CyberArkIdentity Parsing Rule

Parsing Rule

CyberArk Identity

Details

IDCyberArkIdentity_Parsing_Rules
From Version6.10.0

Rules (XQL)

[INGEST:vendor="cyberark", product="identity", target_dataset="cyberark_identity_raw", no_hit=keep]
filter to_string(WhenOccurred) ~= "[0-9]+"
| alter _time = to_timestamp(to_integer(arrayindex(regextract(to_string(WhenOccurred), "[0-9]+"), 0)), "MILLIS");