Tenable_io Modeling Rule

Details

ID	`Tenable_io_ModelingRule`
From Version	8.15.0
Tags	tenable

Schema

`tenable_io_raw`

Field	Type	Array?
`action`	string	—
`actor`	string	—
`description`	string	—
`fields`	string	—
`id`	string	—
`target`	string	—

`tenable_io_vulnerabilities_raw`

Field	Type	Array?
`asset`	string	—
`output`	string	—
`plugin`	string	—
`severity`	string	—

Source

Tenable_io_2_11.xif Tenable_io_2_11.yml Tenable_io_2_11_schema.json

Download History Raw

[MODEL: dataset = tenable_io_raw]
alter 
    xdm.source.user.identifier = json_extract_scalar(actor, "$.id"),
    xdm.source.identity.identifier = json_extract_scalar(actor, "$.id"),
    xdm.source.user.username = json_extract_scalar(actor, "$.name"),
    xdm.source.identity.username = json_extract_scalar(actor, "$.name"),
    xdm.event.description = description,
    xdm.target.resource.id = json_extract_scalar(`target`, "$.id"),
    xdm.target.resource.name = json_extract_scalar(`target`, "$.name"),
    xdm.target.resource.type = json_extract_scalar(`target`, "$.type"),
    xdm.event.id = id,
    xdm.event.operation = action,
    xdm.event.type = action,
    xdm.source.ipv4 = arraystring(arraymap(json_extract_array(`fields`, "$."), if(json_extract_scalar("@element", "$.key") = "X-Forwarded-For",json_extract_scalar("@element", "$.value"), null)),","),
    xdm.source.agent.identifier = arraystring(arraymap(json_extract_array(`fields`, "$."), if(json_extract_scalar("@element", "$.key") = "X-Request-Uuid",json_extract_scalar("@element", "$.value"), null)),","),
    xdm.event.outcome_reason = arraystring(arraymap(json_extract_array(`fields`, "$."), if(json_extract_scalar("@element", "$.key") = "message",json_extract_scalar("@element", "$.value"), null)),","),
    xdm.event.operation_sub_type = arraystring(arraymap(json_extract_array(`fields`, "$."), if(json_extract_scalar("@element", "$.key") = "serviceName",json_extract_scalar("@element", "$.value"), null)),","),
    xdm.session_context_id = arraystring(arraymap(json_extract_array(`fields`, "$."), if(json_extract_scalar("@element", "$.key") = "X-Session-Uuid",json_extract_scalar("@element", "$.value"), null)),",");

[MODEL: dataset = tenable_io_vulnerabilities_raw]
alter
    xdm.target.host.hostname = replace(json_extract(asset,"$.hostname"),"\"",""),
    xdm.target.host.ipv4_addresses = arraycreate(replace(json_extract(asset,"$.ipv4"),"\"","")),
    xdm.target.host.device_id = replace(json_extract(asset,"$.uuid"),"\"",""),
    xdm.target.host.os = replace(arrayindex(json_extract_array(asset,"$.operating_system"),0),"\"",""),
    xdm.alert.description = replace(json_extract(plugin,"$.description"),"\"",""),
    xdm.alert.name = replace(json_extract(plugin,"$.name"),"\"",""),
    xdm.alert.severity = severity,
    xdm.event.description = output,
    xdm.source.host.fqdn = replace(json_extract(asset,"$.fqdn"),"\"",""),
    xdm.target.host.fqdn = replace(json_extract(asset,"$.fqdn"),"\"",""),
    xdm.alert.category = replace(json_extract(plugin,"$.family"),"\"",""),
    xdm.alert.original_alert_id = json_extract_scalar(plugin,"$.id");