Zoom Modeling Rule

Details

ID	`Zoom_ModelingRule`
From Version	6.10.0
Tags	Zoom

Schema

`zoom_zoom_raw`

Field	Type	Array?
`action`	string	—
`category_type`	string	—
`client_type`	string	—
`email`	string	—
`event_type`	string	—
`ip_address`	string	—
`operation_detail`	string	—
`operator`	string	—
`time`	string	—
`type`	string	—
`version`	string	—

Source

Zoom.xif Zoom.yml Zoom_schema.json

Download History Raw

[MODEL: dataset=zoom_zoom_raw]
filter
    event_type = "operation_log"
| alter
    xdm.event.type = event_type,
	xdm.source.user.upn = operator,
	xdm.event.original_event_type = category_type,
	xdm.event.description = operation_detail,
	xdm.event.outcome_reason = action;

filter
    event_type = "activity_log"
| alter
    xdm.event.type = event_type,
	xdm.source.user.upn = email,
	xdm.event.operation = type,
	xdm.source.ipv4 = ip_address,
	xdm.source.interface = client_type,
	xdm.observer.version = version;