[RULE: UBIQUITI_GENERAL_FIELDS]
alter
src_ipv4 = if(src ~= "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}",src ,null),
src_ipv6 = if(src ~= "^((?:[a-fA-F\d]{0,4}\:){2,7}[a-fA-F\d]{0,4})$",src ,null),
dst_ipv4 = if(dst ~= "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}",dst ,null),
dst_ipv6 = if(dst ~= "^((?:[a-fA-F\d]{0,4}\:){2,7}[a-fA-F\d]{0,4})$",dst ,null),
unifi_client_ipv4 = if(UNIFIclientIp ~= "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}",UNIFIclientIp ,null),
unifi_client_ipv6 = if(UNIFIclientIp ~= "^((?:[a-fA-F\d]{0,4}\:){2,7}[a-fA-F\d]{0,4})$",UNIFIclientIp ,null);
[MODEL: dataset = ubiquiti_unifi_raw]
filter UNIFIcategory = "Monitoring" or UNIFIcategory = "Security" or UNIFIcategory = "System" or UNIFIcategory = "Internet" or UNIFIcategory = "Power"
| call UBIQUITI_GENERAL_FIELDS
| alter
xdm.target.port = to_integer(dpt),
xdm.source.port = to_integer(spt),
xdm.source.ipv4 = coalesce(src_ipv4,unifi_client_ipv4),
xdm.source.ipv6 = coalesce(src_ipv6,unifi_client_ipv6),
xdm.target.ipv4 = dst_ipv4,
xdm.target.ipv6 = dst_ipv6,
xdm.intermediate.ipv4 = UNIFIdeviceIp,
xdm.alert.description = msg,
xdm.target.host.hostname = UNIFIhost,
xdm.alert.severity = UNIFIrisk,
xdm.alert.category = UNIFIcategory,
xdm.alert.subcategory = UNIFIsubCategory,
xdm.target.host.mac_addresses = arraycreate(UNIFIdeviceMac),
xdm.network.session_id = UNIFIipsSessionId,
xdm.alert.original_threat_name = UNIFIipsSignature,
xdm.observer.name = UNIFIdeviceName,
xdm.observer.version = UNIFIdeviceVersion,
xdm.source.vlan = to_integer(UNIFInetworkVlan),
xdm.auth.auth_method = UNIFIauthMethod,
xdm.alert.name = cefName,
xdm.source.user.username = UNIFIadmin,
xdm.source.identity.username = UNIFIadmin,
xdm.source.host.mac_addresses = arraycreate(UNIFIclientMac);