Prisma SAAS Security Modeling Rule

Details

ID	`Prisma_SAAS_Security_ModelingRule`
From Version	8.4.0

Schema

`paloaltonetworks_saassecurity_raw`

Field	Type	Array?
`_reporting_device_ip`	string	—
`action`	string	—
`admin_role`	string	—
`asset_id`	string	—
`cloud_app_instance`	string	—
`event_type`	string	—
`ip`	string	—
`item_type`	string	—
`location`	string	—
`log_type`	string	—
`remoteAddress`	string	—
`resource_value_new`	string	—
`resource_value_old`	string	—
`source_ip`	string	—
`target_name`	string	—
`timestamp`	datetime	—
`user`	string	—

Source

SaasSecurityEventCollector_1_3.xif SaasSecurityEventCollector_1_3.yml SaasSecurityEventCollector_1_3_schema.json

Download History Raw

[MODEL: dataset=paloaltonetworks_saassecurity_raw]
alter
    xdm.event.type = log_type,
    xdm.source.ipv4 = coalesce(ip, source_ip, _reporting_device_ip),
    xdm.event.operation_sub_type = coalesce(event_type, log_type),
    xdm.target.resource.type = item_type,
    xdm.target.resource.name = action,
    xdm.event.operation = coalesce(remoteAddress, target_name),
    xdm.target.resource_before.value = resource_value_old,
    xdm.target.resource.value = resource_value_new,
    xdm.target.resource.id = asset_id,
    xdm.source.user.username = coalesce(user, admin_role),
    xdm.source.application.name = cloud_app_instance,
    xdm.source.location.city = location;