Rules (XIF)
[MODEL: dataset=runzero_runzero_raw]
alter
xdm.event.type = action,
xdm.event.id = id,
xdm.event.outcome = if(lowercase(to_string(success)) = "false", XDM_CONST.OUTCOME_FAILED, lowercase(to_string(success)) = "true", XDM_CONST.OUTCOME_SUCCESS, success = null, null, to_string(success)),
xdm.target.resource.type = target_type,
xdm.target.resource.name = target_name,
xdm.target.resource.id = target_id,
xdm.source.user.username = if(source_type="user", source_name, null),
xdm.source.user.identifier = if(source_type ="user", source_id, null),
xdm.source.host.hostname = if(source_type = "agent", source_name , null),
xdm.source.agent.identifier = if(source_type ="agent", source_id, null),
xdm.source.process.name = if(source_type not in("agent","user"), source_name , null),
xdm.source.process.identifier = if(source_type not in("agent","user"), source_id , null);
Schema
runzero_runzero_raw
| Field |
Type |
Array? |
action |
string |
— |
id |
string |
— |
source_id |
string |
— |
source_name |
string |
— |
source_type |
string |
— |
success |
string |
— |
target_id |
string |
— |
target_name |
string |
— |
target_type |
string |
— |
Raw JSON
{
"runzero_runzero_raw": {
"action": {
"type": "string",
"is_array": false
},
"id": {
"type": "string",
"is_array": false
},
"success": {
"type": "string",
"is_array": false
},
"target_type": {
"type": "string",
"is_array": false
},
"target_name": {
"type": "string",
"is_array": false
},
"target_id": {
"type": "string",
"is_array": false
},
"source_name": {
"type": "string",
"is_array": false
},
"source_id": {
"type": "string",
"is_array": false
},
"source_type": {
"type": "string",
"is_array": false
}
}
}