[MODEL:dataset="txone_stellarone_raw"]
alter
get_user = coalesce(suser, username, activeuser, accessuser, threatuser),
get_host_os = coalesce(cs2, agentos),
get_target_file = arrayindex(regextract(coalesce(filepath, path), "[^\\\/]+$"),0),
get_file_path = coalesce(filepath, accessimagepath, threatimagepath, path),
get_proc_id = coalesce(to_string(pid), processid),
get_cs1_event_msg = if(cs1label = "Detailed Event Message", cs1),
get_cs1_client_ip = if(cs1label = "clientIpAddress", cs1),
get_outcome = coalesce(to_string(status), to_string(actionresult), result),
get_host = coalesce(agentendpoint, dvchost)
| alter
get_file_name = coalesce(filename, get_target_file),
get_description = coalesce(get_cs1_event_msg, msg, detailmsg, `desc`),
get_src_ip = coalesce(src, clientip, agentip, get_cs1_client_ip)
| alter //XDM Mapping
xdm.observer.version = cefdeviceversion,
xdm.observer.name = coalesce(dvchost, agentendpoint, dvc, serverip),
xdm.observer.unique_identifier = deviceexternalid,
xdm.event.type = cefname,
xdm.event.operation_sub_type = act,
xdm.event.id = eventid,
xdm.event.original_event_type = cefdeviceeventclassid,
xdm.event.description = get_description,
xdm.alert.severity = to_string(cefseverity),
xdm.alert.name = threatname,
xdm.alert.original_threat_name = threatname,
xdm.alert.original_threat_id = threatattackid,
xdm.source.host.hostname = get_host,
// xdm.source.user.group.guid = agentgrpguid,
xdm.source.user.groups = arraycreate(coalesce(agentgrpname, userrole)),
xdm.source.host.os = get_host_os,
xdm.source.host.os_family = if(
get_host_os ~= "(?i)windows", XDM_CONST.OS_FAMILY_WINDOWS,
get_host_os ~= "(?i)linux", XDM_CONST.OS_FAMILY_LINUX,
get_host_os ~= "(?i)mac|darwin", XDM_CONST.OS_FAMILY_MACOS,
get_host_os),
xdm.source.user.username = get_user,
xdm.source.ipv4 = if(is_ipv4(get_src_ip), get_src_ip),
xdm.source.ipv6 = if(is_ipv6(get_src_ip), get_src_ip),
xdm.target.ipv4 = if(is_ipv4(dst), dst),
xdm.target.ipv6 = if(is_ipv6(dst), dst),
xdm.target.host.hostname = if(is_ipv4(dst) = FALSE and is_ipv6(dst) = FALSE, dst),
xdm.target.file.filename = get_file_name,
xdm.target.file.path = get_file_path,
xdm.target.process.pid = if(get_proc_id ~= "\d+", to_integer(get_proc_id)),
xdm.target.process.name = arrayindex(regextract(blockedprocess, "[^\\\/]+$"),0),
xdm.target.host.device_category = devicetype,
xdm.event.outcome = if(
get_outcome = "0", XDM_CONST.OUTCOME_UNKNOWN,
get_outcome = "1", XDM_CONST.OUTCOME_SUCCESS,
get_outcome = "2", XDM_CONST.OUTCOME_FAILED,
get_outcome ~= "(?i)block|fail|denied",XDM_CONST.OUTCOME_FAILED,
get_outcome ~= "(?i)success|allow|approved", XDM_CONST.OUTCOME_SUCCESS,
get_outcome),
xdm.event.outcome_reason = get_outcome,
xdm.logon.logon_guid = logguid;