SailPoint IdentityNow Modeling Rule

Details

Rules (XIF)

[MODEL: dataset= "sailpoint_identitynow_raw"]
alter
    get_src_name = actor -> name,
    get_dst_name = `target` -> name,
    get_objects = objects-> []
| alter
    set_src_email = arrayindex(regextract(get_src_name, "\S+\@\S+"),0),
    set_dst_email = arrayindex(regextract(get_dst_name, "\S+\@\S+"),0),
    set_objects = arraymap(get_objects , trim("@element", "\""))
| alter
    xdm.event.original_event_type = action,
    xdm.event.id = id,
    xdm.alert.name = name,
    xdm.event.tags = set_objects,
    xdm.event.operation_sub_type = operation,
    xdm.source.user.ou = org,
    xdm.source.cloud.region = pod,
    xdm.event.outcome = if(status in ("PASSED", "SUCCESS","APPROVED","PROCESSED","UPDATED","CREATED","DELETED","ENABLED","DISABLED","FORWARDED","ESCALATED","DETECTED", "ACCESSED", "CANCELLED"), XDM_CONST.OUTCOME_SUCCESS, status in ("FAILED","BLOCKED", "REJECTED"), XDM_CONST.OUTCOME_FAILED, status in ("STARTED", "REMEDIATE"), XDM_CONST.OUTCOME_UNKNOWN,status),
    xdm.event.is_completed = if(status in ("PASSED", "SUCCESS","APPROVED","PROCESSED","UPDATED","CREATED","DELETED","ENABLED","DISABLED","FORWARDED","ESCALATED","DETECTED", "ACCESSED", "CANCELLED", "FAILED", "BLOCKED", "REJECTED"), True, status in ("STARTED","REMEDIATE"), False),
    xdm.event.type = type,
    xdm.target.resource.name = if(stack = "", null, stack),
    xdm.target.resource.type = "Stack",
    xdm.target.ipv4 = if(is_ipv4(ipAddress), if(incidr(ipAddress, "0.0.0.0/0"), ipAddress, null), null),
    xdm.target.ipv6  = arrayindex(regextract(ipAddress, "(?:[a-fA-F\d]{0,4}\:){7}[\wa-fA-F]{0,4}"), 0),
    xdm.source.user.username = if(
        set_src_email != null, arrayindex(regextract(set_src_email, "(\S+)\@"),0),
        get_src_name !~= "@", get_src_name
    ),
    xdm.source.user.upn = set_src_email,
    xdm.target.user.username = if(
        set_dst_email != null, arrayindex(regextract(set_dst_email, "(\S+)\@"),0), 
        get_dst_name !~= "@", get_dst_name
    ),
    xdm.target.user.upn = set_dst_email,
    xdm.event.description = attributes;

Schema

sailpoint_identitynow_raw

{
    "sailpoint_identitynow_raw": {
        "action": {
            "type": "string",
            "is_array": false
        },
        "created": {
            "type": "datetime",
            "is_array": false
        },
        "id": {
            "type": "string",
            "is_array": false
        },
        "name": {
            "type": "string",
            "is_array": false
        },
        "objects": {
            "type": "string",
            "is_array": false
        },
        "operation": {
            "type": "string",
            "is_array": false
        },
        "org": {
            "type": "string",
            "is_array": false
        },
        "pod": {
            "type": "string",
            "is_array": false
        },
        "stack": {
            "type": "string",
            "is_array": false
        },
        "ipaddress": {
            "type": "string",
            "is_array": false
        },
        "actor": {
            "type": "string",
            "is_array": false
        },
        "target": {
            "type": "string",
            "is_array": false
        },
        "status": {
            "type": "string",
            "is_array": false
        },
        "attributes": {
            "type": "string",
            "is_array": false
        },
        "type": {
            "type": "string",
            "is_array": false
        }
    }
}