Prisma SAAS Security Modeling Rule

Modeling Rule

SaaS Security by Palo Alto Networks

Details

IDPrisma_SAAS_Security_ModelingRule
From Version8.4.0

Rules (XIF)

[MODEL: dataset=paloaltonetworks_saassecurity_raw]
alter
    xdm.event.type = log_type,
    xdm.source.ipv4 = coalesce(ip, source_ip, _reporting_device_ip),
    xdm.event.operation_sub_type = coalesce(event_type, log_type),
    xdm.target.resource.type = item_type,
    xdm.target.resource.name = action,
    xdm.event.operation = coalesce(remoteAddress, target_name),
    xdm.target.resource_before.value = resource_value_old,
    xdm.target.resource.value = resource_value_new,
    xdm.target.resource.id = asset_id,
    xdm.source.user.username = coalesce(user, admin_role),
    xdm.source.application.name = cloud_app_instance,
    xdm.source.location.city = location;

Schema

paloaltonetworks_saassecurity_raw

Field Type Array?
_reporting_device_ip string —
action string —
admin_role string —
asset_id string —
cloud_app_instance string —
event_type string —
ip string —
item_type string —
location string —
log_type string —
remoteAddress string —
resource_value_new string —
resource_value_old string —
source_ip string —
target_name string —
timestamp datetime —
user string —
Raw JSON 
{
    "paloaltonetworks_saassecurity_raw": {
      "log_type": {
        "type": "string",
        "is_array": false
      },
      "timestamp": {
        "type": "datetime",
        "is_array": false
      },
      "admin_role": {
        "type": "string",
        "is_array": false
      },
      "ip": {
        "type": "string",
        "is_array": false
      },
      "event_type": {
        "type": "string",
        "is_array": false
      },
      "item_type": {
        "type": "string",
        "is_array": false
      },
      "action": {
        "type": "string",
        "is_array": false
      },
      "remoteAddress": {
        "type": "string",
        "is_array": false
      },
      "resource_value_old": {
        "type": "string",
        "is_array": false
      },
      "resource_value_new": {
        "type": "string",
        "is_array": false
      },
      "asset_id": {
        "type": "string",
        "is_array": false
      },
      "user": {
        "type": "string",
        "is_array": false
      },
      "source_ip": {
        "type": "string",
        "is_array": false
      },
      "location": {
        "type": "string",
        "is_array": false
      },
      "target_name": {
        "type": "string",
        "is_array": false
      },
      "_reporting_device_ip": {
        "type": "string",
        "is_array": false
      },
      "cloud_app_instance": {
        "type": "string",
        "is_array": false
      }
}
  }