Rules (XQL)
[INGEST:vendor="microsoft", product="windows", target_dataset="microsoft_windows_raw", no_hit=drop]
filter to_string(time_created) ~= ".*\d{2}:\d{2}:\d{2}.*" AND provider_name not in ("Microsoft-Windows-Sysmon", "AD FS Auditing", "Microsoft-Antimalware-Scan-Interface","Microsoft-Windows-DNSServer", "Microsoft-Windows-DNS-Server-Service")
| alter
tmp_get_time = to_epoch(_time),
tmp_get_insert_time = to_epoch(_insert_time),
tmp_get_time_created = to_epoch(parse_timestamp("%FT%H:%M:%E*SZ",to_string(time_created)))
| alter
_time = if(subtract(tmp_get_time_created, tmp_get_time) < 0, to_timestamp(tmp_get_time_created), subtract(tmp_get_insert_time, tmp_get_time) < 0, to_timestamp(tmp_get_insert_time), to_timestamp(tmp_get_time))
| alter
_scope = coalesce(_scope, event_data -> _scope, event_data -> scope, arrayindex(regextract(_raw_log, "<_scope>([^<]+)<\/_scope>"), 0))
| fields -tmp*;