Rules (XIF)
[MODEL: dataset=symantec_bluecoatproxysg_raw]
/* docs:
- log formats: https://techdocs.broadcom.com/us/en/symantec-security-software/web-and-network-security/edge-swg/7-4/getting-started/page-help-administration/page-help-logging/log-formats.html#concept26560_Custom
- default formats: https://techdocs.broadcom.com/us/en/symantec-security-software/web-and-network-security/edge-swg/7-4/getting-started/page-help-administration/page-help-logging/log-formats/default-formats.html
- field list: date time time-taken c-ip sc-status s-action sc-bytes cs-bytes cs-method cs-uri-scheme cs-host cs-uri-port cs-uri-path cs-uri-query cs-username cs-auth-group s-supplier-name rs(Content-Type) cs(Referer) cs(User-Agent) sc-filter-result cs-categories x-virus-id s-ip r-ip
*/
// filter out records which contain only metadata
filter raw_log_cleaned !~= "^#.*"
| alter // Extract fields based on their relative location in the list
time_taken = parsed_fields -> time_taken, // Time taken (in milliseconds) to process the request
c_ip = parsed_fields -> c_ip, // IP address of the client
sc_status = parsed_fields -> sc_status, // Protocol status code from appliance to client
s_action = parsed_fields -> s_action, // Type of action the Edge SWG (ProxySG) took to process this request (see https://techdocs.broadcom.com/us/en/symantec-security-software/web-and-network-security/edge-swg/7-4/getting-started/page-help-administration/page-help-logging/log-formats.html#concept26560_ActionF)
sc_bytes = parsed_fields -> sc_bytes, // Number of bytes sent from appliance to client
cs_bytes = parsed_fields -> cs_bytes, // Number of bytes sent from client to appliance
cs_method = parsed_fields -> cs_method, // Request method that is used from client to appliance
cs_uri_scheme = parsed_fields -> cs_uri_scheme, // Scheme from the log URL.
cs_host = parsed_fields -> cs_host, // Hostname from the log URL
cs_uri_port = parsed_fields -> cs_uri_port, // Port from the log URL.
cs_uri_path = parsed_fields -> cs_uri_path, // Path from the log URL. Does not include the query.
cs_uri_query = parsed_fields -> cs_uri_query, // Query from the log URL
cs_username = parsed_fields -> cs_username, // username of a client authenticated to the proxy
cs_auth_group = parsed_fields -> cs_auth_group, // group to which an authenticated user belongs
s_supplier_name = parsed_fields -> s_supplier_name, // Hostname of the upstream host
rs_content_type = parsed_fields -> rs_content_type, // Response header: Content-Type
cs_referer = parsed_fields -> cs_referer, // Request header: Referer
cs_user_agent = parsed_fields -> cs_user_agent, // Request header: User-Agent
sc_filter_result = parsed_fields -> sc_filter_result, // Content filtering result: Denied, Proxied, or Observed
cs_categories = parsed_fields -> cs_categories, // Content filtering category of the request URL
x_virus_id = parsed_fields -> x_virus_id, // Identifier of a virus if one was detected.
s_ip = parsed_fields -> s_ip, // IP address of the appliance on which the client established its connection
r_ip = parsed_fields -> r_ip, // IP address of the destination
event_description = arrayindex(regextract(raw_log_cleaned ,"\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2}\s\S+\s(.*)"),0) // The raw log without headers
| alter // post extraction processing
// check IP addresses formats
c_ip_v4 = if(c_ip ~= "(?:\d{1,3}\.){3}\d{1,3}", c_ip),
c_ip_v6 = if(c_ip ~= "(?:[a-fA-F\d]{0,4}\:){7}[\wa-fA-F]{0,4}", c_ip),
s_ip_v4 = if(s_ip ~= "(?:\d{1,3}\.){3}\d{1,3}", s_ip),
s_ip_v6 = if(s_ip ~= "(?:[a-fA-F\d]{0,4}\:){7}[\wa-fA-F]{0,4}", s_ip),
r_ip_v4 = if(r_ip ~= "(?:\d{1,3}\.){3}\d{1,3}", r_ip),
r_ip_v6 = if(r_ip ~= "(?:[a-fA-F\d]{0,4}\:){7}[\wa-fA-F]{0,4}", r_ip),
// decode url-encoded spaces (%20) back to an ascii space
cs_username_decoded = replex(cs_username, "\%20", " "),
rs_content_type_decoded = replex(rs_content_type, "\%20", " "),
// assure uppercase values for enum mapping
cs_http_method = uppercase(cs_method),
cs_protocol = uppercase(cs_uri_scheme),
// compose the full URL
cs_url = concat(cs_uri_scheme, "://", cs_host, ":", cs_uri_port, cs_uri_path, cs_uri_query)
| alter // XDM mappings
xdm.alert.original_threat_id = x_virus_id,
xdm.event.duration = to_integer(time_taken),
xdm.event.outcome = if(sc_filter_result = "DENIED", XDM_CONST.OUTCOME_FAILED, sc_filter_result = "OBSERVED", XDM_CONST.OUTCOME_SUCCESS, sc_filter_result = "PROXIED", XDM_CONST.OUTCOME_PARTIAL, sc_filter_result),
xdm.event.outcome_reason = s_action,
xdm.network.http.content_type = rs_content_type_decoded,
xdm.network.http.domain = cs_host,
xdm.network.http.method = if(cs_http_method = "GET", XDM_CONST.HTTP_METHOD_GET, cs_http_method = "POST", XDM_CONST.HTTP_METHOD_POST, cs_http_method = "PUT", XDM_CONST.HTTP_METHOD_PUT, cs_http_method = "OPTIONS", XDM_CONST.HTTP_METHOD_OPTIONS, cs_http_method = "CONNECT", XDM_CONST.HTTP_METHOD_CONNECT, cs_http_method = "ACL", XDM_CONST.HTTP_METHOD_ACL, cs_http_method = "BASELINE_CONTROL", XDM_CONST.HTTP_METHOD_BASELINE_CONTROL, cs_http_method = "BIND", XDM_CONST.HTTP_METHOD_BIND, cs_http_method = "CHECKIN", XDM_CONST.HTTP_METHOD_CHECKIN, cs_http_method = "CHECKOUT", XDM_CONST.HTTP_METHOD_CHECKOUT, cs_http_method = "COPY", XDM_CONST.HTTP_METHOD_COPY, cs_http_method = "DELETE", XDM_CONST.HTTP_METHOD_DELETE, cs_http_method = "HEAD", XDM_CONST.HTTP_METHOD_HEAD, cs_http_method = "LABEL", XDM_CONST.HTTP_METHOD_LABEL, cs_http_method = "LINK", XDM_CONST.HTTP_METHOD_LINK, cs_http_method = "LOCK", XDM_CONST.HTTP_METHOD_LOCK, cs_http_method = "MERGE", XDM_CONST.HTTP_METHOD_MERGE, cs_http_method = "MKACTIVITY", XDM_CONST.HTTP_METHOD_MKACTIVITY, cs_http_method = "MKCALENDAR", XDM_CONST.HTTP_METHOD_MKCALENDAR, cs_http_method = "MKCOL", XDM_CONST.HTTP_METHOD_MKCOL, cs_http_method = "MKREDIRECTREF", XDM_CONST.HTTP_METHOD_MKREDIRECTREF, cs_http_method = "MKWORKSPACE", XDM_CONST.HTTP_METHOD_MKWORKSPACE, cs_http_method = "MOVE", XDM_CONST.HTTP_METHOD_MOVE, cs_http_method = "ORDERPATCH", XDM_CONST.HTTP_METHOD_ORDERPATCH, cs_http_method = "PATCH", XDM_CONST.HTTP_METHOD_PATCH, cs_http_method = "PRI", XDM_CONST.HTTP_METHOD_PRI, cs_http_method = "PROPFIND", XDM_CONST.HTTP_METHOD_PROPFIND, cs_http_method = "PROPPATCH", XDM_CONST.HTTP_METHOD_PROPPATCH, cs_http_method = "REBIND", XDM_CONST.HTTP_METHOD_REBIND, cs_http_method = "REPORT", XDM_CONST.HTTP_METHOD_REPORT, cs_http_method = "SEARCH", XDM_CONST.HTTP_METHOD_SEARCH, cs_http_method = "TRACE", XDM_CONST.HTTP_METHOD_TRACE, cs_http_method = "UNBIND", XDM_CONST.HTTP_METHOD_UNBIND, cs_http_method = "UNCHECKOUT", XDM_CONST.HTTP_METHOD_UNCHECKOUT, cs_http_method = "UNLINK", XDM_CONST.HTTP_METHOD_UNLINK, cs_http_method = "UNLOCK", XDM_CONST.HTTP_METHOD_UNLOCK, cs_http_method = "UPDATE", XDM_CONST.HTTP_METHOD_UPDATE, cs_http_method = "UPDATEREDIRECTREF", XDM_CONST.HTTP_METHOD_UPDATEREDIRECTREF, cs_http_method = "VERSION_CONTROL", XDM_CONST.HTTP_METHOD_VERSION_CONTROL, cs_http_method),
xdm.network.http.referrer = cs_referer,
xdm.network.http.response_code = if(sc_status = "100", XDM_CONST.HTTP_RSP_CODE_CONTINUE, sc_status = "101", XDM_CONST.HTTP_RSP_CODE_SWITCHING_PROTOCOLS, sc_status = "102", XDM_CONST.HTTP_RSP_CODE_PROCESSING, sc_status = "103", XDM_CONST.HTTP_RSP_CODE_EARLY_HINTS, sc_status = "200", XDM_CONST.HTTP_RSP_CODE_OK, sc_status = "201", XDM_CONST.HTTP_RSP_CODE_CREATED, sc_status = "202", XDM_CONST.HTTP_RSP_CODE_ACCEPTED, sc_status = "203", XDM_CONST.HTTP_RSP_CODE_NON__AUTHORITATIVE_INFORMATION, sc_status = "204", XDM_CONST.HTTP_RSP_CODE_NO_CONTENT, sc_status = "205", XDM_CONST.HTTP_RSP_CODE_RESET_CONTENT, sc_status = "206", XDM_CONST.HTTP_RSP_CODE_PARTIAL_CONTENT, sc_status = "207", XDM_CONST.HTTP_RSP_CODE_MULTI__STATUS, sc_status = "208", XDM_CONST.HTTP_RSP_CODE_ALREADY_REPORTED, sc_status = "226", XDM_CONST.HTTP_RSP_CODE_IM_USED, sc_status = "300", XDM_CONST.HTTP_RSP_CODE_MULTIPLE_CHOICES, sc_status = "301", XDM_CONST.HTTP_RSP_CODE_MOVED_PERMANENTLY, sc_status = "302", XDM_CONST.HTTP_RSP_CODE_FOUND, sc_status = "303", XDM_CONST.HTTP_RSP_CODE_SEE_OTHER, sc_status = "304", XDM_CONST.HTTP_RSP_CODE_NOT_MODIFIED, sc_status = "305", XDM_CONST.HTTP_RSP_CODE_USE_PROXY, sc_status = "307", XDM_CONST.HTTP_RSP_CODE_TEMPORARY_REDIRECT, sc_status = "308", XDM_CONST.HTTP_RSP_CODE_PERMANENT_REDIRECT, sc_status = "400", XDM_CONST.HTTP_RSP_CODE_BAD_REQUEST, sc_status = "401", XDM_CONST.HTTP_RSP_CODE_UNAUTHORIZED, sc_status = "402", XDM_CONST.HTTP_RSP_CODE_PAYMENT_REQUIRED, sc_status = "403", XDM_CONST.HTTP_RSP_CODE_FORBIDDEN, sc_status = "404", XDM_CONST.HTTP_RSP_CODE_NOT_FOUND, sc_status = "405", XDM_CONST.HTTP_RSP_CODE_METHOD_NOT_ALLOWED, sc_status = "406", XDM_CONST.HTTP_RSP_CODE_NOT_ACCEPTABLE, sc_status = "407", XDM_CONST.HTTP_RSP_CODE_PROXY_AUTHENTICATION_REQUIRED, sc_status = "408", XDM_CONST.HTTP_RSP_CODE_REQUEST_TIMEOUT, sc_status = "409", XDM_CONST.HTTP_RSP_CODE_CONFLICT, sc_status = "410", XDM_CONST.HTTP_RSP_CODE_GONE, sc_status = "411", XDM_CONST.HTTP_RSP_CODE_LENGTH_REQUIRED, sc_status = "412", XDM_CONST.HTTP_RSP_CODE_PRECONDITION_FAILED, sc_status = "413", XDM_CONST.HTTP_RSP_CODE_CONTENT_TOO_LARGE, sc_status = "414", XDM_CONST.HTTP_RSP_CODE_URI_TOO_LONG, sc_status = "415", XDM_CONST.HTTP_RSP_CODE_UNSUPPORTED_MEDIA_TYPE, sc_status = "416", XDM_CONST.HTTP_RSP_CODE_RANGE_NOT_SATISFIABLE, sc_status = "417", XDM_CONST.HTTP_RSP_CODE_EXPECTATION_FAILED, sc_status = "421", XDM_CONST.HTTP_RSP_CODE_MISDIRECTED_REQUEST, sc_status = "422", XDM_CONST.HTTP_RSP_CODE_UNPROCESSABLE_CONTENT, sc_status = "423", XDM_CONST.HTTP_RSP_CODE_LOCKED, sc_status = "424", XDM_CONST.HTTP_RSP_CODE_FAILED_DEPENDENCY, sc_status = "425", XDM_CONST.HTTP_RSP_CODE_TOO_EARLY, sc_status = "426", XDM_CONST.HTTP_RSP_CODE_UPGRADE_REQUIRED, sc_status = "428", XDM_CONST.HTTP_RSP_CODE_PRECONDITION_REQUIRED, sc_status = "429", XDM_CONST.HTTP_RSP_CODE_TOO_MANY_REQUESTS, sc_status = "431", XDM_CONST.HTTP_RSP_CODE_REQUEST_HEADER_FIELDS_TOO_LARGE, sc_status = "451", XDM_CONST.HTTP_RSP_CODE_UNAVAILABLE_FOR_LEGAL_REASONS, sc_status = "500", XDM_CONST.HTTP_RSP_CODE_INTERNAL_SERVER_ERROR, sc_status = "501", XDM_CONST.HTTP_RSP_CODE_NOT_IMPLEMENTED, sc_status = "502", XDM_CONST.HTTP_RSP_CODE_BAD_GATEWAY, sc_status = "503", XDM_CONST.HTTP_RSP_CODE_SERVICE_UNAVAILABLE, sc_status = "504", XDM_CONST.HTTP_RSP_CODE_GATEWAY_TIMEOUT, sc_status = "505", XDM_CONST.HTTP_RSP_CODE_HTTP_VERSION_NOT_SUPPORTED, sc_status = "506", XDM_CONST.HTTP_RSP_CODE_VARIANT_ALSO_NEGOTIATES, sc_status = "507", XDM_CONST.HTTP_RSP_CODE_INSUFFICIENT_STORAGE, sc_status = "508", XDM_CONST.HTTP_RSP_CODE_LOOP_DETECTED, sc_status = "511", XDM_CONST.HTTP_RSP_CODE_NETWORK_AUTHENTICATION_REQUIRED, sc_status = null, null, sc_status),
xdm.network.http.url = cs_url,
xdm.network.http.url_category = cs_categories,
xdm.network.ip_protocol = if(cs_protocol="TCP", XDM_CONST.IP_PROTOCOL_TCP, cs_protocol="UDP", XDM_CONST.IP_PROTOCOL_UDP, cs_protocol="ICMP",XDM_CONST.IP_PROTOCOL_ICMP, cs_protocol="HOPOPT",XDM_CONST.IP_PROTOCOL_HOPOPT, cs_protocol="IGMP",XDM_CONST.IP_PROTOCOL_IGMP, cs_protocol="GGP",XDM_CONST.IP_PROTOCOL_GGP, cs_protocol="IP",XDM_CONST.IP_PROTOCOL_IP, cs_protocol="ST",XDM_CONST.IP_PROTOCOL_ST, cs_protocol="CBT",XDM_CONST.IP_PROTOCOL_CBT, cs_protocol="EGP",XDM_CONST.IP_PROTOCOL_EGP, cs_protocol="IGP",XDM_CONST.IP_PROTOCOL_IGP, cs_protocol="BBN_RCC_MON",XDM_CONST.IP_PROTOCOL_BBN_RCC_MON, cs_protocol="NVP_II",XDM_CONST.IP_PROTOCOL_NVP_II, cs_protocol="PUP",XDM_CONST.IP_PROTOCOL_PUP, cs_protocol="ARGUS",XDM_CONST.IP_PROTOCOL_ARGUS, cs_protocol="EMCON",XDM_CONST.IP_PROTOCOL_EMCON, cs_protocol="XNET",XDM_CONST.IP_PROTOCOL_XNET, cs_protocol="CHAOS",XDM_CONST.IP_PROTOCOL_CHAOS, cs_protocol="MUX",XDM_CONST.IP_PROTOCOL_MUX, cs_protocol="DCN_MEAS",XDM_CONST.IP_PROTOCOL_DCN_MEAS, cs_protocol="HMP",XDM_CONST.IP_PROTOCOL_HMP, cs_protocol="PRM",XDM_CONST.IP_PROTOCOL_PRM, cs_protocol="XNS_IDP",XDM_CONST.IP_PROTOCOL_XNS_IDP, cs_protocol="TRUNK_1",XDM_CONST.IP_PROTOCOL_TRUNK_1, cs_protocol="TRUNK_2",XDM_CONST.IP_PROTOCOL_TRUNK_2, cs_protocol="LEAF_1",XDM_CONST.IP_PROTOCOL_LEAF_1, cs_protocol="LEAF_2",XDM_CONST.IP_PROTOCOL_LEAF_2, cs_protocol="RDP",XDM_CONST.IP_PROTOCOL_RDP, cs_protocol="IRTP",XDM_CONST.IP_PROTOCOL_IRTP, cs_protocol="ISO_TP4",XDM_CONST.IP_PROTOCOL_ISO_TP4, cs_protocol="NETBLT",XDM_CONST.IP_PROTOCOL_NETBLT, cs_protocol="MFE_NSP",XDM_CONST.IP_PROTOCOL_MFE_NSP, cs_protocol="MERIT_INP",XDM_CONST.IP_PROTOCOL_MERIT_INP, cs_protocol="DCCP",XDM_CONST.IP_PROTOCOL_DCCP, cs_protocol="3PC",XDM_CONST.IP_PROTOCOL_3PC, cs_protocol="IDPR",XDM_CONST.IP_PROTOCOL_IDPR, cs_protocol="XTP",XDM_CONST.IP_PROTOCOL_XTP, cs_protocol="DDP",XDM_CONST.IP_PROTOCOL_DDP, cs_protocol="IDPR_CMTP",XDM_CONST.IP_PROTOCOL_IDPR_CMTP, cs_protocol="TP",XDM_CONST.IP_PROTOCOL_TP, cs_protocol="IL",XDM_CONST.IP_PROTOCOL_IL, cs_protocol="IPV6",XDM_CONST.IP_PROTOCOL_IPV6, cs_protocol="SDRP",XDM_CONST.IP_PROTOCOL_SDRP, cs_protocol="IPV6_ROUTE",XDM_CONST.IP_PROTOCOL_IPV6_ROUTE, cs_protocol="IPV6_FRAG",XDM_CONST.IP_PROTOCOL_IPV6_FRAG, cs_protocol="IDRP",XDM_CONST.IP_PROTOCOL_IDRP, cs_protocol="RSVP",XDM_CONST.IP_PROTOCOL_RSVP, cs_protocol="GRE",XDM_CONST.IP_PROTOCOL_GRE, cs_protocol="DSR",XDM_CONST.IP_PROTOCOL_DSR, cs_protocol="BNA",XDM_CONST.IP_PROTOCOL_BNA, cs_protocol="ESP",XDM_CONST.IP_PROTOCOL_ESP, cs_protocol="AH",XDM_CONST.IP_PROTOCOL_AH, cs_protocol="I_NLSP",XDM_CONST.IP_PROTOCOL_I_NLSP, cs_protocol="SWIPE",XDM_CONST.IP_PROTOCOL_SWIPE, cs_protocol="NARP",XDM_CONST.IP_PROTOCOL_NARP, cs_protocol="MOBILE",XDM_CONST.IP_PROTOCOL_MOBILE, cs_protocol="TLSP",XDM_CONST.IP_PROTOCOL_TLSP, cs_protocol="SKIP",XDM_CONST.IP_PROTOCOL_SKIP, cs_protocol="IPV6_ICMP",XDM_CONST.IP_PROTOCOL_IPV6_ICMP, cs_protocol="IPV6_NONXT",XDM_CONST.IP_PROTOCOL_IPV6_NONXT, cs_protocol="IPV6_OPTS",XDM_CONST.IP_PROTOCOL_IPV6_OPTS, cs_protocol="CFTP",XDM_CONST.IP_PROTOCOL_CFTP, cs_protocol="SAT_EXPAK",XDM_CONST.IP_PROTOCOL_SAT_EXPAK, cs_protocol="KRYPTOLAN",XDM_CONST.IP_PROTOCOL_KRYPTOLAN, cs_protocol="RVD",XDM_CONST.IP_PROTOCOL_RVD, cs_protocol="IPPC",XDM_CONST.IP_PROTOCOL_IPPC, cs_protocol="SAT_MON",XDM_CONST.IP_PROTOCOL_SAT_MON, cs_protocol="VISA",XDM_CONST.IP_PROTOCOL_VISA, cs_protocol="IPCV",XDM_CONST.IP_PROTOCOL_IPCV, cs_protocol="CPNX",XDM_CONST.IP_PROTOCOL_CPNX, cs_protocol="CPHB",XDM_CONST.IP_PROTOCOL_CPHB, cs_protocol="WSN",XDM_CONST.IP_PROTOCOL_WSN, cs_protocol="PVP",XDM_CONST.IP_PROTOCOL_PVP, cs_protocol="BR_SAT_MON",XDM_CONST.IP_PROTOCOL_BR_SAT_MON, cs_protocol="SUN_ND",XDM_CONST.IP_PROTOCOL_SUN_ND, cs_protocol="WB_MON",XDM_CONST.IP_PROTOCOL_WB_MON, cs_protocol="WB_EXPAK",XDM_CONST.IP_PROTOCOL_WB_EXPAK, cs_protocol="ISO_IP",XDM_CONST.IP_PROTOCOL_ISO_IP, cs_protocol="VMTP",XDM_CONST.IP_PROTOCOL_VMTP, cs_protocol="SECURE_VMTP",XDM_CONST.IP_PROTOCOL_SECURE_VMTP, cs_protocol="VINES",XDM_CONST.IP_PROTOCOL_VINES, cs_protocol="TTP",XDM_CONST.IP_PROTOCOL_TTP, cs_protocol="NSFNET_IGP",XDM_CONST.IP_PROTOCOL_NSFNET_IGP, cs_protocol="DGP",XDM_CONST.IP_PROTOCOL_DGP, cs_protocol="TCF",XDM_CONST.IP_PROTOCOL_TCF, cs_protocol="EIGRP",XDM_CONST.IP_PROTOCOL_EIGRP, cs_protocol="OSPFIGP",XDM_CONST.IP_PROTOCOL_OSPFIGP, cs_protocol="SPRITE_RPC",XDM_CONST.IP_PROTOCOL_SPRITE_RPC, cs_protocol="LARP",XDM_CONST.IP_PROTOCOL_LARP, cs_protocol="MTP",XDM_CONST.IP_PROTOCOL_MTP, cs_protocol="AX25",XDM_CONST.IP_PROTOCOL_AX25, cs_protocol="IPIP",XDM_CONST.IP_PROTOCOL_IPIP, cs_protocol="MICP",XDM_CONST.IP_PROTOCOL_MICP, cs_protocol="SCC_SP",XDM_CONST.IP_PROTOCOL_SCC_SP, cs_protocol="ETHERIP",XDM_CONST.IP_PROTOCOL_ETHERIP, cs_protocol="ENCAP",XDM_CONST.IP_PROTOCOL_ENCAP, cs_protocol="GMTP",XDM_CONST.IP_PROTOCOL_GMTP, cs_protocol="IFMP",XDM_CONST.IP_PROTOCOL_IFMP, cs_protocol="PNNI",XDM_CONST.IP_PROTOCOL_PNNI, cs_protocol="PIM",XDM_CONST.IP_PROTOCOL_PIM, cs_protocol="ARIS",XDM_CONST.IP_PROTOCOL_ARIS, cs_protocol="SCPS",XDM_CONST.IP_PROTOCOL_SCPS, cs_protocol="QNX",XDM_CONST.IP_PROTOCOL_QNX, cs_protocol="AN",XDM_CONST.IP_PROTOCOL_AN, cs_protocol="IPCOMP",XDM_CONST.IP_PROTOCOL_IPCOMP, cs_protocol="SNP",XDM_CONST.IP_PROTOCOL_SNP, cs_protocol="COMPAQ_PEER",XDM_CONST.IP_PROTOCOL_COMPAQ_PEER, cs_protocol="IPX_IN_IP",XDM_CONST.IP_PROTOCOL_IPX_IN_IP, cs_protocol="VRRP",XDM_CONST.IP_PROTOCOL_VRRP, cs_protocol="PGM",XDM_CONST.IP_PROTOCOL_PGM, cs_protocol="L2TP",XDM_CONST.IP_PROTOCOL_L2TP, cs_protocol="DDX",XDM_CONST.IP_PROTOCOL_DDX, cs_protocol="IATP",XDM_CONST.IP_PROTOCOL_IATP, cs_protocol="STP",XDM_CONST.IP_PROTOCOL_STP, cs_protocol="SRP",XDM_CONST.IP_PROTOCOL_SRP, cs_protocol="UTI",XDM_CONST.IP_PROTOCOL_UTI, cs_protocol="SMP",XDM_CONST.IP_PROTOCOL_SMP, cs_protocol="SM",XDM_CONST.IP_PROTOCOL_SM, cs_protocol="PTP",XDM_CONST.IP_PROTOCOL_PTP, cs_protocol="ISIS",XDM_CONST.IP_PROTOCOL_ISIS, cs_protocol="FIRE",XDM_CONST.IP_PROTOCOL_FIRE, cs_protocol="CRTP",XDM_CONST.IP_PROTOCOL_CRTP, cs_protocol="CRUDP",XDM_CONST.IP_PROTOCOL_CRUDP, cs_protocol="SSCOPMCE",XDM_CONST.IP_PROTOCOL_SSCOPMCE, cs_protocol="IPLT",XDM_CONST.IP_PROTOCOL_IPLT, cs_protocol="SPS",XDM_CONST.IP_PROTOCOL_SPS, cs_protocol="PIPE",XDM_CONST.IP_PROTOCOL_PIPE, cs_protocol="SCTP",XDM_CONST.IP_PROTOCOL_SCTP, cs_protocol="FC",XDM_CONST.IP_PROTOCOL_FC, cs_protocol="RSVP_E2E_IGNORE",XDM_CONST.IP_PROTOCOL_RSVP_E2E_IGNORE, cs_protocol="MOBILITY",XDM_CONST.IP_PROTOCOL_MOBILITY, cs_protocol="UDPLITE",XDM_CONST.IP_PROTOCOL_UDPLITE, cs_protocol="MPLS_IN_IP",XDM_CONST.IP_PROTOCOL_MPLS_IN_IP, cs_protocol="MANET",XDM_CONST.IP_PROTOCOL_MANET, cs_protocol="HIP",XDM_CONST.IP_PROTOCOL_HIP, cs_protocol="SHIM6",XDM_CONST.IP_PROTOCOL_SHIM6, cs_protocol="WESP",XDM_CONST.IP_PROTOCOL_WESP, cs_protocol="ROHC",XDM_CONST.IP_PROTOCOL_ROHC, cs_protocol="RESERVED",XDM_CONST.IP_PROTOCOL_RESERVED,cs_protocol="0",XDM_CONST.IP_PROTOCOL_HOPOPT, cs_protocol="1",XDM_CONST.IP_PROTOCOL_ICMP, cs_protocol="2",XDM_CONST.IP_PROTOCOL_IGMP, cs_protocol="3",XDM_CONST.IP_PROTOCOL_GGP, cs_protocol="4",XDM_CONST.IP_PROTOCOL_IP, cs_protocol="5",XDM_CONST.IP_PROTOCOL_ST, cs_protocol="6",XDM_CONST.IP_PROTOCOL_TCP, cs_protocol="7",XDM_CONST.IP_PROTOCOL_CBT, cs_protocol="8",XDM_CONST.IP_PROTOCOL_EGP, cs_protocol="9",XDM_CONST.IP_PROTOCOL_IGP, cs_protocol="10",XDM_CONST.IP_PROTOCOL_BBN_RCC_MON, cs_protocol="11",XDM_CONST.IP_PROTOCOL_NVP_II, cs_protocol="12",XDM_CONST.IP_PROTOCOL_PUP, cs_protocol="13",XDM_CONST.IP_PROTOCOL_ARGUS, cs_protocol="14",XDM_CONST.IP_PROTOCOL_EMCON, cs_protocol="15",XDM_CONST.IP_PROTOCOL_XNET, cs_protocol="16",XDM_CONST.IP_PROTOCOL_CHAOS, cs_protocol="17",XDM_CONST.IP_PROTOCOL_UDP, cs_protocol="18",XDM_CONST.IP_PROTOCOL_MUX, cs_protocol="19",XDM_CONST.IP_PROTOCOL_DCN_MEAS, cs_protocol="20",XDM_CONST.IP_PROTOCOL_HMP, cs_protocol="21",XDM_CONST.IP_PROTOCOL_PRM, cs_protocol="22",XDM_CONST.IP_PROTOCOL_XNS_IDP, cs_protocol="23",XDM_CONST.IP_PROTOCOL_TRUNK_1, cs_protocol="24",XDM_CONST.IP_PROTOCOL_TRUNK_2, cs_protocol="25",XDM_CONST.IP_PROTOCOL_LEAF_1, cs_protocol="26",XDM_CONST.IP_PROTOCOL_LEAF_2, cs_protocol="27",XDM_CONST.IP_PROTOCOL_RDP, cs_protocol="28",XDM_CONST.IP_PROTOCOL_IRTP, cs_protocol="29",XDM_CONST.IP_PROTOCOL_ISO_TP4, cs_protocol="30",XDM_CONST.IP_PROTOCOL_NETBLT, cs_protocol="31",XDM_CONST.IP_PROTOCOL_MFE_NSP, cs_protocol="32",XDM_CONST.IP_PROTOCOL_MERIT_INP, cs_protocol="33",XDM_CONST.IP_PROTOCOL_DCCP, cs_protocol="34",XDM_CONST.IP_PROTOCOL_3PC, cs_protocol="35",XDM_CONST.IP_PROTOCOL_IDPR, cs_protocol="36",XDM_CONST.IP_PROTOCOL_XTP, cs_protocol="37",XDM_CONST.IP_PROTOCOL_DDP, cs_protocol="38",XDM_CONST.IP_PROTOCOL_IDPR_CMTP, cs_protocol="39",XDM_CONST.IP_PROTOCOL_TP, cs_protocol="40",XDM_CONST.IP_PROTOCOL_IL, cs_protocol="41",XDM_CONST.IP_PROTOCOL_IPV6, cs_protocol="42",XDM_CONST.IP_PROTOCOL_SDRP, cs_protocol="43",XDM_CONST.IP_PROTOCOL_IPV6_ROUTE, cs_protocol="44",XDM_CONST.IP_PROTOCOL_IPV6_FRAG, cs_protocol="45",XDM_CONST.IP_PROTOCOL_IDRP, cs_protocol="46",XDM_CONST.IP_PROTOCOL_RSVP, cs_protocol="47",XDM_CONST.IP_PROTOCOL_GRE, cs_protocol="48",XDM_CONST.IP_PROTOCOL_DSR, cs_protocol="49",XDM_CONST.IP_PROTOCOL_BNA, cs_protocol="50",XDM_CONST.IP_PROTOCOL_ESP, cs_protocol="51",XDM_CONST.IP_PROTOCOL_AH, cs_protocol="52",XDM_CONST.IP_PROTOCOL_I_NLSP, cs_protocol="53",XDM_CONST.IP_PROTOCOL_SWIPE, cs_protocol="54",XDM_CONST.IP_PROTOCOL_NARP, cs_protocol="55",XDM_CONST.IP_PROTOCOL_MOBILE, cs_protocol="56",XDM_CONST.IP_PROTOCOL_TLSP, cs_protocol="57",XDM_CONST.IP_PROTOCOL_SKIP, cs_protocol="58",XDM_CONST.IP_PROTOCOL_IPV6_ICMP, cs_protocol="59",XDM_CONST.IP_PROTOCOL_IPV6_NONXT, cs_protocol="60",XDM_CONST.IP_PROTOCOL_IPV6_OPTS, cs_protocol="62",XDM_CONST.IP_PROTOCOL_CFTP, cs_protocol="64",XDM_CONST.IP_PROTOCOL_SAT_EXPAK, cs_protocol="65",XDM_CONST.IP_PROTOCOL_KRYPTOLAN, cs_protocol="66",XDM_CONST.IP_PROTOCOL_RVD, cs_protocol="67",XDM_CONST.IP_PROTOCOL_IPPC, cs_protocol="69",XDM_CONST.IP_PROTOCOL_SAT_MON, cs_protocol="70",XDM_CONST.IP_PROTOCOL_VISA, cs_protocol="71",XDM_CONST.IP_PROTOCOL_IPCV, cs_protocol="72",XDM_CONST.IP_PROTOCOL_CPNX, cs_protocol="73",XDM_CONST.IP_PROTOCOL_CPHB, cs_protocol="74",XDM_CONST.IP_PROTOCOL_WSN, cs_protocol="75",XDM_CONST.IP_PROTOCOL_PVP, cs_protocol="76",XDM_CONST.IP_PROTOCOL_BR_SAT_MON, cs_protocol="77",XDM_CONST.IP_PROTOCOL_SUN_ND, cs_protocol="78",XDM_CONST.IP_PROTOCOL_WB_MON, cs_protocol="79",XDM_CONST.IP_PROTOCOL_WB_EXPAK, cs_protocol="80",XDM_CONST.IP_PROTOCOL_ISO_IP, cs_protocol="81",XDM_CONST.IP_PROTOCOL_VMTP, cs_protocol="82",XDM_CONST.IP_PROTOCOL_SECURE_VMTP, cs_protocol="83",XDM_CONST.IP_PROTOCOL_VINES, cs_protocol="84",XDM_CONST.IP_PROTOCOL_TTP, cs_protocol="85",XDM_CONST.IP_PROTOCOL_NSFNET_IGP, cs_protocol="86",XDM_CONST.IP_PROTOCOL_DGP, cs_protocol="87",XDM_CONST.IP_PROTOCOL_TCF, cs_protocol="88",XDM_CONST.IP_PROTOCOL_EIGRP, cs_protocol="89",XDM_CONST.IP_PROTOCOL_OSPFIGP, cs_protocol="90",XDM_CONST.IP_PROTOCOL_SPRITE_RPC, cs_protocol="91",XDM_CONST.IP_PROTOCOL_LARP, cs_protocol="92",XDM_CONST.IP_PROTOCOL_MTP, cs_protocol="93",XDM_CONST.IP_PROTOCOL_AX25, cs_protocol="94",XDM_CONST.IP_PROTOCOL_IPIP, cs_protocol="95",XDM_CONST.IP_PROTOCOL_MICP, cs_protocol="96",XDM_CONST.IP_PROTOCOL_SCC_SP, cs_protocol="97",XDM_CONST.IP_PROTOCOL_ETHERIP, cs_protocol="98",XDM_CONST.IP_PROTOCOL_ENCAP, cs_protocol="100",XDM_CONST.IP_PROTOCOL_GMTP, cs_protocol="101",XDM_CONST.IP_PROTOCOL_IFMP, cs_protocol="102",XDM_CONST.IP_PROTOCOL_PNNI, cs_protocol="103",XDM_CONST.IP_PROTOCOL_PIM, cs_protocol="104",XDM_CONST.IP_PROTOCOL_ARIS, cs_protocol="105",XDM_CONST.IP_PROTOCOL_SCPS, cs_protocol="106",XDM_CONST.IP_PROTOCOL_QNX, cs_protocol="107",XDM_CONST.IP_PROTOCOL_AN, cs_protocol="108",XDM_CONST.IP_PROTOCOL_IPCOMP, cs_protocol="109",XDM_CONST.IP_PROTOCOL_SNP, cs_protocol="110",XDM_CONST.IP_PROTOCOL_COMPAQ_PEER, cs_protocol="111",XDM_CONST.IP_PROTOCOL_IPX_IN_IP, cs_protocol="112",XDM_CONST.IP_PROTOCOL_VRRP, cs_protocol="113",XDM_CONST.IP_PROTOCOL_PGM, cs_protocol="115",XDM_CONST.IP_PROTOCOL_L2TP, cs_protocol="116",XDM_CONST.IP_PROTOCOL_DDX, cs_protocol="117",XDM_CONST.IP_PROTOCOL_IATP, cs_protocol="118",XDM_CONST.IP_PROTOCOL_STP, cs_protocol="119",XDM_CONST.IP_PROTOCOL_SRP, cs_protocol="120",XDM_CONST.IP_PROTOCOL_UTI, cs_protocol="121",XDM_CONST.IP_PROTOCOL_SMP, cs_protocol="122",XDM_CONST.IP_PROTOCOL_SM, cs_protocol="123",XDM_CONST.IP_PROTOCOL_PTP, cs_protocol="124",XDM_CONST.IP_PROTOCOL_ISIS, cs_protocol="125",XDM_CONST.IP_PROTOCOL_FIRE, cs_protocol="126",XDM_CONST.IP_PROTOCOL_CRTP, cs_protocol="127",XDM_CONST.IP_PROTOCOL_CRUDP, cs_protocol="128",XDM_CONST.IP_PROTOCOL_SSCOPMCE, cs_protocol="129",XDM_CONST.IP_PROTOCOL_IPLT, cs_protocol="130",XDM_CONST.IP_PROTOCOL_SPS, cs_protocol="131",XDM_CONST.IP_PROTOCOL_PIPE, cs_protocol="132",XDM_CONST.IP_PROTOCOL_SCTP, cs_protocol="133",XDM_CONST.IP_PROTOCOL_FC, cs_protocol="134",XDM_CONST.IP_PROTOCOL_RSVP_E2E_IGNORE, cs_protocol="135",XDM_CONST.IP_PROTOCOL_MOBILITY, cs_protocol="136",XDM_CONST.IP_PROTOCOL_UDPLITE, cs_protocol="137",XDM_CONST.IP_PROTOCOL_MPLS_IN_IP, cs_protocol="138",XDM_CONST.IP_PROTOCOL_MANET, cs_protocol="139",XDM_CONST.IP_PROTOCOL_HIP, cs_protocol="140",XDM_CONST.IP_PROTOCOL_SHIM6, cs_protocol="141",XDM_CONST.IP_PROTOCOL_WESP, cs_protocol="142",XDM_CONST.IP_PROTOCOL_ROHC, cs_protocol="255",XDM_CONST.IP_PROTOCOL_RESERVED, cs_protocol),
xdm.observer.action = sc_filter_result,
xdm.observer.name = s_supplier_name,
xdm.intermediate.host.ipv4_addresses = if(s_ip_v4 != null, arraycreate(s_ip_v4)),
xdm.intermediate.host.ipv6_addresses = if(s_ip_v6 != null, arraycreate(s_ip_v6)),
xdm.source.ipv4 = c_ip_v4,
xdm.source.ipv6 = c_ip_v6,
xdm.target.port = to_integer(cs_uri_port),
xdm.target.ipv4 = r_ip_v4,
xdm.target.ipv6 = r_ip_v6,
xdm.source.sent_bytes = to_integer(cs_bytes),
xdm.source.user_agent = cs_user_agent,
xdm.source.user.groups = if(cs_auth_group != null, arraycreate(cs_auth_group)),
xdm.source.user.username = cs_username_decoded,
xdm.target.host.hostname = cs_host,
xdm.target.resource.name = cs_uri_path,
xdm.target.sent_bytes = to_integer(sc_bytes),
xdm.target.url = cs_url,
xdm.event.description = event_description;