Rules (XIF)
[MODEL: dataset = proofpoint_isolation_raw]
alter web_category = uppercase(categories)
| alter
xdm.source.user.identifier = userId,
xdm.source.user.username = userName,
xdm.target.url = url,
xdm.network.http.url = url,
xdm.source.location.region = if(region != null and zone != null,concat(region,"-",zone),region),
xdm.observer.action = disposition,
xdm.event.outcome_reason = disposition,
xdm.network.http.url_category = if(web_category ~= "ABORTION", XDM_CONST.URL_CATEGORY_ABORTION, web_category ~= "DRUGS", XDM_CONST.URL_CATEGORY_ABUSED_DRUGS, web_category ~= "ADULT", XDM_CONST.URL_CATEGORY_ADULT, web_category ~= "ALCOHOL|TOBACCO", XDM_CONST.URL_CATEGORY_ALCOHOL_AND_TOBACCO, web_category ~= "AUCTIONS", XDM_CONST.URL_CATEGORY_AUCTIONS, web_category ~= "BUSINESS|ECONOMY", XDM_CONST.URL_CATEGORY_BUSINESS_AND_ECONOMY, web_category ~= "COMMAND|CONTROL", XDM_CONST.URL_CATEGORY_COMMAND_AND_CONTROL, web_category ~= "COMPUTER|INTERNET INFO", XDM_CONST.URL_CATEGORY_COMPUTER_AND_INTERNET_INFO, web_category ~= "CONTENT DELIVERY NETWORKS|CDN", XDM_CONST.URL_CATEGORY_CONTENT_DELIVERY_NETWORKS, web_category ~= "COPYRIGHT|INFRINGEMENT", XDM_CONST.URL_CATEGORY_COPYRIGHT_INFRINGEMENT, web_category ~= "CRYPTO", XDM_CONST.URL_CATEGORY_CRYPTOCURRENCY, web_category ~= "DATING", XDM_CONST.URL_CATEGORY_DATING, web_category ~= "DNS", XDM_CONST.URL_CATEGORY_DYNAMIC_DNS, web_category ~= "EDUCATIONAL|INSTITUTIONS", XDM_CONST.URL_CATEGORY_EDUCATIONAL_INSTITUTIONS, web_category ~= "ENTERTAINMENT|ARTS", XDM_CONST.URL_CATEGORY_ENTERTAINMENT_AND_ARTS, web_category ~= "EXTREMISM", XDM_CONST.URL_CATEGORY_EXTREMISM, web_category ~= "FINANCIAL|FINANCE", XDM_CONST.URL_CATEGORY_FINANCIAL_SERVICES, web_category ~= "GAMBLING", XDM_CONST.URL_CATEGORY_GAMBLING, web_category ~= "GAMES", XDM_CONST.URL_CATEGORY_GAMES, web_category ~= "GOVERNMENT", XDM_CONST.URL_CATEGORY_GOVERNMENT, web_category ~= "GRAYWARE", XDM_CONST.URL_CATEGORY_GRAYWARE, web_category ~= "HACKING", XDM_CONST.URL_CATEGORY_HACKING, web_category ~= "HEALTH|MEDICINE", XDM_CONST.URL_CATEGORY_HEALTH_AND_MEDICINE, web_category ~= "HOME|GARDEN", XDM_CONST.URL_CATEGORY_HOME_AND_GARDEN, web_category ~= "HUNTING|FISHING", XDM_CONST.URL_CATEGORY_HUNTING_AND_FISHING, web_category ~= "INSUFFICIENT CONTENT", XDM_CONST.URL_CATEGORY_INSUFFICIENT_CONTENT, web_category ~= "INTERNET COMMUNICATIONS|TELEPHONY", XDM_CONST.URL_CATEGORY_INTERNET_COMMUNICATIONS_AND_TELEPHONY, web_category ~= "PORTAL", XDM_CONST.URL_CATEGORY_INTERNET_PORTALS, web_category ~= "JOB", XDM_CONST.URL_CATEGORY_JOB_SEARCH, web_category ~= "LEGAL", XDM_CONST.URL_CATEGORY_LEGAL, web_category ~= "MALWARE", XDM_CONST.URL_CATEGORY_MALWARE, web_category ~= "MILITARY", XDM_CONST.URL_CATEGORY_MILITARY, web_category ~= "MOTOR|VEHICLES", XDM_CONST.URL_CATEGORY_MOTOR_VEHICLES, web_category ~= "MUSIC", XDM_CONST.URL_CATEGORY_MUSIC, web_category ~= "REGISTERED DOMAIN", XDM_CONST.URL_CATEGORY_NEWLY_REGISTERED_DOMAIN, web_category ~= "NEWS", XDM_CONST.URL_CATEGORY_NEWS, web_category ~= "NOT RESOLVED", XDM_CONST.URL_CATEGORY_NOT_RESOLVED, web_category ~= "NUDITY", XDM_CONST.URL_CATEGORY_NUDITY, web_category ~= "STORAGE|BACKUP", XDM_CONST.URL_CATEGORY_ONLINE_STORAGE_AND_BACKUP, web_category ~= "PARKED", XDM_CONST.URL_CATEGORY_PARKED, web_category ~= "PEER", XDM_CONST.URL_CATEGORY_PEER_TO_PEER, web_category ~= "PERSONAL SITE|BLOGS", XDM_CONST.URL_CATEGORY_PERSONAL_SITES_AND_BLOGS, web_category ~= "PHILOSOPHY|POLITICAL|ADVOCACY", XDM_CONST.URL_CATEGORY_PHILOSOPHY_AND_POLITICAL_ADVOCACY, web_category ~= "PHISHING", XDM_CONST.URL_CATEGORY_PHISHING, web_category ~= "PRIVATE IP", XDM_CONST.URL_CATEGORY_PRIVATE_IP_ADDRESSES, web_category ~= "PROXY AVOIDANCE|ANONYMIZERS", XDM_CONST.URL_CATEGORY_PROXY_AVOIDANCE_AND_ANONYMIZERS, web_category ~= "QUESTIONABLE", XDM_CONST.URL_CATEGORY_QUESTIONABLE, web_category ~= "REAL ESTATE", XDM_CONST.URL_CATEGORY_REAL_ESTATE, web_category ~= "RECREATION|HOBBIES", XDM_CONST.URL_CATEGORY_RECREATION_AND_HOBBIES, web_category ~= "REFERENCE|RESEARCH", XDM_CONST.URL_CATEGORY_REFERENCE_AND_RESEARCH, web_category ~= "RELIGION", XDM_CONST.URL_CATEGORY_RELIGION, web_category ~= "SEARCH ENGINE", XDM_CONST.URL_CATEGORY_SEARCH_ENGINES, web_category ~= "SEX EDUCATION", XDM_CONST.URL_CATEGORY_SEX_EDUCATION, web_category ~= "SHAREWARE|FREEWARE", XDM_CONST.URL_CATEGORY_SHAREWARE_AND_FREEWARE, web_category ~= "SHOPPING", XDM_CONST.URL_CATEGORY_SHOPPING, web_category ~= "SOCIAL NETWORK", XDM_CONST.URL_CATEGORY_SOCIAL_NETWORKING, web_category ~= "SOCIETY", XDM_CONST.URL_CATEGORY_SOCIETY, web_category ~= "SPORTS", XDM_CONST.URL_CATEGORY_SPORTS, web_category ~= "STOCK", XDM_CONST.URL_CATEGORY_STOCK_ADVICE_AND_TOOLS, web_category ~= "STREAM|MEDIA", XDM_CONST.URL_CATEGORY_STREAMING_MEDIA, web_category ~= "SWIMSUITS|APPAREL", XDM_CONST.URL_CATEGORY_SWIMSUITS_AND_INTIMATE_APPAREL, web_category ~= "TRAINING", XDM_CONST.URL_CATEGORY_TRAINING_AND_TOOLS, web_category ~= "TRANSLATION", XDM_CONST.URL_CATEGORY_TRANSLATION, web_category ~= "TRAVEL", XDM_CONST.URL_CATEGORY_TRAVEL, web_category ~= "UNKNOWN", XDM_CONST.URL_CATEGORY_UNKNOWN, web_category ~= "WEAPONS", XDM_CONST.URL_CATEGORY_WEAPONS, web_category ~= "ADVERTISEMENTS", XDM_CONST.URL_CATEGORY_WEB_ADVERTISEMENTS, web_category ~= "WEB HOSTING", XDM_CONST.URL_CATEGORY_WEB_HOSTING, web_category ~= "EMAIL", XDM_CONST.URL_CATEGORY_WEB_BASED_EMAIL),
xdm.target.file.filename = fileName,
xdm.event.description = if(parentPageURL != null or isiFrame != null,object_create("parentPageURL",parentPageURL,"isiFrame",isiFrame),null),
xdm.target.file.size = to_integer(fileSize),
xdm.network.http.referrer = parentPageURL,
xdm.target.file.file_type = fileMimeType,
xdm.network.http.content_type = fileMimeType,
xdm.alert.subcategory = classification;