[MODEL: dataset = prisma_cloud_compute_raw]
alter
lowercase_tags = lowercase(tags),
lowercase_osDistro = lowercase(osDistro),
lowercase_provider = lowercase(provider),
get_label_image_name_1 = json_extract_scalar(labels, "$['baseimage.name']"),
get_label_image_name_2 = json_extract_scalar(labels, "$['org.opencontainers.image.ref.name']"),
get_label_image_name_3 = json_extract_scalar(labels, "$.Name"),
get_label_image_name_4 = json_extract_scalar(labels, "$.name"),
get_label_image_os = json_extract_scalar(labels, "$['org.opencontainers.image.version']"),
get_label_image_author = json_extract_scalar(labels, "$['org.opencontainers.image.authors']"),
get_label_app = json_extract_scalar(labels, "$.app"),
get_label_maintainer = json_extract_scalar(labels, "$.maintainer"),
get_label_osDistro = lowercase(json_extract_scalar(labels, "$.osDistro")),
get_label_osVersion = json_extract_scalar(labels, "$.osVersion")
| alter
check_image = coalesce(image, get_label_image_name_1, get_label_image_name_2, get_label_image_name_3, get_label_image_name_4),
check_osDistro = coalesce(lowercase_osDistro, get_label_osDistro),
check_origin_vendor = coalesce(get_label_maintainer, get_label_image_author),
check_fullos_1 = get_label_osDistro + get_label_osVersion,
check_fullos_2 = get_label_image_name_2 + get_label_image_os
| alter
xdm.target.user.username = user,
xdm.target.host.fqdn = fqdn,
xdm.target.host.hostname = host,
xdm.network.rule = rule,
xdm.event.tags = arraycreate(if(lowercase_tags ~= "auth", XDM_CONST.EVENT_TAG_AUTHENTICATION, lowercase_tags ~= "vpn", XDM_CONST.EVENT_TAG_VPN, lowercase_tags ~= "network", XDM_CONST.EVENT_TAG_NETWORK, lowercase_tags = null, null, to_string(lowercase_tags))),
xdm.event.type = type,
xdm.target.agent.identifier = check_image,
xdm.alert.description = coalesce(aggregatedAlerts, aggregated),
xdm.target.host.manufacturer = labels,
xdm.target.location.region = region,
xdm.event.description = message,
xdm.target.application.name = get_label_app,
xdm.alert.category = category,
xdm.target.resource.type = if(function != null, "function", check_image != null, "INSTANCE", container != null, "container", null),
xdm.target.resource.value = if(function != null, "function", check_image != null, check_image, container != null, container, null),
xdm.target.host.os_family = if(check_osDistro ~= "win", XDM_CONST.OS_FAMILY_WINDOWS, check_osDistro ~= "mac", XDM_CONST.OS_FAMILY_MACOS, check_osDistro ~= "linux|amzn", XDM_CONST.OS_FAMILY_LINUX, get_label_maintainer ~= "Red Hat", XDM_CONST.OS_FAMILY_LINUX, check_osDistro ~= "android", XDM_CONST.OS_FAMILY_ANDROID, check_osDistro ~= "ios", XDM_CONST.OS_FAMILY_IOS, check_osDistro ~= "ubuntu", XDM_CONST.OS_FAMILY_UBUNTU, check_osDistro ~= "debian", XDM_CONST.OS_FAMILY_DEBIAN, check_osDistro ~= "fedora", XDM_CONST.OS_FAMILY_FEDORA, check_osDistro ~= "centos", XDM_CONST.OS_FAMILY_CENTOS, check_osDistro ~= "chromeos", XDM_CONST.OS_FAMILY_CHROMEOS, check_osDistro ~= "solaris", XDM_CONST.OS_FAMILY_SOLARIS, check_osDistro ~= "scada", XDM_CONST.OS_FAMILY_SCADA, check_osDistro = null, null, to_string(lowercase_osDistro)),
xdm.target.cloud.provider = if(lowercase_provider ~= "aws|amazon|amz", XDM_CONST.CLOUD_PROVIDER_AWS, check_osDistro ~= "aws|amazon|amz", XDM_CONST.CLOUD_PROVIDER_AWS, lowercase_provider ~= "gcp|google", XDM_CONST.CLOUD_PROVIDER_GCP, lowercase_provider ~= "azure|microsoft", XDM_CONST.CLOUD_PROVIDER_AZURE, lowercase_provider ~= "baba|alibaba", XDM_CONST.CLOUD_PROVIDER_ALIBABA, lowercase_provider = null, null, to_string(lowercase_provider)),
xdm.target.cloud.project = accountID,
xdm.target.process.container_id = container,
xdm.target.host.os = coalesce(osRelease, check_fullos_1, check_fullos_2),
xdm.target.host.device_category = to_string(collections),
//xdm.alert.risks = vulnerabilities,
xdm.target.process.command_line = if(command = null, arraystring(regextract(message, "command:\s+(.*)"), ""), command),
xdm.target.process.name = if(startupProcess = "#startupProcess", null, startupProcess),
xdm.target.application.publisher = check_origin_vendor;