Rules (XIF)
[MODEL: dataset="VMware_ESXi_raw"]
alter
event_type = arrayindex( regextract(_raw_log ,"\d+-\d+-\d+T\d+:\d+:\d+\.*\d*Z[\s|\|]\s*([a-zA-Z0-9-_]+)"),0),
username_1 = arrayindex(regextract(_raw_log ,"User\s\'([a-zA-Z]+)\'"),0),
username_2 = arrayindex(regextract(_raw_log ,"for\s+(\S+)\s+from"),0),
command_line = arrayindex( regextract(_raw_log ,"command\s\'([^\']+)\'"),0),
source_ip = arrayindex( regextract(_raw_log ,"from\s(\d+\.\d+\.\d+\.\d+)\s"),0),
source_port = arrayindex( regextract(_raw_log ,"from\s\d+\.\d+\.\d+\.\d+\sport\s(\d+)"),0),
msg_1 = arrayindex( regextract(_raw_log ,"T\d+\:\d+\:\d+\.*\d*Z\s*\w+\:\s+(.*)$"),0),
msg_2 = arrayindex( regextract(_raw_log ,"T\d+\:\d+\:\d+\.*\d*Z\|\s[a-zA-Z0-9\-\_]+\|\s\w+\:\s*(.*)"),0),
msg_3 = arrayindex(regextract(_raw_log ,"line \d+\:(.*)$"),0),
path_1 = arrayindex( regextract(_raw_log ,"path\:\s*(\S+)"),0),
path_2 = arrayindex( regextract(_raw_log ,"on\s(\/\S+)"),0),
mac_address = arrayindex( regextract(_raw_log , "MAC Address:\s([a-zA-Z0-9]+\:[a-zA-Z0-9]+\:[a-zA-Z0-9]+\:[a-zA-Z0-9]+\:[a-zA-Z0-9]+\:[a-zA-Z0-9]+)"),0)
| alter
msg = coalesce(msg_1, msg_2),
path = coalesce(path_1, path_2),
username = coalesce(username_1, username_2)
| alter
xdm.event.type = event_type,
xdm.source.user.username = username,
xdm.target.process.command_line = command_line,
xdm.source.ipv4 = source_ip,
xdm.source.port = to_number(source_port),
xdm.event.description = msg,
xdm.target.process.executable.path = path,
xdm.source.host.mac_addresses = arraycreate(coalesce(mac_address ,""));