Rules (XIF)
[MODEL: dataset="qualys_qualys_raw"]
filter
event_type in ("activity_log")
| alter
tmp_source_ipv4 = if(Details ~= "[\"\']?ips[\"\']?[:=][\"\']([^\"]+)[\"\']", arrayindex(regextract(Details, "[\"\']?ips[\"\']?[:=][\"\']((?:\d{1,3}\.){3}\d{1,3})[\"\']"), 0), null),
tmp_source_ipv6 = if(Details ~= "[\"\']?ips[\"\']?[:=][\"\']([^\"]+)[\"\']", arrayindex(regextract(Details, "[\"\']?ips[\"\']?[:=][\"\']((?:[a-fA-F\d]{0,4}\:){2,7}[a-fA-F\d]{0,4})[\"\']"), 0), null),
tmp_target_ipv4 = if(Details ~= "target:\s+(.*)$", arrayindex(regextract(Details, "target:\s+((?:\d{1,3}\.){3}\d{1,3})$"), 0), null),
tmp_target_ipv6 = if(Details ~= "target:\s+(.*)$", arrayindex(regextract(Details, "target:\s+((?:[a-fA-F\d]{0,4}\:){2,7}[a-fA-F\d]{0,4})$"), 0), null),
tmp_for_ipv4 = if(Details ~= "for\s([\d\.a-fA-F:]+)", arrayindex(regextract(Details, "for\s((?:\d{1,3}\.){3}\d{1,3})"), 0), null),
tmp_for_ipv6 = if(Details ~= "for\s([\d\.a-fA-F:]+)", arrayindex(regextract(Details, "for\s((?:[a-fA-F\d]{0,4}\:){2,7}[a-fA-F\d]{0,4})"), 0), null),
User_IP_ipv4 = if(User_IP ~= "(?:\d{1,3}\.){3}\d{1,3}", User_IP, null),
User_IP_ipv6 = if(User_IP ~= "(?:[a-fA-F\d]{0,4}\:){2,7}[a-fA-F\d]{0,4}", User_IP, null),
report_size_units = lowercase(if( Details ~= "Report Size:\s*([^,\)]+)" , arraystring(regextract(Details, "Report Size:\s*[^\s]+\s*([^,\)]+)"), ""), null)),
report_size = to_number(if( Details ~= "Report Size:\s*([^\s,\)]+)" , arraystring(regextract(Details, "Report Size:\s*([^\s,\)]+)"), ""), null)),
report_duration_units = lowercase(if( Details ~= "Report Duration:\s*([^,\)]+)" , arraystring(regextract(Details, "Report Duration:\s*[^\s]+\s*([^,\)]+)"), ""), null)),
report_duration = to_number(if( Details ~= "Report Duration:\s*([^\s,\)]+)" , arraystring(regextract(Details, "Report Duration:\s*([^\s,\)]+)"), ""), null)),
duration_seconds = to_number(if( Details ~= "duration:\s*([^\s,\)]+)" , arraystring(regextract(Details, "duration:\s*\d+:\d+:(\d+)"), ""), null)),
duration_minutes = to_number(if( Details ~= "duration:\s*([^\s,\)]+)" , arraystring(regextract(Details, "duration:\s*\d+:(\d+):\d+"), ""), null)),
duration_hours = to_number(if( Details ~= "duration:\s*([^\s,\)]+)" , arraystring(regextract(Details, "duration:\s*(\d+):\d+:\d+"), ""), null))
| alter
asset_group_id = if( Details ~= "\"assetGroupId\":\"([^\"]+)" , arraystring(regextract(Details, "\"assetGroupId\":\"([^\"]+)"), ""), null),
business_division = if( Details ~= "\"businessDivision\":\"([^\"]+)" , arraystring(regextract(Details, "\"businessDivision\":\"([^\"]+)"), ""), null),
business_impact = if( Details ~= "\"businessImpact\":\"([^\"]+)" , arraystring(regextract(Details, "\"businessImpact\":\"([^\"]+)"), ""), null),
comment = if( Details ~= "comment=\[([^\]]+)" , arraystring(regextract(Details, "comment=\[([^\]]+)"), ""), null),
criticality = if( Details ~= "Criticality:([^\s]+)" , arraystring(regextract(Details, "Criticality:([^\s;]+)"), ""), null),
duration = to_number(add(add(multiply(duration_seconds, 1000), multiply(multiply(duration_minutes, 60), 1000)), multiply(multiply(duration_hours, 3600), 1000))),
entity_name = if( Details ~= "\"entityName\":\"([^\"]+)" , arraystring(regextract(Details, "\"entityName\":\"([^\"]+)"), ""), null),
format = trim(if( Details ~= "FORMAT:([^\s]+)" , arraystring(regextract(Details, "FORMAT:([^\s]+)"), ""), null), ","),
function = if( Details ~= "Function=\[([^\]]+)" , arraystring(regextract(Details, "Function=\[([^\]]+)"), ""), null),
id_report = if( Details ~= "ID:([^\s]+)" , arraystring(regextract(Details, "ID:([^\s]+)"), ""), null),
modules = if( Details ~= "\"modules\":\"([^\"]+)" , arraystring(regextract(Details, "\"modules\":\"([^\"]+)"), ""), null),
name = if( Details ~= "\"name\":\"([^\"]+)" , arraystring(regextract(Details, "\"name\":\"([^\"]+)"), ""), null),
operation = if( Details ~= "\"operation\":\"([^\"]+)", arraystring(regextract(Details, "\"operation\":\"([^\"]+)"), ""), null),
owner = if( Details ~= "owner=([^\s]+)" , arraystring(regextract(Details, "owner=([^\s;]+)"), ""), null),
report_duration = to_number(if(report_duration_units = "seconds", multiply(report_duration, 1000), report_duration_units = "minutes", multiply(multiply(report_duration, 60), 1000), report_duration_units = "hours", multiply(multiply(report_duration, 3600), 1000), null)),
report_size = if(report_size_units = "kb", multiply(report_size, 1000), report_size_units = "mb", multiply(report_size, 1000000), report_size_units = "gb", multiply(report_size, 1000000000), null),
status = if( Details ~= "Status:([^\s]+)" , arraystring(regextract(Details, "Status:([^\s]+)"), ""), null),
req_id = if( Details ~= "\"requestId\":\"([^\"]+)" , arraystring(regextract(Details, "\"requestId\":\"([^\"]+)"), ""), null),
title_capital = if( Details ~= "TITLE:([^\s]+)" , arraystring(regextract(Details, "TITLE:([^\s]+)"), ""), null),
title_equal = if( Details ~= "title=([^\s]+)" , arraystring(regextract(Details, "title=\'([^\']+)\'"), ""), null)
| alter
xdm.observer.action = Action,
xdm.observer.type = modules,
xdm.event.id = coalesce(req_id, id_report),
xdm.event.original_event_type = coalesce(concat(Module, " - ", Action), entity_name),
xdm.event.type = event_type,
xdm.event.description = Details,
xdm.event.operation_sub_type = coalesce(operation, comment),
xdm.event.outcome = status,
xdm.event.outcome_reason = status,
xdm.event.duration = coalesce(report_duration, duration),
xdm.alert.severity = coalesce(business_impact, criticality),
xdm.auth.privilege_level = User_Role,
xdm.source.ipv4 = coalesce(User_IP_ipv4, tmp_source_ipv4),
xdm.source.ipv6 = coalesce(User_IP_ipv6, tmp_source_ipv6),
xdm.source.user.groups = arraycreate(asset_group_id),
xdm.source.host.hostname = name,
xdm.source.agent.identifier = owner,
xdm.source.user.ou = coalesce(business_division, function),
xdm.source.user.username = User_Name,
xdm.target.ipv4 = coalesce(tmp_target_ipv4, tmp_for_ipv4),
xdm.target.ipv6 = coalesce(tmp_target_ipv6, tmp_for_ipv6),
xdm.target.file.size = to_number(report_size),
xdm.target.file.extension = format,
xdm.target.file.filename = coalesce(title_capital, title_equal);
[MODEL: dataset="qualys_assets_raw"]
filter
event_type in ("host_list_detection")
| alter
tmp_severity = json_extract_scalar(DETECTION, "$.SEVERITY"),
tmp_qds_severity = trim(json_extract(DETECTION, "$.QDS['@severity']"), "\""),
tmp_ip_v4 = if(IP ~= "(?:\d{1,3}\.){3}\d{1,3}", IP, null),
tmp_ip_v6 = if(IP ~= "(?:[a-fA-F\d]{0,4}\:){2,7}[a-fA-F\d]{0,4}", IP, null)
| alter
xdm.observer.action = json_extract_scalar(DETECTION, "$.STATUS"),
xdm.observer.unique_identifier = QG_HOSTID,
xdm.observer.type = TRACKING_METHOD,
xdm.event.tags = arraycreate(coalesce(json_extract_scalar(`TAG`, "$.NAME"), json_extract_scalar(CLOUD_PROVIDER_TAGS, "$.NAME"))),
xdm.event.type = event_type,
xdm.alert.description = json_extract_scalar(DETECTION, "$.RESULTS"),
xdm.alert.subcategory = json_extract_scalar(DETECTION, "$.TYPE"),
xdm.alert.severity = if(tmp_qds_severity not in ("", null), tmp_qds_severity, tmp_severity = "1", "Minimal", tmp_severity = "2", "Medium", tmp_severity = "3", "Serious", tmp_severity = "4", "Critical", tmp_severity = "5", "Urgent", tmp_severity),
xdm.alert.original_threat_id = json_extract_scalar(DETECTION, "$.QID"),
xdm.network.session_id = NETWORK_ID,
xdm.network.ip_protocol = json_extract_scalar(DETECTION, "$.PROTOCOL"),
xdm.source.host.hardware_uuid = ID,
xdm.source.agent.identifier = ASSET_ID,
xdm.source.ipv4 = tmp_ip_v4,
xdm.source.ipv6 = coalesce(tmp_ip_v6, IPV6),
xdm.source.host.os = coalesce(OS, OS_CPE),
xdm.source.host.hostname = coalesce(json_extract_scalar(DNS_DATA, "$.HOSTNAME"), json_extract_scalar(DETECTION, "$.INSTANCE")),
xdm.source.host.fqdn = coalesce(json_extract_scalar(DNS_DATA, "$.FQDN"), json_extract_scalar(DETECTION, "$.FQDN")),
xdm.source.cloud.provider = CLOUD_PROVIDER,
xdm.source.cloud.project = coalesce(CLOUD_SERVICE, json_extract_scalar(METADATA, "$.EC2.NAME"), json_extract_scalar(METADATA, "$.GOOGLE.NAME"), json_extract_scalar(METADATA, "$.AZURE.NAME")),
xdm.source.host.device_id = coalesce(EC2_INSTANCE_ID, CLOUD_RESOURCE_ID),
xdm.source.user.netbios_domain = NETBIOS,
xdm.source.port = to_integer(json_extract_scalar(DETECTION, "$.PORT")),
xdm.source.application.name = json_extract_scalar(DETECTION, "$.SERVICE");