Rules (XIF)
[MODEL: dataset=cisco_ise_raw]
// CISE_Passed_Authentications, CISE_Failed_Attempts, CISE_RADIUS_Diagnostics, CISE_RADIUS_Accounting, CISE_TACACS_Accounting Parsing
/* --------------------------------------------------------------------------------
Key_Values
- Acct-Input-Packets=
- Acct-Output-Packets=
- Acct-Session-Id=
- Acct-Status-Type=
- AcsSessionID=
- Authen-Method=
- AuthenticationMethod=
- Called-Station-ID=
- Calling-Station-ID=
- CmdSet=
- DestinationIPAddress=
- DestinationPort=
- Device IP Address=
- Device Port=
- Device Type=
- EapAuthentication=
- EndPointMACAddress=
- FailureReason=
- Framed-IP-Address=
- IdentityPolicyMatchedRule=
- NAS-IP-Address=
- NAS-Port=
- NAS-Port-Id=
- NetworkDeviceGroups=
- NetworkDeviceName=
- Privilege-Level=
- Protocol=
- Remote-Address=
- Service=
- Service-Argument=
- User-Name=
- UserName=
- User=
-------------------------------------------------------------------------------*/
alter
logType = arrayindex(regextract(_raw_log, "<\d+>\w+\s*\d+\s\d+:\d+:\d+\s[\S]+\s(\w+)\s"),0)
| filter logType in ("CISE_Passed_Authentications", "CISE_Failed_Attempts", "CISE_RADIUS_Diagnostics", "CISE_RADIUS_Accounting", "CISE_TACACS_Accounting")
| alter
Acct_Input_Packets = arrayindex(regextract(_raw_log, "Acct-Input-Packets=([^\,\;]+)"),0),
Acct_Output_Packets = arrayindex(regextract(_raw_log, "Acct-Output-Packets=([^\,\;]+)"),0),
Acct_Session_Id = arrayindex(regextract(_raw_log, "Acct-Session-Id=([^\,\;]+)"),0),
Acct_Status_Type = arrayindex(regextract(_raw_log, "Acct-Status-Type=([^\,\;]+)"),0),
AcsSessionID = arrayindex(regextract(_raw_log, "AcsSessionID=([^\,]+)"),0),
AuthenticationMethod = arrayindex(regextract(_raw_log, "AuthenticationMethod=([^\,;]+)"),0),
Authen_Method = arrayindex(regextract(_raw_log, "Authen-Method=([^\,;]+)"),0),
Called_Station_ID_ipv4 = arrayindex(regextract(_raw_log, "Called-Station-ID=(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"),0),
Called_Station_ID_ipv6 = arrayindex(regextract(_raw_log, "Called-Station-ID=((?:(?:[A-Fa-f0-9]{1,4}:){7}[A-Fa-f0-9]{1,4}|(?:[A-Fa-f0-9]{1,4}:){1,7}:|(?:[A-Fa-f0-9]{1,4}:){1,6}:[A-Fa-f0-9]{1,4}|(?:[A-Fa-f0-9]{1,4}:){1,5}(?::[A-Fa-f0-9]{1,4}){1,2}|(?:[A-Fa-f0-9]{1,4}:){1,4}(?::[A-Fa-f0-9]{1,4}){1,3}|(?:[A-Fa-f0-9]{1,4}:){1,3}(?::[A-Fa-f0-9]{1,4}){1,4}|(?:[A-Fa-f0-9]{1,4}:){1,2}(?::[A-Fa-f0-9]{1,4}){1,5}|[A-Fa-f0-9]{1,4}:(?:(?::[A-Fa-f0-9]{1,4}){1,6})|:(?::[A-Fa-f0-9]{1,4}){1,7}|::))"),0),
Called_Station_ID_mac = arrayindex(regextract(_raw_log, "Called-Station-ID=(\S{2}[:-]\S{2}[:-]\S{2}[:-]\S{2}[:-]\S{2}[:-]\S{2}|[a-fA-F\d]{12})"), 0),
Calling_Station_ID_ipv4 = arrayindex(regextract(_raw_log, "Calling-Station-ID=(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"),0),
Calling_Station_ID_ipv6 = arrayindex(regextract(_raw_log, "Calling-Station-ID=((?:(?:[A-Fa-f0-9]{1,4}:){7}[A-Fa-f0-9]{1,4}|(?:[A-Fa-f0-9]{1,4}:){1,7}:|(?:[A-Fa-f0-9]{1,4}:){1,6}:[A-Fa-f0-9]{1,4}|(?:[A-Fa-f0-9]{1,4}:){1,5}(?::[A-Fa-f0-9]{1,4}){1,2}|(?:[A-Fa-f0-9]{1,4}:){1,4}(?::[A-Fa-f0-9]{1,4}){1,3}|(?:[A-Fa-f0-9]{1,4}:){1,3}(?::[A-Fa-f0-9]{1,4}){1,4}|(?:[A-Fa-f0-9]{1,4}:){1,2}(?::[A-Fa-f0-9]{1,4}){1,5}|[A-Fa-f0-9]{1,4}:(?:(?::[A-Fa-f0-9]{1,4}){1,6})|:(?::[A-Fa-f0-9]{1,4}){1,7}|::))"),0),
Calling_Station_ID_mac = arrayindex(regextract(_raw_log, "Calling-Station-ID=(\S{2}[:-]\S{2}[:-]\S{2}[:-]\S{2}[:-]\S{2}[:-]\S{2}|[a-fA-F\d]{12})"),0),
CmdSet = arrayindex(regextract(_raw_log, "CmdSet=([^\,;]+)"),0),
Description1 = arrayindex(regextract(_raw_log, "(?:DEBUG|INFO|WARN|ERROR|FATAL|CRITICAL|NOTICE)\s*([^:]+\:\s+[^,]+)"), 0),
Description2 = arrayindex(regextract(_raw_log, "<\d+>\w+\s*\d+\s\d+:\d+:\d+\s\S+\s\w+\s\d+\s+(.*)"), 0),
DestinationIPAddress_ipv4 = arrayindex(regextract(_raw_log, "DestinationIPAddress=(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}),"),0),
DestinationIPAddress_ipv6 = arrayindex(regextract(_raw_log, "DestinationIPAddress=((?:[a-fA-F\d]{0,4}\:){2,7}[a-fA-F\d]{0,4}),"),0),
DestinationPort = arrayindex(regextract(_raw_log, "DestinationPort=(\d+),"),0),
DeviceIPAddress_ipv4 = arrayindex(regextract(_raw_log, "Device IP Address=(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}),"),0),
DeviceIPAddress_ipv6 = arrayindex(regextract(_raw_log, "Device IP Address=((?:[a-fA-F\d]{0,4}\:){2,7}[a-fA-F\d]{0,4}),"),0),
Device_Port = arrayindex(regextract(_raw_log, "Device Port=([^\,\;]+)"),0),
Device_Type = arrayindex(regextract(_raw_log, "Device Type=Device Type#([^\,]+)"), 0),
EapAuthentication = arrayindex(regextract(_raw_log, "EapAuthentication=([^\,]+)"),0),
EndPointMACAddress = arrayindex(regextract(_raw_log, "EndPointMACAddress=([^\,]+)"),0),
FailureReason = arrayindex(regextract(_raw_log, "FailureReason=([^\,]+)"),0),
framedIP_ipv4 = arrayindex(regextract(_raw_log, "Framed-IP-Address=(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}),"),0),
framedIP_ipv6 = arrayindex(regextract(_raw_log, "Framed-IP-Address=((?:[a-fA-F\d]{0,4}\:){2,7}[a-fA-F\d]{0,4}),"),0),
IdentityPolicyMatchedRule = arrayindex(regextract(_raw_log, "IdentityPolicyMatchedRule=([^\,]+)"),0),
logSeverity = lowercase(arrayindex(regextract(_raw_log, "\s+(DEBUG|INFO|WARN|ERROR|FATAL|CRITICAL|NOTICE)[\s:]+"),0)),
NAS_IP_Address_ipv4 = arrayindex(regextract(_raw_log, "NAS-IP-Address=(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}),"),0),
NAS_IP_Address_ipv6 = arrayindex(regextract(_raw_log, "NAS-IP-Address=((?:[a-fA-F\d]{0,4}\:){2,7}[a-fA-F\d]{0,4}),"),0),
NAS_Port = arrayindex(regextract(_raw_log, "NAS-Port=(\d+),"),0),
NAS_Port_Id = arrayindex(regextract(_raw_log, "NAS-Port-Id=([^\,\;]+)"),0),
NetworkDeviceGroups_DeviceType = arrayindex(regextract(_raw_log, "NetworkDeviceGroups=Device Type#([^\,]+)"), 0),
NetworkDeviceName = arrayindex(regextract(_raw_log, "NetworkDeviceName=([^,]+),"),0),
Privilege_Level = arrayindex(regextract(_raw_log, "Privilege-Level=([^\,;]+)"),0),
Protocol = arrayindex(regextract(_raw_log, "Protocol=([^,]+),"),0),
Remote_Address_ipv4 = arrayindex(regextract(_raw_log, "Remote-Address=(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}),"),0),
Remote_Address_ipv6 = arrayindex(regextract(_raw_log, "Remote-Address=((?:[a-fA-F\d]{0,4}\:){2,7}[a-fA-F\d]{0,4}),"),0),
Service = arrayindex(regextract(_raw_log, "Service=([^\,;]+)"),0),
Service_Argument = arrayindex(regextract(_raw_log, "Service-Argument=([^\,;]+)"),0),
User = arrayindex(regextract(_raw_log, "User=([^\,;]+)"),0),
UserName1 = arrayindex(regextract(_raw_log, "User-Name=([a-zA-Z0-9\@\-\\\/\\\._]+)"),0),
UserName2 = arrayindex(regextract(_raw_log, "UserName=([a-zA-Z0-9\@\-\\\/\\\._]+)"),0)
| alter
Remote_Address_Hostname = if(Remote_Address_ipv4 = null and Remote_Address_ipv6 = null, arrayindex(regextract(_raw_log, "Remote-Address=([^,]+),"),0), null),
SourceIPv4_type_identifier = if(Calling_Station_ID_ipv4 != null, "Calling_Station_ID", Remote_Address_ipv4 != null, "Remote_Address", framedIP_ipv4 != null, "framedIP", DeviceIPAddress_ipv4 != null, "DeviceIPAddress", NAS_IP_Address_ipv4 != null, "NAS_IP_Address", null),
SourceIPv6_type_identifier = if(Calling_Station_ID_ipv6 != null, "Calling_Station_ID", Remote_Address_ipv6 != null, "Remote_Address", framedIP_ipv6 != null, "framedIP", DeviceIPAddress_ipv6 != null, "DeviceIPAddress", NAS_IP_Address_ipv6 != null, "NAS_IP_Address", null)
| alter
xdm.observer.name = arrayindex(regextract(_raw_log, "<\d+>\w+\s*\d+\s\d+:\d+:\d+\s([\S]+)"),0),
xdm.event.type = logType,
xdm.event.description = coalesce(Description1, Description2),
xdm.event.log_level = if(logSeverity ~= "debug", XDM_CONST.LOG_LEVEL_DEBUG, logSeverity ~= "info", XDM_CONST.LOG_LEVEL_INFORMATIONAL, logSeverity ~= "warn", XDM_CONST.LOG_LEVEL_WARNING, logSeverity ~= "error", XDM_CONST.LOG_LEVEL_ERROR, logSeverity = "fatal", XDM_CONST.LOG_LEVEL_EMERGENCY, logSeverity ~= "critical", XDM_CONST.LOG_LEVEL_CRITICAL, logSeverity ~= "notice", XDM_CONST.LOG_LEVEL_NOTICE, logSeverity = null, null, XDM_CONST.LOG_LEVEL_NOTICE),
xdm.event.original_event_type = arrayindex(regextract(_raw_log, "(\d+)\s(?:DEBUG|INFO|WARN|ERROR|FATAL|CRITICAL|NOTICE)"),0),
xdm.event.id = arrayindex(regextract(_raw_log, "<\d+>\w+\s*\d+\s\d+:\d+:\d+\s[\S]+\s\w+\s(\d+)"),0),
xdm.event.outcome = if(Description1 ~= "[Ss][Uu][Cc][Cc][Ee]", XDM_CONST.OUTCOME_SUCCESS, Description1 ~= "[Ff][Aa][Ii][Ll]", XDM_CONST.OUTCOME_FAILED, null),
xdm.event.outcome_reason = FailureReason,
xdm.event.operation = Service,
xdm.event.operation_sub_type = coalesce(Acct_Status_Type, Service_Argument),
xdm.source.host.hostname = if(SourceIPv4_type_identifier in("DeviceIPAddress", "NAS_IP_Address") or SourceIPv6_type_identifier in ("DeviceIPAddress", "NAS_IP_Address"), NetworkDeviceName, Remote_Address_Hostname),
xdm.source.ipv4 = coalesce(Calling_Station_ID_ipv4, Remote_Address_ipv4, framedIP_ipv4, DeviceIPAddress_ipv4, NAS_IP_Address_ipv4),
xdm.source.ipv6 = coalesce(Calling_Station_ID_ipv6, Remote_Address_ipv6, framedIP_ipv6, DeviceIPAddress_ipv6, NAS_IP_Address_ipv6),
xdm.source.port = if(SourceIPv4_type_identifier in ("DeviceIPAddress", "NAS_IP_Address") or SourceIPv6_type_identifier in ("DeviceIPAddress", "NAS_IP_Address"), coalesce(to_integer(Device_Port), to_integer(NAS_Port)), null),
xdm.source.process.command_line = CmdSet,
xdm.source.interface = NAS_Port_Id,
xdm.source.host.mac_addresses = arraydistinct(arraycreate(EndPointMACAddress, Calling_Station_ID_mac)),
xdm.source.host.device_category = if(SourceIPv4_type_identifier in("DeviceIPAddress", "NAS_IP_Address") or SourceIPv6_type_identifier in ("DeviceIPAddress", "NAS_IP_Address"), coalesce(Device_Type, NetworkDeviceGroups_DeviceType), null),
xdm.source.user.username = coalesce(UserName1, UserName2, User),
xdm.source.sent_packets = to_integer(Acct_Output_Packets),
xdm.intermediate.host.hostname = if((SourceIPv4_type_identifier not in ("DeviceIPAddress", "NAS_IP_Address") or SourceIPv4_type_identifier = null) and (SourceIPv6_type_identifier not in ("DeviceIPAddress", "NAS_IP_Address") or SourceIPv6_type_identifier = null), NetworkDeviceName, null),
xdm.intermediate.ipv4 = if(SourceIPv4_type_identifier in ("Calling_Station_ID", "Remote_Address"), coalesce(framedIP_ipv4, DeviceIPAddress_ipv4, NAS_IP_Address_ipv4), SourceIPv4_type_identifier = "framedIP", coalesce(DeviceIPAddress_ipv4, NAS_IP_Address_ipv4), null),
xdm.intermediate.ipv6 = if(SourceIPv6_type_identifier in ("Calling_Station_ID", "Remote_Address"), coalesce(framedIP_ipv6, DeviceIPAddress_ipv6, NAS_IP_Address_ipv6), SourceIPv6_type_identifier = "framedIP", coalesce(DeviceIPAddress_ipv6, NAS_IP_Address_ipv6), null),
xdm.intermediate.port = if((SourceIPv4_type_identifier not in ("DeviceIPAddress", "NAS_IP_Address") or SourceIPv4_type_identifier = null) and (SourceIPv6_type_identifier not in ("DeviceIPAddress", "NAS_IP_Address") or SourceIPv6_type_identifier = null), coalesce(to_integer(NAS_Port), to_integer(Device_Port)), null),
xdm.intermediate.host.device_category = if((SourceIPv4_type_identifier not in ("DeviceIPAddress", "NAS_IP_Address") or SourceIPv4_type_identifier = null) and (SourceIPv6_type_identifier not in ("DeviceIPAddress", "NAS_IP_Address") or SourceIPv6_type_identifier = null), coalesce(Device_Type, NetworkDeviceGroups_DeviceType), null),
xdm.target.host.mac_addresses = arraycreate(Called_Station_ID_mac),
xdm.target.ipv4 = coalesce(DestinationIPAddress_ipv4, Called_Station_ID_ipv4),
xdm.target.ipv6 = coalesce(DestinationIPAddress_ipv6, Called_Station_ID_ipv6),
xdm.target.port = to_integer(DestinationPort),
xdm.target.sent_packets = to_integer(Acct_Input_Packets),
xdm.network.session_id = coalesce(AcsSessionID, Acct_Session_Id),
xdm.network.application_protocol = Protocol,
xdm.network.rule = IdentityPolicyMatchedRule,
xdm.auth.auth_method = coalesce(AuthenticationMethod, Authen_Method, EapAuthentication),
xdm.auth.privilege_level = if(Privilege_Level = "0", XDM_CONST.PRIVILEGE_LEVEL_GUEST, Privilege_Level = "1", XDM_CONST.PRIVILEGE_LEVEL_USER, Privilege_Level = "15", XDM_CONST.PRIVILEGE_LEVEL_ADMIN, Privilege_Level);
// CISE_Alarm Parsing
/* --------------------------------------------------------------------------------
Key_Values
- Admin=
- Calling Station Id=
- Cause=
- Endpoint=
- back up file name:
- From
- To
- NAD Address=
- NAS IP Address=
- NAS Identifier=
- Network device IP=
- Network Device Name=
- Object Name=
- Object Type=
- Repository Name:
- Server=
-------------------------------------------------------------------------------*/
alter
logType = arrayindex(regextract(_raw_log, "<\d+>\w+\s*\d+\s\d+:\d+:\d+\s[\S]+\s(\w+)\s"),0)
| filter logType = "CISE_Alarm"
| alter
Admin = arrayindex(regextract(_raw_log, "Admin=([^\,\;]+)"),0),
Calling_Station_Id_ipv4 = arrayindex(regextract(_raw_log, "Calling Station Id=(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"),0),
Calling_Station_Id_ipv6 = arrayindex(regextract(_raw_log, "Calling Station Id=((?:(?:[A-Fa-f0-9]{1,4}:){7}[A-Fa-f0-9]{1,4}|(?:[A-Fa-f0-9]{1,4}:){1,7}:|(?:[A-Fa-f0-9]{1,4}:){1,6}:[A-Fa-f0-9]{1,4}|(?:[A-Fa-f0-9]{1,4}:){1,5}(?::[A-Fa-f0-9]{1,4}){1,2}|(?:[A-Fa-f0-9]{1,4}:){1,4}(?::[A-Fa-f0-9]{1,4}){1,3}|(?:[A-Fa-f0-9]{1,4}:){1,3}(?::[A-Fa-f0-9]{1,4}){1,4}|(?:[A-Fa-f0-9]{1,4}:){1,2}(?::[A-Fa-f0-9]{1,4}){1,5}|[A-Fa-f0-9]{1,4}:(?:(?::[A-Fa-f0-9]{1,4}){1,6})|:(?::[A-Fa-f0-9]{1,4}){1,7}|::))"),0),
Calling_Station_Id_mac = arrayindex(regextract(_raw_log, "Calling Station Id=(\S{2}[:-]\S{2}[:-]\S{2}[:-]\S{2}[:-]\S{2}[:-]\S{2}|[a-fA-F\d]{12})"),0),
Cause = arrayindex(regextract(_raw_log, "Cause=([^\=]+)"),0),
Description = rtrim(arrayindex(regextract(_raw_log, "<\d+>\w+\s*\d+\s\d+:\d+:\d+\s[\S]+\s\w+\s\w+:\s([^:]+)"),0)),
Endpoint_ipv4 = arrayindex(regextract(_raw_log, "Endpoint=(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"),0),
Endpoint_ipv6 = arrayindex(regextract(_raw_log, "Endpoint=((?:[a-fA-F\d]{0,4}\:){2,7}[a-fA-F\d]{0,4})"),0),
File_name = arrayindex(regextract(_raw_log, "back up file name: \'([^\']+)\'"),0),
Hostname_From = arrayindex(regextract(_raw_log, "From\s+(\S+)\s+To\s+\S+\;"),0),
Hostname_To = arrayindex(regextract(_raw_log, "From\s+\S+\s+To\s+(\S+)\;"),0),
logSeverity = lowercase(arrayindex(regextract(_raw_log, "\s+(DEBUG|INFO|WARN|ERROR|FATAL|CRITICAL|NOTICE)[\s:]+"),0)),
NAD_IP_Address_ipv4 = arrayindex(regextract(_raw_log, "NAD Address=(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"),0),
NAD_IP_Address_ipv6 = arrayindex(regextract(_raw_log, "NAD Address=((?:[a-fA-F\d]{0,4}\:){2,7}[a-fA-F\d]{0,4})"),0),
NAS_IP_Address_ipv4 = arrayindex(regextract(_raw_log, "NAS IP Address=(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"),0),
NAS_IP_Address_ipv6 = arrayindex(regextract(_raw_log, "NAS IP Address=((?:[a-fA-F\d]{0,4}\:){2,7}[a-fA-F\d]{0,4})"),0),
NAS_Identifier = arrayindex(regextract(_raw_log, "NAS Identifier=([^\,\;]+)"),0),
Network_device_IP_ipv4 = arrayindex(regextract(_raw_log, "Network device IP=(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"),0),
Network_device_IP_ipv6 = arrayindex(regextract(_raw_log, "Network device IP=((?:[a-fA-F\d]{0,4}\:){2,7}[a-fA-F\d]{0,4})"),0),
Network_Device_Name = arrayindex(regextract(_raw_log, "Network Device Name=([^\,\;]+)"),0),
Object_Name = arrayindex(regextract(_raw_log, "Object Name=([^\,,\;]+)"),0),
Object_Type = arrayindex(regextract(_raw_log, "Object Type=([^\,,\;]+)"),0),
Observer = arrayindex(regextract(_raw_log, "<\d+>\w+\s*\d+\s\d+:\d+:\d+\s([\S]+)"),0),
Repository_Name = arrayindex(regextract(_raw_log, "Repository Name: \'([^\']+)\'"),0),
Server = arrayindex(regextract(_raw_log, "Server=([^;,\s]+)"),0)
| alter
xdm.observer.name = coalesce(Server, Observer),
xdm.event.log_level = if(logSeverity ~= "debug", XDM_CONST.LOG_LEVEL_DEBUG, logSeverity ~= "info", XDM_CONST.LOG_LEVEL_INFORMATIONAL, logSeverity ~= "warn", XDM_CONST.LOG_LEVEL_WARNING, logSeverity ~= "error", XDM_CONST.LOG_LEVEL_ERROR, logSeverity = "fatal", XDM_CONST.LOG_LEVEL_EMERGENCY, logSeverity ~= "critical", XDM_CONST.LOG_LEVEL_CRITICAL, logSeverity ~= "notice", XDM_CONST.LOG_LEVEL_NOTICE, logSeverity = null, null, XDM_CONST.LOG_LEVEL_NOTICE),
xdm.event.type = logType,
xdm.event.description = Description,
xdm.event.outcome_reason = Cause,
xdm.intermediate.ipv4 = if(Calling_Station_Id_ipv4 != null or Endpoint_ipv4 != null, coalesce(NAS_IP_Address_ipv4, NAD_IP_Address_ipv4, Network_device_IP_ipv4), null),
xdm.intermediate.ipv6 = if(Calling_Station_Id_ipv6 != null or Endpoint_ipv6 != null, coalesce(NAS_IP_Address_ipv6, NAD_IP_Address_ipv6, Network_device_IP_ipv6), null),
xdm.intermediate.host.device_id = if((Calling_Station_Id_ipv4 != null or Endpoint_ipv4 != null) and (Calling_Station_Id_ipv6 != null or Endpoint_ipv6 != null), NAS_Identifier, null),
xdm.intermediate.host.hostname = if(Calling_Station_Id_ipv4 = null and Endpoint_ipv4 = null and Calling_Station_Id_ipv6 = null and Endpoint_ipv6 = null, null, Network_Device_Name),
xdm.source.ipv4 = coalesce(Calling_Station_Id_ipv4, Endpoint_ipv4, NAS_IP_Address_ipv4, NAD_IP_Address_ipv4, Network_device_IP_ipv4),
xdm.source.ipv6 = coalesce(Calling_Station_Id_ipv6, Endpoint_ipv6, NAS_IP_Address_ipv6, NAD_IP_Address_ipv6, Network_device_IP_ipv6),
xdm.source.user.username = Admin,
xdm.source.host.mac_addresses = arraycreate(Calling_Station_Id_mac),
xdm.source.host.hostname = if(Calling_Station_Id_ipv4 = null and Endpoint_ipv4 = null and Calling_Station_Id_ipv6 = null and Endpoint_ipv6 = null, Network_Device_Name, Hostname_From),
xdm.source.host.device_id = if(Calling_Station_Id_ipv4 = null and Endpoint_ipv4 = null and Calling_Station_Id_ipv6 = null and Endpoint_ipv6 = null, NAS_Identifier, null),
xdm.target.resource.name = coalesce(Object_Name, Repository_Name),
xdm.target.resource.type = Object_Type,
xdm.target.host.hostname = Hostname_To,
xdm.target.file.filename = File_name,
xdm.auth.privilege_level = if(Admin != null, XDM_CONST.PRIVILEGE_LEVEL_ADMIN, null);
// CISE_Administrative_and_Operational_Audit Parsing
/* --------------------------------------------------------------------------------
Key_Values
- AdminIPAddress=
- AdminName=
- ConfigChangeData=
- CertificateHash=
- FailureFlag=
- ObjectType=
- ObjectName=
- OperationMessageText=
- PeerName=
- ShutdownReason=
- Targets=
- UniqueConnectionIdentifier=
-------------------------------------------------------------------------------*/
alter
logType = arrayindex(regextract(_raw_log, "<\d+>\w+\s*\d+\s\d+:\d+:\d+\s[\S]+\s(\w+)\s"),0)
| filter (logType = "CISE_Administrative_and_Operational_Audit")
| alter
logSeverity = lowercase(arrayindex(regextract(_raw_log, "\s+(DEBUG|INFO|WARN|ERROR|FATAL|CRITICAL|NOTICE)[\s:]+"),0)),
Description = arrayindex(regextract(_raw_log, "\s+(?:DEBUG|INFO|WARN|ERROR|FATAL|CRITICAL|NOTICE)\s*([^,]+)"),0),
AdminIPAddress = arrayindex(regextract(_raw_log, "AdminIPAddress\s*=\s*([^,]*),"),0),
AdminName = arrayindex(regextract(_raw_log, "AdminName\s*=\s*([^,]*),"),0),
ConfigChangeData = arrayindex(regextract(_raw_log, "ConfigChangeData\s*=\s*(.*?),\s[^=]+=[^=]+,"),0),
CertificateHash = arrayindex(regextract(_raw_log, "CertificateHash\s*=\s*([^,]*),"),0),
FailureFlag = lowercase(arrayindex(regextract(_raw_log, "FailureFlag\s*=\s*([^,]*),"),0)),
ObjectType = arrayindex(regextract(_raw_log, "ObjectType\s*=\s*([^,]*),"),0),
ObjectName = lowercase(arrayindex(regextract(_raw_log, "ObjectName\s*=\s*([^,]*),"),0)),
OperationMessageText = arrayindex(regextract(_raw_log, "OperationMessageText\s*=\s*([^,]*),"),0),
ShutdownReason = arrayindex(regextract(_raw_log, "ShutdownReason\s*=\s*([^,]*),"),0),
UniqueConnectionIdentifier = arrayindex(regextract(_raw_log, "UniqueConnectionIdentifier\s*=\s*([^,]*),"),0)
| alter
xdm.event.id = arrayindex(regextract(_raw_log, "<\d+>\w+\s*\d+\s\d+:\d+:\d+\s[\S]+\s\w+\s(\d+)"),0),
xdm.event.type = logType,
xdm.event.original_event_type = arrayindex(regextract(_raw_log, "(\d+)\s(?:DEBUG|INFO|WARN|ERROR|FATAL|CRITICAL|NOTICE)"),0),
xdm.event.description = if(ConfigChangeData != null and OperationMessageText != null, concat(OperationMessageText, " - ", ConfigChangeData), coalesce(ConfigChangeData, OperationMessageText, Description)),
xdm.event.outcome = if(FailureFlag = "false", XDM_CONST.OUTCOME_SUCCESS, FailureFlag = "true", XDM_CONST.OUTCOME_FAILED, null),
xdm.event.outcome_reason = ShutdownReason,
xdm.event.log_level = if(logSeverity ~= "debug", XDM_CONST.LOG_LEVEL_DEBUG, logSeverity ~= "info", XDM_CONST.LOG_LEVEL_INFORMATIONAL, logSeverity ~= "warn", XDM_CONST.LOG_LEVEL_WARNING, logSeverity ~= "error", XDM_CONST.LOG_LEVEL_ERROR, logSeverity = "fatal", XDM_CONST.LOG_LEVEL_EMERGENCY, logSeverity ~= "critical", XDM_CONST.LOG_LEVEL_CRITICAL, logSeverity ~= "notice", XDM_CONST.LOG_LEVEL_NOTICE, logSeverity = null, null, XDM_CONST.LOG_LEVEL_NOTICE),
xdm.source.ipv4 = if(AdminIPAddress ~= "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}", AdminIPAddress, null),
xdm.source.ipv6 = if(AdminIPAddress ~= "(?:[a-fA-F\d]{0,4}\:){2,7}[a-fA-F\d]{0,4}", AdminIPAddress, null),
xdm.source.user.username = AdminName,
xdm.network.tls.client_certificate.md5 = CertificateHash,
xdm.target.resource.type = ObjectType,
xdm.target.resource.name = ObjectName,
xdm.logon.logon_guid = UniqueConnectionIdentifier;
// CISE_External_MDM Parsing
/* --------------------------------------------------------------------------------
Key_Values
- EndPointMACAddress=
- MDMFailureReason=
- MDMServerName=
- ServerType=
- SessionId=
-------------------------------------------------------------------------------*/
alter
logType = arrayindex(regextract(_raw_log, "<\d+>\w+\s*\d+\s\d+:\d+:\d+\s[\S]+\s(\w+)\s"),0)
| filter logType = "CISE_External_MDM"
| alter
Description = arrayindex(regextract(_raw_log, "\s+(?:DEBUG|INFO|WARN|ERROR|FATAL|CRITICAL|NOTICE)\s*([^,]+)"),0),
EndPointMACAddress = arrayindex(regextract(_raw_log, "EndPointMACAddress\s*=\s*([^,]*),"),0),
logSeverity = lowercase(arrayindex(regextract(_raw_log, "\s+(DEBUG|INFO|WARN|ERROR|FATAL|CRITICAL|NOTICE)[\s:]+"),0)),
MDMFailureReason = arrayindex(regextract(_raw_log, "MDMFailureReason\s*=\s*([^,]*),"),0),
MDMServerName = arrayindex(regextract(_raw_log, "MDMServerName\s*=\s*([^,]*),"),0),
ServerType = arrayindex(regextract(_raw_log, "ServerType\s*=\s*([^,]*),"),0),
SessionId = arrayindex(regextract(_raw_log, "SessionId\s*=\s*([^,]*),"),0)
| alter
xdm.event.id = arrayindex(regextract(_raw_log, "<\d+>\w+\s*\d+\s\d+:\d+:\d+\s[\S]+\s\w+\s(\d+)"),0),
xdm.event.type = logType,
xdm.event.original_event_type = arrayindex(regextract(_raw_log, "(\d+)\s(?:DEBUG|INFO|WARN|ERROR|FATAL|CRITICAL|NOTICE)"),0),
xdm.event.description = Description,
xdm.event.log_level = if(logSeverity ~= "debug", XDM_CONST.LOG_LEVEL_DEBUG, logSeverity ~= "info", XDM_CONST.LOG_LEVEL_INFORMATIONAL, logSeverity ~= "warn", XDM_CONST.LOG_LEVEL_WARNING, logSeverity ~= "error", XDM_CONST.LOG_LEVEL_ERROR, logSeverity = "fatal", XDM_CONST.LOG_LEVEL_EMERGENCY, logSeverity ~= "critical", XDM_CONST.LOG_LEVEL_CRITICAL, logSeverity ~= "notice", XDM_CONST.LOG_LEVEL_NOTICE, logSeverity = null, null, XDM_CONST.LOG_LEVEL_NOTICE),
xdm.event.outcome = if(Description ~= "[Ss][Uu][Cc][Cc][Ee]", XDM_CONST.OUTCOME_SUCCESS, Description ~= "[Ff][Aa][Ii][Ll]", XDM_CONST.OUTCOME_FAILED, null),
xdm.event.outcome_reason = MDMFailureReason,
xdm.source.host.mac_addresses = arraycreate(EndPointMACAddress),
xdm.target.host.hostname = MDMServerName,
xdm.target.host.device_category = ServerType,
xdm.network.session_id = SessionId;
// ### Everything NOT - CISE_Passed_Authentications, CISE_Failed_Attempts, CISE_RADIUS_Diagnostics, CISE_RADIUS_Accounting, CISE_TACACS_Accounting, CISE_Alarm, CISE_Administrative_and_Operational_Audit, CISE_External_MDM
/* --------------------------------------------------------------------------------
Key_Values
- AuthenticationMethod=
- Authen-Method=
- DestinationPort=
- DestinationIPAddress=
- Device Type=
- EndpointNADAddress=
- EndpointIPAddress=
- FailureReason=
- FeedUrl=
- IdentitySelectionMatchedRule=
- MESSAGE=
- EndpointMacAddress=
- MacAddress=
- NAS-Port=
- NetworkDeviceName=
- NetworkDeviceGroups=
- OperatingSystem=
- AD-Operating-System=
- OriginalUserName=
- OperationMessageText=
- PeerAddress=
- posturePassCondition=
- ProfilerErrorMessage=
- System-Management:
- ShutdownReason=
- UniqueConnectionIdentifier=
- UserType=
- UserName=
- User-Fetch-Organizational-Unit=
-------------------------------------------------------------------------------*/
alter
logType = arrayindex(regextract(_raw_log, "<\d+>\w+\s*\d+\s\d+:\d+:\d+\s[\S]+\s(\w+)\s"),0)
| filter logType not in ("CISE_Passed_Authentications", "CISE_Failed_Attempts", "CISE_RADIUS_Diagnostics", "CISE_RADIUS_Accounting", "CISE_TACACS_Accounting", "CISE_Alarm", "CISE_Administrative_and_Operational_Audit", "CISE_External_MDM")
| alter
AuthenticationMethod = arrayindex(regextract(_raw_log, "AuthenticationMethod=([^\,;]+)"),0),
Authen_Method = arrayindex(regextract(_raw_log, "Authen-Method=([^\,;]+)"),0),
Description1 = arrayindex(regextract(_raw_log, "(?:DEBUG|INFO|WARN|ERROR|FATAL|CRITICAL|NOTICE)\s*([^:]+\:\s+[^,]+)"), 0),
Description2 = arrayindex(regextract(_raw_log, "<\d+>\w+\s*\d+\s\d+:\d+:\d+\s\S+\s\w+\s\d+\s+(.*)"), 0),
DestinationPort = arrayindex(regextract(_raw_log, "DestinationPort=([^\\,]+)"),0),
DestinationIPAddress_ipv4 = arrayindex(regextract(_raw_log, "DestinationIPAddress=(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}),"),0),
DestinationIPAddress_ipv6 = arrayindex(regextract(_raw_log, "DestinationIPAddress=((?:[a-fA-F\d]{0,4}\:){2,7}[a-fA-F\d]{0,4}),"),0),
Device_Type = arrayindex(regextract(_raw_log, "Device Type=Device Type#([^\,]+)"), 0),
EndpointNADAddress_ipv4 = arrayindex(regextract(_raw_log, "EndpointNADAddress=(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}),"),0),
EndpointNADAddress_ipv6 = arrayindex(regextract(_raw_log, "EndpointNADAddress=((?:[a-fA-F\d]{0,4}\:){2,7}[a-fA-F\d]{0,4}),"),0),
EndpointIPAddress_ipv4 = arrayindex(regextract(_raw_log, "EndpointIPAddress=(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}),"),0),
EndpointIPAddress_ipv6 = arrayindex(regextract(_raw_log, "EndpointIPAddress=((?:[a-fA-F\d]{0,4}\:){2,7}[a-fA-F\d]{0,4}),"),0),
FailureReason = arrayindex(regextract(_raw_log, "FailureReason=([^,\\;]+)"),0),
FeedUrl = arrayindex(regextract(_raw_log, "FeedUrl=([^,]+)"),0),
IdentitySelectionMatchedRule = arrayindex(regextract(_raw_log, "IdentitySelectionMatchedRule=([^,\\;]+)"),0),
logSeverity = lowercase(arrayindex(regextract(_raw_log, "\s+(DEBUG|INFO|WARN|ERROR|FATAL|CRITICAL|NOTICE)[\s:]+"),0)),
Message = arrayindex(regextract(_raw_log, "MESSAGE=([^\,]+)"),0),
Mac_address = arrayindex(regextract(_raw_log, "(?:EndpointMacAddress|MacAddress)=([^,;\\]+)"),0),
NAS_Port = arrayindex(regextract(_raw_log, "NAS-Port=(\d+)"),0),
NetworkDeviceName = arrayindex(regextract(_raw_log, "NetworkDeviceName=([^,]+),"),0),
NetworkDeviceGroups_DeviceType = arrayindex(regextract(_raw_log, "NetworkDeviceGroups=Device Type#([^\,]+)"), 0),
OS = arrayindex(regextract(_raw_log, "(?:OperatingSystem|AD-Operating-System)=([^,;\\]+)"),0),
OriginalUserName = arrayindex(regextract(_raw_log, "OriginalUserName=([^,\\;]+)"),0),
OperationMessageText = arrayindex(regextract(_raw_log, "OperationMessageText=([^,\\;]+)"),0),
PeerAddress_ipv4 = arrayindex(regextract(_raw_log, "PeerAddress=(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}),"),0),
PeerAddress_ipv6 = arrayindex(regextract(_raw_log, "PeerAddress=((?:[a-fA-F\d]{0,4}\:){2,7}[a-fA-F\d]{0,4}),"),0),
PosturePassCondition = arrayindex(regextract(_raw_log, "posturePassCondition=((?:\S+\\,\s)+[^\\,]+)"),0),
ProfilerErrorMessage = arrayindex(regextract(_raw_log, "ProfilerErrorMessage=([^\,]+)"),0),
Sys_mgmt = arrayindex(regextract(_raw_log, "System-Management:\s+([^\,]+)"),0),
ShutdownReason = arrayindex(regextract(_raw_log, "ShutdownReason[\s+=]+([^,]+)"),0),
UniqueConnectionIdentifier = arrayindex(regextract(_raw_log, "UniqueConnectionIdentifier[\s+=]+(\S+)\,"),0),
UserType = arrayindex(regextract(_raw_log, "UserType=([^,\\;]+)"),0),
UserName = arrayindex(regextract(_raw_log, "UserName=([a-zA-Z0-9\@\-\\\/\\\._]+)"),0),
User_Fetch_Organizational_Unit = arrayindex(regextract(_raw_log, "User-Fetch-Organizational-Unit=([^,\\;]+)"),0)
| alter
xdm.event.type = logType,
xdm.event.original_event_type = arrayindex(regextract(_raw_log, "(\d+)\s(?:DEBUG|INFO|WARN|ERROR|FATAL|CRITICAL|NOTICE)"),0),
xdm.event.description = coalesce(OperationMessageText, Description1, Description2),
xdm.event.log_level = if(logSeverity ~= "debug", XDM_CONST.LOG_LEVEL_DEBUG, logSeverity ~= "info", XDM_CONST.LOG_LEVEL_INFORMATIONAL, logSeverity ~= "warn", XDM_CONST.LOG_LEVEL_WARNING, logSeverity ~= "error", XDM_CONST.LOG_LEVEL_ERROR, logSeverity = "fatal", XDM_CONST.LOG_LEVEL_EMERGENCY, logSeverity ~= "critical", XDM_CONST.LOG_LEVEL_CRITICAL, logSeverity ~= "notice", XDM_CONST.LOG_LEVEL_NOTICE, logSeverity = null, null, XDM_CONST.LOG_LEVEL_NOTICE),
xdm.event.outcome = if(Description1 ~= "[Ss][Uu][Cc][Cc][Ee]" or Message ~= "[Ss][Uu][Cc][Cc][Ee]", XDM_CONST.OUTCOME_SUCCESS, Description1 ~= "[Ff][Aa][Ii][Ll]" or Message ~= "[Ff][Aa][Ii][Ll]", XDM_CONST.OUTCOME_FAILED, null),
xdm.event.outcome_reason = coalesce(FailureReason, ProfilerErrorMessage, Sys_mgmt, ShutdownReason, Message),
xdm.observer.name = arrayindex(regextract(_raw_log, "<\d+>\w+\s*\d+\s\d+:\d+:\d+\s([\S]+)"),0),
xdm.auth.auth_method = coalesce(AuthenticationMethod, Authen_Method),
xdm.network.rule = coalesce(PosturePassCondition, IdentitySelectionMatchedRule),
xdm.network.session_id = UniqueConnectionIdentifier,
xdm.target.port = to_integer(DestinationPort),
xdm.target.ipv4 = coalesce(DestinationIPAddress_ipv4, PeerAddress_ipv4),
xdm.target.ipv6 = coalesce(DestinationIPAddress_ipv6, PeerAddress_ipv6),
xdm.target.url = FeedUrl,
xdm.source.user.user_type = if(UserType = "User", XDM_CONST.USER_TYPE_REGULAR, UserType = "Host", XDM_CONST.USER_TYPE_MACHINE_ACCOUNT, UserType = null, null, to_string(UserType)),
xdm.source.user.username = coalesce(OriginalUserName, UserName),
xdm.source.user.ou = User_Fetch_Organizational_Unit,
xdm.source.host.mac_addresses = arraycreate(Mac_address),
xdm.source.host.os = OS,
xdm.source.ipv4 = coalesce(EndpointIPAddress_ipv4, EndpointNADAddress_ipv4),
xdm.source.ipv6 = coalesce(EndpointIPAddress_ipv6, EndpointNADAddress_ipv6),
xdm.source.port = if(EndpointIPAddress_ipv4 = null and EndpointIPAddress_ipv6 = null, to_integer(NAS_Port), null),
xdm.source.host.hostname = if(EndpointIPAddress_ipv4 = null and EndpointIPAddress_ipv6 = null, NetworkDeviceName, null),
xdm.source.host.device_category = if(EndpointIPAddress_ipv4 = null and EndpointIPAddress_ipv6 = null, coalesce(Device_Type, NetworkDeviceGroups_DeviceType), null),
xdm.intermediate.ipv4 = if(EndpointIPAddress_ipv4 != null, EndpointNADAddress_ipv4, null),
xdm.intermediate.ipv6 = if(EndpointIPAddress_ipv6 != null, EndpointNADAddress_ipv6, null),
xdm.intermediate.port = if(EndpointIPAddress_ipv4 != null or EndpointIPAddress_ipv6 != null, to_integer(NAS_Port), null),
xdm.intermediate.host.hostname = if(EndpointIPAddress_ipv4 != null or EndpointIPAddress_ipv6 != null, NetworkDeviceName, null),
xdm.intermediate.host.device_category = if(EndpointIPAddress_ipv4 != null or EndpointIPAddress_ipv6 != null, coalesce(Device_Type, NetworkDeviceGroups_DeviceType), null);