Rules (XIF)
[MODEL: dataset = prisma_cloud_compute_raw]
alter
lowercase_tags = lowercase(tags),
lowercase_osDistro = lowercase(osDistro),
lowercase_provider = lowercase(provider),
get_label_image_name_1 = json_extract_scalar(labels, "$['baseimage.name']"),
get_label_image_name_2 = json_extract_scalar(labels, "$['org.opencontainers.image.ref.name']"),
get_label_image_name_3 = json_extract_scalar(labels, "$.Name"),
get_label_image_name_4 = json_extract_scalar(labels, "$.name"),
get_label_image_os = json_extract_scalar(labels, "$['org.opencontainers.image.version']"),
get_label_image_author = json_extract_scalar(labels, "$['org.opencontainers.image.authors']"),
get_label_app = json_extract_scalar(labels, "$.app"),
get_label_maintainer = json_extract_scalar(labels, "$.maintainer"),
get_label_osDistro = lowercase(json_extract_scalar(labels, "$.osDistro")),
get_label_osVersion = json_extract_scalar(labels, "$.osVersion")
| alter
check_image = coalesce(image, get_label_image_name_1, get_label_image_name_2, get_label_image_name_3, get_label_image_name_4),
check_osDistro = coalesce(lowercase_osDistro, get_label_osDistro),
check_origin_vendor = coalesce(get_label_maintainer, get_label_image_author),
check_fullos_1 = get_label_osDistro + get_label_osVersion,
check_fullos_2 = get_label_image_name_2 + get_label_image_os
| alter
xdm.target.user.username = user,
xdm.target.host.fqdn = fqdn,
xdm.target.host.hostname = host,
xdm.network.rule = rule,
xdm.event.tags = arraycreate(if(lowercase_tags ~= "auth", XDM_CONST.EVENT_TAG_AUTHENTICATION, lowercase_tags ~= "vpn", XDM_CONST.EVENT_TAG_VPN, lowercase_tags ~= "network", XDM_CONST.EVENT_TAG_NETWORK, lowercase_tags = null, null, to_string(lowercase_tags))),
xdm.event.type = type,
xdm.target.agent.identifier = check_image,
xdm.alert.description = coalesce(aggregatedAlerts, aggregated),
xdm.target.host.manufacturer = labels,
xdm.target.location.region = region,
xdm.event.description = message,
xdm.target.application.name = get_label_app,
xdm.alert.category = category,
xdm.target.resource.type = if(function != null, "function", check_image != null, "INSTANCE", container != null, "container", null),
xdm.target.resource.value = if(function != null, "function", check_image != null, check_image, container != null, container, null),
xdm.target.host.os_family = if(check_osDistro ~= "win", XDM_CONST.OS_FAMILY_WINDOWS, check_osDistro ~= "mac", XDM_CONST.OS_FAMILY_MACOS, check_osDistro ~= "linux|amzn", XDM_CONST.OS_FAMILY_LINUX, get_label_maintainer ~= "Red Hat", XDM_CONST.OS_FAMILY_LINUX, check_osDistro ~= "android", XDM_CONST.OS_FAMILY_ANDROID, check_osDistro ~= "ios", XDM_CONST.OS_FAMILY_IOS, check_osDistro ~= "ubuntu", XDM_CONST.OS_FAMILY_UBUNTU, check_osDistro ~= "debian", XDM_CONST.OS_FAMILY_DEBIAN, check_osDistro ~= "fedora", XDM_CONST.OS_FAMILY_FEDORA, check_osDistro ~= "centos", XDM_CONST.OS_FAMILY_CENTOS, check_osDistro ~= "chromeos", XDM_CONST.OS_FAMILY_CHROMEOS, check_osDistro ~= "solaris", XDM_CONST.OS_FAMILY_SOLARIS, check_osDistro ~= "scada", XDM_CONST.OS_FAMILY_SCADA, check_osDistro = null, null, to_string(lowercase_osDistro)),
xdm.target.cloud.provider = if(lowercase_provider ~= "aws|amazon|amz", XDM_CONST.CLOUD_PROVIDER_AWS, check_osDistro ~= "aws|amazon|amz", XDM_CONST.CLOUD_PROVIDER_AWS, lowercase_provider ~= "gcp|google", XDM_CONST.CLOUD_PROVIDER_GCP, lowercase_provider ~= "azure|microsoft", XDM_CONST.CLOUD_PROVIDER_AZURE, lowercase_provider ~= "baba|alibaba", XDM_CONST.CLOUD_PROVIDER_ALIBABA, lowercase_provider = null, null, to_string(lowercase_provider)),
xdm.target.cloud.project = accountID,
xdm.target.process.container_id = container,
xdm.target.host.os = coalesce(osRelease, check_fullos_1, check_fullos_2),
xdm.target.host.device_category = to_string(collections),
//xdm.alert.risks = vulnerabilities,
xdm.target.process.command_line = if(command = null, arraystring(regextract(message, "command:\s+(.*)"), ""), command),
xdm.target.process.name = if(startupProcess = "#startupProcess", null, startupProcess),
xdm.target.application.publisher = check_origin_vendor;
Schema
prisma_cloud_compute_raw
| Field |
Type |
Array? |
accountID |
string |
— |
accountIDs |
string |
— |
aggregated |
string |
— |
aggregatedAlerts |
string |
— |
appID |
string |
— |
category |
string |
— |
cluster |
string |
— |
collections |
string |
— |
command |
string |
— |
complianceIssues |
string |
— |
container |
string |
— |
dropped |
string |
— |
forensics |
string |
— |
fqdn |
string |
— |
function |
string |
— |
host |
string |
— |
image |
string |
— |
imageID |
string |
— |
labels |
string |
— |
message |
string |
— |
namespaces |
string |
— |
osDistro |
string |
— |
osRelease |
string |
— |
provider |
string |
— |
region |
string |
— |
rest |
string |
— |
rule |
string |
— |
runtime |
string |
— |
startupProcess |
string |
— |
tags |
string |
— |
time |
datetime |
— |
type |
string |
— |
user |
string |
— |
vulnerabilities |
string |
— |
Raw JSON
{
"prisma_cloud_compute_raw": {
"type": {
"type": "string",
"is_array": false
},
"container": {
"type": "string",
"is_array": false
},
"image": {
"type": "string",
"is_array": false
},
"imageID": {
"type": "string",
"is_array": false
},
"tags": {
"type": "string",
"is_array": false
},
"host": {
"type": "string",
"is_array": false
},
"fqdn": {
"type": "string",
"is_array": false
},
"function": {
"type": "string",
"is_array": false
},
"region": {
"type": "string",
"is_array": false
},
"provider": {
"type": "string",
"is_array": false
},
"osRelease": {
"type": "string",
"is_array": false
},
"osDistro": {
"type": "string",
"is_array": false
},
"runtime": {
"type": "string",
"is_array": false
},
"appID": {
"type": "string",
"is_array": false
},
"rule": {
"type": "string",
"is_array": false
},
"message": {
"type": "string",
"is_array": false
},
"aggregated": {
"type": "string",
"is_array": false
},
"rest": {
"type": "string",
"is_array": false
},
"forensics": {
"type": "string",
"is_array": false
},
"accountID": {
"type": "string",
"is_array": false
},
"cluster": {
"type": "string",
"is_array": false
},
"category": {
"type": "string",
"is_array": false
},
"labels": {
"type": "string",
"is_array": false
},
"collections": {
"type": "string",
"is_array": false
},
"complianceIssues": {
"type": "string",
"is_array": false
},
"vulnerabilities": {
"type": "string",
"is_array": false
},
"aggregatedAlerts": {
"type": "string",
"is_array": false
},
"dropped": {
"type": "string",
"is_array": false
},
"command": {
"type": "string",
"is_array": false
},
"startupProcess": {
"type": "string",
"is_array": false
},
"namespaces": {
"type": "string",
"is_array": false
},
"user": {
"type": "string",
"is_array": false
},
"accountIDs": {
"type": "string",
"is_array": false
},
"time": {
"type": "datetime",
"is_array": false
}
}
}