[MODEL: dataset="forcepoint_security_raw"]
alter 
xdm.event.operation_sub_type=if(cn1=1024,"Category permitted, not set",
cn1=1025,"Category blocked",
cn1=1026,"Category permitted",
cn1=1027,"Custom URL, category blocked",
cn1=1028,"Custom URL, category permitted",
cn1=1029,"Always blocked",
cn1=1030,"Never blocked",
cn1=1031,"Blocked by limited access filter",
cn1=1032,"Blocked by keyword",
cn1=1033,"Blocked – subscription level exceeded",
cn1=1034,"Permitted – subscription level exceeded",
cn1=1035,"Password override page",
cn1=1037,"Permitted by password override",
cn1=1040,"Permitted with Confirm option",
cn1=1041,"Blocked – authentication required",
cn1=1042,"Permitted – category not purchased",
cn1=1043,"Permitted by quota",
cn1=1044,"Permitted with keyword match",
cn1=1045,"Blocked due to network bandwidth",
cn1=1046,"Blocked due to protocol bandwidth",
cn1=1047,"File type blocked ",
cn1=1048,"File type permitted",
cn1=1049,"Protocol blocked",
cn1=1050,"Protocol permitted",
cn1=1051,"Protocol permitted, not set",
cn1=1052,"Permitted by limited access filter",
cn1=1053,"Redirected by search filtering",
cn1=1054,"Blocked with Confirm option",
cn1=1055,"Blocked by quota",
cn1=1056,"Permitted – protocol not purchased",
cn1=1057,"Blocked by security override",
cn1=1058,"Blocked by hybrid antivirus scanning (inbound)",
cn1=1059,"Blocked by hybrid antivirus scanning (outbound)",
cn1=1060,"Permitted by exception",
cn1=1061,"Blocked by exception",
cn1=1281,"Category blocked (Content Gateway analysis)",
cn1=1282,"Category permitted (Content Gateway analysis)",
cn1=1293,"Permitted by password override (Content Gateway analysis)",
cn1=1296,"Permitted with confirm option (Content Gateway analysis)",
cn1=1299,"Permitted by quota (Content Gateway analysis)",
cn1=1301,"Blocked due to network bandwidth (Content Gateway analysis)",
cn1=1302,"Blocked due to protocol bandwidth (Content Gateway analysis)",
cn1=1303,"File type blocked (Content Gateway analysis)",
cn1=1304,"File type permitted (Content Gateway analysis)",
cn1=1310,"Blocked with confirm option (Content Gateway analysis)",
cn1=1311,"Blocked by quota (Content Gateway analysis)",
cn1=1313,"Blocked by security override (Content Gateway analysis)",
cn1=1537,"Permitted by scanning link analysis",
cn1=1538,"Web 2.0 request permitted",
cn1=1539,"Permitted after Web 2.0 scanning and link analysis",
cn1=1553,"Blocked by scanning link analysis",
cn1=1554,"Web 2.0 request blocked",
cn1=1555,"Blocked after Web 2.0 scanning and link analysis",
cn1=1556,"Zipbomb permitted (Content Gateway analysis)",
cn1=1557,"Zipbomb blocked (Content Gateway analysis)",to_string(cn1)),
xdm.event.duration=to_integer(cn2),
xdm.target.port=to_integer(dpt),
xdm.source.port=to_integer(spt),
xdm.target.sent_bytes = to_integer(`in`),
xdm.source.sent_bytes=to_integer(out),
xdm.observer.action=act,
xdm.source.zone=logRecordSource,
xdm.network.application_protocol=app,
xdm.network.rule=cs1,
xdm.network.http.url_category=if(cs2="1", XDM_CONST.URL_CATEGORY_ADULT,
cs2="65", XDM_CONST.URL_CATEGORY_ADULT,
cs2="66", XDM_CONST.URL_CATEGORY_ADULT,
cs2="67", XDM_CONST.URL_CATEGORY_ADULT,
cs2="94", XDM_CONST.URL_CATEGORY_ADULT,
cs2="95",XDM_CONST.URL_CATEGORY_ADULT,
cs2="2",XDM_CONST.URL_CATEGORY_BUSINESS_AND_ECONOMY,
cs2="4", XDM_CONST.URL_CATEGORY_GOVERNMENT,
cs2="72", XDM_CONST.URL_CATEGORY_GOVERNMENT,
cs2="73", XDM_CONST.URL_CATEGORY_GOVERNMENT,
cs2="5",XDM_CONST.URL_CATEGORY_NEWS ,
cs2="81",XDM_CONST.URL_CATEGORY_NEWS,
cs2="6", XDM_CONST.URL_CATEGORY_RELIGION,
cs2="82", XDM_CONST.URL_CATEGORY_RELIGION,
cs2="83", XDM_CONST.URL_CATEGORY_RELIGION,
cs2="7",XDM_CONST.URL_CATEGORY_SOCIETY,
cs2="103", XDM_CONST.URL_CATEGORY_SOCIETY ,
cs2="117", XDM_CONST.URL_CATEGORY_SOCIETY,
cs2="10", XDM_CONST.URL_CATEGORY_ABORTION,
cs2="92",XDM_CONST.URL_CATEGORY_ABORTION,
cs2="93", XDM_CONST.URL_CATEGORY_ABORTION,
cs2="11",XDM_CONST.URL_CATEGORY_PHILOSOPHY_AND_POLITICAL_ADVOCACY,
cs2="12",XDM_CONST.URL_CATEGORY_ENTERTAINMENT_AND_ARTS,
cs2="70", XDM_CONST.URL_CATEGORY_ENTERTAINMENT_AND_ARTS,
cs2="13",XDM_CONST.URL_CATEGORY_GAMBLING,
cs2="14",XDM_CONST.URL_CATEGORY_GAMES,
cs2="16",XDM_CONST.URL_CATEGORY_JOB_SEARCH,
cs2="17",XDM_CONST.URL_CATEGORY_SHOPPING,
cs2="101",XDM_CONST.URL_CATEGORY_SHOPPING,
cs2="102",XDM_CONST.URL_CATEGORY_SHOPPING,
cs2="18", XDM_CONST.URL_CATEGORY_SPORTS,
cs2="107", XDM_CONST.URL_CATEGORY_SPORTS,
cs2="20",XDM_CONST.URL_CATEGORY_TRAVEL,
cs2="21", XDM_CONST.URL_CATEGORY_MOTOR_VEHICLES,
cs2="23",XDM_CONST.URL_CATEGORY_WEAPONS,
cs2="24",XDM_CONST.URL_CATEGORY_ABUSED_DRUGS,
cs2="88",XDM_CONST.URL_CATEGORY_ABUSED_DRUGS,
cs2="89", XDM_CONST.URL_CATEGORY_ABUSED_DRUGS,
cs2="90", XDM_CONST.URL_CATEGORY_ABUSED_DRUGS,
cs2="111",XDM_CONST.URL_CATEGORY_ABUSED_DRUGS,
cs2="25",XDM_CONST.URL_CATEGORY_MILITARY,
cs2="27",XDM_CONST.URL_CATEGORY_HEALTH_AND_MEDICINE,
cs2="74",XDM_CONST.URL_CATEGORY_INTERNET_COMMUNICATIONS_AND_TELEPHONY,
cs2="79", XDM_CONST.URL_CATEGORY_INTERNET_COMMUNICATIONS_AND_TELEPHONY,
cs2="91",XDM_CONST.URL_CATEGORY_INTERNET_COMMUNICATIONS_AND_TELEPHONY,
cs2="195", XDM_CONST.URL_CATEGORY_INTERNET_COMMUNICATIONS_AND_TELEPHONY,
cs2="196", XDM_CONST.URL_CATEGORY_INTERNET_COMMUNICATIONS_AND_TELEPHONY, to_string(cs2)),
xdm.network.http.content_type=cs3,
xdm.target.ipv4=dst,
xdm.intermediate.ipv4=dvc,
xdm.source.ipv4=src,
xdm.target.host.hostname=dhost,
xdm.source.user.username=suser,
xdm.event.outcome_reason=reason,
xdm.event.type=cefName,
xdm.source.user.identifier=loginID,
xdm.network.http.url=request,
xdm.alert.severity=cefSeverity,
xdm.network.http.method=if(requestMethod="ACL", XDM_CONST.HTTP_METHOD_ACL,
requestMethod="BASELINE_CONTROL", XDM_CONST.HTTP_METHOD_BASELINE_CONTROL,
requestMethod="BIND", XDM_CONST.HTTP_METHOD_BIND,
requestMethod="CHECKIN", XDM_CONST.HTTP_METHOD_CHECKIN,
requestMethod="CHECKOUT", XDM_CONST.HTTP_METHOD_CHECKOUT,
requestMethod="CONNECT", XDM_CONST.HTTP_METHOD_CONNECT,
requestMethod="COPY", XDM_CONST.HTTP_METHOD_COPY,
requestMethod="DELETE", XDM_CONST.HTTP_METHOD_DELETE,
requestMethod="GET", XDM_CONST.HTTP_METHOD_GET,
requestMethod="HEAD", XDM_CONST.HTTP_METHOD_HEAD,
requestMethod="LABEL", XDM_CONST.HTTP_METHOD_LABEL,
requestMethod="LINK", XDM_CONST.HTTP_METHOD_LINK,
requestMethod="LOCK", XDM_CONST.HTTP_METHOD_LOCK,
requestMethod="MERGE", XDM_CONST.HTTP_METHOD_MERGE,
requestMethod="MKACTIVITY", XDM_CONST.HTTP_METHOD_MKACTIVITY,
requestMethod="MKCALENDAR", XDM_CONST.HTTP_METHOD_MKCALENDAR,
requestMethod="MKCOL", XDM_CONST.HTTP_METHOD_MKCOL,
requestMethod="MKREDIRECTREF", XDM_CONST.HTTP_METHOD_MKREDIRECTREF,
requestMethod="MKWORKSPACE", XDM_CONST.HTTP_METHOD_MKWORKSPACE,
requestMethod="MOVE", XDM_CONST.HTTP_METHOD_MOVE,
requestMethod="OPTIONS", XDM_CONST.HTTP_METHOD_OPTIONS,
requestMethod="ORDERPATCH", XDM_CONST.HTTP_METHOD_ORDERPATCH,
requestMethod="PATCH", XDM_CONST.HTTP_METHOD_PATCH,
requestMethod="POST", XDM_CONST.HTTP_METHOD_POST,
requestMethod="PRI", XDM_CONST.HTTP_METHOD_PRI,
requestMethod="PROPFIND", XDM_CONST.HTTP_METHOD_PROPFIND,
requestMethod="PROPPATCH", XDM_CONST.HTTP_METHOD_PROPPATCH,
requestMethod="PUT", XDM_CONST.HTTP_METHOD_PUT,
requestMethod="REBIND", XDM_CONST.HTTP_METHOD_REBIND,
requestMethod="REPORT", XDM_CONST.HTTP_METHOD_REPORT,
requestMethod="SEARCH", XDM_CONST.HTTP_METHOD_SEARCH,
requestMethod="TRACE", XDM_CONST.HTTP_METHOD_TRACE,
requestMethod="UNBIND", XDM_CONST.HTTP_METHOD_UNBIND,
requestMethod="UNCHECKOUT", XDM_CONST.HTTP_METHOD_UNCHECKOUT,
requestMethod="UNLINK", XDM_CONST.HTTP_METHOD_UNLINK,
requestMethod="UNLOCK", XDM_CONST.HTTP_METHOD_UNLOCK,
requestMethod="UPDATE", XDM_CONST.HTTP_METHOD_UPDATE,
requestMethod="UPDATEREDIRECTREF", XDM_CONST.HTTP_METHOD_UPDATEREDIRECTREF,
requestMethod="VERSION_CONTROL", XDM_CONST.HTTP_METHOD_VERSION_CONTROL, to_string("requestMethod")),
xdm.source.user_agent=requestClientApplication;