Clearswift DLP Parsing Rules

Details

Rules (XQL)

[INGEST:vendor="clearswift", product="dlp", target_dataset="clearswift_dlp_raw", no_hit=keep]
// Support only date time of format:yyyy-MM-ddThh:mm:ssZ. For example: "2021-01-01T10:00:00Z".
filter _raw_log ~= "\d{4}\-\d{2}\-\d{2}[\sT]\d{2}:\d{2}:\d{2}"
| alter
        tmp_get_datetime = arrayindex(regextract(_raw_log, "\d{4}\-\d{2}\-\d{2}[\sT]\d{2}:\d{2}:\d{2}Z"), 0)
| alter
        tmp_get_datetime = parse_timestamp("%Y-%m-%dT%H:%M:%SZ", tmp_get_datetime)
| alter
        _time = tmp_get_datetime
| fields -tmp_get_datetime;