Portnox Modeling Rule

Details

Rules (XIF)

[MODEL:dataset="portnox_portnox_raw"]
filter cefVersion = null
| alter deviceVersion = arrayindex(regextract(_raw_log ,"CEF\:0\|Portnox\|Portnox\|([^\|]+)\|"),0),
    deviceEventClassId = arrayindex(regextract(_raw_log ,"CEF\:0\|Portnox\|Portnox\|[^\|]+\|([^\|]+)\|"),0),
    action = arrayindex(regextract(_raw_log ,"CEF\:0\|Portnox\|Portnox\|[^\|]+\|[^\|]+\|([^\|]+)\|"),0),
    src_user = arrayindex(regextract(_raw_log ,"\|user\s(\S+)\s"),0),
    src_ipv4 = arrayindex(regextract(_raw_log ,"\(ip\:(\d+\.\d+\.\d+\.\d+)\)"),0),
    dst_user = arrayindex(regextract(_raw_log ,"user\s\'([^\']+)\'"),0),
    dst_group = arrayindex(regextract(_raw_log ,"group\s\'([^\']+)\'"),0),
    target_resource = arrayindex(regextract(_raw_log ,"\s\'([^\']+)\'"),0),
    event_description = arrayindex(regextract(_raw_log ,"\|([^\|]+)$"),0),
    dest_hostname = arrayindex(regextract(_raw_log ,"for\sdevice\s([^\.]+)\."),0)
| alter xdm.event.operation_sub_type = action,
    xdm.source.user.username = src_user,
    xdm.target.user.username= dst_user,
    xdm.target.user.groups = arraycreate(dst_group),
    xdm.event.description = event_description,
    xdm.target.host.hostname = dest_hostname,
    xdm.source.ipv4 = src_ipv4,
    xdm.observer.version = deviceVersion,
    xdm.event.id = deviceEventClassId,
    xdm.target.resource.name = target_resource;

filter cefVersion != null
| alter xdm.event.operation_sub_type = act,
    xdm.target.vlan = to_integer(cn1),
    xdm.source.host.os = cs2,
    xdm.event.outcome =  if(outcome in("success","sucess") , XDM_CONST.OUTCOME_SUCCESS  , outcome in ("failure"),XDM_CONST.OUTCOME_FAILED ,to_string(outcome)),
    xdm.auth.auth_method = cs3,
    xdm.target.port = to_integer(dpt),
    xdm.target.ipv4 = dst,
    xdm.event.description = coalesce(msg, description),
    xdm.target.host.mac_addresses = arraycreate(dmac),
    xdm.target.host.hostname = dhost,
    xdm.source.host.hostname = shost,
    xdm.target.file.path = filePath,
    xdm.alert.subcategory = alert_category,
    xdm.source.ipv4 = if(is_ipv4(SourceAddress),SourceAddress, is_ipv4(device_ip), device_ip, null),
    xdm.target.domain = destinationDnsDomain,
    xdm.source.port = to_integer(sourceTranslatedPort),
    xdm.target.process.name = destinationServiceName,
    xdm.observer.version = cefDeviceVersion,
    xdm.network.rule = coalesce(policy, group),
    xdm.source.host.mac_addresses = if(mac_address != null and mac_address != "", arraycreate(mac_address), null),
    xdm.event.id = cefDeviceEventClassId;

Schema

portnox_portnox_raw

{
  "portnox_portnox_raw": {
      "_raw_log": {
          "type": "string",
          "is_array": false
      },"act": {
          "type": "string",
          "is_array": false
      },"description": {
          "type": "string",
          "is_array": false
      },"alert_category": {
          "type": "string",
          "is_array": false
      },"device_ip": {
          "type": "string",
          "is_array": false
      },"policy": {
          "type": "string",
          "is_array": false
      },"mac_address": {
          "type": "string",
          "is_array": false
      },"group": {
          "type": "string",
          "is_array": false
      },"cn1": {
          "type": "string",
          "is_array": false
      },"cs2": {
          "type": "string",
          "is_array": false
      },"outcome": {
          "type": "string",
          "is_array": false
      },"cs3": {
          "type": "string",
          "is_array": false
      },"dpt": {
          "type": "string",
          "is_array": false
      },"dst": {
          "type": "string",
          "is_array": false
      },"msg": {
          "type": "string",
          "is_array": false
      },"dmac": {
          "type": "string",
          "is_array": false
      },"dhost": {
          "type": "string",
          "is_array": false
      },"shost": {
          "type": "string",
          "is_array": false
      },"filePath": {
          "type": "string",
          "is_array": false
      },"SourceAddress": {
          "type": "string",
          "is_array": false
      },"destinationDnsDomain": {
          "type": "string",
          "is_array": false
      },"sourceTranslatedPort": {
          "type": "string",
          "is_array": false
      },"destinationServiceName": {
          "type": "string",
          "is_array": false
      },"cefVersion": {
          "type": "string",
          "is_array": false
      },"cefDeviceEventClassId": {
          "type": "string",
          "is_array": false
      },"cefDeviceVersion": {
          "type": "string",
          "is_array": false
      }
  }
}