Rules (XIF)
[MODEL: dataset = proofpoint_casb_raw]
alter os = lowercase(event -> remote.client.device.os.name),
email = event -> user.email,
owner = event -> resources[0].owner.user.name,
last_modified = to_string(event -> resources[0].modifiedAt),
src_ipv4 = if(event -> remote.client.ip ~= "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}", event -> remote.client.ip, null),
src_ipv6 = if(event -> remote.client.ip ~= "[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}", event -> remote.client.ip, null)
| alter xdm.source.location.country = event -> remote.client.geo.address.country.name,
xdm.source.location.latitude = to_float(event -> remote.client.geo.coordinates.lat),
xdm.source.location.longitude = to_float(event -> remote.client.geo.coordinates.lon),
xdm.source.location.region = event -> remote.client.geo.address.area1.name,
xdm.source.location.city = event -> remote.client.geo.address.area2.name,
xdm.source.ipv4 = src_ipv4,
xdm.source.ipv6 = src_ipv6,
xdm.source.host.os = os,
xdm.source.host.os_family = if(os contains "windows", XDM_CONST.OS_FAMILY_WINDOWS, os contains "mac", XDM_CONST.OS_FAMILY_MACOS, os contains "linux", XDM_CONST.OS_FAMILY_LINUX, os contains "android", XDM_CONST.OS_FAMILY_ANDROID, os contains "ios", XDM_CONST.OS_FAMILY_IOS, os contains "ubuntu", XDM_CONST.OS_FAMILY_UBUNTU, os contains "debian", XDM_CONST.OS_FAMILY_DEBIAN, os contains "fedora", XDM_CONST.OS_FAMILY_FEDORA, os contains "centos", XDM_CONST.OS_FAMILY_CENTOS, os contains "chrome", XDM_CONST.OS_FAMILY_CHROMEOS, os contains "solaris", XDM_CONST.OS_FAMILY_SOLARIS, os contains "scada", XDM_CONST.OS_FAMILY_SCADA, null),
xdm.alert.subcategory = event -> activity.primaryCategory,
xdm.target.file.size = to_integer(event -> activity.stats.size),
xdm.observer.content_version = event -> rver,
xdm.network.rule = event -> incident.reasons[0].name,
xdm.source.asn.isp = event -> remote.host.ip.isp.name,
xdm.source.user_agent = event -> remote.client.agent.description,
xdm.event.id = event -> id,
xdm.target.file.path = event -> resources[0].path,
xdm.target.file.extension = event -> resources[0].extension,
xdm.target.file.file_type = event -> resources[0].kind,
xdm.target.file.filename = event -> resources[0].name,
xdm.target.file.directory = arrayindex(regextract(event -> resources[0].path, "^(.+?)\/[^\/]+$"), 0),
xdm.source.user.first_name = event -> user.firstName,
xdm.source.user.last_name = event -> user.lastName,
xdm.source.user.username = event -> user.name,
xdm.source.user.groups = event -> user.groups[],
xdm.source.user.identifier = event -> user.id,
xdm.alert.severity = event -> incident.severity,
xdm.observer.type = event -> feed.kind,
xdm.observer.name = event -> feed.data.source.kind,
xdm.network.application_protocol = event -> remote.protocol,
xdm.event.description = object_create("user.email",email,"file.owner:",owner,"file.last.modified",last_modified),
xdm.target.url = event -> resources[0].url;