Thinkst Canary Modeling Rule

Details

Rules (XIF)

[MODEL: dataset="thinkst_canary_raw"]
filter
    _raw_log contains "incident" or _raw_log contains "alert"
| alter
    priority = arrayindex(regextract(_raw_log,"\<\d+\>"), 0),
    severity = arrayindex(regextract(_raw_log,"\<\d+\>(\d+)"), 0),
    customer = arrayindex(regextract(_raw_log,"([\w\-]+)\sThinkstCanary"),0),
    id = arrayindex(regextract(_raw_log,"ThinkstCanary\s(\d{4})"),0),
    eventid = arrayindex(regextract(_raw_log,"\seventid\=\"(\d+)\""),0), 
    ReverseDNS = arrayindex(regextract(_raw_log,"ReverseDNS\=\"([\w\-\.]+)\"\sCanaryName"),0),
    CanaryLocation = arrayindex(regextract(_raw_log,"CanaryLocation\=\"([\w\s]+)\""),0),
    Description = arrayindex(regextract(_raw_log,"Description\=\"([\w\s]+)\""),0),
   timestamp = arrayindex(regextract(_raw_log,"Timestamp\=\"([\d]+)\""),0),
    CanaryPort = arrayindex(regextract(_raw_log,"CanaryPort\=\"([\d]+)\""),0),
    CanaryIP = arrayindex(regextract(_raw_log," CanaryIP\=\"(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\""),0),
    SourceIP = arrayindex(regextract(_raw_log," SourceIP\=\"(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\""),0),
    FakeCreds = arrayindex(regextract(_raw_log,"FakeCreds\=\"([\s\w\d]+)\"\s"),0),
    CanaryID = arrayindex(regextract(_raw_log,"CanaryID\=\"([\s\w\d]+)\""),0),
    summary = arrayindex(regextract(_raw_log,"\]\s(.*)"),0),
    Message = arrayindex(regextract(_raw_log,"Message\=\"([\w\s\d]+)\""),0)
| alter
    xdm.event.id = eventid,
    xdm.event.description = Description,
    xdm.event.outcome_reason = summary,
    xdm.target.host.ipv4_addresses = arraycreate(coalesce(CanaryIP,"")),
    xdm.source.host.device_id = CanaryID;

Schema

thinkst_canary_raw

{
    "thinkst_canary_raw": {
      "_raw_log": {
        "type": "string",
        "is_array": false
      }
    }
  }