Rules (XIF)
[MODEL: dataset=withsecure_endpoint_protection_raw]
alter
xdm.alert.severity = coalesce(json_extract_scalar(details, "$.systemDataLevel"), severity),
xdm.observer.type = coalesce(json_extract_scalar(details, "$.systemDataProviderName"), engine),
xdm.event.description = json_extract_scalar(details, "$.name"),
xdm.event.id = coalesce(json_extract_scalar(details, "$.incidentId"), id),
xdm.alert.subcategory = coalesce(json_extract_scalar(details, "$.systemDataChannel"), json_extract_scalar(details, "$.categories")),
xdm.event.original_event_type = json_extract_scalar(details, "$.alertType"),
xdm.alert.original_threat_name = json_extract_scalar(details, "$.infectionName"),
xdm.source.user.username = coalesce(json_extract_scalar(details, "$.systemDataUserInfoUsername"), json_extract_scalar(details, "$.userName")),
xdm.target.file.path = coalesce(json_extract_scalar(details, "$.path"), json_extract_scalar(details, "$.targetPath")),
xdm.target.file.size = to_number(json_extract_scalar(details, "$.size")),
xdm.source.application.name = coalesce(json_extract_scalar(details, "$.appName"), json_extract_scalar(details, "$.process")),
xdm.network.http.url = coalesce(json_extract_scalar(details, "$.websiteUrl"), json_extract_scalar(details, "$.url")),
xdm.source.process.executable.path = coalesce(json_extract_scalar(details, "$.accessorPath"), json_extract_scalar(details, "$.filePath"), source),
xdm.source.process.name = json_extract_scalar(details, "$.creator"),
xdm.source.host.device_id = coalesce(json_extract_scalar(details, "$.systemDataComputer"), json_extract_scalar(details, "$.deviceId"), json_extract_scalar(device, "$.id")),
xdm.source.host.hostname = coalesce(json_extract_scalar(details, "$.deviceName"), json_extract_scalar(details, "$.computerName"), json_extract_scalar(device, "$.name")),
xdm.source.process.command_line = json_extract_scalar(details, "$.commandLine"),
xdm.source.port = to_number(json_extract_scalar(details, "$.localPort")),
xdm.target.port = coalesce(to_number(json_extract_scalar(details, "$.port")), to_number(json_extract_scalar(details, "$.remotePort"))),
xdm.target.process.command_line = json_extract_scalar(details, "$.targetCommandLine"),
xdm.target.file.sha256 = json_extract_scalar(details, "$.targetSha256"),
xdm.target.file.signer = json_extract_scalar(details, "$.targetSignatureSignerName"),
xdm.network.rule = json_extract_scalar(details, "$.appliedRule"),
xdm.source.host.fqdn = json_extract_scalar(details, "$.devicePath"),
xdm.source.process.executable.filename = json_extract_scalar(details, "$.initiator"),
xdm.source.agent.identifier = json_extract_scalar(device, "$.agentId"),
xdm.source.process.executable.sha256 = json_extract_scalar(details, "$.initiator_hash"),
xdm.source.process.executable.signer = json_extract_scalar(details, "$.initiator_signer_name"),
xdm.source.process.pid = coalesce(to_number(json_extract_scalar(details, "$.systemDataProcessId")), to_number(json_extract_scalar(details, "$.processId"))),
xdm.alert.description = json_extract_scalar(details, "$.description"),
xdm.alert.original_alert_id = json_extract_scalar(details, "$.systemDataEventId"),
xdm.event.operation_sub_type = json_extract_scalar(details, "$.systemDataOpcode"),
xdm.source.user.domain = json_extract_scalar(details, "$.systemDataUserInfoDomain"),
xdm.source.user.identifier = json_extract_scalar(details, "$.systemDataUserInfoSid"),
xdm.event.outcome_reason = coalesce(json_extract_scalar(details, "$.resolution"), json_extract_scalar(details, "$.reputation")),
proto = json_extract_scalar(details, "$.ipProtocol"),
extract_ip1 = json_extract_scalar(details, "$.hostIpAddress"),
extract_ip2 = json_extract_scalar(details, "$.localAddress"),
extract_ip3 = coalesce(json_extract_scalar(details, "$.remoteAddress"), json_extract_scalar(details, "$.ip")),
outcome_reason = json_extract_scalar(details, "$.reason"),
outcome_result = coalesce(json_extract_scalar(details, "$.reason"), action)
| alter
xdm.observer.action = outcome_result,
parsed_ip1 = replex(extract_ip1, "\/\d*", ""),
xdm.source.ipv4 = if(extract_ip2 !~= ":", extract_ip2, null),
xdm.source.ipv6 = if(extract_ip2 ~= ":", extract_ip2, null),
xdm.target.ipv4 = if(extract_ip3 !~= ":", extract_ip3, null),
xdm.target.ipv6 = if(extract_ip3 ~= ":", extract_ip3, null),
xdm.target.file.is_signed = if(xdm.target.file.signer != null, True, False),
xdm.network.ip_protocol = if(proto ~="0",XDM_CONST.IP_PROTOCOL_HOPOPT, proto~="1",XDM_CONST.IP_PROTOCOL_ICMP, proto~="2",XDM_CONST.IP_PROTOCOL_IGMP, proto~="3",XDM_CONST.IP_PROTOCOL_GGP, proto~="4",XDM_CONST.IP_PROTOCOL_IP, proto~="5",XDM_CONST.IP_PROTOCOL_ST, proto~="6",XDM_CONST.IP_PROTOCOL_TCP, proto~="7",XDM_CONST.IP_PROTOCOL_CBT, proto~="8",XDM_CONST.IP_PROTOCOL_EGP, proto~="9",XDM_CONST.IP_PROTOCOL_IGP, proto~="10",XDM_CONST.IP_PROTOCOL_BBN_RCC_MON, proto~="11",XDM_CONST.IP_PROTOCOL_NVP_II, proto~="12",XDM_CONST.IP_PROTOCOL_PUP, proto~="13",XDM_CONST.IP_PROTOCOL_ARGUS, proto~="14",XDM_CONST.IP_PROTOCOL_EMCON, proto~="15",XDM_CONST.IP_PROTOCOL_XNET, proto~="16",XDM_CONST.IP_PROTOCOL_CHAOS, proto~="17",XDM_CONST.IP_PROTOCOL_UDP, proto~="18",XDM_CONST.IP_PROTOCOL_MUX, proto~="19",XDM_CONST.IP_PROTOCOL_DCN_MEAS, proto~="20",XDM_CONST.IP_PROTOCOL_HMP, proto~="21",XDM_CONST.IP_PROTOCOL_PRM, proto~="22",XDM_CONST.IP_PROTOCOL_XNS_IDP, proto~="23",XDM_CONST.IP_PROTOCOL_TRUNK_1, proto~="24",XDM_CONST.IP_PROTOCOL_TRUNK_2, proto~="25",XDM_CONST.IP_PROTOCOL_LEAF_1, proto~="26",XDM_CONST.IP_PROTOCOL_LEAF_2, proto~="27",XDM_CONST.IP_PROTOCOL_RDP, proto~="28",XDM_CONST.IP_PROTOCOL_IRTP, proto~="29",XDM_CONST.IP_PROTOCOL_ISO_TP4, proto~="30",XDM_CONST.IP_PROTOCOL_NETBLT, proto~="31",XDM_CONST.IP_PROTOCOL_MFE_NSP, proto~="32",XDM_CONST.IP_PROTOCOL_MERIT_INP, proto~="33",XDM_CONST.IP_PROTOCOL_DCCP, proto~="34",XDM_CONST.IP_PROTOCOL_3PC, proto~="35",XDM_CONST.IP_PROTOCOL_IDPR, proto~="36",XDM_CONST.IP_PROTOCOL_XTP, proto~="37",XDM_CONST.IP_PROTOCOL_DDP, proto~="38",XDM_CONST.IP_PROTOCOL_IDPR_CMTP, proto~="39",XDM_CONST.IP_PROTOCOL_TP, proto~="40",XDM_CONST.IP_PROTOCOL_IL, proto~="41",XDM_CONST.IP_PROTOCOL_IPV6, proto~="42",XDM_CONST.IP_PROTOCOL_SDRP, proto~="43",XDM_CONST.IP_PROTOCOL_IPV6_ROUTE, proto~="44",XDM_CONST.IP_PROTOCOL_IPV6_FRAG, proto~="45",XDM_CONST.IP_PROTOCOL_IDRP, proto~="46",XDM_CONST.IP_PROTOCOL_RSVP, proto~="47",XDM_CONST.IP_PROTOCOL_GRE, proto~="48",XDM_CONST.IP_PROTOCOL_DSR, proto~="49",XDM_CONST.IP_PROTOCOL_BNA, proto~="50",XDM_CONST.IP_PROTOCOL_ESP, proto~="51",XDM_CONST.IP_PROTOCOL_AH, proto~="52",XDM_CONST.IP_PROTOCOL_I_NLSP, proto~="53",XDM_CONST.IP_PROTOCOL_SWIPE, proto~="54",XDM_CONST.IP_PROTOCOL_NARP, proto~="55",XDM_CONST.IP_PROTOCOL_MOBILE, proto~="56",XDM_CONST.IP_PROTOCOL_TLSP, proto~="57",XDM_CONST.IP_PROTOCOL_SKIP, proto~="58",XDM_CONST.IP_PROTOCOL_IPV6_ICMP, proto~="59",XDM_CONST.IP_PROTOCOL_IPV6_NONXT, proto~="60",XDM_CONST.IP_PROTOCOL_IPV6_OPTS, proto~="62",XDM_CONST.IP_PROTOCOL_CFTP, proto~="64",XDM_CONST.IP_PROTOCOL_SAT_EXPAK, proto~="65",XDM_CONST.IP_PROTOCOL_KRYPTOLAN, proto~="66",XDM_CONST.IP_PROTOCOL_RVD, proto~="67",XDM_CONST.IP_PROTOCOL_IPPC, proto~="69",XDM_CONST.IP_PROTOCOL_SAT_MON, proto~="70",XDM_CONST.IP_PROTOCOL_VISA, proto~="71",XDM_CONST.IP_PROTOCOL_IPCV, proto~="72",XDM_CONST.IP_PROTOCOL_CPNX, proto~="73",XDM_CONST.IP_PROTOCOL_CPHB, proto~="74",XDM_CONST.IP_PROTOCOL_WSN, proto~="75",XDM_CONST.IP_PROTOCOL_PVP, proto~="76",XDM_CONST.IP_PROTOCOL_BR_SAT_MON, proto~="77",XDM_CONST.IP_PROTOCOL_SUN_ND, proto~="78",XDM_CONST.IP_PROTOCOL_WB_MON, proto~="79",XDM_CONST.IP_PROTOCOL_WB_EXPAK, proto~="80",XDM_CONST.IP_PROTOCOL_ISO_IP, proto~="81",XDM_CONST.IP_PROTOCOL_VMTP, proto~="82",XDM_CONST.IP_PROTOCOL_SECURE_VMTP, proto~="83",XDM_CONST.IP_PROTOCOL_VINES, proto~="84",XDM_CONST.IP_PROTOCOL_TTP, proto~="85",XDM_CONST.IP_PROTOCOL_NSFNET_IGP, proto~="86",XDM_CONST.IP_PROTOCOL_DGP, proto~="87",XDM_CONST.IP_PROTOCOL_TCF, proto~="88",XDM_CONST.IP_PROTOCOL_EIGRP, proto~="89",XDM_CONST.IP_PROTOCOL_OSPFIGP, proto~="90",XDM_CONST.IP_PROTOCOL_SPRITE_RPC, proto~="91",XDM_CONST.IP_PROTOCOL_LARP, proto~="92",XDM_CONST.IP_PROTOCOL_MTP, proto~="93",XDM_CONST.IP_PROTOCOL_AX25, proto~="94",XDM_CONST.IP_PROTOCOL_IPIP, proto~="95",XDM_CONST.IP_PROTOCOL_MICP, proto~="96",XDM_CONST.IP_PROTOCOL_SCC_SP, proto~="97",XDM_CONST.IP_PROTOCOL_ETHERIP, proto~="98",XDM_CONST.IP_PROTOCOL_ENCAP, proto~="100",XDM_CONST.IP_PROTOCOL_GMTP, proto~="101",XDM_CONST.IP_PROTOCOL_IFMP, proto~="102",XDM_CONST.IP_PROTOCOL_PNNI, proto~="103",XDM_CONST.IP_PROTOCOL_PIM, proto~="104",XDM_CONST.IP_PROTOCOL_ARIS, proto~="105",XDM_CONST.IP_PROTOCOL_SCPS, proto~="106",XDM_CONST.IP_PROTOCOL_QNX, proto~="107",XDM_CONST.IP_PROTOCOL_AN, proto~="108",XDM_CONST.IP_PROTOCOL_IPCOMP, proto~="110",XDM_CONST.IP_PROTOCOL_COMPAQ_PEER, proto~="111",XDM_CONST.IP_PROTOCOL_IPX_IN_IP, proto~="112",XDM_CONST.IP_PROTOCOL_VRRP, proto~="113",XDM_CONST.IP_PROTOCOL_PGM, proto~="115",XDM_CONST.IP_PROTOCOL_L2TP, proto~="116",XDM_CONST.IP_PROTOCOL_DDX, proto~="117",XDM_CONST.IP_PROTOCOL_IATP, proto~="118",XDM_CONST.IP_PROTOCOL_STP, proto~="119",XDM_CONST.IP_PROTOCOL_SRP, proto~="120",XDM_CONST.IP_PROTOCOL_UTI, proto~="121",XDM_CONST.IP_PROTOCOL_SMP, proto~="122",XDM_CONST.IP_PROTOCOL_SM, proto~="123",XDM_CONST.IP_PROTOCOL_PTP, proto~="124",XDM_CONST.IP_PROTOCOL_ISIS, proto~="125",XDM_CONST.IP_PROTOCOL_FIRE, proto~="126",XDM_CONST.IP_PROTOCOL_CRTP, proto~="127",XDM_CONST.IP_PROTOCOL_CRUDP, proto~="128",XDM_CONST.IP_PROTOCOL_SSCOPMCE, proto~="129",XDM_CONST.IP_PROTOCOL_IPLT, proto~="130",XDM_CONST.IP_PROTOCOL_SPS, proto~="131",XDM_CONST.IP_PROTOCOL_PIPE, proto~="132",XDM_CONST.IP_PROTOCOL_SCTP, proto~="133",XDM_CONST.IP_PROTOCOL_FC, proto~="134",XDM_CONST.IP_PROTOCOL_RSVP_E2E_IGNORE, proto~="135",XDM_CONST.IP_PROTOCOL_MOBILITY, proto~="136",XDM_CONST.IP_PROTOCOL_UDPLITE, proto~="137",XDM_CONST.IP_PROTOCOL_MPLS_IN_IP,to_string(proto)),
xdm.event.outcome = if(outcome_reason != null, XDM_CONST.OUTCOME_FAILED, outcome_result = "created", XDM_CONST.OUTCOME_SUCCESS, outcome_result = "allow", XDM_CONST.OUTCOME_SUCCESS, outcome_result = "renamed", XDM_CONST.OUTCOME_SUCCESS, outcome_result = "deleted", XDM_CONST.OUTCOME_SUCCESS, outcome_result = "disinfected", XDM_CONST.OUTCOME_SUCCESS, outcome_result = "closed", XDM_CONST.OUTCOME_FAILED, outcome_result = "deny", XDM_CONST.OUTCOME_FAILED, outcome_result = "blocked", XDM_CONST.OUTCOME_FAILED, outcome_result = "quarantined", XDM_CONST.OUTCOME_FAILED, outcome_result = "reported", XDM_CONST.OUTCOME_PARTIAL, outcome_result = "none", XDM_CONST.OUTCOME_UNKNOWN, outcome_result = null, null, to_string(outcome_result))
| alter
xdm.source.host.ipv4_addresses = arraycreate(if(parsed_ip1 !~= ":", parsed_ip1, null)),
xdm.source.host.ipv6_addresses = arraycreate(if(parsed_ip1 ~= ":", parsed_ip1, null));