[MODEL: dataset = "msft_azure_flowlogs_raw"] // --- NSG & VNet Flow Logs --- filter category in ("NetworkSecurityGroupFlowEvent", "FlowLogFlowEvent") | alter get_flowState = if(category = "NetworkSecurityGroupFlowEvent", flowState, category = "FlowLogFlowEvent", deviceAction, null) | alter xdm.event.tags = arraycreate(XDM_CONST.EVENT_TAG_CLOUD), xdm.source.cloud.provider = XDM_CONST.CLOUD_PROVIDER_AZURE, xdm.target.cloud.provider = XDM_CONST.CLOUD_PROVIDER_AZURE, xdm.target.resource.id = resourceId, xdm.event.operation_sub_type = operationName, xdm.event.original_event_type = if(category = "NetworkSecurityGroupFlowEvent", "Network Security Group Flow Event", category = "FlowLogFlowEvent", "VNet Flow Log Event", null), xdm.network.rule = nsgRuleName, xdm.source.ipv4 = arrayindex(regextract(sourceAddress, "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}"), 0), xdm.source.ipv6 = arrayindex(regextract(sourceAddress, "[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}"), 0), xdm.target.ipv4 = arrayindex(regextract(destinationAddress, "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}"), 0), xdm.target.ipv6 = arrayindex(regextract(destinationAddress, "[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}"), 0), xdm.intermediate.host.mac_addresses = arraycreate(mac), xdm.source.port = to_integer(sourcePort), xdm.target.port = to_integer(destinationPort), xdm.network.ip_protocol = if( transportProtocol = "T", XDM_CONST.IP_PROTOCOL_TCP, transportProtocol = "U", XDM_CONST.IP_PROTOCOL_UDP, transportProtocol = "6", XDM_CONST.IP_PROTOCOL_TCP, transportProtocol = "17", XDM_CONST.IP_PROTOCOL_UDP, transportProtocol = "1", XDM_CONST.IP_PROTOCOL_ICMP, transportProtocol = "58", XDM_CONST.IP_PROTOCOL_IPV6_ICMP, transportProtocol = null, null, to_string(transportProtocol) ), xdm.event.outcome = if( deviceAction in ("A", "B", "C", "E"), XDM_CONST.OUTCOME_SUCCESS, deviceAction = "D", XDM_CONST.OUTCOME_FAILED, deviceAction = null, null, to_string(deviceAction) ), xdm.event.outcome_reason = deviceAction, xdm.observer.type = if( get_flowState = "B", "Begin, a flow is created. No statistics are provided", get_flowState = "C", "Continuing for an ongoing flow. Statistics are provided at five-minute intervals", get_flowState = "E", "End, when a flow is terminated. Statistics are provided", get_flowState = "D", "Deny, when a flow is denied", get_flowState = null, null, to_string(get_flowState) ), xdm.event.description = if( deviceDirection = "I", "Inbound", deviceDirection = "O", "Outbound", deviceDirection = null, null, to_string(deviceDirection) ), xdm.source.sent_packets = to_integer(packetsStoD), xdm.source.sent_bytes = to_integer(bytesStoD), xdm.target.sent_packets = to_integer(packetsDtoS), xdm.target.sent_bytes = to_integer(bytesDtoS); // --- NTA Flow Logs --- filter _raw_log -> Type = "NTAIpDetails" | alter lower_ThreatType = lowercase(_raw_log -> ThreatType), get_Location = _raw_log -> Location | alter xdm.event.tags = arraycreate(XDM_CONST.EVENT_TAG_CLOUD), xdm.source.cloud.provider = XDM_CONST.CLOUD_PROVIDER_AZURE, xdm.target.cloud.provider = XDM_CONST.CLOUD_PROVIDER_AZURE, xdm.event.original_event_type = "NTA IP Details", xdm.event.type = _raw_log -> SubType, xdm.alert.subcategory = _raw_log -> FlowType, xdm.target.ipv4 = arrayindex(regextract(_raw_log -> Ip, "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}"), 0), xdm.target.ipv6 = arrayindex(regextract(_raw_log -> Ip, "((?:[a-fA-F\d]{0,4}\:){2,7}[a-fA-F\d]{0,4})"), 0), xdm.event.description = _raw_log -> PublicIpDetails, xdm.alert.category = if( lower_ThreatType = "apk", XDM_CONST.THREAT_CATEGORY_APK, lower_ThreatType = "dmg", XDM_CONST.THREAT_CATEGORY_DMG, lower_ThreatType = "flash", XDM_CONST.THREAT_CATEGORY_FLASH, lower_ThreatType = "java-class", XDM_CONST.THREAT_CATEGORY_JAVA_CLASS, lower_ThreatType = "macho", XDM_CONST.THREAT_CATEGORY_MACHO, lower_ThreatType = "office", XDM_CONST.THREAT_CATEGORY_OFFICE, lower_ThreatType = "openoffice", XDM_CONST.THREAT_CATEGORY_OPENOFFICE, lower_ThreatType = "pdf", XDM_CONST.THREAT_CATEGORY_PDF, lower_ThreatType = "pe", XDM_CONST.THREAT_CATEGORY_PE, lower_ThreatType = "pkg", XDM_CONST.THREAT_CATEGORY_PKG, lower_ThreatType = "adware", XDM_CONST.THREAT_CATEGORY_ADWARE, lower_ThreatType = "autogen", XDM_CONST.THREAT_CATEGORY_AUTOGEN, lower_ThreatType = "backdoor", XDM_CONST.THREAT_CATEGORY_BACKDOOR, lower_ThreatType = "botnet", XDM_CONST.THREAT_CATEGORY_BOTNET, lower_ThreatType = "browser-hijack", XDM_CONST.THREAT_CATEGORY_BROWSER_HIJACK, lower_ThreatType = "cryptominer", XDM_CONST.THREAT_CATEGORY_CRYPTOMINER, lower_ThreatType = "data-theft", XDM_CONST.THREAT_CATEGORY_DATA_THEFT, lower_ThreatType = "dns", XDM_CONST.THREAT_CATEGORY_DNS, lower_ThreatType = "dns-security", XDM_CONST.THREAT_CATEGORY_DNS_SECURITY, lower_ThreatType = "dns-wildfire", XDM_CONST.THREAT_CATEGORY_DNS_WILDFIRE, lower_ThreatType = "downloader", XDM_CONST.THREAT_CATEGORY_DOWNLOADER, lower_ThreatType = "fraud", XDM_CONST.THREAT_CATEGORY_FRAUD, lower_ThreatType = "hacktool", XDM_CONST.THREAT_CATEGORY_HACKTOOL, lower_ThreatType = "keylogger", XDM_CONST.THREAT_CATEGORY_KEYLOGGER, lower_ThreatType = "networm", XDM_CONST.THREAT_CATEGORY_NETWORM, lower_ThreatType = "phishing-kit", XDM_CONST.THREAT_CATEGORY_PHISHING_KIT, lower_ThreatType = "post-exploitation", XDM_CONST.THREAT_CATEGORY_POST_EXPLOITATION, lower_ThreatType = "webshell", XDM_CONST.THREAT_CATEGORY_WEBSHELL, lower_ThreatType = "spyware", XDM_CONST.THREAT_CATEGORY_SPYWARE, lower_ThreatType = "brute force", XDM_CONST.THREAT_CATEGORY_BRUTE_FORCE, lower_ThreatType = "code execution", XDM_CONST.THREAT_CATEGORY_CODE_EXECUTION, lower_ThreatType = "code-obfuscation", XDM_CONST.THREAT_CATEGORY_CODE_OBFUSCATION, lower_ThreatType = "dos", XDM_CONST.THREAT_CATEGORY_DOS, lower_ThreatType = "exploit-kit", XDM_CONST.THREAT_CATEGORY_EXPLOIT_KIT, lower_ThreatType = "info-leak", XDM_CONST.THREAT_CATEGORY_INFO_LEAK, lower_ThreatType = "insecure-credentials", XDM_CONST.THREAT_CATEGORY_INSECURE_CREDENTIALS, lower_ThreatType = "overflow", XDM_CONST.THREAT_CATEGORY_OVERFLOW, lower_ThreatType = "phishing", XDM_CONST.THREAT_CATEGORY_PHISHING, lower_ThreatType = "protocol-anomaly", XDM_CONST.THREAT_CATEGORY_PROTOCOL_ANOMALY, lower_ThreatType = "sql-injection", XDM_CONST.THREAT_CATEGORY_SQL_INJECTION, lower_ThreatType = null, null, to_string(lower_ThreatType) ), xdm.target.asn.domain = _raw_log -> DNSDomain, xdm.alert.description = _raw_log -> ThreatDescription, xdm.target.location.country = if(get_Location ~= "^\S{2}$", get_Location), xdm.target.location.region = if(get_Location !~= "^\S{2}$", get_Location), xdm.target.url = _raw_log -> Url, xdm.target.port = to_integer(_raw_log -> Port); filter _raw_log -> Type = "NTATopologyDetails" | alter get_Access = _raw_log -> Access, // get_IsVirtualAppliance = _raw_log -> IsVirtualAppliance, get_Protocol = _raw_log -> Protocol | alter xdm.event.tags = arraycreate(XDM_CONST.EVENT_TAG_CLOUD), xdm.source.cloud.provider = XDM_CONST.CLOUD_PROVIDER_AZURE, xdm.target.cloud.provider = XDM_CONST.CLOUD_PROVIDER_AZURE, xdm.event.original_event_type = "NTA Topology Details", xdm.event.outcome = if( get_Access = "Allow", XDM_CONST.OUTCOME_SUCCESS, get_Access = "Deny", XDM_CONST.OUTCOME_FAILED, get_Access = null, null, to_string(get_Access) ), xdm.event.outcome_reason = get_Access, xdm.target.subnet = _raw_log -> Subnetwork, xdm.event.type = coalesce(_raw_log -> SubType, _raw_log -> ComponentType), xdm.network.rule = object_create( "Priority", _raw_log -> Priority, "Protocol", _raw_log -> Protocol, "SourcePortRange", _raw_log -> SourcePortRange, "DestinationPortRange", _raw_log -> DestinationPortRange, "SourceAddressPrefix", _raw_log -> SourceAddressPrefix, "DestinationAddressPrefix", _raw_log -> DestinationAddressPrefix, "Access", _raw_log -> Access, "Direction", _raw_log -> Direction, "RuleType", _raw_log -> RuleType, "Nsg", _raw_log -> Nsg ), xdm.target.location.region = coalesce(_raw_log -> Region, _raw_log -> DiscoveryRegion), xdm.target.host.mac_addresses = arraycreate(_raw_log -> MacAddress), xdm.target.host.hostname = _raw_log -> Name, xdm.target.host.device_id = _raw_log -> PrivateEndpointResourceId, xdm.target.host.ipv4_addresses = regextract(_raw_log -> PrivateIpAddresses, "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}"), xdm.target.host.ipv6_addresses = regextract(_raw_log -> PrivateIpAddresses, "((?:[a-fA-F\d]{0,4}\:){2,7}[a-fA-F\d]{0,4})"), xdm.network.ip_protocol = if(get_Protocol = "HOPOPT", XDM_CONST.IP_PROTOCOL_HOPOPT, get_Protocol = "ICMP", XDM_CONST.IP_PROTOCOL_ICMP, get_Protocol = "IGMP", XDM_CONST.IP_PROTOCOL_IGMP, get_Protocol = "GGP", XDM_CONST.IP_PROTOCOL_GGP, get_Protocol = "IP", XDM_CONST.IP_PROTOCOL_IP, get_Protocol = "ST", XDM_CONST.IP_PROTOCOL_ST, get_Protocol ~= "[Tt][Cc][Pp]", XDM_CONST.IP_PROTOCOL_TCP, get_Protocol = "CBT", XDM_CONST.IP_PROTOCOL_CBT, get_Protocol = "EGP", XDM_CONST.IP_PROTOCOL_EGP, get_Protocol = "IGP", XDM_CONST.IP_PROTOCOL_IGP, get_Protocol = "BBN_RCC_MON", XDM_CONST.IP_PROTOCOL_BBN_RCC_MON, get_Protocol = "NVP_II", XDM_CONST.IP_PROTOCOL_NVP_II, get_Protocol = "PUP", XDM_CONST.IP_PROTOCOL_PUP, get_Protocol = "ARGUS", XDM_CONST.IP_PROTOCOL_ARGUS, get_Protocol = "EMCON", XDM_CONST.IP_PROTOCOL_EMCON, get_Protocol = "XNET", XDM_CONST.IP_PROTOCOL_XNET, get_Protocol = "CHAOS", XDM_CONST.IP_PROTOCOL_CHAOS, get_Protocol ~= "[Uu][Dd][Pp]", XDM_CONST.IP_PROTOCOL_UDP, get_Protocol = "MUX", XDM_CONST.IP_PROTOCOL_MUX, get_Protocol = "DCN_MEAS", XDM_CONST.IP_PROTOCOL_DCN_MEAS, get_Protocol = "HMP", XDM_CONST.IP_PROTOCOL_HMP, get_Protocol = "PRM", XDM_CONST.IP_PROTOCOL_PRM, get_Protocol = "XNS_IDP", XDM_CONST.IP_PROTOCOL_XNS_IDP, get_Protocol = "TRUNK_1", XDM_CONST.IP_PROTOCOL_TRUNK_1, get_Protocol = "TRUNK_2", XDM_CONST.IP_PROTOCOL_TRUNK_2, get_Protocol = "LEAF_1", XDM_CONST.IP_PROTOCOL_LEAF_1, get_Protocol = "LEAF_2", XDM_CONST.IP_PROTOCOL_LEAF_2, get_Protocol = "RDP", XDM_CONST.IP_PROTOCOL_RDP, get_Protocol = "IRTP", XDM_CONST.IP_PROTOCOL_IRTP, get_Protocol = "ISO_TP4", XDM_CONST.IP_PROTOCOL_ISO_TP4, get_Protocol = "NETBLT", XDM_CONST.IP_PROTOCOL_NETBLT, get_Protocol = "MFE_NSP", XDM_CONST.IP_PROTOCOL_MFE_NSP, get_Protocol = "MERIT_INP", XDM_CONST.IP_PROTOCOL_MERIT_INP, get_Protocol = "DCCP", XDM_CONST.IP_PROTOCOL_DCCP, get_Protocol = "3PC", XDM_CONST.IP_PROTOCOL_3PC, get_Protocol = "IDPR", XDM_CONST.IP_PROTOCOL_IDPR, get_Protocol = "XTP", XDM_CONST.IP_PROTOCOL_XTP, get_Protocol = "DDP", XDM_CONST.IP_PROTOCOL_DDP, get_Protocol = "IDPR_CMTP", XDM_CONST.IP_PROTOCOL_IDPR_CMTP, get_Protocol = "TP", XDM_CONST.IP_PROTOCOL_TP, get_Protocol = "IL", XDM_CONST.IP_PROTOCOL_IL, get_Protocol = "IPV6", XDM_CONST.IP_PROTOCOL_IPV6, get_Protocol = "SDRP", XDM_CONST.IP_PROTOCOL_SDRP, get_Protocol = "IPV6_ROUTE", XDM_CONST.IP_PROTOCOL_IPV6_ROUTE, get_Protocol = "IPV6_FRAG", XDM_CONST.IP_PROTOCOL_IPV6_FRAG, get_Protocol = "IDRP", XDM_CONST.IP_PROTOCOL_IDRP, get_Protocol = "RSVP", XDM_CONST.IP_PROTOCOL_RSVP, get_Protocol = "GRE", XDM_CONST.IP_PROTOCOL_GRE, get_Protocol = "DSR", XDM_CONST.IP_PROTOCOL_DSR, get_Protocol = "BNA", XDM_CONST.IP_PROTOCOL_BNA, get_Protocol = "ESP", XDM_CONST.IP_PROTOCOL_ESP, get_Protocol = "AH", XDM_CONST.IP_PROTOCOL_AH, get_Protocol = "I_NLSP", XDM_CONST.IP_PROTOCOL_I_NLSP, get_Protocol = "SWIPE", XDM_CONST.IP_PROTOCOL_SWIPE, get_Protocol = "NARP", XDM_CONST.IP_PROTOCOL_NARP, get_Protocol = "MOBILE", XDM_CONST.IP_PROTOCOL_MOBILE, get_Protocol = "TLSP", XDM_CONST.IP_PROTOCOL_TLSP, get_Protocol = "SKIP", XDM_CONST.IP_PROTOCOL_SKIP, get_Protocol = "IPV6_ICMP", XDM_CONST.IP_PROTOCOL_IPV6_ICMP, get_Protocol = "IPV6_NONXT", XDM_CONST.IP_PROTOCOL_IPV6_NONXT, get_Protocol = "IPV6_OPTS", XDM_CONST.IP_PROTOCOL_IPV6_OPTS, get_Protocol = "CFTP", XDM_CONST.IP_PROTOCOL_CFTP, get_Protocol = "SAT_EXPAK", XDM_CONST.IP_PROTOCOL_SAT_EXPAK, get_Protocol = "KRYPTOLAN", XDM_CONST.IP_PROTOCOL_KRYPTOLAN, get_Protocol = "RVD", XDM_CONST.IP_PROTOCOL_RVD, get_Protocol = "IPPC", XDM_CONST.IP_PROTOCOL_IPPC, get_Protocol = "SAT_MON", XDM_CONST.IP_PROTOCOL_SAT_MON, get_Protocol = "VISA", XDM_CONST.IP_PROTOCOL_VISA, get_Protocol = "IPCV", XDM_CONST.IP_PROTOCOL_IPCV, get_Protocol = "CPNX", XDM_CONST.IP_PROTOCOL_CPNX, get_Protocol = "CPHB", XDM_CONST.IP_PROTOCOL_CPHB, get_Protocol = "WSN", XDM_CONST.IP_PROTOCOL_WSN, get_Protocol = "PVP", XDM_CONST.IP_PROTOCOL_PVP, get_Protocol = "BR_SAT_MON", XDM_CONST.IP_PROTOCOL_BR_SAT_MON, get_Protocol = "SUN_ND", XDM_CONST.IP_PROTOCOL_SUN_ND, get_Protocol = "WB_MON", XDM_CONST.IP_PROTOCOL_WB_MON, get_Protocol = "WB_EXPAK", XDM_CONST.IP_PROTOCOL_WB_EXPAK, get_Protocol = "ISO_IP", XDM_CONST.IP_PROTOCOL_ISO_IP, get_Protocol = "VMTP", XDM_CONST.IP_PROTOCOL_VMTP, get_Protocol = "SECURE_VMTP", XDM_CONST.IP_PROTOCOL_SECURE_VMTP, get_Protocol = "VINES", XDM_CONST.IP_PROTOCOL_VINES, get_Protocol = "TTP", XDM_CONST.IP_PROTOCOL_TTP, get_Protocol = "NSFNET_IGP", XDM_CONST.IP_PROTOCOL_NSFNET_IGP, get_Protocol = "DGP", XDM_CONST.IP_PROTOCOL_DGP, get_Protocol = "TCF", XDM_CONST.IP_PROTOCOL_TCF, get_Protocol = "EIGRP", XDM_CONST.IP_PROTOCOL_EIGRP, get_Protocol = "OSPFIGP", XDM_CONST.IP_PROTOCOL_OSPFIGP, get_Protocol = "SPRITE_RPC", XDM_CONST.IP_PROTOCOL_SPRITE_RPC, get_Protocol = "LARP", XDM_CONST.IP_PROTOCOL_LARP, get_Protocol = "MTP", XDM_CONST.IP_PROTOCOL_MTP, get_Protocol = "AX25", XDM_CONST.IP_PROTOCOL_AX25, get_Protocol = "IPIP", XDM_CONST.IP_PROTOCOL_IPIP, get_Protocol = "MICP", XDM_CONST.IP_PROTOCOL_MICP, get_Protocol = "SCC_SP", XDM_CONST.IP_PROTOCOL_SCC_SP, get_Protocol = "ETHERIP", XDM_CONST.IP_PROTOCOL_ETHERIP, get_Protocol = "ENCAP", XDM_CONST.IP_PROTOCOL_ENCAP, get_Protocol = "GMTP", XDM_CONST.IP_PROTOCOL_GMTP, get_Protocol = "IFMP", XDM_CONST.IP_PROTOCOL_IFMP, get_Protocol = "PNNI", XDM_CONST.IP_PROTOCOL_PNNI, get_Protocol = "PIM", XDM_CONST.IP_PROTOCOL_PIM, get_Protocol = "ARIS", XDM_CONST.IP_PROTOCOL_ARIS, get_Protocol = "SCPS", XDM_CONST.IP_PROTOCOL_SCPS, get_Protocol = "QNX", XDM_CONST.IP_PROTOCOL_QNX, get_Protocol = "AN", XDM_CONST.IP_PROTOCOL_AN, get_Protocol = "IPCOMP", XDM_CONST.IP_PROTOCOL_IPCOMP, get_Protocol = "SNP", XDM_CONST.IP_PROTOCOL_SNP, get_Protocol = "COMPAQ_PEER", XDM_CONST.IP_PROTOCOL_COMPAQ_PEER, get_Protocol = "IPX_IN_IP", XDM_CONST.IP_PROTOCOL_IPX_IN_IP, get_Protocol = "VRRP", XDM_CONST.IP_PROTOCOL_VRRP, get_Protocol = "PGM", XDM_CONST.IP_PROTOCOL_PGM, get_Protocol = "L2TP", XDM_CONST.IP_PROTOCOL_L2TP, get_Protocol = "DDX", XDM_CONST.IP_PROTOCOL_DDX, get_Protocol = "IATP", XDM_CONST.IP_PROTOCOL_IATP, get_Protocol = "STP", XDM_CONST.IP_PROTOCOL_STP, get_Protocol = "SRP", XDM_CONST.IP_PROTOCOL_SRP, get_Protocol = "UTI", XDM_CONST.IP_PROTOCOL_UTI, get_Protocol = "SMP", XDM_CONST.IP_PROTOCOL_SMP, get_Protocol = "SM", XDM_CONST.IP_PROTOCOL_SM, get_Protocol = "PTP", XDM_CONST.IP_PROTOCOL_PTP, get_Protocol = "ISIS", XDM_CONST.IP_PROTOCOL_ISIS, get_Protocol = "FIRE", XDM_CONST.IP_PROTOCOL_FIRE, get_Protocol = "CRTP", XDM_CONST.IP_PROTOCOL_CRTP, get_Protocol = "CRUDP", XDM_CONST.IP_PROTOCOL_CRUDP, get_Protocol = "SSCOPMCE", XDM_CONST.IP_PROTOCOL_SSCOPMCE, get_Protocol = "IPLT", XDM_CONST.IP_PROTOCOL_IPLT, get_Protocol = "SPS", XDM_CONST.IP_PROTOCOL_SPS, get_Protocol = "PIPE", XDM_CONST.IP_PROTOCOL_PIPE, get_Protocol = "SCTP", XDM_CONST.IP_PROTOCOL_SCTP, get_Protocol = "FC", XDM_CONST.IP_PROTOCOL_FC, get_Protocol = "RSVP_E2E_IGNORE", XDM_CONST.IP_PROTOCOL_RSVP_E2E_IGNORE, get_Protocol = "MOBILITY", XDM_CONST.IP_PROTOCOL_MOBILITY, get_Protocol = "UDPLITE", XDM_CONST.IP_PROTOCOL_UDPLITE, get_Protocol = "MPLS_IN_IP", XDM_CONST.IP_PROTOCOL_MPLS_IN_IP, get_Protocol = "MANET", XDM_CONST.IP_PROTOCOL_MANET, get_Protocol = "HIP", XDM_CONST.IP_PROTOCOL_HIP, get_Protocol = "SHIM6", XDM_CONST.IP_PROTOCOL_SHIM6, get_Protocol = "WESP", XDM_CONST.IP_PROTOCOL_WESP, get_Protocol = "ROHC", XDM_CONST.IP_PROTOCOL_ROHC, get_Protocol = "RESERVED", XDM_CONST.IP_PROTOCOL_RESERVED, get_Protocol = null, null, to_string(get_Protocol)), xdm.target.ipv4 = arrayindex(regextract(_raw_log -> PublicIpAddresses, "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}"), 0), xdm.target.ipv6 = arrayindex(regextract(_raw_log -> PublicIpAddresses, "((?:[a-fA-F\d]{0,4}\:){2,7}[a-fA-F\d]{0,4})"), 0), xdm.target.host.ipv4_public_addresses = regextract(_raw_log -> PublicIpAddresses, "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}"), xdm.target.host.ipv6_public_addresses = regextract(_raw_log -> PublicIpAddresses, "((?:[a-fA-F\d]{0,4}\:){2,7}[a-fA-F\d]{0,4})"), xdm.observer.action = _raw_log -> Status, xdm.target.cloud.project_id = coalesce(_raw_log -> Subscription, _raw_log -> TenantId), xdm.target.cloud.project = _raw_log -> SubscriptionName, xdm.target.agent.identifier = _raw_log -> VirtualMachine, xdm.target.zone = _raw_log -> Zones;