Rules (XIF)
[MODEL: dataset = salesforce_login_raw ]
alter xdm.source.user.identifier = replex(_USER_ID_ ,"\"",""),
xdm.target.module.path = replex(_URI_ ,"\"",""),
xdm.event.duration = to_integer(multiply(to_integer(replex(_RUN_TIME_ ,"\"","")),1000)),
xdm.source.ipv4 = arrayindex(regextract(_SOURCE_IP_ ,"(\d+\.\d+\.\d+\.\d+)"),0),
xdm.source.user.username = replex(_USER_NAME_ ,"\"",""),
xdm.source.user.user_type = if(_USER_TYPE_ in ("Standard","PowerPartner","PowerCustomerSuccess","Guest","CustomerSuccess","CspLitePortal","CsnOnly"),XDM_CONST.USER_TYPE_REGULAR ,_USER_TYPE_ = "SelfService",XDM_CONST.USER_TYPE_SERVICE_ACCOUNT ,to_string(replex(_USER_TYPE_ ,"\"",""))),
xdm.event.type = replex(_EVENT_TYPE_ ,"\"",""),
xdm.source.user_agent = replex(_BROWSER_TYPE_ ,"\"",""),
xdm.network.tls.cipher = replex(_CIPHER_SUITE_ ,"\"",""),
xdm.network.tls.protocol_version = replex(_TLS_PROTOCOL_ ,"\"",""),
xdm.database.response_time = to_integer(replex(_DB_TOTAL_TIME_ ,"\"","")),
xdm.logon.logon_guid = replex(_LOGIN_KEY_ ,"\"",""),
xdm.observer.version = replex(_API_VERSION_ ,"\"",""),
xdm.event.outcome_reason = replex(_LOGIN_STATUS_ ,"\"",""),
xdm.source.host.os = replex(_PLATFORM_TYPE_ ,"\"",""),
xdm.auth.auth_method = replex(_AUTHENTICATION_METHOD_REFERENCE_ ,"\"","");
[MODEL: dataset = salesforce_audit_raw]
alter xdm.event.operation_sub_type = Action,
xdm.event.description = Display,
xdm.source.user.identifier = CreatedById,
xdm.target.resource.id = Id,
xdm.event.type = json_extract_scalar(attributes,"$.type" ),
xdm.source.user.username = CreatedByIssuer,
xdm.target.user.username = DelegateUser;
[MODEL: dataset = salesforce_eventlogfile_raw]
alter method = coalesce(replex(_METHOD_ ,"\"",""),replex(_HTTP_METHOD_,"\"","")),
timefield = to_integer(multiply(to_integer(replex(_TIME_ ,"\"","")),1000)),
run_time = to_integer(multiply(to_integer(replex(_RUN_TIME_ ,"\"","")),1000)),
totoal_ms = if(_TOTAL_MS_ ~= "\d+", to_integer(_TOTAL_MS_),null),
client_ip = if(_CLIENT_IP_ ~= "\d+\.\d+\.\d+\.\d+",replex(_CLIENT_IP_ ,"\"",""),null ),
exec_time = to_integer(replex(_EXEC_TIME_ ,"\"","")),
url = replex(_URL_ ,"\"",""),
next_link = replex(_NEXT_LINK_ ,"\"",""),
execute_ms = to_integer(replex(_EXECUTE_MS_ ,"\"","")),
file_type = replex(_FILE_TYPE_,"\"",""),
media_type = replex(_MEDIA_TYPE_ ,"\"",""),
size_bytes = to_integer(replex(_SIZE_BYTES_, "\"","")),
db_cpu_time = to_integer(replex(_DB_CPU_TIME_,"\"","")),
entry_point = replex(_ENTRY_POINT_,"\"",""),
uri = replex(_URI_ ,"\"",""),
status_code = replex(_STATUS_CODE_,"\"",""),
browser_name = replex(_BROWSER_NAME_,"\"",""),
user_agent = replex(_USER_AGENT_,"\"",""),
callout_time = to_integer(replex(_CALLOUT_TIME_,"\"","")),
flow_load_time = to_integer(replex(_FLOW_LOAD_TIME_,"\"","")),
record_id = replex(_RECORD_ID_,"\"",""),
device_session_id = replex(_DEVICE_SESSION_ID_,"\"",""),
prevpage_app_name = replex(_PREVPAGE_APP_NAME_ ,"\"",""),
app_name = replex(_APP_NAME_ ,"\"",""),
target_ui_element = replex(_TARGET_UI_ELEMENT_,"\"",""),
page_url = replex(_PAGE_URL_ ,"\"",""),
duration_field = to_integer(replex(_DURATION_ ,"\"","")),
entity = replex(_ENTITY_ ,"\"",""),
file_preview_type = replex(_FILE_PREVIEW_TYPE_,"\"",""),
device_id = if( _DEVICE_ID_ = "\"\"",null,replex(_DEVICE_ID_ ,"\"","") ),
user_type = replex(_USER_TYPE_ ,"\"","")
| alter xdm.target.file.path = coalesce(uri ,entry_point ),
xdm.target.url = coalesce(url,next_link ),
xdm.event.duration = coalesce(timefield,duration_field,run_time,totoal_ms,exec_time,execute_ms,db_cpu_time,callout_time,flow_load_time),
xdm.event.operation_sub_type = replex(_ACTION_ ,"\"",""),
xdm.network.http.method = if(method = "GET", XDM_CONST.HTTP_METHOD_GET , method = "POST", XDM_CONST.HTTP_METHOD_POST, method = "PUT", XDM_CONST.HTTP_METHOD_PUT, to_String(method)),
xdm.target.process.executable.filename = replex(_ORIGIN_ ,"\"",""),
xdm.target.process.command_line = replex(_SEARCH_QUERY_ ,"\"",""),
xdm.target.host.os = replex(_OS_NAME_ ,"\"",""),
xdm.target.user.identifier = replex(_USER_ID_ ,"\"",""),
xdm.target.application.name = coalesce(app_name,prevpage_app_name),
xdm.target.resource.name = coalesce(page_url,target_ui_element,entity),
xdm.target.process.executable.extension = if(_QUIDDITY_ = "A", "ACS Batch Apex",_QUIDDITY_ = "B", "Bulk API and Bulk API 2.0",_QUIDDITY_ = "BA", "Start method of a Batch Apex job",_QUIDDITY_ = "C", "Scheduled Apex",_QUIDDITY_ = "CI", "Commerce Integration",_QUIDDITY_ = "DL", " Discoverable Login page",_QUIDDITY_ = "E", "Inbound Email Service",_QUIDDITY_ = "F", "Future",_QUIDDITY_ = "FC", "Function Callback",_QUIDDITY_ = "H", "Apex REST",_QUIDDITY_ = "I", "Invocable Action",_QUIDDITY_ = "K", "Quick Action",_QUIDDITY_ = "L", "Lightning",_QUIDDITY_ = "M", "Remote Action",_QUIDDITY_ = "P", "Bulk Apex jobs running in parallel",_QUIDDITY_ = "PEPC", "Platform Event Publish Callback",_QUIDDITY_ = "PI", "Post install script for a managed package",_QUIDDITY_ = "Q", "Queueable",_QUIDDITY_ = "QTXF", "Transaction Finalizer for Queueable",_QUIDDITY_ = "R", "Synchronous uncategorized (which is where all transactions not specified elsewhere end up)",_QUIDDITY_ = "S", "QueryLocator Batch Apex (Batch Apex jobs run faster when the start method returns a QueryLocator object that doesn't include related records via a subquery. See Batch Apex Best Practices in Using Batch Apex.)",_QUIDDITY_ = "TA", "Tests Async",_QUIDDITY_ = "TD", "Tests Deployment",_QUIDDITY_ = "TS", "Tests Synchronous",_QUIDDITY_ = "V", "Visualforce",_QUIDDITY_ = "W", "SOAP Webservices",_QUIDDITY_ = "X", "Execute Anonymous",to_string(_QUIDDITY_)),
xdm.source.ipv4 = client_ip,
xdm.source.host.device_id = device_id,
xdm.target.file.file_type = coalesce(file_type ,media_type, file_preview_type),
xdm.network.session_id = coalesce(record_id,device_session_id),
xdm.source.user.user_type = if(user_type in ("Standard","PowerPartner","PowerCustomerSuccess","Guest","CustomerSuccess","CspLitePortal","CsnOnly"),XDM_CONST.USER_TYPE_REGULAR,user_type = "SelfService",XDM_CONST.USER_TYPE_SERVICE_ACCOUNT ,to_string(user_type)),
xdm.target.location.country = arrayindex(regextract(_CLIENT_GEO_ ,"\"([^\/]+)\/"),0),
xdm.target.file.size = size_bytes,
xdm.source.user_agent = coalesce(user_agent,browser_name),
xdm.observer.type = replex(_ENTITY_NAME_,"\"",""),
xdm.network.dns.response_code = if(status_code = "100", XDM_CONST.HTTP_RSP_CODE_CONTINUE, status_code = "101", XDM_CONST.HTTP_RSP_CODE_SWITCHING_PROTOCOLS, status_code = "102", XDM_CONST.HTTP_RSP_CODE_PROCESSING, status_code = "103", XDM_CONST.HTTP_RSP_CODE_EARLY_HINTS, status_code = "200", XDM_CONST.HTTP_RSP_CODE_OK, status_code = "201", XDM_CONST.HTTP_RSP_CODE_CREATED, status_code = "202", XDM_CONST.HTTP_RSP_CODE_ACCEPTED, status_code = "203", XDM_CONST.HTTP_RSP_CODE_NON__AUTHORITATIVE_INFORMATION, status_code = "204", XDM_CONST.HTTP_RSP_CODE_NO_CONTENT, status_code = "205", XDM_CONST.HTTP_RSP_CODE_RESET_CONTENT, status_code = "206", XDM_CONST.HTTP_RSP_CODE_PARTIAL_CONTENT, status_code = "207", XDM_CONST.HTTP_RSP_CODE_MULTI__STATUS, status_code = "208", XDM_CONST.HTTP_RSP_CODE_ALREADY_REPORTED, status_code = "226", XDM_CONST.HTTP_RSP_CODE_IM_USED, status_code = "300", XDM_CONST.HTTP_RSP_CODE_MULTIPLE_CHOICES, status_code = "301", XDM_CONST.HTTP_RSP_CODE_MOVED_PERMANENTLY, status_code = "302", XDM_CONST.HTTP_RSP_CODE_FOUND, status_code = "303", XDM_CONST.HTTP_RSP_CODE_SEE_OTHER, status_code = "304", XDM_CONST.HTTP_RSP_CODE_NOT_MODIFIED, status_code = "305", XDM_CONST.HTTP_RSP_CODE_USE_PROXY, status_code = "307", XDM_CONST.HTTP_RSP_CODE_TEMPORARY_REDIRECT, status_code = "308", XDM_CONST.HTTP_RSP_CODE_PERMANENT_REDIRECT, status_code = "400", XDM_CONST.HTTP_RSP_CODE_BAD_REQUEST, status_code = "401", XDM_CONST.HTTP_RSP_CODE_UNAUTHORIZED, status_code = "402", XDM_CONST.HTTP_RSP_CODE_PAYMENT_REQUIRED, status_code = "403", XDM_CONST.HTTP_RSP_CODE_FORBIDDEN, status_code = "404", XDM_CONST.HTTP_RSP_CODE_NOT_FOUND, status_code = "405", XDM_CONST.HTTP_RSP_CODE_METHOD_NOT_ALLOWED, status_code = "406", XDM_CONST.HTTP_RSP_CODE_NOT_ACCEPTABLE, status_code = "407", XDM_CONST.HTTP_RSP_CODE_PROXY_AUTHENTICATION_REQUIRED, status_code = "408", XDM_CONST.HTTP_RSP_CODE_REQUEST_TIMEOUT, status_code = "409", XDM_CONST.HTTP_RSP_CODE_CONFLICT, status_code = "410", XDM_CONST.HTTP_RSP_CODE_GONE, status_code = "411", XDM_CONST.HTTP_RSP_CODE_LENGTH_REQUIRED, status_code = "412", XDM_CONST.HTTP_RSP_CODE_PRECONDITION_FAILED, status_code = "413", XDM_CONST.HTTP_RSP_CODE_CONTENT_TOO_LARGE, status_code = "414", XDM_CONST.HTTP_RSP_CODE_URI_TOO_LONG, status_code = "415", XDM_CONST.HTTP_RSP_CODE_UNSUPPORTED_MEDIA_TYPE, status_code = "416", XDM_CONST.HTTP_RSP_CODE_RANGE_NOT_SATISFIABLE, status_code = "417", XDM_CONST.HTTP_RSP_CODE_EXPECTATION_FAILED, status_code = "421", XDM_CONST.HTTP_RSP_CODE_MISDIRECTED_REQUEST, status_code = "422", XDM_CONST.HTTP_RSP_CODE_UNPROCESSABLE_CONTENT, status_code = "423", XDM_CONST.HTTP_RSP_CODE_LOCKED, status_code = "424", XDM_CONST.HTTP_RSP_CODE_FAILED_DEPENDENCY, status_code = "425", XDM_CONST.HTTP_RSP_CODE_TOO_EARLY, status_code = "426", XDM_CONST.HTTP_RSP_CODE_UPGRADE_REQUIRED, status_code = "428", XDM_CONST.HTTP_RSP_CODE_PRECONDITION_REQUIRED, status_code = "429", XDM_CONST.HTTP_RSP_CODE_TOO_MANY_REQUESTS, status_code = "431", XDM_CONST.HTTP_RSP_CODE_REQUEST_HEADER_FIELDS_TOO_LARGE, status_code = "451", XDM_CONST.HTTP_RSP_CODE_UNAVAILABLE_FOR_LEGAL_REASONS, status_code = "500", XDM_CONST.HTTP_RSP_CODE_INTERNAL_SERVER_ERROR, status_code = "501", XDM_CONST.HTTP_RSP_CODE_NOT_IMPLEMENTED, status_code = "502", XDM_CONST.HTTP_RSP_CODE_BAD_GATEWAY, status_code = "503", XDM_CONST.HTTP_RSP_CODE_SERVICE_UNAVAILABLE, status_code = "504", XDM_CONST.HTTP_RSP_CODE_GATEWAY_TIMEOUT, status_code = "505", XDM_CONST.HTTP_RSP_CODE_HTTP_VERSION_NOT_SUPPORTED, status_code = "506", XDM_CONST.HTTP_RSP_CODE_VARIANT_ALSO_NEGOTIATES, status_code = "507", XDM_CONST.HTTP_RSP_CODE_INSUFFICIENT_STORAGE, status_code = "508", XDM_CONST.HTTP_RSP_CODE_LOOP_DETECTED, status_code = "511", XDM_CONST.HTTP_RSP_CODE_NETWORK_AUTHENTICATION_REQUIRED, status_code = null, null, to_string(status_code)),
xdm.source.sent_bytes = to_integer(replex(_REQUEST_SIZE_,"\"","")),
xdm.target.sent_bytes = to_integer(replex(_RESPONSE_SIZE_,"\"","")),
xdm.database.schema = coalesce(replex(_SEARCH_QUERY_, "\"",""),replex(_SELECT_ ,"\"","")),
xdm.database.response_time = to_integer(replex(_DB_TOTAL_TIME_ ,"\"","")),
xdm.source.host.hostname = replex(_DEVICE_PLATFORM_,"\"",""),
xdm.event.type = replex(_EVENT_TYPE_,"\"","");