[MODEL: dataset="cisco_firepower_raw"]
alter 
xdm.target.port=to_integer(dpt),
xdm.source.port=to_integer(spt),
xdm.target.sent_bytes=to_integer(bytesIn),
xdm.source.sent_bytes=to_integer(bytesOut),
xdm.observer.action=act,
xdm.network.application_protocol=app,
xdm.network.rule=cs2,
xdm.source.zone=cs3,
xdm.target.zone=cs4,
xdm.alert.category=cs5,
xdm.source.ipv4=if(is_ipv4(src), src),
xdm.source.ipv6=if(is_ipv6(src), src),
xdm.target.ipv4=if(is_ipv4(dst), dst),
xdm.target.ipv6=if(is_ipv6(dst), dst),
xdm.source.user.username=suser,
xdm.source.identity.username=suser,
xdm.target.user.username=duser,
xdm.target.identity.username=duser,
xdm.source.process.pid=to_integer(dvcpid),
xdm.event.outcome_reason=reason,
xdm.source.application.name=requestClientApplication,
xdm.source.interface=deviceOutboundInterface,
xdm.target.interface=deviceInboundInterface,
xdm.observer.unique_identifier=deviceExternalId,
xdm.alert.severity=cefSeverity,
xdm.event.id=externalId,
xdm.network.http.url=request,
xdm.observer.name=dvchost,
xdm.event.outcome=outcome,
xdm.event.type=cefName,
xdm.observer.vendor=cefDeviceVendor,
xdm.observer.product=cefDeviceProduct,
xdm.target.file.filename=fname,
xdm.target.file.md5=fileHash,
xdm.target.file.file_type=fileType;