[MODEL: dataset = "vmware_carbon_black_cloud_raw"]
alter  
    event_type = if(to_string(flagged) != null, "audit log", to_string(severity) != null, "alert log", null)
| filter event_type in("alert log")
| alter //detection of IP address's types  
        external_ipv4 = arrayindex(regextract(device_external_ip,"(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"),0),
        external_ipv6 = arrayindex(regextract(device_external_ip, "([a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5})"),0),
        internal_ipv4 = arrayindex(regextract(device_internal_ip,"(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"),0),
        internal_ipv6 = arrayindex(regextract(device_internal_ip, "([a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5})"),0)
| alter
        xdm.source.cloud.project = org_key,
        xdm.target.url = alert_url,
        xdm.alert.original_alert_id = id,
        xdm.event.type = type,
        xdm.alert.severity = to_string(severity),
        xdm.alert.description = reason,
        xdm.alert.original_threat_id = threat_id,
        xdm.event.id = primary_event_id,
        xdm.target.host.device_id = to_string(device_id),
        xdm.target.host.hostname = device_name,
        xdm.alert.risks = arraycreate("Device target value:" + device_target_value, "ml classification final verdict: " + ml_classification_final_verdict),
        xdm.target.resource.type = "Policy",
        xdm.target.resource.name = device_policy,
        xdm.target.resource.id = to_string(device_policy_id),
        xdm.target.resource.value = policy_applied, //Policy applied or not applied
        xdm.event.operation_sub_type = run_state, // did the threat ran or not
        xdm.event.outcome = if(sensor_action ~= "ALLOW|ALLOW_AND_LOG", XDM_CONST.OUTCOME_SUCCESS, sensor_action ~= "DENY| TERMINATE", XDM_CONST.OUTCOME_FAILED, XDM_CONST.OUTCOME_UNKNOWN),
        xdm.target.host.os_family = if(device_os = "WINDOWS", XDM_CONST.OS_FAMILY_WINDOWS, device_os = "MAC", XDM_CONST.OS_FAMILY_MACOS, device_os = "LINUX", XDM_CONST.OS_FAMILY_LINUX),
        xdm.target.host.os = device_os_version,
        xdm.target.user.username = device_username,
        xdm.target.identity.username = device_username,
        xdm.target.host.ipv4_addresses = arraycreate(internal_ipv4, external_ipv4),
        xdm.target.host.ipv6_addresses = arraycreate(internal_ipv6, external_ipv6),
        xdm.observer.type = "Watchlist",
        xdm.observer.unique_identifier = report_id,
        xdm.observer.name = report_name,
        xdm.observer.action = report_description,
        xdm.observer.product = report_link,
        xdm.alert.mitre_tactics = arraycreate(report_link),
        xdm.source.process.pid = process_pid,
        xdm.source.process.executable.path = process_name,
        xdm.source.process.executable.filename= arrayindex(regextract(process_name, "[^\\]+$"),0),
        xdm.source.process.executable.sha256 = process_sha256,
        xdm.source.process.executable.md5 = process_md5,
        xdm.source.process.command_line = process_cmdline,
        xdm.source.user.username = process_username, //username in which the actor process was executed
        xdm.source.identity.username = process_username, //username in which the actor process was executed
        xdm.source.process.parent_id = to_string(parent_pid);
alter  
    event_type = if(to_string(flagged) != null, "audit log", to_string(severity) != null, "alert log", null)
| filter event_type in("audit log")
| alter 
        client_ipv4 = regextract(clientIp,"(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"),
        client_ipv6 = regextract(clientIp, "([a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5})")
| alter
    xdm.event.description = description,
    xdm.source.cloud.project = orgName,
    xdm.target.url = requestUrl,
    xdm.source.user.username = loginName,
    xdm.source.identity.username = loginName,
    xdm.source.ipv4 = arrayindex(client_ipv4,0),
    xdm.source.ipv6 = arrayindex(client_ipv6,0),
    xdm.event.id = eventId;