Rules (XIF)
[MODEL: dataset=orca_security_raw]
filter cloud_provider = "gcp"
| alter xdm.alert.description = details,
xdm.alert.name = json_extract_scalar(data, "$.title"),
xdm.source.user.username = account_name,
xdm.alert.original_alert_id = json_extract_scalar(state, "$.alert_id"),
xdm.target.cloud.provider = cloud_provider,
xdm.alert.subcategory = category,
xdm.source.user.user_type = if(cloud_account_type = "Regular", XDM_CONST.USER_TYPE_REGULAR, to_string(cloud_account_type)),
xdm.event.type = type_string,
mitre_category = json_extract_scalar(data, "$.mitre_category")
| alter xdm.alert.mitre_tactics = arraycreate(if(mitre_category="initial access", XDM_CONST.MITRE_TACTIC_INITIAL_ACCESS
,mitre_category="execution",XDM_CONST.MITRE_TACTIC_EXECUTION
,mitre_category="persistence",XDM_CONST.MITRE_TACTIC_PERSISTENCE
,mitre_category="privilege escalation",XDM_CONST.MITRE_TACTIC_PRIVILEGE_ESCALATION
,mitre_category="defense evasion",XDM_CONST.MITRE_TACTIC_DEFENSE_EVASION
,mitre_category="credential Access",XDM_CONST.MITRE_TACTIC_CREDENTIAL_ACCESS
,mitre_category="discovery", XDM_CONST.MITRE_TACTIC_DISCOVERY
,mitre_category="lateral movement",XDM_CONST.MITRE_TACTIC_LATERAL_MOVEMENT
,mitre_category="collection", XDM_CONST.MITRE_TACTIC_COLLECTION
,mitre_category="exfiltration", XDM_CONST.MITRE_TACTIC_EXFILTRATION
,mitre_category="impact",XDM_CONST.MITRE_TACTIC_IMPACT ,mitre_category)),
mitre_technique = json_extract_scalar(data, "$.mitre_technique.0")
| alter xdm.alert.mitre_techniques = regextract(mitre_technique , "\(([^\)]+)\)"),
xdm.source.user.identifier = arrayindex(regextract(account_name , "\(([^\)]+)\)"), 0),
xdm.alert.severity = json_extract_scalar(state, "$.severity")
| alter xdm.network.tls.server_certificate.issuer = json_extract_scalar(model, "$.data.GcpCertificate.IssuerName"),
xdm.network.tls.server_certificate.serial = json_extract_scalar(model, "$.data.GcpCertificate.SerialNumber"),
xdm.network.tls.server_certificate.subject = json_extract_scalar(model, "$.data.GcpCertificate.Name"),
xdm.target.process.name = json_extract_scalar(model, "$.data.GcpIamServiceAccount.DisplayName"),
xdm.target.process.pid = to_number(json_extract_scalar(model, "$.data.GcpIamServiceAccount.UniqueId")),
xdm.target.user.username = json_extract_scalar(model, "$.data.User.Name"),
xdm.target.user.identifier = json_extract_scalar(model, "$.data.User.UserId"),
xdm.target.user.upn = json_extract_scalar(model, "$.data.GcpUser.Email"),
region_1 = json_extract_scalar(model, "$.data.GcpVpcSubnet.Region"),
region_2 = json_extract_scalar(model, "$.data.GcpSecretManagerSecret.Regions")
| alter xdm.target.cloud.region = coalesce(region_1, region_2),
str_duration = arrayindex(regextract(json_extract_scalar(model, "$.data.GcpPubSubSubscription.MessageRetentionDuration"), "\d+"), 0)
| alter xdm.event.duration = to_number(multiply(to_number(str_duration), 1000)),
xdm.target.subnet = coalesce(json_extract_scalar(model, "$.data.GcpVpcSubnet.Name"), json_extract_scalar(model, "$.data.GcpGkeCluster.ServicesIpv4Cidr")),
xdm.target.agent.version = json_extract_scalar(model, "$.data.GcpGkeCluster.CurrentNodeVersion"),
xdm.logon.fingerprint = json_extract_scalar(model, "$.data.GcpGkeCluster.LabelFingerprint"),
xdm.target.ipv4 = json_extract_scalar(model, "$.data.GcpGkeCluster.Endpoint"),
xdm.target.url = json_extract_scalar(model, "$.data.GcpGkeCluster.InstanceGroupUrls"),
xdm.target.resource.type = coalesce(json_extract_scalar(model, "$.data.GcpVpcSubnet.Vpc.model.type"), json_extract_scalar(model, "$.data.GcpBigqueryTable.Dataset.model.type")),
xdm.database.affected_rows = to_number(json_extract_scalar(model, "$.data.GcpBigqueryTable.NumRows")),
xdm.database.tables = arraycreate(coalesce(json_extract_scalar(model, "$.data.GcpBigqueryTable.Name"), json_extract_scalar(model, "$.data.GcpBigqueryTable.Dataset.model.name"))),
xdm.database.name = json_extract_scalar(model, "$.data.Storage.Name"),
name_1 = json_extract_scalar(model, "$.data.GcpSecretManagerSecret.Name"),
name_2 = json_extract_scalar(model, "$.data.GcpPubSubTopic.Name"),
name_3 = json_extract_scalar(model, "$.data.GcpGkeCluster.Name"),
name_4 = json_extract_scalar(model, "$.data.GcpPubSubSubscription.Name"),
name_5 = json_extract_scalar(model, "$.data.Function.Name"),
name_6 = json_extract_scalar(model, "$.data.Vpc.Name"),
name_7 = json_extract_scalar(model, "$.data.GcpIamPolicy.PolicyBindings.models.0.model.data.GcpIamPolicyBinding.Role.model.name"),
name_8 = json_extract_scalar(model, "$.data.GcpKmsKey.Name"),
name_9 = json_extract_scalar(model, "$.data.GcpVmSnapshot.Name")
| alter xdm.target.resource.name = coalesce(name_1, name_2, name_3, name_4, name_5, name_6, name_7, name_8, name_9),
id_1 = json_extract_scalar(model, "$.data.GcpSecretManagerSecret.SecretId"),
id_2 = json_extract_scalar(model, "$.data.GcpPubSubTopic.Policy.model.id"),
id_3 = json_extract_scalar(model, "$.data.GcpVpcSubnet.Vpc.model.id"),
id_4 = json_extract_scalar(model, "$.data.Vpc.VpcId"),
id_5 = json_extract_scalar(model, "$.data.Function.FunctionId"),
id_6 = json_extract_scalar(model, "$.data.GcpBigqueryTable.TableId"),
id_7 = json_extract_scalar(model, "$.data.GcpBigqueryDataset.DatasetId"),
id_8 = json_extract_scalar(model, "$.data.GcpVmSnapshot.SnapshotId")
| alter xdm.target.resource.id = coalesce(id_1, id_2, id_3, id_4, id_5, id_6, id_7, id_8),
xdm.target.cloud.zone = coalesce(json_extract_scalar(model, "$.data.GcpGkeCluster.zone"), json_extract_scalar(model, "$.data.GcpVmSnapshot.Zone"));
filter cloud_provider = "aws"
| alter xdm.alert.description = details,
xdm.alert.name = json_extract_scalar(data, "$.title"),
xdm.source.user.username = account_name,
xdm.target.cloud.region = json_extract_scalar(model, "$.data.Inventory.Region"),
xdm.alert.original_alert_id = json_extract_scalar(state, "$.alert_id"),
xdm.target.cloud.provider = cloud_provider,
xdm.alert.subcategory = category,
xdm.source.user.user_type = if(cloud_account_type = "Regular", XDM_CONST.USER_TYPE_REGULAR, to_string(cloud_account_type)),
xdm.event.type = type_string,
mitre_category = json_extract_scalar(data, "$.mitre_category")
| alter xdm.alert.mitre_tactics = arraycreate(if(mitre_category="initial access", XDM_CONST.MITRE_TACTIC_INITIAL_ACCESS
,mitre_category="execution",XDM_CONST.MITRE_TACTIC_EXECUTION
,mitre_category="persistence",XDM_CONST.MITRE_TACTIC_PERSISTENCE
,mitre_category="privilege escalation",XDM_CONST.MITRE_TACTIC_PRIVILEGE_ESCALATION
,mitre_category="defense evasion",XDM_CONST.MITRE_TACTIC_DEFENSE_EVASION
,mitre_category="credential Access",XDM_CONST.MITRE_TACTIC_CREDENTIAL_ACCESS
,mitre_category="discovery", XDM_CONST.MITRE_TACTIC_DISCOVERY
,mitre_category="lateral movement",XDM_CONST.MITRE_TACTIC_LATERAL_MOVEMENT
,mitre_category="collection", XDM_CONST.MITRE_TACTIC_COLLECTION
,mitre_category="exfiltration", XDM_CONST.MITRE_TACTIC_EXFILTRATION
,mitre_category="impact",XDM_CONST.MITRE_TACTIC_IMPACT ,mitre_category)),
mitre_technique = json_extract_scalar(data, "$.mitre_technique.0")
| alter xdm.alert.mitre_techniques = regextract(mitre_technique , "\(([^\)]+)\)"),
xdm.source.user.identifier = arrayindex(regextract(account_name , "\(([^\)]+)\)"), 0),
xdm.alert.severity = json_extract_scalar(state, "$.severity")
| alter xdm.database.name = coalesce(json_extract_scalar(model, "$.data.Storage.Name"), json_extract_scalar(model, "$.data.AwsCloudTrail.S3Bucket.model.name")),
xdm.database.tables = arraycreate(json_extract_scalar(model, "$.data.AwsDynamodbTable.Name")),
xdm.event.duration = to_number(json_extract_scalar(model, "$.data.AwsSqsQueue.MessageRetentionPeriod")),
xdm.network.tls.client_certificate.serial = json_extract_scalar(model, "$.data.AwsCertificate.SerialNumber"),
xdm.network.tls.server_certificate.issuer = json_extract_scalar(model, "$.data.AwsCertificate.IssuerName"),
zone_1 = json_extract_scalar(model, "$.data.AwsSubnet.AvailabilityZone"),
zone_2 = json_extract_scalar(model, "$.data.AwsRdsDbInstanceSnapshot.AvailabilityZone"),
zone_3 = json_extract_scalar(model, "$.data.AwsEc2EbsVolume.AvailabilityZone"),
zone_4 = json_extract_scalar(model, "$.data.AwsEc2Elb.AvailabilityZones"),
zone_5 = json_extract_scalar(model, "$.data.AwsRdsDbClusterSnapshot.AvailabilityZones"),
zone_6 = json_extract_scalar(model, "$.data.AwsAsg.AvailabilityZones"),
zone_7 = json_extract_scalar(model, "$.data.AwsEcsContainerInstance.Ec2Instance.model.data.Compute.AvailabilityZones")
| alter xdm.target.cloud.zone = coalesce(zone_1, zone_2, zone_3, zone_4, zone_5, zone_6, zone_7),
xdm.target.host.device_id = json_extract_scalar(model, "$.data.AwsEfsFileSystem.FileSystemId"),
xdm.target.host.hostname = coalesce(json_extract_scalar(model, "$.data.AwsEksCluster.Endpoint"), json_extract_scalar(model, "$.AwsEcsContainerInstance.Ec2Instance.model.data.name")),
xdm.target.host.ipv4_addresses = arraycreate(coalesce(json_extract_scalar(model, "$.data.AwsAsg.Ec2Instances.models.0.model.data.AwsEc2Instance.PublicIpAddress"), json_extract_scalar(model, "$.data.AwsEcsContainerInstance.Ec2Instance.model.data.Compute.PublicIps"))),
xdm.target.host.mac_addresses = arraycreate(json_extract_scalar(model, "$.data.AwsEcsContainerInstance.Ec2Instance.model.data.Compute.MacAddresses")),
xdm.target.interface = json_extract_scalar(model, "$.data.AwsEc2VpcEndpoint.NetworkInterfaceIds"),
xdm.target.ipv4 = json_extract_scalar(model, "$.data.AwsEc2ElasticIpAddress.PublicIpAddress"),
region_1 = json_extract_scalar(model, "$.data.AwsGlueDataCatalog.Region"),
region_2 = json_extract_scalar(model, "$.data.AwsCloudFormationStack.Region"),
region_3 = json_extract_scalar(model, "$.data.AwsKmsKey.Region"),
region_4 = json_extract_scalar(model, "$.data.AwsEc2ElasticIpAddress.NetworkBorderGroup"),
region_5 = json_extract_scalar(model, "$.data.AwsEcsContainerInstance.Ec2Instance.model.data.Compute.Regions")
| alter xdm.target.location.region = coalesce(region_1, region_2, region_3, region_4, region_5),
xdm.target.port = to_number(coalesce(json_extract_scalar(model, "$.data.AwsRdsDbInstanceSnapshot.Port"), json_extract_scalar(model, "$.data.AwsRdsDbClusterSnapshot.Port"))),
xdm.target.process.executable.path = coalesce(json_extract_scalar(model, "$.data.AwsIamRole.path"), json_extract_scalar(model, "$.data.AwsIamGroup.Path")),
aws_id_1 = json_extract_scalar(model, "$.data.AwsEc2NetworkAcl.Vpc.model.id"),
aws_id_2 = json_extract_scalar(model, "$.data.AwsSubnet.Vpc.model.id"),
aws_id_3 = json_extract_scalar(model, "$.data.Vpc.VpcId"),
aws_id_4 = json_extract_scalar(model, "$.data.AwsEc2SecurityGroup.Vpc.model.id"),
aws_id_5 = json_extract_scalar(model, "$.data.AwsCloudFormationStack.StackId"),
aws_id_6 = json_extract_scalar(model, "$.data.AwsRdsDbInstanceSnapshot.DbiResourceId"),
aws_id_7 = json_extract_scalar(model, "$.data.AwsApiGatewayEndpoint.ApiId"),
aws_id_8 = json_extract_scalar(model, "$.data.AwsDynamodbTable.TableId"),
aws_id_9 = json_extract_scalar(model, "$.data.AwsAsg.Ec2Instances.models.0.model.data.AwsEc2Instance.Vm.ImageId"),
aws_id_10 = json_extract_scalar(model, "$.data.AwsEc2ElasticIpAddress.AllocationId"),
aws_id_11 = json_extract_scalar(model, "$.data.AwsEc2VpcEndpoint.VpcEndpointId")
| alter xdm.target.resource.id = coalesce(aws_id_1, aws_id_2, aws_id_3, aws_id_4, aws_id_5, aws_id_6, aws_id_7, aws_id_8, aws_id_9, aws_id_10, aws_id_11),
aws_name_1 = json_extract_scalar(model, "$.data.AwsSubnet.Vpc.model.name"),
aws_name_2 = json_extract_scalar(model, "$.data.Vpc.Name"),
aws_name_3 = json_extract_scalar(model, "$.data.AwsEc2SecurityGroup.Vpc.model.Name"),
aws_name_4 = json_extract_scalar(model, "$.data.name"),
aws_name_5 = json_extract_scalar(model, "$.data.AwsGlueDataCatalog.Name"),
aws_name_6 = json_extract_scalar(model, "$.data.AwsCloudFormationStack.Name"),
aws_name_7 = json_extract_scalar(model, "$.data.AwsIamPasswordPolicy.Name"),
aws_name_8 = json_extract_scalar(model, "$.data.AwsEc2InternetGateway.Name"),
aws_name_9 = json_extract_scalar(model, "$.data.AwsEventBus.Name"),
aws_name_10 = json_extract_scalar(model, "$.data.AwsEc2NetworkAcl.Vpc.model.name"),
aws_name_11 = json_extract_scalar(model, "$.data.AwsRoute53HostedZone.Name"),
aws_name_12 = json_extract_scalar(model, "$.data.AwsApiGatewayV2Route.Name"),
aws_name_13 = json_extract_scalar(model, "$.data.AwsEfsFileSystem.Name"),
aws_name_14 = json_extract_scalar(model, "$.data.AwsEc2VpcEndpoint.Name"),
aws_name_15 = json_extract_scalar(model, "$.data.AwsBackupVault.Name"),
aws_name_16 = json_extract_scalar(model, "$.data.AwsEc2EbsSnapshot.Name"),
aws_name_17 = json_extract_scalar(model, "$.data.AwsSqsQueue.Name"),
aws_name_18 = json_extract_scalar(model, "$.data.AwsEcsContainerInstance.Name"),
aws_name_19 = json_extract_scalar(model, "$.data.AwsEc2ElasticIpAddress.Name"),
aws_name_20 = json_extract_scalar(model, "$.data.AwsAsg.Ec2Instances.models.model.0.data.AwsEc2Instance.Name"),
aws_name_21 = json_extract_scalar(model, "$.data.AwsRdsDbClusterSnapshot.Name"),
aws_name_22 = json_extract_scalar(model, "$.data.AwsSecurityHub.Name"),
aws_name_23 = json_extract_scalar(model, "$.data.AwsApiGatewayEndpoint.Name"),
aws_name_24 = json_extract_scalar(model, "$.data.AwsLambdaFunction.Name"),
aws_name_25 = json_extract_scalar(model, "$.data.AwsEc2Elb.Name"),
aws_name_26 = json_extract_scalar(model, "$.data.AwsEc2Elbv2.Name"),
aws_name_27 = json_extract_scalar(model, "$.data.AwsIamPolicy.Name"),
aws_name_28 = json_extract_scalar(model, "$.data.AwsEksCluster.Name"),
aws_name_29 = json_extract_scalar(model, "$.data.AwsSnsTopic.Name"),
aws_name_30 = json_extract_scalar(model, "$.data.AwsCloudTrail.Name"),
aws_name_31 = json_extract_scalar(model, "$.data.AwsIamGroup.Name"),
aws_name_32 = json_extract_scalar(model, "$.data.AwsEc2EbsVolume.Name"),
aws_name_33 = json_extract_scalar(model, "$.data.AwsKmsKey.Name"),
aws_name_34 = json_extract_scalar(model, "$.data.AwsRdsDbInstanceSnapshot.Name")
| alter xdm.target.resource.name = coalesce(aws_name_1, aws_name_2, aws_name_3, aws_name_4, aws_name_5, aws_name_6, aws_name_7, aws_name_8, aws_name_9, aws_name_10, aws_name_11, aws_name_12, aws_name_13, aws_name_14, aws_name_15, aws_name_16, aws_name_17, aws_name_18, aws_name_19, aws_name_20, aws_name_21, aws_name_22, aws_name_23, aws_name_24, aws_name_25, aws_name_26, aws_name_27, aws_name_28, aws_name_29, aws_name_30, aws_name_31, aws_name_32, aws_name_33, aws_name_34),
xdm.target.resource.type = json_extract_scalar(model, "$.data.AwsRdsDbInstanceSnapshot.StorageType"),
xdm.target.subnet = coalesce(json_extract_scalar(model, "$.data.AwsSubnet.CidrBlock"), json_extract_scalar(model, "$.data.AwsEksCluster.PublicAccessCidrs")),
identifier_1 = json_extract_scalar(model, "$.data.User.UserId"),
identifier_2 = json_extract_scalar(model, "$.data.User.Name"),
identifier_3 = json_extract_scalar(model, "$.data.AwsEfsFileSystem.OwnerId")
| alter xdm.target.user.identifier = coalesce(identifier_1, identifier_2, identifier_3),
xdm.target.user.username = coalesce(json_extract_scalar(model, "$.data.AwsRdsDbInstanceSnapshot.MasterUsername"), json_extract_scalar(model, "$.data.AwsRdsDbClusterSnapshot.MasterUsername"));
filter cloud_provider = "azure"
| alter xdm.alert.description = details,
xdm.alert.name = json_extract_scalar(data, "$.title"),
xdm.source.user.username = account_name,
xdm.target.cloud.region = json_extract_scalar(model, "$.data.Inventory.Region"),
xdm.alert.original_alert_id = json_extract_scalar(state, "$.alert_id"),
xdm.target.cloud.provider = cloud_provider,
xdm.alert.subcategory = category,
xdm.source.user.user_type = if(cloud_account_type = "Regular", XDM_CONST.USER_TYPE_REGULAR, to_string(cloud_account_type)),
xdm.event.type = type_string,
mitre_category = json_extract_scalar(data, "$.mitre_category")
| alter xdm.alert.mitre_tactics = arraycreate(if(mitre_category="initial access", XDM_CONST.MITRE_TACTIC_INITIAL_ACCESS
,mitre_category="execution",XDM_CONST.MITRE_TACTIC_EXECUTION
,mitre_category="persistence",XDM_CONST.MITRE_TACTIC_PERSISTENCE
,mitre_category="privilege escalation",XDM_CONST.MITRE_TACTIC_PRIVILEGE_ESCALATION
,mitre_category="defense evasion",XDM_CONST.MITRE_TACTIC_DEFENSE_EVASION
,mitre_category="credential Access",XDM_CONST.MITRE_TACTIC_CREDENTIAL_ACCESS
,mitre_category="discovery", XDM_CONST.MITRE_TACTIC_DISCOVERY
,mitre_category="lateral movement",XDM_CONST.MITRE_TACTIC_LATERAL_MOVEMENT
,mitre_category="collection", XDM_CONST.MITRE_TACTIC_COLLECTION
,mitre_category="exfiltration", XDM_CONST.MITRE_TACTIC_EXFILTRATION
,mitre_category="impact",XDM_CONST.MITRE_TACTIC_IMPACT ,mitre_category)),
mitre_technique = json_extract_scalar(data, "$.mitre_technique.0")
| alter xdm.alert.mitre_techniques = regextract(mitre_technique , "\(([^\)]+)\)"),
xdm.source.user.identifier = arrayindex(regextract(account_name , "\(([^\)]+)\)"), 0),
xdm.alert.severity = json_extract_scalar(state, "$.severity")
| alter xdm.database.name = coalesce(json_extract_scalar(model, "$.data.AzurePostgresDbServer.Name"), json_extract_scalar(model, "$.data.AzureStorageAccount.Name")),
xdm.target.application.name = json_extract_scalar(model, "$.data.AzureWebAppService.Name"),
hostname_1 = json_extract_scalar(model, "$.data.AzureNetworkSecurityGroupRule.NetworkSecurityGroup.model.name"),
hostname_2 = json_extract_scalar(model, "$.data.AzureNetworkInterface.Name"),
hostname_3 = json_extract_scalar(model, "$.data.AzureFunctionApp.HostNames"),
hostname_4 = json_extract_scalar(model, "$.data.AzureWebAppService.HostNames"),
hostname_5 = json_extract_scalar(model, "$.data.AzurePublicIp.Name")
| alter xdm.target.host.hostname = coalesce(hostname_1, hostname_2, hostname_3, hostname_4, hostname_5),
proto = json_extract_scalar(model, "$.data.AzureNetworkSecurityGroupRule.NetworkSecurityGroupRuleIpPermissions.models.model.data.AzureNetworkSecurityGroupRuleIpPermission.Protocol")
| alter xdm.network.ip_protocol = if(proto="HOPOPT",XDM_CONST.IP_PROTOCOL_HOPOPT, proto="ICMP",XDM_CONST.IP_PROTOCOL_ICMP, proto="IGMP",XDM_CONST.IP_PROTOCOL_IGMP, proto="GGP",XDM_CONST.IP_PROTOCOL_GGP, proto="IP",XDM_CONST.IP_PROTOCOL_IP, proto="ST",XDM_CONST.IP_PROTOCOL_ST, proto="TCP",XDM_CONST.IP_PROTOCOL_TCP, proto="CBT",XDM_CONST.IP_PROTOCOL_CBT, proto="EGP",XDM_CONST.IP_PROTOCOL_EGP, proto="IGP",XDM_CONST.IP_PROTOCOL_IGP, proto="BBN_RCC_MON",XDM_CONST.IP_PROTOCOL_BBN_RCC_MON, proto="NVP_II",XDM_CONST.IP_PROTOCOL_NVP_II, proto="PUP",XDM_CONST.IP_PROTOCOL_PUP, proto="ARGUS",XDM_CONST.IP_PROTOCOL_ARGUS, proto="EMCON",XDM_CONST.IP_PROTOCOL_EMCON, proto="XNET",XDM_CONST.IP_PROTOCOL_XNET, proto="CHAOS",XDM_CONST.IP_PROTOCOL_CHAOS, proto="UDP",XDM_CONST.IP_PROTOCOL_UDP, proto="MUX",XDM_CONST.IP_PROTOCOL_MUX, proto="DCN_MEAS",XDM_CONST.IP_PROTOCOL_DCN_MEAS, proto="HMP",XDM_CONST.IP_PROTOCOL_HMP, proto="PRM",XDM_CONST.IP_PROTOCOL_PRM, proto="XNS_IDP",XDM_CONST.IP_PROTOCOL_XNS_IDP, proto="TRUNK_1",XDM_CONST.IP_PROTOCOL_TRUNK_1, proto="TRUNK_2",XDM_CONST.IP_PROTOCOL_TRUNK_2, proto="LEAF_1",XDM_CONST.IP_PROTOCOL_LEAF_1, proto="LEAF_2",XDM_CONST.IP_PROTOCOL_LEAF_2, proto="RDP",XDM_CONST.IP_PROTOCOL_RDP, proto="IRTP",XDM_CONST.IP_PROTOCOL_IRTP, proto="ISO_TP4",XDM_CONST.IP_PROTOCOL_ISO_TP4, proto="NETBLT",XDM_CONST.IP_PROTOCOL_NETBLT, proto="MFE_NSP",XDM_CONST.IP_PROTOCOL_MFE_NSP, proto="MERIT_INP",XDM_CONST.IP_PROTOCOL_MERIT_INP, proto="DCCP",XDM_CONST.IP_PROTOCOL_DCCP, proto="3PC",XDM_CONST.IP_PROTOCOL_3PC, proto="IDPR",XDM_CONST.IP_PROTOCOL_IDPR, proto="XTP",XDM_CONST.IP_PROTOCOL_XTP, proto="DDP",XDM_CONST.IP_PROTOCOL_DDP, proto="IDPR_CMTP",XDM_CONST.IP_PROTOCOL_IDPR_CMTP, proto="TP",XDM_CONST.IP_PROTOCOL_TP, proto="IL",XDM_CONST.IP_PROTOCOL_IL, proto="IPV6",XDM_CONST.IP_PROTOCOL_IPV6, proto="SDRP",XDM_CONST.IP_PROTOCOL_SDRP, proto="IPV6_ROUTE",XDM_CONST.IP_PROTOCOL_IPV6_ROUTE, proto="IPV6_FRAG",XDM_CONST.IP_PROTOCOL_IPV6_FRAG, proto="IDRP",XDM_CONST.IP_PROTOCOL_IDRP, proto="RSVP",XDM_CONST.IP_PROTOCOL_RSVP, proto="GRE",XDM_CONST.IP_PROTOCOL_GRE, proto="DSR",XDM_CONST.IP_PROTOCOL_DSR, proto="BNA",XDM_CONST.IP_PROTOCOL_BNA, proto="ESP",XDM_CONST.IP_PROTOCOL_ESP, proto="AH",XDM_CONST.IP_PROTOCOL_AH, proto="I_NLSP",XDM_CONST.IP_PROTOCOL_I_NLSP, proto="SWIPE",XDM_CONST.IP_PROTOCOL_SWIPE, proto="NARP",XDM_CONST.IP_PROTOCOL_NARP, proto="MOBILE",XDM_CONST.IP_PROTOCOL_MOBILE, proto="TLSP",XDM_CONST.IP_PROTOCOL_TLSP, proto="SKIP",XDM_CONST.IP_PROTOCOL_SKIP, proto="IPV6_ICMP",XDM_CONST.IP_PROTOCOL_IPV6_ICMP, proto="IPV6_NONXT",XDM_CONST.IP_PROTOCOL_IPV6_NONXT, proto="IPV6_OPTS",XDM_CONST.IP_PROTOCOL_IPV6_OPTS, proto="CFTP",XDM_CONST.IP_PROTOCOL_CFTP, proto="SAT_EXPAK",XDM_CONST.IP_PROTOCOL_SAT_EXPAK, proto="KRYPTOLAN",XDM_CONST.IP_PROTOCOL_KRYPTOLAN, proto="RVD",XDM_CONST.IP_PROTOCOL_RVD, proto="IPPC",XDM_CONST.IP_PROTOCOL_IPPC, proto="SAT_MON",XDM_CONST.IP_PROTOCOL_SAT_MON, proto="VISA",XDM_CONST.IP_PROTOCOL_VISA, proto="IPCV",XDM_CONST.IP_PROTOCOL_IPCV, proto="CPNX",XDM_CONST.IP_PROTOCOL_CPNX, proto="CPHB",XDM_CONST.IP_PROTOCOL_CPHB, proto="WSN",XDM_CONST.IP_PROTOCOL_WSN, proto="PVP",XDM_CONST.IP_PROTOCOL_PVP, proto="BR_SAT_MON",XDM_CONST.IP_PROTOCOL_BR_SAT_MON, proto="SUN_ND",XDM_CONST.IP_PROTOCOL_SUN_ND, proto="WB_MON",XDM_CONST.IP_PROTOCOL_WB_MON, proto="WB_EXPAK",XDM_CONST.IP_PROTOCOL_WB_EXPAK, proto="ISO_IP",XDM_CONST.IP_PROTOCOL_ISO_IP, proto="VMTP",XDM_CONST.IP_PROTOCOL_VMTP, proto="SECURE_VMTP",XDM_CONST.IP_PROTOCOL_SECURE_VMTP, proto="VINES",XDM_CONST.IP_PROTOCOL_VINES, proto="TTP",XDM_CONST.IP_PROTOCOL_TTP, proto="NSFNET_IGP",XDM_CONST.IP_PROTOCOL_NSFNET_IGP, proto="DGP",XDM_CONST.IP_PROTOCOL_DGP, proto="TCF",XDM_CONST.IP_PROTOCOL_TCF, proto="EIGRP",XDM_CONST.IP_PROTOCOL_EIGRP, proto="OSPFIGP",XDM_CONST.IP_PROTOCOL_OSPFIGP, proto="SPRITE_RPC",XDM_CONST.IP_PROTOCOL_SPRITE_RPC, proto="LARP",XDM_CONST.IP_PROTOCOL_LARP, proto="MTP",XDM_CONST.IP_PROTOCOL_MTP, proto="AX25",XDM_CONST.IP_PROTOCOL_AX25, proto="IPIP",XDM_CONST.IP_PROTOCOL_IPIP, proto="MICP",XDM_CONST.IP_PROTOCOL_MICP, proto="SCC_SP",XDM_CONST.IP_PROTOCOL_SCC_SP, proto="ETHERIP",XDM_CONST.IP_PROTOCOL_ETHERIP, proto="ENCAP",XDM_CONST.IP_PROTOCOL_ENCAP, proto="GMTP",XDM_CONST.IP_PROTOCOL_GMTP, proto="IFMP",XDM_CONST.IP_PROTOCOL_IFMP, proto="PNNI",XDM_CONST.IP_PROTOCOL_PNNI, proto="PIM",XDM_CONST.IP_PROTOCOL_PIM, proto="ARIS",XDM_CONST.IP_PROTOCOL_ARIS, proto="SCPS",XDM_CONST.IP_PROTOCOL_SCPS, proto="QNX",XDM_CONST.IP_PROTOCOL_QNX, proto="AN",XDM_CONST.IP_PROTOCOL_AN, proto="IPCOMP",XDM_CONST.IP_PROTOCOL_IPCOMP, proto="COMPAQ_PEER",XDM_CONST.IP_PROTOCOL_COMPAQ_PEER, proto="IPX_IN_IP",XDM_CONST.IP_PROTOCOL_IPX_IN_IP, proto="VRRP",XDM_CONST.IP_PROTOCOL_VRRP, proto="PGM",XDM_CONST.IP_PROTOCOL_PGM, proto="L2TP",XDM_CONST.IP_PROTOCOL_L2TP, proto="DDX",XDM_CONST.IP_PROTOCOL_DDX, proto="IATP",XDM_CONST.IP_PROTOCOL_IATP, proto="STP",XDM_CONST.IP_PROTOCOL_STP, proto="SRP",XDM_CONST.IP_PROTOCOL_SRP, proto="UTI",XDM_CONST.IP_PROTOCOL_UTI, proto="SMP",XDM_CONST.IP_PROTOCOL_SMP, proto="SM",XDM_CONST.IP_PROTOCOL_SM, proto="PTP",XDM_CONST.IP_PROTOCOL_PTP, proto="ISIS",XDM_CONST.IP_PROTOCOL_ISIS, proto="FIRE",XDM_CONST.IP_PROTOCOL_FIRE, proto="CRTP",XDM_CONST.IP_PROTOCOL_CRTP, proto="CRUDP",XDM_CONST.IP_PROTOCOL_CRUDP, proto="SSCOPMCE",XDM_CONST.IP_PROTOCOL_SSCOPMCE, proto="IPLT",XDM_CONST.IP_PROTOCOL_IPLT, proto="SPS",XDM_CONST.IP_PROTOCOL_SPS, proto="PIPE",XDM_CONST.IP_PROTOCOL_PIPE, proto="SCTP",XDM_CONST.IP_PROTOCOL_SCTP, proto="FC",XDM_CONST.IP_PROTOCOL_FC, proto="RSVP_E2E_IGNORE",XDM_CONST.IP_PROTOCOL_RSVP_E2E_IGNORE, proto="MOBILITY",XDM_CONST.IP_PROTOCOL_MOBILITY, proto="UDPLITE",XDM_CONST.IP_PROTOCOL_UDPLITE, proto="MPLS_IN_IP",XDM_CONST.IP_PROTOCOL_MPLS_IN_IP, proto="MANET",XDM_CONST.IP_PROTOCOL_MANET, proto="HIP",XDM_CONST.IP_PROTOCOL_HIP, proto="SHIM6",XDM_CONST.IP_PROTOCOL_SHIM6, proto="WESP",XDM_CONST.IP_PROTOCOL_WESP, proto="ROHC",XDM_CONST.IP_PROTOCOL_ROHC, proto="RESERVED",XDM_CONST.IP_PROTOCOL_RESERVED, proto=null, null, to_string(proto)),
xdm.target.host.ipv4_addresses = arraycreate(json_extract_scalar(model, "$.data.AzureFunctionApp.PossibleOutboundIpAddresses")),
xdm.target.host.mac_addresses = arraycreate(json_extract_scalar(model, "$.data.AzureNetworkInterface.MacAddress")),
interface_1 = json_extract_scalar(model, "$.data.AzureNetworkSecurityGroup.Name.NetworkInterfaceIds"),
interface_2 = json_extract_scalar(model, "$.data.AzureNetworkInterface.NetworkInterfaceId"),
interface_3 = json_extract_scalar(model, "$.data.AzurePublicIp.NetworkInterface.model.name")
| alter xdm.target.interface = coalesce(interface_1, interface_2, interface_3),
xdm.target.ipv4 = json_extract_scalar(model, "$.data.AzureNetworkInterface.ConnectedPublicIps.models.model.data.AzurePublicIp.IpAddress"),
xdm.target.cloud.zone = json_extract_scalar(model, "$.data.Inventory.Zones"),
azure_region_1 = json_extract_scalar(model, "$.data.AzureNetworkInterface.ConnectedPublicIps.models.model.data.AzurePublicIp.Location"),
azure_region_2 = json_extract_scalar(model, "$.data.AzureNetworkWatcher.Location"),
azure_region_3 = json_extract_scalar(model, "$.data.AzureNetworkInterface.ConnectedPublicIps.models.model.data.AzurePublicIp.Location"),
azure_region_4 = json_extract_scalar(model, "$.data.AzureFunctionApp.Location"),
azure_region_5 = json_extract_scalar(model, "$.data.AzureKeyVault.Location"),
azure_region_6 = json_extract_scalar(model, "$.data.AzureWebAppService.Location"),
azure_region_7 = json_extract_scalar(model, "$.data.AzurePublicIp.Location"),
azure_region_8 = json_extract_scalar(model, "$.data.AzureStorageAccount.Location")
| alter xdm.target.location.region = coalesce(azure_region_1, azure_region_2, azure_region_3, azure_region_4, azure_region_5, azure_region_6, azure_region_7, azure_region_8),
xdm.target.port = to_number(json_extract_scalar(model, "$.data.AzureNetworkSecurityGroupRule.NetworkSecurityGroupRuleIpPermissions.models.model.data.AzureNetworkSecurityGroupRuleIpPermission.DestinationPortTo")),
azure_id_1 = json_extract_scalar(model, "$.data.AzureNetworkSecurityGroupRule.RuleId"),
azure_id_2 = json_extract_scalar(model, "$.data.AzureBlobStorage.BlobId"),
azure_id_3 = json_extract_scalar(model, "$.data.AzurePostgresDbServer.GlobalId"),
azure_id_4 = json_extract_scalar(model, "$.data.AzureNetworkWatcher.NetworkWatcherId"),
azure_id_5 = json_extract_scalar(model, "$.data.AzureFunctionApp.FunctionId"),
azure_id_6 = json_extract_scalar(model, "$.data.AzureKeyVault.KeyVaultId"),
azure_id_7 = json_extract_scalar(model, "$.data.AzureWebAppService.WebAppId"),
azure_id_8 = json_extract_scalar(model, "$.data.AzureSubscriptionDiagnosticSetting.DiagnosticSettingId"),
azure_id_9 = json_extract_scalar(model, "$.data.AzureStorageAccount.StoragAccountId")
| alter xdm.target.resource.id = coalesce(azure_id_1, azure_id_2, azure_id_3, azure_id_4, azure_id_5, azure_id_6, azure_id_7, azure_id_8, azure_id_9),
azure_name_1 = json_extract_scalar(model, "$.data.AzureNetworkSecurityGroupRule.Name"),
azure_name_2 = json_extract_scalar(model, "$.data.AzureNetworkSecurityGroup.Name"),
azure_name_3 = json_extract_scalar(model, "$.data.AzureVNet.Name"),
azure_name_4 = json_extract_scalar(model, "$.data.AzureBlobStorage.Name"),
azure_name_5 = json_extract_scalar(model, "$.data.AzureNetworkWatcher.Name"),
azure_name_6 = json_extract_scalar(model, "$.data.AzureFunctionApp.Name"),
azure_name_7 = json_extract_scalar(model, "$.data.AzureKeyVault.Name"),
azure_name_8 = json_extract_scalar(model, "$.data.AwsEventBus.Name"),
azure_name_9 = json_extract_scalar(model, "$.data.AzureSubscriptionDiagnosticSetting.Name")
| alter xdm.target.resource.name = coalesce(azure_name_1, azure_name_2, azure_name_3, azure_name_4, azure_name_5, azure_name_6, azure_name_7, azure_name_8, azure_name_9),
xdm.target.subnet = json_extract_scalar(model, "$.data.AzureVNet.AddressSpace"),
xdm.target.url = json_extract_scalar(model, "$.data.AzureKeyVault.VaultUri"),
xdm.target.user.groups = arraycreate(json_extract_scalar(model, "$.data.AzurePrincipal.RoleAssignments.models.model.data.AzureRoleAssignment.Name")),
azure_identifier_1 = json_extract_scalar(model, "$.data.AzureUser.AzureUserId"),
azure_identifier_2 = json_extract_scalar(model, "$.data.AzureRoleAssignment.AssignmentId"),
azure_identifier_3 = json_extract_scalar(model, "$.data.User.UserId"),
azure_identifier_4 = json_extract_scalar(model, "$.data.AzurePrincipal.PrincipalId")
| alter xdm.target.user.identifier = coalesce(azure_identifier_1, azure_identifier_2, azure_identifier_3, azure_identifier_4),
xdm.target.user.upn = json_extract_scalar(model, "$.data.AzureUser.Name"),
azure_username_1 = json_extract_scalar(model, "$.data.AzureUser.DisplayName"),
azure_username_2 = json_extract_scalar(model, "$.data.AzureRoleAssignment.Name"),
azure_username_3 = json_extract_scalar(model, "$.data.AzurePostgresDbServer.AdministratorLogin"),
azure_username_4 = json_extract_scalar(model, "$.data.AwsUser.Name"),
azure_username_5 = json_extract_scalar(model, "$.data.AzureWebAppService.ResourceGroup.model.name"),
azure_username_6 = json_extract_scalar(model, "$.data.AzurePrincipal.Name")
| alter xdm.target.user.username = coalesce(azure_username_1, azure_username_2, azure_username_3, azure_username_4, azure_username_5, azure_username_6);