Rules (XIF)
[MODEL: dataset= "tigera_calico_raw"]
alter
tigera_secure = arrayindex(regextract(_raw_log ,"({.*})"), 0)
| alter
action = tigera_secure -> action,
ip_proto = tigera_secure -> proto,
source_ip = tigera_secure -> source_ip,
dest_ip = tigera_secure -> dest_ip
| alter
xdm.source.ipv4 = if(tigera_secure ~= "(?:\d{1,3}\.){3}\d{1,3}", source_ip),
xdm.source.ipv6 = if(tigera_secure ~= "(?:[a-fA-F\d]{0,4}\:){7}[\wa-fA-F]{0,4}", source_ip),
xdm.source.host.hostname = tigera_secure -> source_name,
xdm.source.host.fqdn = tigera_secure -> source_namespace,
xdm.source.port = to_integer(tigera_secure -> source_port),
xdm.source.host.device_category = tigera_secure -> source_type,
// xdm.source.cloud.source_type = arraystring(json_extract_scalar_array(tigera_secure , "$.source_labels.labels"), ", "),
xdm.target.ipv4 = if(tigera_secure ~= "(?:\d{1,3}\.){3}\d{1,3}", dest_ip ),
xdm.target.ipv6 = if(tigera_secure ~= "(?:[a-fA-F\d]{0,4}\:){7}[\wa-fA-F]{0,4}", dest_ip),
xdm.target.host.hostname = tigera_secure -> dest_name,
xdm.target.resource.value = tigera_secure -> dest_namespace,
xdm.target.port = to_integer(tigera_secure -> dest_port),
xdm.target.host.device_category = tigera_secure -> dest_type,
// xdm.target.cloud.source_type = arraystring(json_extract_scalar_array(tigera_secure , "$.dest_labels.labels"), ", "),
xdm.event.outcome_reason = action,
xdm.event.outcome = if(action = "allow", XDM_CONST.OUTCOME_SUCCESS , action in ("block","deny"), XDM_CONST.OUTCOME_FAILED, XDM_CONST.OUTCOME_UNKNOWN),
xdm.observer.type = arraystring(json_extract_scalar_array(tigera_secure , "$.policies.all_policies"), ", "),
xdm.target.sent_bytes = to_integer(tigera_secure -> bytes_in),
xdm.source.sent_bytes = to_integer(tigera_secure -> bytes_out),
xdm.observer.name = tigera_secure -> host,
xdm.network.ip_protocol = if(ip_proto="hopopt",XDM_CONST.IP_PROTOCOL_HOPOPT, ip_proto="icmp",XDM_CONST.IP_PROTOCOL_ICMP, ip_proto="igmp",XDM_CONST.IP_PROTOCOL_IGMP, ip_proto="ggp",XDM_CONST.IP_PROTOCOL_GGP, ip_proto="ip",XDM_CONST.IP_PROTOCOL_IP, ip_proto="st",XDM_CONST.IP_PROTOCOL_ST, ip_proto="tcp",XDM_CONST.IP_PROTOCOL_TCP, ip_proto="cbt",XDM_CONST.IP_PROTOCOL_CBT, ip_proto="egp",XDM_CONST.IP_PROTOCOL_EGP, ip_proto="igp",XDM_CONST.IP_PROTOCOL_IGP, ip_proto="bbn_rcc_mon",XDM_CONST.IP_PROTOCOL_BBN_RCC_MON, ip_proto="nvp_ii",XDM_CONST.IP_PROTOCOL_NVP_II, ip_proto="pup",XDM_CONST.IP_PROTOCOL_PUP, ip_proto="argus",XDM_CONST.IP_PROTOCOL_ARGUS, ip_proto="emcon",XDM_CONST.IP_PROTOCOL_EMCON, ip_proto="xnet",XDM_CONST.IP_PROTOCOL_XNET, ip_proto="chaos",XDM_CONST.IP_PROTOCOL_CHAOS, ip_proto="udp",XDM_CONST.IP_PROTOCOL_UDP, ip_proto="mux",XDM_CONST.IP_PROTOCOL_MUX, ip_proto="dcn_meas",XDM_CONST.IP_PROTOCOL_DCN_MEAS, ip_proto="hmp",XDM_CONST.IP_PROTOCOL_HMP, ip_proto="prm",XDM_CONST.IP_PROTOCOL_PRM, ip_proto="xns_idp",XDM_CONST.IP_PROTOCOL_XNS_IDP, ip_proto="trunk_1",XDM_CONST.IP_PROTOCOL_TRUNK_1, ip_proto="trunk_2",XDM_CONST.IP_PROTOCOL_TRUNK_2, ip_proto="leaf_1",XDM_CONST.IP_PROTOCOL_LEAF_1, ip_proto="leaf_2",XDM_CONST.IP_PROTOCOL_LEAF_2, ip_proto="rdp",XDM_CONST.IP_PROTOCOL_RDP, ip_proto="irtp",XDM_CONST.IP_PROTOCOL_IRTP, ip_proto="iso_tp4",XDM_CONST.IP_PROTOCOL_ISO_TP4, ip_proto="netblt",XDM_CONST.IP_PROTOCOL_NETBLT, ip_proto="mfe_nsp",XDM_CONST.IP_PROTOCOL_MFE_NSP, ip_proto="merit_inp",XDM_CONST.IP_PROTOCOL_MERIT_INP, ip_proto="dccp",XDM_CONST.IP_PROTOCOL_DCCP, ip_proto="3pc",XDM_CONST.IP_PROTOCOL_3PC, ip_proto="idpr",XDM_CONST.IP_PROTOCOL_IDPR, ip_proto="xtp",XDM_CONST.IP_PROTOCOL_XTP, ip_proto="ddp",XDM_CONST.IP_PROTOCOL_DDP, ip_proto="idpr_cmtp",XDM_CONST.IP_PROTOCOL_IDPR_CMTP, ip_proto="tp",XDM_CONST.IP_PROTOCOL_TP, ip_proto="il",XDM_CONST.IP_PROTOCOL_IL, ip_proto="ipv6",XDM_CONST.IP_PROTOCOL_IPV6, ip_proto="sdrp",XDM_CONST.IP_PROTOCOL_SDRP, ip_proto="ipv6_route",XDM_CONST.IP_PROTOCOL_IPV6_ROUTE, ip_proto="ipv6_frag",XDM_CONST.IP_PROTOCOL_IPV6_FRAG, ip_proto="idrp",XDM_CONST.IP_PROTOCOL_IDRP, ip_proto="rsvp",XDM_CONST.IP_PROTOCOL_RSVP, ip_proto="gre",XDM_CONST.IP_PROTOCOL_GRE, ip_proto="dsr",XDM_CONST.IP_PROTOCOL_DSR, ip_proto="bna",XDM_CONST.IP_PROTOCOL_BNA, ip_proto="esp",XDM_CONST.IP_PROTOCOL_ESP, ip_proto="ah",XDM_CONST.IP_PROTOCOL_AH, ip_proto="i_nlsp",XDM_CONST.IP_PROTOCOL_I_NLSP, ip_proto="swipe",XDM_CONST.IP_PROTOCOL_SWIPE, ip_proto="narp",XDM_CONST.IP_PROTOCOL_NARP, ip_proto="mobile",XDM_CONST.IP_PROTOCOL_MOBILE, ip_proto="tlsp",XDM_CONST.IP_PROTOCOL_TLSP, ip_proto="skip",XDM_CONST.IP_PROTOCOL_SKIP, ip_proto="ipv6_icmp",XDM_CONST.IP_PROTOCOL_IPV6_ICMP, ip_proto="ipv6_nonxt",XDM_CONST.IP_PROTOCOL_IPV6_NONXT, ip_proto="ipv6_opts",XDM_CONST.IP_PROTOCOL_IPV6_OPTS, ip_proto="cftp",XDM_CONST.IP_PROTOCOL_CFTP, ip_proto="sat_expak",XDM_CONST.IP_PROTOCOL_SAT_EXPAK, ip_proto="kryptolan",XDM_CONST.IP_PROTOCOL_KRYPTOLAN, ip_proto="rvd",XDM_CONST.IP_PROTOCOL_RVD, ip_proto="ippc",XDM_CONST.IP_PROTOCOL_IPPC, ip_proto="sat_mon",XDM_CONST.IP_PROTOCOL_SAT_MON, ip_proto="visa",XDM_CONST.IP_PROTOCOL_VISA, ip_proto="ipcv",XDM_CONST.IP_PROTOCOL_IPCV, ip_proto="cpnx",XDM_CONST.IP_PROTOCOL_CPNX, ip_proto="cphb",XDM_CONST.IP_PROTOCOL_CPHB, ip_proto="wsn",XDM_CONST.IP_PROTOCOL_WSN, ip_proto="pvp",XDM_CONST.IP_PROTOCOL_PVP, ip_proto="br_sat_mon",XDM_CONST.IP_PROTOCOL_BR_SAT_MON, ip_proto="sun_nd",XDM_CONST.IP_PROTOCOL_SUN_ND, ip_proto="wb_mon",XDM_CONST.IP_PROTOCOL_WB_MON, ip_proto="wb_expak",XDM_CONST.IP_PROTOCOL_WB_EXPAK, ip_proto="iso_ip",XDM_CONST.IP_PROTOCOL_ISO_IP, ip_proto="vmtp",XDM_CONST.IP_PROTOCOL_VMTP, ip_proto="secure_vmtp",XDM_CONST.IP_PROTOCOL_SECURE_VMTP, ip_proto="vines",XDM_CONST.IP_PROTOCOL_VINES, ip_proto="ttp",XDM_CONST.IP_PROTOCOL_TTP, ip_proto="nsfnet_igp",XDM_CONST.IP_PROTOCOL_NSFNET_IGP, ip_proto="dgp",XDM_CONST.IP_PROTOCOL_DGP, ip_proto="tcf",XDM_CONST.IP_PROTOCOL_TCF, ip_proto="eigrp",XDM_CONST.IP_PROTOCOL_EIGRP, ip_proto="ospfigp",XDM_CONST.IP_PROTOCOL_OSPFIGP, ip_proto="sprite_rpc",XDM_CONST.IP_PROTOCOL_SPRITE_RPC, ip_proto="larp",XDM_CONST.IP_PROTOCOL_LARP, ip_proto="mtp",XDM_CONST.IP_PROTOCOL_MTP, ip_proto="ax25",XDM_CONST.IP_PROTOCOL_AX25, ip_proto="ipip",XDM_CONST.IP_PROTOCOL_IPIP, ip_proto="micp",XDM_CONST.IP_PROTOCOL_MICP, ip_proto="scc_sp",XDM_CONST.IP_PROTOCOL_SCC_SP, ip_proto="etherip",XDM_CONST.IP_PROTOCOL_ETHERIP, ip_proto="encap",XDM_CONST.IP_PROTOCOL_ENCAP, ip_proto="gmtp",XDM_CONST.IP_PROTOCOL_GMTP, ip_proto="ifmp",XDM_CONST.IP_PROTOCOL_IFMP, ip_proto="pnni",XDM_CONST.IP_PROTOCOL_PNNI, ip_proto="pim",XDM_CONST.IP_PROTOCOL_PIM, ip_proto="aris",XDM_CONST.IP_PROTOCOL_ARIS, ip_proto="scps",XDM_CONST.IP_PROTOCOL_SCPS, ip_proto="qnx",XDM_CONST.IP_PROTOCOL_QNX, ip_proto="an",XDM_CONST.IP_PROTOCOL_AN, ip_proto="ipcomp",XDM_CONST.IP_PROTOCOL_IPCOMP, ip_proto="snp",XDM_CONST.IP_PROTOCOL_SNP, ip_proto="compaq_peer",XDM_CONST.IP_PROTOCOL_COMPAQ_PEER, ip_proto="ipx_in_ip",XDM_CONST.IP_PROTOCOL_IPX_IN_IP, ip_proto="vrrp",XDM_CONST.IP_PROTOCOL_VRRP, ip_proto="pgm",XDM_CONST.IP_PROTOCOL_PGM, ip_proto="l2tp",XDM_CONST.IP_PROTOCOL_L2TP, ip_proto="ddx",XDM_CONST.IP_PROTOCOL_DDX, ip_proto="iatp",XDM_CONST.IP_PROTOCOL_IATP, ip_proto="stp",XDM_CONST.IP_PROTOCOL_STP, ip_proto="srp",XDM_CONST.IP_PROTOCOL_SRP, ip_proto="uti",XDM_CONST.IP_PROTOCOL_UTI, ip_proto="smp",XDM_CONST.IP_PROTOCOL_SMP, ip_proto="sm",XDM_CONST.IP_PROTOCOL_SM, ip_proto="ptp",XDM_CONST.IP_PROTOCOL_PTP, ip_proto="isis",XDM_CONST.IP_PROTOCOL_ISIS, ip_proto="fire",XDM_CONST.IP_PROTOCOL_FIRE, ip_proto="crtp",XDM_CONST.IP_PROTOCOL_CRTP, ip_proto="crudp",XDM_CONST.IP_PROTOCOL_CRUDP, ip_proto="sscopmce",XDM_CONST.IP_PROTOCOL_SSCOPMCE, ip_proto="iplt",XDM_CONST.IP_PROTOCOL_IPLT, ip_proto="sps",XDM_CONST.IP_PROTOCOL_SPS, ip_proto="pipe",XDM_CONST.IP_PROTOCOL_PIPE, ip_proto="sctp",XDM_CONST.IP_PROTOCOL_SCTP, ip_proto="fc",XDM_CONST.IP_PROTOCOL_FC, ip_proto="rsvp_e2e_ignore",XDM_CONST.IP_PROTOCOL_RSVP_E2E_IGNORE, ip_proto="mobility",XDM_CONST.IP_PROTOCOL_MOBILITY, ip_proto="udplite",XDM_CONST.IP_PROTOCOL_UDPLITE, ip_proto="mpls_in_ip",XDM_CONST.IP_PROTOCOL_MPLS_IN_IP, ip_proto="manet",XDM_CONST.IP_PROTOCOL_MANET, ip_proto="hip",XDM_CONST.IP_PROTOCOL_HIP, ip_proto="shim6",XDM_CONST.IP_PROTOCOL_SHIM6, ip_proto="wesp",XDM_CONST.IP_PROTOCOL_WESP, ip_proto="rohc",XDM_CONST.IP_PROTOCOL_ROHC, ip_proto="reserved",to_string(ip_proto));