Saviynt Enterprise Identity Cloud Modeling Rule

Details

Rules (XIF)

[MODEL: dataset=saviynt_eic_raw]
alter 
        extract_message = if(Message contains "\"message", Message -> message, Message),
        extract_message_objectName = Message -> objectName,
        extract_ipv4 = arrayindex(regextract(IP_Address , "(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"),0),
        extract_ipv6 = arrayindex(regextract(IP_Address, "([a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5})"),0)

| alter
        xdm.event.type = "Audit",
        xdm.event.id = event_hash,
        xdm.event.description = extract_message,
        xdm.event.operation_sub_type = Action_Taken,
        xdm.source.ipv4 = extract_ipv4,
        xdm.source.ipv6 = extract_ipv6,
        xdm.source.user.identifier = Accessed_By,
        xdm.source.user.username = Accessed_By,
        xdm.target.resource.type = Object_Type,
        xdm.target.resource.name = extract_message_objectName;

Schema

saviynt_eic_raw

{
   "saviynt_eic_raw":{
      "event_hash": {
         "type":"string",
         "is_array":false
      },
      "IP_Address": {
         "type":"string",
         "is_array":false
      },
      "Accessed_By": {
         "type":"string",
         "is_array":false
      },
      "Object_Type": {
         "type":"string",
         "is_array":false
      },
      "Action_Taken": {
         "type":"string",
         "is_array":false
      },
      "Message": {
         "type":"string",
         "is_array":false
      }
   }
}