Rules (XIF)
[MODEL: dataset ="symantec_cloud_soc_raw"]
alter browsers_array = json_extract_array(browsers, "$"),
devices_array = json_extract_array(devices, "$")
| alter len_browsers = array_length(browsers_array),
len_devices = array_length(devices_array)
| alter xdm.alert.severity = severity,
xdm.source.location.country = coalesce(country, arrayindex(regextract(locations , "\(([^\)]+)\)"),0)),
xdm.source.location.city = coalesce(city, arrayindex(regextract(locations , "^(.*?)\s*\("),0)),
xdm.source.location.latitude = to_float(latitude),
xdm.source.location.longitude = to_float(longitude),
xdm.source.host.ipv4_addresses = arraycreate(coalesce(hosts,host)),
xdm.event.operation_sub_type = activity_type,
xdm.target.application.name = service,
xdm.target.resource.type = object_type,
xdm.source.user.username = user_name,
xdm.source.user.upn = user,
xdm.network.http.browser = if(len_browsers >= 2 ,replace(arraystring(browsers_array, ","),"\"",""), replace(arrayindex(browsers_array,0),"\"","")),
xdm.source.host.hostname = if(len_devices >= 2 ,replace(arraystring(devices_array, ","),"\"",""), replace(arrayindex(devices_array,0),"\"","")),
xdm.event.type = type;
Schema
symantec_cloud_soc_raw
| Field |
Type |
Array? |
activity_type |
string |
— |
browsers |
string |
— |
city |
string |
— |
country |
string |
— |
devices |
string |
— |
host |
string |
— |
hosts |
string |
— |
latitude |
string |
— |
locations |
string |
— |
longitude |
string |
— |
object_type |
string |
— |
service |
string |
— |
severity |
string |
— |
type |
string |
— |
user |
string |
— |
user_name |
string |
— |
Raw JSON
{
"symantec_cloud_soc_raw": {
"severity": {
"type": "string",
"is_array": false
},
"locations": {
"type": "string",
"is_array": false
},
"city": {
"type": "string",
"is_array": false
},
"country": {
"type": "string",
"is_array": false
},
"latitude": {
"type": "string",
"is_array": false
},
"longitude": {
"type": "string",
"is_array": false
},
"activity_type": {
"type": "string",
"is_array": false
},
"object_type": {
"type": "string",
"is_array": false
},
"service": {
"type": "string",
"is_array": false
},
"user_name": {
"type": "string",
"is_array": false
},
"user": {
"type": "string",
"is_array": false
},
"type": {
"type": "string",
"is_array": false
},
"browsers": {
"type": "string",
"is_array": false
},
"devices": {
"type": "string",
"is_array": false
},
"host": {
"type": "string",
"is_array": false
},
"hosts": {
"type": "string",
"is_array": false
}
}
}