Rules (XIF)
[MODEL: dataset = zeronetworks_segment_raw]
// Audit logs
filter source_log_type = "audit"
| alter
userRole_string = to_string(userRole),
auditType_string = to_string(auditType),
enforcementSource_string = to_string(enforcementSource)
| alter
userRole_normalized = if(userRole_string = "1", "Admin", userRole_string = "2", "Viewer", userRole_string = "3", "Regular", userRole_string = "4", "API-FullAccess", userRole_string = "5", "API-ReadOnly", userRole_string = "6", "SelfService", userRole_string = "7", "CloudConnectorProvisioning", userRole_string = "8", "JAMF Asset", userRole_string = "9", "Asset Manager", userRole_string = "10", "Operaror", userRole_string = "11", "Service Now Token", userRole_string),
destinationEntityIDs = arraystring(arraymap(destinationEntitiesList -> [], json_extract_scalar("@element", "$.id")), ", "),
destinationEntityNames = arraystring(arraymap(destinationEntitiesList -> [], json_extract_scalar("@element", "$.name")), ", ")
| alter
xdm.event.type = if (auditType_string = "1", "Asset is being segmented (network)", auditType_string = "2", "Asset segmented (network)", auditType_string = "3", "Asset failed being segmented (network)", auditType_string = "4", "Asset is being unsegmented (network)", auditType_string = "5", "Asset unsegmented (network)", auditType_string = "6", "Asset failed being unsegmented (network)", auditType_string = "7", "Asset added to learning (network)", auditType_string = "8", "Asset removed from learning (network)", auditType_string = "9", "Inbound allow rule created", auditType_string = "10", "Inbound allow rule deleted", auditType_string = "11", "Inbound allow rule expired", auditType_string = "12", "Inbound allow rule edited", auditType_string = "17", "Inbound MFA policy created", auditType_string = "18", "Inbound MFA policy edited", auditType_string = "19", "Inbound MFA policy deleted", auditType_string = "20", "Inbound JIT rule created", auditType_string = "21", "Inbound JIT rule deleted", auditType_string = "22", "Inbound JIT rule expired", auditType_string = "23", "Inbound JIT rule revived", auditType_string = "24", "Inbound JIT rule edited", auditType_string = "25", "API Token created", auditType_string = "26", "API Token deleted", auditType_string = "27", "API Token regenerated", auditType_string = "28", "Asset segmentation date postponed (network)", auditType_string = "29", "Outbound block rule created", auditType_string = "30", "Outbound block rule deleted", auditType_string = "31", "Outbound block rule expired", auditType_string = "32", "Outbound block rule edited", auditType_string = "33", "Inbound block rule created", auditType_string = "34", "Inbound block rule deleted", auditType_string = "35", "Inbound block rule expired", auditType_string = "36", "Inbound block rule edited", auditType_string = "39", "Asset unsegmented (network) (overriding policy)", auditType_string = "40", "Asset is being unsegmented (network) (overriding policy)", auditType_string = "41", "Asset removed from learning (network) (overriding policy)", auditType_string = "42", "Asset is being segmented (network) (policy)", auditType_string = "43", "Asset segmented (network) (policy)", auditType_string = "44", "Asset added to learning (network) (policy)", auditType_string = "45", "Segmentation policy created", auditType_string = "46", "Segmentation policy deleted", auditType_string = "47", "Segmentation policy edited", auditType_string = "48", "Inbound JIT access rejected", auditType_string = "49", "Inbound JIT fallback rule created", auditType_string = "50", "Inbound JIT fallback rule deleted", auditType_string = "51", "Inbound JIT fallback rule expired", auditType_string = "53", "Outbound allow rule created", auditType_string = "54", "Outbound allow rule deleted", auditType_string = "55", "Outbound allow rule expired", auditType_string = "56", "Outbound allow rule edited", auditType_string = "58", "Admin portal role changed to admin", auditType_string = "59", "Admin portal role changed to viewer", auditType_string = "60", "Admin portal role revoked", auditType_string = "61", "Outbound JIT rule created", auditType_string = "62", "Outbound JIT rule deleted", auditType_string = "63", "Outbound JIT rule expired", auditType_string = "64", "Outbound MFA policy created", auditType_string = "65", "Outbound MFA policy deleted", auditType_string = "66", "Outbound MFA policy edited", auditType_string = "67", "Outbound JIT access rejected", auditType_string = "68", "Asset learning is done (network)", auditType_string = "69", "Asset learning (policy) is done (network)", auditType_string = "70", "Manual Linux asset created", auditType_string = "71", "Manual OT/IoT asset created", auditType_string = "72", "Asset learning extended (network)", auditType_string = "73", "Admin portal logon", auditType_string = "74", "Asset manager added", auditType_string = "75", "Asset manager removed", auditType_string = "76", "Asset is monitored by Cloud connector", auditType_string = "77", "Asset is no longer monitored by Cloud connector", auditType_string = "78", "Asset is monitored by Segment server", auditType_string = "79", "Asset is back to learning (network)", auditType_string = "80", "Manual OT/IoT asset edited", auditType_string = "81", "Admin portal role changed to operator", auditType_string = "82", "Segment server deployed", auditType_string = "83", "AI inbound allow rule rejected", auditType_string = "84", "AI inbound block rule rejected", auditType_string = "85", "AI outbound allow rule rejected", auditType_string = "86", "AI outbound block rule rejected", auditType_string = "87", "AI inbound allow rule approved", auditType_string = "88", "AI inbound block rule approved", auditType_string = "89", "AI outbound allow rule approved", auditType_string = "90", "AI outbound block rule approved", auditType_string = "91", "AI inbound allow rule approved with changes", auditType_string = "92", "AI inbound block rule approved with changes", auditType_string = "93", "AI outbound allow rule approved with changes", auditType_string = "94", "AI outbound block rule approved with changes", auditType_string = "95", "Connect region created", auditType_string = "96", "Connect session created", auditType_string = "97", "Connect session expired", auditType_string = "98", "Connect session revoked", auditType_string = "99", "Connect session logged out", auditType_string = "100", "User access configuration created", auditType_string = "101", "User access configuration edited", auditType_string = "102", "User access configuration deleted", auditType_string = "103", "Connect server deployed", auditType_string = "104", "Connect asset created", auditType_string = "105", "Asset segmentation postponed (network) (pending review rules)", auditType_string = "106", "Connect region edited", auditType_string = "107", "Connect server edited", auditType_string = "108", "Asset is being segmented (identity)", auditType_string = "109", "Asset segmented (identity)", auditType_string = "110", "Asset is being unsegmented (identity)", auditType_string = "111", "Asset unsegmented (identity)", auditType_string = "112", "Identity rule created", auditType_string = "113", "Identity rule deleted", auditType_string = "114", "Identity rule expired", auditType_string = "115", "Identity rule edited", auditType_string = "116", "User segmented (identity)", auditType_string = "117", "User unsegmented (identity)", auditType_string = "118", "User added to learning (identity)", auditType_string = "119", "User removed from learning (identity)", auditType_string = "120", "Asset added to RPC monitoring", auditType_string = "121", "Asset removed from RPC monitoring", auditType_string = "122", "User classification changed", auditType_string = "123", "Connect session extended", auditType_string = "124", "Asset marked as inactive by repository (deleted)", auditType_string = "125", "Asset marked as active by repository", auditType_string = "126", "Asset marked as inactive by user", auditType_string = "127", "Asset marked as active by user", auditType_string = "128", "Break glass configuration activated", auditType_string = "129", "Break glass configuration deactivated", auditType_string = "130", "Asset marked as inactive by repository (disable)", auditType_string = "131", "Asset marked as active by repository (enable)", auditType_string = "132", "Break glass configuration activated (asset)", auditType_string = "133", "Break glass configuration deactivated (asset)", auditType_string = "134", "Asset is being segmented (RPC)", auditType_string = "135", "Asset segmented (RPC)", auditType_string = "136", "Asset is being unsegmented (RPC)", auditType_string = "137", "Asset unsegmented (RPC)", auditType_string = "138", "RPC rule created", auditType_string = "139", "RPC rule deleted", auditType_string = "140", "RPC rule expired", auditType_string = "141", "RPC rule edited", auditType_string),
xdm.event.original_event_type = auditType_string,
xdm.event.operation_sub_type = if(enforcementSource_string = "1", "ReacticePolicy", enforcementSource_string = "2", "Automated", enforcementSource_string = "3", "AccessPortal", enforcementSource_string = "4", "AdminPortal", enforcementSource_string = "5", "AI", enforcementSource_string = "6", "API", enforcementSource_string = "7", "Setup", enforcementSource_string),
xdm.source.user.identifier = json_extract_scalar(performedBy, "$.id"),
xdm.source.user.username = json_extract_scalar(performedBy, "$.name"),
xdm.auth.privilege_level = if(userRole_normalized = "Admin", XDM_CONST.PRIVILEGE_LEVEL_ADMIN, userRole_normalized in("Viewer", "Regular"), XDM_CONST.PRIVILEGE_LEVEL_USER, null),
xdm.target.resource.parent_id = if(parentObjectId != null and parentObjectId != "", parentObjectId, null),
xdm.target.resource.id = if(reportedObjectId != null and reportedObjectId != "", reportedObjectId, reportedObjectId = null or reportedObjectId = "", destinationEntityIDs, null),
xdm.target.resource.name = if(reportedObjectId = null or reportedObjectId = "", destinationEntityNames, null),
xdm.source.ipv4 = if(json_extract_scalar(details, "$.publicIp") ~= "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}", json_extract_scalar(details, "$.publicIp"), null),
xdm.source.ipv6 = if(json_extract_scalar(details, "$.publicIp") ~= "(?:[a-fA-F\d]{0,4}\:){1,7}[a-fA-F\d]{0,4}", json_extract_scalar(details, "$.publicIp"), null);
// Network Activity logs
filter source_log_type = "network_activities"
| alter
protocol_string = to_string(protocol),
state_string = to_string(state),
src_assetType = to_string(json_extract_scalar(src, "$.assetType")),
dst_assetType = to_string(json_extract_scalar(dst, "$.assetType")),
inbound_rules_ids = arraymap(inboundRuleMatches -> [], json_extract_scalar("@element", "$.ruleId")),
outbound_rules_ids = arraymap(outboundRuleMatches -> [], json_extract_scalar("@element", "$.ruleId"))
| alter
xdm.event.type = source_log_type,
xdm.network.ip_protocol = if(protocol_string = "0", XDM_CONST.IP_PROTOCOL_HOPOPT, protocol_string = "1", XDM_CONST.IP_PROTOCOL_ICMP, protocol_string = "2", XDM_CONST.IP_PROTOCOL_IGMP, protocol_string = "3", XDM_CONST.IP_PROTOCOL_GGP, protocol_string = "4", XDM_CONST.IP_PROTOCOL_IP, protocol_string = "5", XDM_CONST.IP_PROTOCOL_ST, protocol_string = "6", XDM_CONST.IP_PROTOCOL_TCP, protocol_string = "7", XDM_CONST.IP_PROTOCOL_CBT, protocol_string = "8", XDM_CONST.IP_PROTOCOL_EGP, protocol_string = "9", XDM_CONST.IP_PROTOCOL_IGP, protocol_string = "10", XDM_CONST.IP_PROTOCOL_BBN_RCC_MON, protocol_string = "11", XDM_CONST.IP_PROTOCOL_NVP_II, protocol_string = "12", XDM_CONST.IP_PROTOCOL_PUP, protocol_string = "13", XDM_CONST.IP_PROTOCOL_ARGUS, protocol_string = "14", XDM_CONST.IP_PROTOCOL_EMCON, protocol_string = "15", XDM_CONST.IP_PROTOCOL_XNET, protocol_string = "16", XDM_CONST.IP_PROTOCOL_CHAOS, protocol_string = "17", XDM_CONST.IP_PROTOCOL_UDP, protocol_string = "18", XDM_CONST.IP_PROTOCOL_MUX, protocol_string = "19", XDM_CONST.IP_PROTOCOL_DCN_MEAS, protocol_string = "20", XDM_CONST.IP_PROTOCOL_HMP, protocol_string = "21", XDM_CONST.IP_PROTOCOL_PRM, protocol_string = "22", XDM_CONST.IP_PROTOCOL_XNS_IDP, protocol_string = "23", XDM_CONST.IP_PROTOCOL_TRUNK_1, protocol_string = "24", XDM_CONST.IP_PROTOCOL_TRUNK_2, protocol_string = "25", XDM_CONST.IP_PROTOCOL_LEAF_1, protocol_string = "26", XDM_CONST.IP_PROTOCOL_LEAF_2, protocol_string = "27", XDM_CONST.IP_PROTOCOL_RDP, protocol_string = "28", XDM_CONST.IP_PROTOCOL_IRTP, protocol_string = "29", XDM_CONST.IP_PROTOCOL_ISO_TP4, protocol_string = "30", XDM_CONST.IP_PROTOCOL_NETBLT, protocol_string = "31", XDM_CONST.IP_PROTOCOL_MFE_NSP, protocol_string = "32", XDM_CONST.IP_PROTOCOL_MERIT_INP, protocol_string = "33", XDM_CONST.IP_PROTOCOL_DCCP, protocol_string = "34", XDM_CONST.IP_PROTOCOL_3PC, protocol_string = "35", XDM_CONST.IP_PROTOCOL_IDPR, protocol_string = "36", XDM_CONST.IP_PROTOCOL_XTP, protocol_string = "37", XDM_CONST.IP_PROTOCOL_DDP, protocol_string = "38", XDM_CONST.IP_PROTOCOL_IDPR_CMTP, protocol_string = "39", XDM_CONST.IP_PROTOCOL_TP, protocol_string = "40", XDM_CONST.IP_PROTOCOL_IL, protocol_string = "41", XDM_CONST.IP_PROTOCOL_IPV6, protocol_string = "42", XDM_CONST.IP_PROTOCOL_SDRP, protocol_string = "43", XDM_CONST.IP_PROTOCOL_IPV6_ROUTE, protocol_string = "44", XDM_CONST.IP_PROTOCOL_IPV6_FRAG, protocol_string = "45", XDM_CONST.IP_PROTOCOL_IDRP, protocol_string = "46", XDM_CONST.IP_PROTOCOL_RSVP, protocol_string = "47", XDM_CONST.IP_PROTOCOL_GRE, protocol_string = "48", XDM_CONST.IP_PROTOCOL_DSR, protocol_string = "49", XDM_CONST.IP_PROTOCOL_BNA, protocol_string = "50", XDM_CONST.IP_PROTOCOL_ESP, protocol_string = "51", XDM_CONST.IP_PROTOCOL_AH, protocol_string = "52", XDM_CONST.IP_PROTOCOL_I_NLSP, protocol_string = "53", XDM_CONST.IP_PROTOCOL_SWIPE, protocol_string = "54", XDM_CONST.IP_PROTOCOL_NARP, protocol_string = "55", XDM_CONST.IP_PROTOCOL_MOBILE, protocol_string = "56", XDM_CONST.IP_PROTOCOL_TLSP, protocol_string = "57", XDM_CONST.IP_PROTOCOL_SKIP, protocol_string = "58", XDM_CONST.IP_PROTOCOL_IPV6_ICMP, protocol_string = "59", XDM_CONST.IP_PROTOCOL_IPV6_NONXT, protocol_string = "60", XDM_CONST.IP_PROTOCOL_IPV6_OPTS, protocol_string = "62", XDM_CONST.IP_PROTOCOL_CFTP, protocol_string = "64", XDM_CONST.IP_PROTOCOL_SAT_EXPAK, protocol_string = "65", XDM_CONST.IP_PROTOCOL_KRYPTOLAN, protocol_string = "66", XDM_CONST.IP_PROTOCOL_RVD, protocol_string = "67", XDM_CONST.IP_PROTOCOL_IPPC, protocol_string = "69", XDM_CONST.IP_PROTOCOL_SAT_MON, protocol_string = "70", XDM_CONST.IP_PROTOCOL_VISA, protocol_string = "71", XDM_CONST.IP_PROTOCOL_IPCV, protocol_string = "72", XDM_CONST.IP_PROTOCOL_CPNX, protocol_string = "73", XDM_CONST.IP_PROTOCOL_CPHB, protocol_string = "74", XDM_CONST.IP_PROTOCOL_WSN, protocol_string = "75", XDM_CONST.IP_PROTOCOL_PVP, protocol_string = "76", XDM_CONST.IP_PROTOCOL_BR_SAT_MON, protocol_string = "77", XDM_CONST.IP_PROTOCOL_SUN_ND, protocol_string = "78", XDM_CONST.IP_PROTOCOL_WB_MON, protocol_string = "79", XDM_CONST.IP_PROTOCOL_WB_EXPAK, protocol_string = "80", XDM_CONST.IP_PROTOCOL_ISO_IP, protocol_string = "81", XDM_CONST.IP_PROTOCOL_VMTP, protocol_string = "82", XDM_CONST.IP_PROTOCOL_SECURE_VMTP, protocol_string = "83", XDM_CONST.IP_PROTOCOL_VINES, protocol_string = "84", XDM_CONST.IP_PROTOCOL_TTP, protocol_string = "85", XDM_CONST.IP_PROTOCOL_NSFNET_IGP, protocol_string = "86", XDM_CONST.IP_PROTOCOL_DGP, protocol_string = "87", XDM_CONST.IP_PROTOCOL_TCF, protocol_string = "88", XDM_CONST.IP_PROTOCOL_EIGRP, protocol_string = "89", XDM_CONST.IP_PROTOCOL_OSPFIGP, protocol_string = "90", XDM_CONST.IP_PROTOCOL_SPRITE_RPC, protocol_string = "91", XDM_CONST.IP_PROTOCOL_LARP, protocol_string = "92", XDM_CONST.IP_PROTOCOL_MTP, protocol_string = "93", XDM_CONST.IP_PROTOCOL_AX25, protocol_string = "94", XDM_CONST.IP_PROTOCOL_IPIP, protocol_string = "95", XDM_CONST.IP_PROTOCOL_MICP, protocol_string = "96", XDM_CONST.IP_PROTOCOL_SCC_SP, protocol_string = "97", XDM_CONST.IP_PROTOCOL_ETHERIP, protocol_string = "98", XDM_CONST.IP_PROTOCOL_ENCAP, protocol_string = "100", XDM_CONST.IP_PROTOCOL_GMTP, protocol_string = "101", XDM_CONST.IP_PROTOCOL_IFMP, protocol_string = "102", XDM_CONST.IP_PROTOCOL_PNNI, protocol_string = "103", XDM_CONST.IP_PROTOCOL_PIM, protocol_string = "104", XDM_CONST.IP_PROTOCOL_ARIS, protocol_string = "105", XDM_CONST.IP_PROTOCOL_SCPS, protocol_string = "106", XDM_CONST.IP_PROTOCOL_QNX, protocol_string = "107", XDM_CONST.IP_PROTOCOL_AN, protocol_string = "108", XDM_CONST.IP_PROTOCOL_IPCOMP, protocol_string = "109", XDM_CONST.IP_PROTOCOL_SNP, protocol_string = "110", XDM_CONST.IP_PROTOCOL_COMPAQ_PEER, protocol_string = "111", XDM_CONST.IP_PROTOCOL_IPX_IN_IP, protocol_string = "112", XDM_CONST.IP_PROTOCOL_VRRP, protocol_string = "113", XDM_CONST.IP_PROTOCOL_PGM, protocol_string = "115", XDM_CONST.IP_PROTOCOL_L2TP, protocol_string = "116", XDM_CONST.IP_PROTOCOL_DDX, protocol_string = "117", XDM_CONST.IP_PROTOCOL_IATP, protocol_string = "118", XDM_CONST.IP_PROTOCOL_STP, protocol_string = "119", XDM_CONST.IP_PROTOCOL_SRP, protocol_string = "120", XDM_CONST.IP_PROTOCOL_UTI, protocol_string = "121", XDM_CONST.IP_PROTOCOL_SMP, protocol_string = "122", XDM_CONST.IP_PROTOCOL_SM, protocol_string = "123", XDM_CONST.IP_PROTOCOL_PTP, protocol_string = "124", XDM_CONST.IP_PROTOCOL_ISIS, protocol_string = "125", XDM_CONST.IP_PROTOCOL_FIRE, protocol_string = "126", XDM_CONST.IP_PROTOCOL_CRTP, protocol_string = "127", XDM_CONST.IP_PROTOCOL_CRUDP, protocol_string = "128", XDM_CONST.IP_PROTOCOL_SSCOPMCE, protocol_string = "129", XDM_CONST.IP_PROTOCOL_IPLT, protocol_string = "130", XDM_CONST.IP_PROTOCOL_SPS, protocol_string = "131", XDM_CONST.IP_PROTOCOL_PIPE, protocol_string = "132", XDM_CONST.IP_PROTOCOL_SCTP, protocol_string = "133", XDM_CONST.IP_PROTOCOL_FC, protocol_string = "134", XDM_CONST.IP_PROTOCOL_RSVP_E2E_IGNORE, protocol_string = "135", XDM_CONST.IP_PROTOCOL_MOBILITY, protocol_string = "136", XDM_CONST.IP_PROTOCOL_UDPLITE, protocol_string = "137", XDM_CONST.IP_PROTOCOL_MPLS_IN_IP, protocol_string = "138", XDM_CONST.IP_PROTOCOL_MANET, protocol_string = "139", XDM_CONST.IP_PROTOCOL_HIP, protocol_string = "140", XDM_CONST.IP_PROTOCOL_SHIM6, protocol_string = "141", XDM_CONST.IP_PROTOCOL_WESP, protocol_string = "142", XDM_CONST.IP_PROTOCOL_ROHC, protocol_string = "255", XDM_CONST.IP_PROTOCOL_RESERVED, to_string(protocol_string)),
xdm.observer.action = if(state_string = "1", "Blocked", state_string = "2", "Requested", state_string = "3", "Established", state_string = "4", "Blocked At Source", state_string = "5", "Blocked By Third Party", state_string = "6", "Blocked At Source By Third Party", state_string),
xdm.event.outcome_reason = to_string(reason),
xdm.source.host.device_id = if(json_extract_scalar(src, "$.assetId") != "", json_extract_scalar(src, "$.assetId"), null),
xdm.source.host.device_category = if(src_assetType = "1", "Client", src_assetType = "2", "Server", src_assetType = "3", "Virtual cluster", src_assetType = "4", "IP camera", src_assetType = "5", "Smart TV", src_assetType = "6", "Factory controller", src_assetType = "7", "Medical device", src_assetType = "8", "Printer", src_assetType = "9", "Scanner", src_assetType = "10", "Smart card reader", src_assetType = "11", "Router", src_assetType = "12", "Hypervisor", src_assetType = "13", "PLC", src_assetType = "14", "HMI", src_assetType = "15", "Switch", src_assetType = "16", "Terminal station", src_assetType = "17", "RTU", src_assetType = "18", "Wireless access point", src_assetType = "19", "Historian", src_assetType = "20", "Game console", src_assetType = "21", "Fire alarm", src_assetType = "22", "UPS", src_assetType = "23", "Storage appliance", src_assetType = "24", "Virtualization appliance", src_assetType = "25", "Firewall appliance", src_assetType = "26", "Security scanner", src_assetType = "27", "Security controller", src_assetType = "28", "Door lock", src_assetType = "29", "Biometric entry system", src_assetType = "30", "HVAC", src_assetType = "31", "Room scheduler", src_assetType = "32", "Load Balancer Appliance", src_assetType = "33", "WAN Concentrator", src_assetType = "34", "IPAM Appliance", src_assetType),
xdm.source.host.fqdn = if(json_extract_scalar(src, "$.fqdn") != "", json_extract_scalar(src, "$.fqdn"), null),
xdm.source.ipv4 = if(json_extract_scalar(src, "$.ip") ~= "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}", json_extract_scalar(src, "$.ip"), null),
xdm.source.ipv6 = if(json_extract_scalar(src, "$.ip") ~= "(?:[a-fA-F\d]{0,4}\:){1,7}[a-fA-F\d]{0,4}", json_extract_scalar(src, "$.ip"), null),
xdm.source.port = to_integer(json_extract_scalar(src, "$.port")),
xdm.source.process.pid = to_integer(json_extract_scalar(src, "$.processId")),
xdm.source.process.name = if(json_extract_scalar(src, "$.processName") != "", json_extract_scalar(src, "$.processName"), null),
xdm.source.process.executable.path = if(json_extract_scalar(src, "$.processPath") != "", json_extract_scalar(src, "$.processPath"), null),
xdm.source.user.identifier = if(json_extract_scalar(src, "$.userId") != "", json_extract_scalar(src, "$.userId"), null),
xdm.source.user.username = if(json_extract_scalar(src, "$.userName") contains """\\""", arrayindex(regextract(json_extract_scalar(src, "$.userName"), "[^\\]+\\([^\\]+)"), 0), json_extract_scalar(src, "$.userName") != "", json_extract_scalar(src, "$.userName"), null),
xdm.source.user.domain = if(arrayindex(regextract(json_extract_scalar(src, "$.userName"), """([^\\\\]+)\\\\"""), 0) != "", arrayindex(regextract(json_extract_scalar(src, "$.userName"), "([^\\]+)\\"), 0), null),
xdm.target.host.device_id = if(json_extract_scalar(dst, "$.assetId") != "", json_extract_scalar(dst, "$.assetId"), null),
xdm.target.host.device_category = if(dst_assetType = "1", "Client", dst_assetType = "2", "Server", dst_assetType = "3", "Virtual cluster", dst_assetType = "4", "IP camera", dst_assetType = "5", "Smart TV", dst_assetType = "6", "Factory controller", dst_assetType = "7", "Medical device", dst_assetType = "8", "Printer", dst_assetType = "9", "Scanner", dst_assetType = "10", "Smart card reader", dst_assetType = "11", "Router", dst_assetType = "12", "Hypervisor", dst_assetType = "13", "PLC", dst_assetType = "14", "HMI", dst_assetType = "15", "Switch", dst_assetType = "16", "Terminal station", dst_assetType = "17", "RTU", dst_assetType = "18", "Wireless access point", dst_assetType = "19", "Historian", dst_assetType = "20", "Game console", dst_assetType = "21", "Fire alarm", dst_assetType = "22", "UPS", dst_assetType = "23", "Storage appliance", dst_assetType = "24", "Virtualization appliance", dst_assetType = "25", "Firewall appliance", dst_assetType = "26", "Security scanner", dst_assetType = "27", "Security controller", dst_assetType = "28", "Door lock", dst_assetType = "29", "Biometric entry system", dst_assetType = "30", "HVAC", dst_assetType = "31", "Room scheduler", dst_assetType = "32", "Load Balancer Appliance", dst_assetType = "33", "WAN Concentrator", dst_assetType = "34", "IPAM Appliance", dst_assetType),
xdm.target.host.fqdn = if(json_extract_scalar(dst, "$.fqdn") != "", json_extract_scalar(dst, "$.fqdn"), null),
xdm.target.ipv4 = if(json_extract_scalar(dst, "$.ip") ~= "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}", json_extract_scalar(dst, "$.ip"), null),
xdm.target.ipv6 = if(json_extract_scalar(dst, "$.ip") ~= "(?:[a-fA-F\d]{0,4}\:){1,7}[a-fA-F\d]{0,4}", json_extract_scalar(dst, "$.ip"), null),
xdm.target.port = to_integer(json_extract_scalar(dst, "$.port")),
xdm.target.process.pid = to_integer(json_extract_scalar(dst, "$.processId")),
xdm.target.process.name = if(json_extract_scalar(dst, "$.processName") != "", json_extract_scalar(dst, "$.processName"), null),
xdm.target.process.executable.path = if(json_extract_scalar(dst, "$.processPath") != "", json_extract_scalar(dst, "$.processPath"), null),
xdm.target.user.identifier = if(json_extract_scalar(dst, "$.userId") != "", json_extract_scalar(dst, "$.userId"), null),
xdm.target.user.username = if(json_extract_scalar(dst, "$.userName") contains """\\""", arrayindex(regextract(json_extract_scalar(dst, "$.userName"), "[^\\]+\\([^\\]+)"), 0), json_extract_scalar(dst, "$.userName") != "", json_extract_scalar(dst, "$.userName"), null),
xdm.target.user.domain = if(arrayindex(regextract(json_extract_scalar(dst, "$.userName"), """([^\\\\]+)\\\\"""), 0) != "", arrayindex(regextract(json_extract_scalar(dst, "$.userName"), "([^\\]+)\\"), 0), null),
xdm.network.rule = if(arraystring(arrayconcat(inbound_rules_ids, outbound_rules_ids), ", ") != "", arraystring(arrayconcat(inbound_rules_ids, outbound_rules_ids), ", "), null);