Zscaler Internet Access Modeling Rule

Details

ID	`zscaler_internet_access_modeling_rule`
From Version	6.8.0
To Version	6.9.9
Tags	Zscaler Internet Access

Rules (XIF)

[MODEL: dataset=zscaler_nssweblog_raw, model=Network]
alter XDM.Network.session_context_id=externalId ,
XDM.Network.Observer.action = act,
XDM.Network.outcome = outcome,
XDM.Network.reason=reason,
XDM.Network.http.method = requestMethod,
XDM.Network.http.url=request,
XDM.Network.Source.host.hostname = devicehostname,
XDM.Network.Source.host.ipv4_addresses=arraycreate(coalesce(src, "")),
XDM.Network.Destination.host.ipv4_addresses=arraycreate(coalesce(dst, "")),
XDM.Network.application_protocol_category=cat,
XDM.Network.protocol_layers=arraycreate(coalesce(app, "")),
XDM.Network.Source.user.username=suser,
XDM.Network.Source.zone=spriv,
XDM.Network.http.domain=dhost,
XDM.Network.http.response_code=outcome,
XDM.Network.Destination.bytes=to_integer(out),
XDM.Network.http.url_category=cs2,
XDM.Network.http.content_type=contenttype,
XDM.Network.threat.category=cs4,
XDM.Network.threat.name=cs5,
XDM.Network.threat.severity=to_string(cn1),
XDM.Network.Observer.name = _reporting_device_name ,
XDM.Network.http.user_agent = requestClientApplication,
XDM.Network.Destination.interface = destinationServiceName,
XDM.Network.Source.ipv4 = sourceTranslatedAddress, 
XDM.Network.original_event_type = ZscalerNSSWeblogURLClass, 
XDM.Network.Observer.product = _product,
XDM.Network.Observer.vendor = _vendor,
XDM.Network.Destination.process.executable.file_type = fileType;

Schema

`zscaler_nssweblog_raw`

Field	Type	Array?
`ZscalerNSSWeblogURLClass`	string	—
`_product`	string	—
`_reporting_device_name`	string	—
`_vendor`	string	—
`act`	string	—
`app`	string	—
`cat`	string	—
`cn1`	string	—
`contenttype`	string	—
`cs2`	string	—
`cs4`	string	—
`cs5`	string	—
`destinationServiceName`	string	—
`devicehostname`	string	—
`dhost`	string	—
`dst`	string	—
`externalId`	string	—
`fileType`	string	—
`out`	string	—
`outcome`	string	—
`reason`	string	—
`request`	string	—
`requestClientApplication`	string	—
`requestMethod`	string	—
`sourceTranslatedAddress`	string	—
`spriv`	string	—
`src`	string	—
`suser`	string	—

Raw JSON

{
  "zscaler_nssweblog_raw": {
      "externalId": {
        "type": "string",
        "is_array": false
      },
      "act": {
        "type": "string",
        "is_array": false
      },
      "reason": {
        "type": "string",
        "is_array": false
      },
      "requestMethod": {
        "type": "string",
        "is_array": false
      },
      "request": {
        "type": "string",
        "is_array": false
      },
      "devicehostname": {
        "type": "string",
        "is_array": false
      },
      "src": {
        "type": "string",
        "is_array": false
      },
      "dst": {
        "type": "string",
        "is_array": false
      },
      "cat": {
        "type": "string",
        "is_array": false
      },
      "app": {
        "type": "string",
        "is_array": false
      },
      "suser": {
        "type": "string",
        "is_array": false
      },
      "spriv": {
        "type": "string",
        "is_array": false
      },
      "dhost": {
        "type": "string",
        "is_array": false
      },
      "outcome": {
        "type": "string",
        "is_array": false
      },
      "out": {
        "type": "string",
        "is_array": false
      },
      "cs2": {
        "type": "string",
        "is_array": false
      },
      "contenttype": {
        "type": "string",
        "is_array": false
      },
      "cs4": {
        "type": "string",
        "is_array": false
      },
      "cs5": {
        "type": "string",
        "is_array": false
      },
      "cn1": {
        "type": "string",
        "is_array": false
      },
      "_reporting_device_name": {
        "type": "string",
        "is_array": false
      },
      "requestClientApplication": {
        "type": "string",
        "is_array": false
      },
      "destinationServiceName": {
        "type": "string",
        "is_array": false
      },
      "sourceTranslatedAddress": {
        "type": "string",
        "is_array": false
      },
      "ZscalerNSSWeblogURLClass": {
        "type": "string",
        "is_array": false
      },
      "_product": {
        "type": "string",
        "is_array": false
      },
      "_vendor": {
        "type": "string",
        "is_array": false
      },
      "fileType": {
        "type": "string",
        "is_array": false
      }
  }
}