Rules (XIF)
[MODEL: dataset = "vmware_nsx_raw"]
alter
check_audit = parsed_fields -> audit,
event_type = parsed_fields -> type,
useranme_1 = parsed_fields -> USER,
username_2 = parsed_fields -> username,
username_3 = parsed_fields -> UserName,
src_ipv4_and_port = parsed_fields -> Src,
log_level = parsed_fields -> level,
operation_status = parsed_fields -> Operationstatus,
pid = parsed_fields -> pid,
device_model_1 = parsed_fields -> node,
device_model_2 = parsed_fields -> component
| alter
auditlogs = if(check_audit = "true", "AUDIT", check_audit),
src_ipv4 = arrayindex(regextract(src_ipv4_and_port , "(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"),0),
dst_port = arrayindex(regextract(src_ipv4_and_port ,"\:(\d+)"),0)
| alter
xdm.source.host.hostname = parsed_fields -> hostname,
xdm.event.type = coalesce(auditlogs , event_type),
xdm.source.user.username = coalesce(useranme_1 , username_2,username_3),
xdm.source.ipv4 = src_ipv4,
xdm.source.host.device_model = coalesce(device_model_2 , device_model_1),
xdm.source.process.pid = to_integer(pid),
xdm.target.port = to_integer(dst_port),
xdm.event.operation_sub_type = parsed_fields -> Operation,
xdm.event.description = parsed_fields -> description,
xdm.source.process.command_line = parsed_fields -> COMMAND,
xdm.source.process.executable.directory = parsed_fields -> PWD,
xdm.event.log_level = if(log_level = "ERROR",XDM_CONST.LOG_LEVEL_ERROR, log_level = "WARRNING", XDM_CONST.LOG_LEVEL_WARNING, log_level = "ALERT", XDM_CONST.LOG_LEVEL_ALERT, log_level = "CRITICAL", XDM_CONST.LOG_LEVEL_CRITICAL,log_level = "DEBUG" ,XDM_CONST.LOG_LEVEL_DEBUG, log_level = "EMERGENCY" ,XDM_CONST.LOG_LEVEL_EMERGENCY, log_level = "INFO", XDM_CONST.LOG_LEVEL_INFORMATIONAL, log_level = "NOTICE" ,XDM_CONST.LOG_LEVEL_NOTICE, log_level),
xdm.event.outcome = if(operation_status = "success", XDM_CONST.OUTCOME_SUCCESS, operation_status = "failure", XDM_CONST.OUTCOME_FAILED , operation_status);