Zoom Modeling Rule

Details

ID	`Zoom_ModelingRule`
From Version	6.10.0
Tags	Zoom

Rules (XIF)

[MODEL: dataset=zoom_zoom_raw]
filter
    event_type = "operation_log"
| alter
    xdm.event.type = event_type,
	xdm.source.user.upn = operator,
	xdm.event.original_event_type = category_type,
	xdm.event.description = operation_detail,
	xdm.event.outcome_reason = action;

filter
    event_type = "activity_log"
| alter
    xdm.event.type = event_type,
	xdm.source.user.upn = email,
	xdm.event.operation = type,
	xdm.source.ipv4 = ip_address,
	xdm.source.interface = client_type,
	xdm.observer.version = version;

Schema

`zoom_zoom_raw`

Field	Type	Array?
`action`	string	—
`category_type`	string	—
`client_type`	string	—
`email`	string	—
`event_type`	string	—
`ip_address`	string	—
`operation_detail`	string	—
`operator`	string	—
`time`	string	—
`type`	string	—
`version`	string	—

Raw JSON

{
    "zoom_zoom_raw": {
        "time": {
            "type": "string",
            "is_array": false
        },
        "operator": {
            "type": "string",
            "is_array": false
        },
        "category_type": {
            "type": "string",
            "is_array": false
        },
        "operation_detail": {
            "type": "string",
            "is_array": false
        },
        "action": {
            "type": "string",
            "is_array": false
        },
        "email": {
            "type": "string",
            "is_array": false
        },
        "type": {
            "type": "string",
            "is_array": false
        },
        "ip_address": {
            "type": "string",
            "is_array": false
        },
        "client_type": {
            "type": "string",
            "is_array": false
        },
        "version": {
            "type": "string",
            "is_array": false
        },
        "event_type": {
            "type": "string",
            "is_array": false
        }
    }
}