[MODEL: dataset=cyberark_identity_raw]
filter
    EventType in ("Cloud.Core.OAuthToken.Create", "Cloud.Core.Logout", "Cloud.Core.MfaSummary", "Cloud.Core.StartImpersonate","Cloud.Core.Login", "Cloud.Core.LoginFail", "Cloud.Core.Logout", "Cloud.Core.OAuthToken.InvalidClient" )
| alter
    xdm.target.user.identifier = ImpersonateTargetUuid,
    xdm.target.user.username = coalesce(NormalizedUser,UserName,ImpersonateTargetName),
    xdm.session_context_id = Session,
    xdm.event.outcome = MfaResult,
    xdm.event.outcome_reason = MfaReason,
    xdm.target.application.name = coalesce(ProfileName, ApplicationName, AppName),
	xdm.auth.auth_method = AuthMethod,
    xdm.event.type=EventType,
    xdm.source.ipv4 = FromIPAddress,
    xdm.source.application.name = AppId;
    
filter  EventType not in ("Cloud.Core.OAuthToken.Create", "Cloud.Core.Logout", "Cloud.Core.MfaSummary", "Cloud.Core.StartImpersonate","Cloud.Core.Login", "Cloud.Core.LoginFail", "Cloud.Core.Logout", "Cloud.Core.OAuthToken.InvalidClient" )
 |   alter
    xdm.target.resource.name = coalesce(ObjectName, Role, Alias, ProfileName, TargetUser, DSName, ImpersonateTargetName, Cname, AffectedTenant, OU, DeviceName, ApplicationName, AppName, EntityName),
    xdm.target.resource.type = coalesce(ObjectType, Type, DSType, LicenseType, NewLicenseType, ApplicationType, EntityType),
    xdm.target.resource.id = coalesce( if(EventType NOT IN ("Cloud.AfwEnterprise.Enroll", "Cloud.AfwEnterprise.Unenroll", "Cloud.Core.EmmTenantMigrated", "Cloud.Saas.Application.AppPublish", "Cloud.Saas.Application.AppUnpublish"), RoleId), Id, TargetUserID, Uuid, Key, DSUuid, ImpersonateTargetUuid, ProxyId, ConnectorUuid, DeviceID, ApplicationID, AppId, EntityUuid),
    xdm.source.user.username =coalesce(Changer, EmailAddress, UserName),
    xdm.source.user.identifier =coalesce(ChangerUuid,EntityName, UserGuid),
    xdm.source.ipv4 = FromIPAddress,
    xdm.event.outcome = coalesce(Result, SyncResult, MfaResult),
    xdm.event.outcome_reason = coalesce(Exception, FailedMessage, FailureReason, DeleteReason, SyncActionReason),
    xdm.target.resource.value = coalesce(ReplaceDomain, Thumbprint, Value, UserState, SetPath, NewState, To, NewEntity),
    xdm.target.resource_before.value =coalesce(PreviousUserState, OldState, From, OldEntity),
    xdm.event.description = coalesce(Exception, Description),
    xdm.target.user.username =coalesce(EntityName, ProfileName,ApplicationName, MachineName, ClientAddress, HostAddress, UserName, `Target`, EnrollProfileUser, NormalizedUser),
    xdm.target.user.identifier = coalesce(UserGuid, LocalAccountUuid),
    xdm.target.resource_before.type = OldLicenseType,
    xdm.target.resource.sub_type = MobileAppType,
    xdm.session_context_id = coalesce(JobUniqueId, SessionId),
	xdm.event.type=EventType;