU_AUTHENTICATIONMETHOD": {
"type": "string",
"is_array": false
},
"IAU_FAILURECODE": {
"type": "string",
"is_array": false
},
"IAU_COMPONENTDATA": {
"type": "string",
"is_array": false
},
"IAU_COMPONENTID": {
"type": "string",
"is_array": false
},
"IAU_COMPONENTNAME": {
"type": "string",
"is_array": false
},
"IAU_CONTEXTFIELDS": {
"type": "string",
"is_array": false
},
"IAU_HOMEINSTANCE": {
"type": "string",
"is_array": false
},
"IAU_ORACLEHOME": {
"type": "string",
"is_array": false
},
"IAU_PROCESSID": {
"type": "string",
"is_array": false
},
"IAU_ROLES": {
"type": "string",
"is_array": false
},
"IAU_SESSIONID": {
"type": "string",
"is_array": false
},
"IAU_TARGET": {
"type": "string",
"is_array": false
},
"IAU_TARGETCOMPONENTTYPE": {
"type": "string",
"is_array": false
},
"IAU_TENANTID": {
"type": "string",
"is_array": false
},
"IAU_APPLICATIONDOMAINNAME": {
"type": "string",
"is_array": false
},
"IAU_AUTHENTICATIONSCHEMEID": {
"type": "string",
"is_array": false
},
"IAU_AGENTID": {
"type": "string",
"is_array": false
},
"IAU_ADDITIONALINFO": {
"type": "string",
"is_array": false
},
"IAU_USERID": {
"type": "string",
"is_array": false
},
"IAU_RESOURCEHOST": {
"type": "string",
"is_array": false
},
"IAU_REQUESTID": {
"type": "string",
"is_array": false
},
"IAU_OLDATTRIBUTES": {
"type": "string",
"is_array": false
},
"IAU_NEWATTRIBUTES": {
"type": "string",
"is_array": false
},
"IAU_RESOURCEURI": {
"type": "string",
"is_array": false
},
"IAU_OLDSETTINGS": {
"type": "string",
"is_array": false
},
"IAU_NEWSETTINGS": {
"type": "string",
"is_array": false
},
"IAU_SERVICEURI": {
"type": "string",
"is_array": false
},
"IAU_CLIENTIPADDRESS": {
"type": "string",
"is_array": false
},
"IAU_IDENTITYDOMAIN": {
"type": "string",
"is_array": false
},
"IAU_EVENTSTATUS": {
"type": "int",
"is_array": false
},
"IAU_THREADID": {
"type": "int",
"is_array": false
}
}
}