[MODEL: dataset= "sailpoint_identitynow_raw"]
alter
get_src_name = actor -> name,
get_dst_name = `target` -> name,
get_objects = objects-> []
| alter
set_src_email = arrayindex(regextract(get_src_name, "\S+\@\S+"),0),
set_dst_email = arrayindex(regextract(get_dst_name, "\S+\@\S+"),0),
set_objects = arraymap(get_objects , trim("@element", "\""))
| alter
xdm.event.original_event_type = action,
xdm.event.id = id,
xdm.alert.name = name,
xdm.event.tags = set_objects,
xdm.event.operation_sub_type = operation,
xdm.source.user.ou = org,
xdm.source.cloud.region = pod,
xdm.event.outcome = if(status in ("PASSED", "SUCCESS","APPROVED","PROCESSED","UPDATED","CREATED","DELETED","ENABLED","DISABLED","FORWARDED","ESCALATED","DETECTED", "ACCESSED", "CANCELLED"), XDM_CONST.OUTCOME_SUCCESS, status in ("FAILED","BLOCKED", "REJECTED"), XDM_CONST.OUTCOME_FAILED, status in ("STARTED", "REMEDIATE"), XDM_CONST.OUTCOME_UNKNOWN,status),
xdm.event.is_completed = if(status in ("PASSED", "SUCCESS","APPROVED","PROCESSED","UPDATED","CREATED","DELETED","ENABLED","DISABLED","FORWARDED","ESCALATED","DETECTED", "ACCESSED", "CANCELLED", "FAILED", "BLOCKED", "REJECTED"), True, status in ("STARTED","REMEDIATE"), False),
xdm.event.type = type,
xdm.target.resource.name = if(stack = "", null, stack),
xdm.target.resource.type = "Stack",
xdm.target.ipv4 = if(is_ipv4(ipAddress), if(incidr(ipAddress, "0.0.0.0/0"), ipAddress, null), null),
xdm.target.ipv6 = arrayindex(regextract(ipAddress, "(?:[a-fA-F\d]{0,4}\:){7}[\wa-fA-F]{0,4}"), 0),
xdm.source.user.username = if(
set_src_email != null, arrayindex(regextract(set_src_email, "(\S+)\@"),0),
get_src_name !~= "@", get_src_name
),
xdm.source.user.upn = set_src_email,
xdm.target.user.username = if(
set_dst_email != null, arrayindex(regextract(set_dst_email, "(\S+)\@"),0),
get_dst_name !~= "@", get_dst_name
),
xdm.target.user.upn = set_dst_email,
xdm.event.description = attributes;