RunZero RunZero Modeling Rule

Details

ID	`RunZero_RunZero_modeling_rule`
From Version	8.15.0
Tags	RunZero

Schema

`runzero_runzero_raw`

Field	Type	Array?
`action`	string	—
`id`	string	—
`source_id`	string	—
`source_name`	string	—
`source_type`	string	—
`success`	string	—
`target_id`	string	—
`target_name`	string	—
`target_type`	string	—

Source

RunZeroModelingRules_2_11.xif RunZeroModelingRules_2_11.yml RunZeroModelingRules_2_11_schema.json

Download History Raw

[MODEL: dataset=runzero_runzero_raw]
alter
	xdm.event.type = action,
    xdm.event.id = id,
    xdm.event.outcome = if(lowercase(to_string(success)) = "false", XDM_CONST.OUTCOME_FAILED, lowercase(to_string(success)) = "true", XDM_CONST.OUTCOME_SUCCESS, success = null, null, to_string(success)),
    xdm.target.resource.type = target_type,
    xdm.target.resource.name = target_name,
    xdm.target.resource.id = target_id,
    xdm.source.user.username = if(source_type="user", source_name, null),
    xdm.source.identity.username = if(source_type="user", source_name, null),
    xdm.source.user.identifier = if(source_type ="user", source_id, null),
    xdm.source.identity.identifier = if(source_type ="user", source_id, null),
    xdm.source.host.hostname = if(source_type = "agent", source_name , null),
    xdm.source.agent.identifier = if(source_type ="agent", source_id, null),
    xdm.source.process.name = if(source_type not in("agent","user"), source_name , null),
    xdm.source.process.identifier = if(source_type not in("agent","user"), source_id  , null);