[MODEL: dataset="cyber_ark_vault_raw"]
alter
    event_description = uppercase(cefName),
    reason_uppercase = uppercase(reason),
    cs2_len = len(cs2),
    cn2_len = len(to_string(cn2))
| alter 
    xdm.alert.name = cefName,
    xdm.alert.severity = cefSeverity,
    xdm.alert.original_alert_id = to_string(cn1),
    xdm.database.name = cs4, // ExtraDetails.DataBase
    xdm.event.id = cefDeviceEventClassId,
    xdm.event.type = cefName,
    xdm.event.description = msg,
    xdm.event.operation_sub_type = act,
    xdm.event.outcome = if(event_description ~= "SUCCESS|SUCCEEDED",XDM_CONST.OUTCOME_SUCCESS, event_description ~= "FAIL|UNAUTHORIZED|BLOCK|INCORRECT", XDM_CONST.OUTCOME_FAILED),
    xdm.event.outcome_reason = if(reason_uppercase ~= "FAILURE|WARNING|INFO", reason, cn2_len > 0, cn2, msg),
    xdm.event.log_level = if(cefSeverity = "10", XDM_CONST.LOG_LEVEL_CRITICAL, cefSeverity = "7", XDM_CONST.LOG_LEVEL_ERROR, cefSeverity = "5", XDM_CONST.LOG_LEVEL_INFORMATIONAL),
    xdm.intermediate.ipv4 = if(dvc ~= "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}", dvc, null),
    xdm.intermediate.ipv6 = if(dvc ~= "[a-fA-F\d\:]{8,}", dvc, null),
    xdm.network.application_protocol = app, // ExtraDetails.Protocol
    xdm.network.session_id = to_string(externalID), // ExtraDetails.SessionID
    xdm.observer.version = cefDeviceVersion, 
    xdm.source.user.username = suser,
    xdm.source.ipv4 = if(shost ~= "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}", shost), 
    xdm.source.ipv6 = if(shost ~= "[a-fA-F\d\:]{8,}", shost), 
    xdm.source.host.hostname = if(shost !~= "\d{1,3}\.\d{1,3}\d{1,3}\.\d{1,3}|[a-fA-F\d\:]{8,}", shost), 
    xdm.source.host.device_category = cs3,
    xdm.source.process.command_line = reason, // ExtraDetails.Command
    xdm.target.ipv4 = if(dhost ~= "\d{1,3}\.\d{1,3}\d{1,3}\.\d{1,3}", dhost), 
    xdm.target.ipv6 =  if(dhost ~= "[a-fA-F\d\:]{8,}", dhost), 
    xdm.target.host.hostname = if(dhost !~= "\d{1,3}\.\d{1,3}\d{1,3}\.\d{1,3}|[a-fA-F\d\:]{8,}", dhost), 
    xdm.target.user.username = if(len(duser) > 0, duser, cs1),
    xdm.target.file.filename = fname,
    xdm.target.resource.name = if(cs2_len > 0, cs2), // name of the target safe 
    xdm.target.resource.type = if(cs2_len > 0, trim(cs2Label, "\"")); // "Safe Name" label