ProofpointCASB Parsing Rule

Parsing Rule

Proofpoint CASB

Details

IDProofpointCASB_ParsingRule
From Version8.2.0

Rules (XQL)

[INGEST:vendor="proofpoint", product="casb", target_dataset="proofpoint_casb_raw", no_hit=keep]
alter tmp_timestamp = event -> event.occurredAt
| filter tmp_timestamp ~= "\d{4}\-\d{2}\-\d{2}T\d{2}\:\d{2}\:\d{2}\.\d{3}Z"
| alter _time = parse_timestamp("%Y-%m-%dT%H:%M:%E3SZ", tmp_timestamp)
| fields -tmp_timestamp;