ProofpointTAP Modeling Rule

Details

Rules (XIF)

[MODEL: dataset=proofpoint_tap_raw]
alter
        fromAddress_string = if(fromAddress contains "[", arraystring(arraymap(fromAddress -> [], trim("@element", "\"")), ", "), fromAddress),
        threatID_string =  arraystring(arraymap(threatsinfomap -> [],  "@element"-> threatID), ", ")
| alter
    xdm.event.type = concat(_vendor," - ",_log_type),
    xdm.alert.description = coalesce(threatsInfoMap, threatURL),
    xdm.alert.original_threat_id = coalesce(threatID, threatID_string),
    xdm.alert.subcategory = coalesce(arraystring(arraymap (json_extract_array (threatsInfoMap,"$."), json_extract_scalar ("@element", "$.threatType")), ", "), classification, json_extract_scalar(threatsinfomap, "$['0'].classification")),
    xdm.alert.original_alert_id = GUID,
    xdm.alert.original_threat_name = coalesce(classification, json_extract_scalar(threatsinfomap, "$['0'].classification")),
    xdm.event.id = GUID,
    xdm.email.cc = arraymap(json_extract_array(ccAddresses, "$."), trim("@element", "\"")),
    xdm.email.sender = coalesce(fromAddress_string, sender),
    xdm.email.message_id = messageID,
    xdm.email.attachment.filename = arraystring(arraymap (json_extract_array (messageParts,"$."), json_extract_scalar ("@element", "$.filename")), ","),
    xdm.email.attachment.md5 = arraystring(arraymap (json_extract_array (messageParts,"$."), json_extract_scalar ("@element", "$.md5")), ","),
    xdm.email.attachment.sha256 = arraystring(arraymap (json_extract_array (messageParts,"$."), json_extract_scalar ("@element", "$.sha256")), ","),
    xdm.email.recipients = if(recipient contains "[", arraymap(recipient -> [], trim("@element", "\"")), arraycreate(recipient)),
    xdm.email.return_path = sender,
    xdm.email.subject = subject,
    xdm.intermediate.host.ipv4_addresses = arraycreate(senderIP),
    xdm.source.host.ipv4_addresses = arraycreate(clickIP),
    xdm.source.user_agent = userAgent,
    xdm.target.url = url,
    // Parse message messageTime
    xdm.email.delivery_timestamp = messageTime;

Schema

proofpoint_tap_raw

{
    "proofpoint_tap_raw": {
        "ccAddresses": {
            "type": "string",
            "is_array": false
        },
        "fromAddress": {
            "type": "string",
            "is_array": false
        },
        "GUID": {
            "type": "string",
            "is_array": false
        },
        "messageID": {
            "type": "string",
            "is_array": false
        },
        "messageParts": {
            "type": "string",
            "is_array": false
        },
        "messageTime": {
            "type": "datetime",
            "is_array": false
        },
        "recipient": {
            "type": "string",
            "is_array": false
        },
        "sender": {
            "type": "string",
            "is_array": false
        },
        "senderIP": {
            "type": "string",
            "is_array": false
        },
        "subject": {
            "type": "string",
            "is_array": false
        },
        "threatsInfoMap": {
            "type": "string",
            "is_array": false
        },
        "clickIP": {
            "type": "string",
            "is_array": false
        },
        "clickTime": {
            "type": "datetime",
            "is_array": false
        },
        "url": {
            "type": "string",
            "is_array": false
        },
        "userAgent": {
            "type": "string",
            "is_array": false
        },
        "threatURL": {
            "type": "string",
            "is_array": false
        },
        "threatID": {
            "type": "string",
            "is_array": false
        },
        "classification": {
            "type": "string",
            "is_array": false
        },
        "_vendor": {
            "type": "string",
            "is_array": false
        },
        "_log_type": {
            "type": "string",
            "is_array": false
        }
    }
}