[MODEL: dataset="akamai_guardicore_raw"] /* ========================================== Audit logs mapping ========================================== */ filter cefName ~= "Audit" | alter //Extraction fields src_username_from_upn = if(suser ~= "@", arrayindex(regextract(suser, "(\S+)\@"),0)), //Sometimes the suser field comes as UPN. msg_host = arrayindex(regextract(msg, "host\:\s(\S+)\,"),0), msg_port = arrayindex(regextract(msg, "port\:\s(\d+)"),0), msg_protocol = arrayindex(regextract(msg, "protocol\:\s(\w+)"),0), msg_resource_name = arrayindex(regextract(msg, "resource\:\s(\S+)"),0), msg_status_code = arrayindex(regextract(msg, "status\scode\:\s(\d+)"),0), msg_failed_login_reason = arrayindex(regextract(msg,"reason\:\s(.+)"),0) | alter //XDM Mapping xdm.event.type = cefName, xdm.observer.version = cefDeviceVersion, xdm.event.operation = if( act CONTAINS "authentication", XDM_CONST.OPERATION_TYPE_AUTHENTICATION, act IN("Get asset*", "Access to*"), XDM_CONST.OPERATION_TYPE_READ, act CONTAINS "Change password", XDM_CONST.OPERATION_TYPE_UPDATE, act IN("Adding*", "Create*"), XDM_CONST.OPERATION_TYPE_CREATE, act), xdm.event.operation_sub_type = act, xdm.source.user.upn = if(src_username_from_upn != null, suser), xdm.source.identity.upn = if(src_username_from_upn != null, suser), xdm.source.user.username = coalesce(src_username_from_upn, suser), xdm.source.identity.username = coalesce(src_username_from_upn, suser), xdm.source.ipv4 = if(is_ipv4(src) = TRUE, src), xdm.source.ipv6 = if(is_ipv6(src) = TRUE, src), xdm.event.description = msg, xdm.target.host.hostname = msg_host, xdm.target.port = to_integer(msg_port), xdm.network.ip_protocol = if( msg_protocol = null, null, msg_protocol = "HOPOPT",XDM_CONST.IP_PROTOCOL_HOPOPT, msg_protocol = "ICMP",XDM_CONST.IP_PROTOCOL_ICMP, msg_protocol = "IGMP",XDM_CONST.IP_PROTOCOL_IGMP, msg_protocol = "GGP",XDM_CONST.IP_PROTOCOL_GGP, msg_protocol = "IP",XDM_CONST.IP_PROTOCOL_IP, msg_protocol = "ST",XDM_CONST.IP_PROTOCOL_ST, msg_protocol = "TCP",XDM_CONST.IP_PROTOCOL_TCP, msg_protocol = "CBT",XDM_CONST.IP_PROTOCOL_CBT, msg_protocol = "EGP",XDM_CONST.IP_PROTOCOL_EGP, msg_protocol = "IGP",XDM_CONST.IP_PROTOCOL_IGP, msg_protocol = "BBN_RCC_MON",XDM_CONST.IP_PROTOCOL_BBN_RCC_MON, msg_protocol = "NVP_II",XDM_CONST.IP_PROTOCOL_NVP_II, msg_protocol = "PUP",XDM_CONST.IP_PROTOCOL_PUP, msg_protocol = "ARGUS",XDM_CONST.IP_PROTOCOL_ARGUS, msg_protocol = "EMCON",XDM_CONST.IP_PROTOCOL_EMCON, msg_protocol = "XNET",XDM_CONST.IP_PROTOCOL_XNET, msg_protocol = "CHAOS",XDM_CONST.IP_PROTOCOL_CHAOS, msg_protocol = "UDP",XDM_CONST.IP_PROTOCOL_UDP, msg_protocol = "MUX",XDM_CONST.IP_PROTOCOL_MUX, msg_protocol = "DCN_MEAS",XDM_CONST.IP_PROTOCOL_DCN_MEAS, msg_protocol = "HMP",XDM_CONST.IP_PROTOCOL_HMP, msg_protocol = "PRM",XDM_CONST.IP_PROTOCOL_PRM, msg_protocol = "XNS_IDP",XDM_CONST.IP_PROTOCOL_XNS_IDP, msg_protocol = "TRUNK_1",XDM_CONST.IP_PROTOCOL_TRUNK_1, msg_protocol = "TRUNK_2",XDM_CONST.IP_PROTOCOL_TRUNK_2, msg_protocol = "LEAF_1",XDM_CONST.IP_PROTOCOL_LEAF_1, msg_protocol = "LEAF_2",XDM_CONST.IP_PROTOCOL_LEAF_2, msg_protocol = "RDP",XDM_CONST.IP_PROTOCOL_RDP, msg_protocol = "IRTP",XDM_CONST.IP_PROTOCOL_IRTP, msg_protocol = "ISO_TP4",XDM_CONST.IP_PROTOCOL_ISO_TP4, msg_protocol = "NETBLT",XDM_CONST.IP_PROTOCOL_NETBLT, msg_protocol = "MFE_NSP",XDM_CONST.IP_PROTOCOL_MFE_NSP, msg_protocol = "MERIT_INP",XDM_CONST.IP_PROTOCOL_MERIT_INP, msg_protocol = "DCCP",XDM_CONST.IP_PROTOCOL_DCCP, msg_protocol = "3PC",XDM_CONST.IP_PROTOCOL_3PC, msg_protocol = "IDPR",XDM_CONST.IP_PROTOCOL_IDPR, msg_protocol = "XTP",XDM_CONST.IP_PROTOCOL_XTP, msg_protocol = "DDP",XDM_CONST.IP_PROTOCOL_DDP, msg_protocol = "IDPR_CMTP",XDM_CONST.IP_PROTOCOL_IDPR_CMTP, msg_protocol = "TP",XDM_CONST.IP_PROTOCOL_TP, msg_protocol = "IL",XDM_CONST.IP_PROTOCOL_IL, msg_protocol = "IPV6",XDM_CONST.IP_PROTOCOL_IPV6, msg_protocol = "SDRP",XDM_CONST.IP_PROTOCOL_SDRP, msg_protocol = "IPV6_ROUTE",XDM_CONST.IP_PROTOCOL_IPV6_ROUTE, msg_protocol = "IPV6_FRAG",XDM_CONST.IP_PROTOCOL_IPV6_FRAG, msg_protocol = "IDRP",XDM_CONST.IP_PROTOCOL_IDRP, msg_protocol = "RSVP",XDM_CONST.IP_PROTOCOL_RSVP, msg_protocol = "GRE",XDM_CONST.IP_PROTOCOL_GRE, msg_protocol = "DSR",XDM_CONST.IP_PROTOCOL_DSR, msg_protocol = "BNA",XDM_CONST.IP_PROTOCOL_BNA, msg_protocol = "ESP",XDM_CONST.IP_PROTOCOL_ESP, msg_protocol = "AH",XDM_CONST.IP_PROTOCOL_AH, msg_protocol = "I_NLSP",XDM_CONST.IP_PROTOCOL_I_NLSP, msg_protocol = "SWIPE",XDM_CONST.IP_PROTOCOL_SWIPE, msg_protocol = "NARP",XDM_CONST.IP_PROTOCOL_NARP, msg_protocol = "MOBILE",XDM_CONST.IP_PROTOCOL_MOBILE, msg_protocol = "TLSP",XDM_CONST.IP_PROTOCOL_TLSP, msg_protocol = "SKIP",XDM_CONST.IP_PROTOCOL_SKIP, msg_protocol = "IPV6_ICMP",XDM_CONST.IP_PROTOCOL_IPV6_ICMP, msg_protocol = "IPV6_NONXT",XDM_CONST.IP_PROTOCOL_IPV6_NONXT, msg_protocol = "IPV6_OPTS",XDM_CONST.IP_PROTOCOL_IPV6_OPTS, msg_protocol = "CFTP",XDM_CONST.IP_PROTOCOL_CFTP, msg_protocol = "SAT_EXPAK",XDM_CONST.IP_PROTOCOL_SAT_EXPAK, msg_protocol = "KRYPTOLAN",XDM_CONST.IP_PROTOCOL_KRYPTOLAN, msg_protocol = "RVD",XDM_CONST.IP_PROTOCOL_RVD, msg_protocol = "IPPC",XDM_CONST.IP_PROTOCOL_IPPC, msg_protocol = "SAT_MON",XDM_CONST.IP_PROTOCOL_SAT_MON, msg_protocol = "VISA",XDM_CONST.IP_PROTOCOL_VISA, msg_protocol = "IPCV",XDM_CONST.IP_PROTOCOL_IPCV, msg_protocol = "CPNX",XDM_CONST.IP_PROTOCOL_CPNX, msg_protocol = "CPHB",XDM_CONST.IP_PROTOCOL_CPHB, msg_protocol = "WSN",XDM_CONST.IP_PROTOCOL_WSN, msg_protocol = "PVP",XDM_CONST.IP_PROTOCOL_PVP, msg_protocol = "BR_SAT_MON",XDM_CONST.IP_PROTOCOL_BR_SAT_MON, msg_protocol = "SUN_ND",XDM_CONST.IP_PROTOCOL_SUN_ND, msg_protocol = "WB_MON",XDM_CONST.IP_PROTOCOL_WB_MON, msg_protocol = "WB_EXPAK",XDM_CONST.IP_PROTOCOL_WB_EXPAK, msg_protocol = "ISO_IP",XDM_CONST.IP_PROTOCOL_ISO_IP, msg_protocol = "VMTP",XDM_CONST.IP_PROTOCOL_VMTP, msg_protocol = "SECURE_VMTP",XDM_CONST.IP_PROTOCOL_SECURE_VMTP, msg_protocol = "VINES",XDM_CONST.IP_PROTOCOL_VINES, msg_protocol = "TTP",XDM_CONST.IP_PROTOCOL_TTP, msg_protocol = "NSFNET_IGP",XDM_CONST.IP_PROTOCOL_NSFNET_IGP, msg_protocol = "DGP",XDM_CONST.IP_PROTOCOL_DGP, msg_protocol = "TCF",XDM_CONST.IP_PROTOCOL_TCF, msg_protocol = "EIGRP",XDM_CONST.IP_PROTOCOL_EIGRP, msg_protocol = "OSPFIGP",XDM_CONST.IP_PROTOCOL_OSPFIGP, msg_protocol = "SPRITE_RPC",XDM_CONST.IP_PROTOCOL_SPRITE_RPC, msg_protocol = "LARP",XDM_CONST.IP_PROTOCOL_LARP, msg_protocol = "MTP",XDM_CONST.IP_PROTOCOL_MTP, msg_protocol = "AX25",XDM_CONST.IP_PROTOCOL_AX25, msg_protocol = "IPIP",XDM_CONST.IP_PROTOCOL_IPIP, msg_protocol = "MICP",XDM_CONST.IP_PROTOCOL_MICP, msg_protocol = "SCC_SP",XDM_CONST.IP_PROTOCOL_SCC_SP, msg_protocol = "ETHERIP",XDM_CONST.IP_PROTOCOL_ETHERIP, msg_protocol = "ENCAP",XDM_CONST.IP_PROTOCOL_ENCAP, msg_protocol = "GMTP",XDM_CONST.IP_PROTOCOL_GMTP, msg_protocol = "IFMP",XDM_CONST.IP_PROTOCOL_IFMP, msg_protocol = "PNNI",XDM_CONST.IP_PROTOCOL_PNNI, msg_protocol = "PIM",XDM_CONST.IP_PROTOCOL_PIM, msg_protocol = "ARIS",XDM_CONST.IP_PROTOCOL_ARIS, msg_protocol = "SCPS",XDM_CONST.IP_PROTOCOL_SCPS, msg_protocol = "QNX",XDM_CONST.IP_PROTOCOL_QNX, msg_protocol = "AN",XDM_CONST.IP_PROTOCOL_AN, msg_protocol = "IPCOMP",XDM_CONST.IP_PROTOCOL_IPCOMP, msg_protocol = "SNP",XDM_CONST.IP_PROTOCOL_SNP, msg_protocol = "COMPAQ_PEER",XDM_CONST.IP_PROTOCOL_COMPAQ_PEER, msg_protocol = "IPX_IN_IP",XDM_CONST.IP_PROTOCOL_IPX_IN_IP, msg_protocol = "VRRP",XDM_CONST.IP_PROTOCOL_VRRP, msg_protocol = "PGM",XDM_CONST.IP_PROTOCOL_PGM, msg_protocol = "L2TP",XDM_CONST.IP_PROTOCOL_L2TP, msg_protocol = "DDX",XDM_CONST.IP_PROTOCOL_DDX, msg_protocol = "IATP",XDM_CONST.IP_PROTOCOL_IATP, msg_protocol = "STP",XDM_CONST.IP_PROTOCOL_STP, msg_protocol = "SRP",XDM_CONST.IP_PROTOCOL_SRP, msg_protocol = "UTI",XDM_CONST.IP_PROTOCOL_UTI, msg_protocol = "SMP",XDM_CONST.IP_PROTOCOL_SMP, msg_protocol = "SM",XDM_CONST.IP_PROTOCOL_SM, msg_protocol = "PTP",XDM_CONST.IP_PROTOCOL_PTP, msg_protocol = "ISIS",XDM_CONST.IP_PROTOCOL_ISIS, msg_protocol = "FIRE",XDM_CONST.IP_PROTOCOL_FIRE, msg_protocol = "CRTP",XDM_CONST.IP_PROTOCOL_CRTP, msg_protocol = "CRUDP",XDM_CONST.IP_PROTOCOL_CRUDP, msg_protocol = "SSCOPMCE",XDM_CONST.IP_PROTOCOL_SSCOPMCE, msg_protocol = "IPLT",XDM_CONST.IP_PROTOCOL_IPLT, msg_protocol = "SPS",XDM_CONST.IP_PROTOCOL_SPS, msg_protocol = "PIPE",XDM_CONST.IP_PROTOCOL_PIPE, msg_protocol = "SCTP",XDM_CONST.IP_PROTOCOL_SCTP, msg_protocol = "FC",XDM_CONST.IP_PROTOCOL_FC, msg_protocol = "RSVP_E2E_IGNORE",XDM_CONST.IP_PROTOCOL_RSVP_E2E_IGNORE, msg_protocol = "MOBILITY",XDM_CONST.IP_PROTOCOL_MOBILITY, msg_protocol = "UDPLITE",XDM_CONST.IP_PROTOCOL_UDPLITE, msg_protocol = "MPLS_IN_IP",XDM_CONST.IP_PROTOCOL_MPLS_IN_IP, msg_protocol = "MANET",XDM_CONST.IP_PROTOCOL_MANET, msg_protocol = "HIP",XDM_CONST.IP_PROTOCOL_HIP, msg_protocol = "SHIM6",XDM_CONST.IP_PROTOCOL_SHIM6, msg_protocol = "WESP",XDM_CONST.IP_PROTOCOL_WESP, msg_protocol = "ROHC",XDM_CONST.IP_PROTOCOL_ROHC, msg_protocol = "RESERVED",XDM_CONST.IP_PROTOCOL_RESERVED, msg_protocol = "0",XDM_CONST.IP_PROTOCOL_HOPOPT, msg_protocol = "1",XDM_CONST.IP_PROTOCOL_ICMP, msg_protocol = "2",XDM_CONST.IP_PROTOCOL_IGMP, msg_protocol = "3",XDM_CONST.IP_PROTOCOL_GGP, msg_protocol = "4",XDM_CONST.IP_PROTOCOL_IP, msg_protocol = "5",XDM_CONST.IP_PROTOCOL_ST, msg_protocol = "6",XDM_CONST.IP_PROTOCOL_TCP, msg_protocol = "7",XDM_CONST.IP_PROTOCOL_CBT, msg_protocol = "8",XDM_CONST.IP_PROTOCOL_EGP, msg_protocol = "9",XDM_CONST.IP_PROTOCOL_IGP, msg_protocol = "10",XDM_CONST.IP_PROTOCOL_BBN_RCC_MON, msg_protocol = "11",XDM_CONST.IP_PROTOCOL_NVP_II, msg_protocol = "12",XDM_CONST.IP_PROTOCOL_PUP, msg_protocol = "13",XDM_CONST.IP_PROTOCOL_ARGUS, msg_protocol = "14",XDM_CONST.IP_PROTOCOL_EMCON, msg_protocol = "15",XDM_CONST.IP_PROTOCOL_XNET, msg_protocol = "16",XDM_CONST.IP_PROTOCOL_CHAOS, msg_protocol = "17",XDM_CONST.IP_PROTOCOL_UDP, msg_protocol = "18",XDM_CONST.IP_PROTOCOL_MUX, msg_protocol = "19",XDM_CONST.IP_PROTOCOL_DCN_MEAS, msg_protocol = "20",XDM_CONST.IP_PROTOCOL_HMP, msg_protocol = "21",XDM_CONST.IP_PROTOCOL_PRM, msg_protocol = "22",XDM_CONST.IP_PROTOCOL_XNS_IDP, msg_protocol = "23",XDM_CONST.IP_PROTOCOL_TRUNK_1, msg_protocol = "24",XDM_CONST.IP_PROTOCOL_TRUNK_2, msg_protocol = "25",XDM_CONST.IP_PROTOCOL_LEAF_1, msg_protocol = "26",XDM_CONST.IP_PROTOCOL_LEAF_2, msg_protocol = "27",XDM_CONST.IP_PROTOCOL_RDP, msg_protocol = "28",XDM_CONST.IP_PROTOCOL_IRTP, msg_protocol = "29",XDM_CONST.IP_PROTOCOL_ISO_TP4, msg_protocol = "30",XDM_CONST.IP_PROTOCOL_NETBLT, msg_protocol = "31",XDM_CONST.IP_PROTOCOL_MFE_NSP, msg_protocol = "32",XDM_CONST.IP_PROTOCOL_MERIT_INP, msg_protocol = "33",XDM_CONST.IP_PROTOCOL_DCCP, msg_protocol = "34",XDM_CONST.IP_PROTOCOL_3PC, msg_protocol = "35",XDM_CONST.IP_PROTOCOL_IDPR, msg_protocol = "36",XDM_CONST.IP_PROTOCOL_XTP, msg_protocol = "37",XDM_CONST.IP_PROTOCOL_DDP, msg_protocol = "38",XDM_CONST.IP_PROTOCOL_IDPR_CMTP, msg_protocol = "39",XDM_CONST.IP_PROTOCOL_TP, msg_protocol = "40",XDM_CONST.IP_PROTOCOL_IL, msg_protocol = "41",XDM_CONST.IP_PROTOCOL_IPV6, msg_protocol = "42",XDM_CONST.IP_PROTOCOL_SDRP, msg_protocol = "43",XDM_CONST.IP_PROTOCOL_IPV6_ROUTE, msg_protocol = "44",XDM_CONST.IP_PROTOCOL_IPV6_FRAG, msg_protocol = "45",XDM_CONST.IP_PROTOCOL_IDRP, msg_protocol = "46",XDM_CONST.IP_PROTOCOL_RSVP, msg_protocol = "47",XDM_CONST.IP_PROTOCOL_GRE, msg_protocol = "48",XDM_CONST.IP_PROTOCOL_DSR, msg_protocol = "49",XDM_CONST.IP_PROTOCOL_BNA, msg_protocol = "50",XDM_CONST.IP_PROTOCOL_ESP, msg_protocol = "51",XDM_CONST.IP_PROTOCOL_AH, msg_protocol = "52",XDM_CONST.IP_PROTOCOL_I_NLSP, msg_protocol = "53",XDM_CONST.IP_PROTOCOL_SWIPE, msg_protocol = "54",XDM_CONST.IP_PROTOCOL_NARP, msg_protocol = "55",XDM_CONST.IP_PROTOCOL_MOBILE, msg_protocol = "56",XDM_CONST.IP_PROTOCOL_TLSP, msg_protocol = "57",XDM_CONST.IP_PROTOCOL_SKIP, msg_protocol = "58",XDM_CONST.IP_PROTOCOL_IPV6_ICMP, msg_protocol = "59",XDM_CONST.IP_PROTOCOL_IPV6_NONXT, msg_protocol = "60",XDM_CONST.IP_PROTOCOL_IPV6_OPTS, msg_protocol = "62",XDM_CONST.IP_PROTOCOL_CFTP, msg_protocol = "64",XDM_CONST.IP_PROTOCOL_SAT_EXPAK, msg_protocol = "65",XDM_CONST.IP_PROTOCOL_KRYPTOLAN, msg_protocol = "66",XDM_CONST.IP_PROTOCOL_RVD, msg_protocol = "67",XDM_CONST.IP_PROTOCOL_IPPC, msg_protocol = "69",XDM_CONST.IP_PROTOCOL_SAT_MON, msg_protocol = "70",XDM_CONST.IP_PROTOCOL_VISA, msg_protocol = "71",XDM_CONST.IP_PROTOCOL_IPCV, msg_protocol = "72",XDM_CONST.IP_PROTOCOL_CPNX, msg_protocol = "73",XDM_CONST.IP_PROTOCOL_CPHB, msg_protocol = "74",XDM_CONST.IP_PROTOCOL_WSN, msg_protocol = "75",XDM_CONST.IP_PROTOCOL_PVP, msg_protocol = "76",XDM_CONST.IP_PROTOCOL_BR_SAT_MON, msg_protocol = "77",XDM_CONST.IP_PROTOCOL_SUN_ND, msg_protocol = "78",XDM_CONST.IP_PROTOCOL_WB_MON, msg_protocol = "79",XDM_CONST.IP_PROTOCOL_WB_EXPAK, msg_protocol = "80",XDM_CONST.IP_PROTOCOL_ISO_IP, msg_protocol = "81",XDM_CONST.IP_PROTOCOL_VMTP, msg_protocol = "82",XDM_CONST.IP_PROTOCOL_SECURE_VMTP, msg_protocol = "83",XDM_CONST.IP_PROTOCOL_VINES, msg_protocol = "84",XDM_CONST.IP_PROTOCOL_TTP, msg_protocol = "85",XDM_CONST.IP_PROTOCOL_NSFNET_IGP, msg_protocol = "86",XDM_CONST.IP_PROTOCOL_DGP, msg_protocol = "87",XDM_CONST.IP_PROTOCOL_TCF, msg_protocol = "88",XDM_CONST.IP_PROTOCOL_EIGRP, msg_protocol = "89",XDM_CONST.IP_PROTOCOL_OSPFIGP, msg_protocol = "90",XDM_CONST.IP_PROTOCOL_SPRITE_RPC, msg_protocol = "91",XDM_CONST.IP_PROTOCOL_LARP, msg_protocol = "92",XDM_CONST.IP_PROTOCOL_MTP, msg_protocol = "93",XDM_CONST.IP_PROTOCOL_AX25, msg_protocol = "94",XDM_CONST.IP_PROTOCOL_IPIP, msg_protocol = "95",XDM_CONST.IP_PROTOCOL_MICP, msg_protocol = "96",XDM_CONST.IP_PROTOCOL_SCC_SP, msg_protocol = "97",XDM_CONST.IP_PROTOCOL_ETHERIP, msg_protocol = "98",XDM_CONST.IP_PROTOCOL_ENCAP, msg_protocol = "100",XDM_CONST.IP_PROTOCOL_GMTP, msg_protocol = "101",XDM_CONST.IP_PROTOCOL_IFMP, msg_protocol = "102",XDM_CONST.IP_PROTOCOL_PNNI, msg_protocol = "103",XDM_CONST.IP_PROTOCOL_PIM, msg_protocol = "104",XDM_CONST.IP_PROTOCOL_ARIS, msg_protocol = "105",XDM_CONST.IP_PROTOCOL_SCPS, msg_protocol = "106",XDM_CONST.IP_PROTOCOL_QNX, msg_protocol = "107",XDM_CONST.IP_PROTOCOL_AN, msg_protocol = "108",XDM_CONST.IP_PROTOCOL_IPCOMP, msg_protocol = "109",XDM_CONST.IP_PROTOCOL_SNP, msg_protocol = "110",XDM_CONST.IP_PROTOCOL_COMPAQ_PEER, msg_protocol = "111",XDM_CONST.IP_PROTOCOL_IPX_IN_IP, msg_protocol = "112",XDM_CONST.IP_PROTOCOL_VRRP, msg_protocol = "113",XDM_CONST.IP_PROTOCOL_PGM, msg_protocol = "115",XDM_CONST.IP_PROTOCOL_L2TP, msg_protocol = "116",XDM_CONST.IP_PROTOCOL_DDX, msg_protocol = "117",XDM_CONST.IP_PROTOCOL_IATP, msg_protocol = "118",XDM_CONST.IP_PROTOCOL_STP, msg_protocol = "119",XDM_CONST.IP_PROTOCOL_SRP, msg_protocol = "120",XDM_CONST.IP_PROTOCOL_UTI, msg_protocol = "121",XDM_CONST.IP_PROTOCOL_SMP, msg_protocol = "122",XDM_CONST.IP_PROTOCOL_SM, msg_protocol = "123",XDM_CONST.IP_PROTOCOL_PTP, msg_protocol = "124",XDM_CONST.IP_PROTOCOL_ISIS, msg_protocol = "125",XDM_CONST.IP_PROTOCOL_FIRE, msg_protocol = "126",XDM_CONST.IP_PROTOCOL_CRTP, msg_protocol = "127",XDM_CONST.IP_PROTOCOL_CRUDP, msg_protocol = "128",XDM_CONST.IP_PROTOCOL_SSCOPMCE, msg_protocol = "129",XDM_CONST.IP_PROTOCOL_IPLT, msg_protocol = "130",XDM_CONST.IP_PROTOCOL_SPS, msg_protocol = "131",XDM_CONST.IP_PROTOCOL_PIPE, msg_protocol = "132",XDM_CONST.IP_PROTOCOL_SCTP, msg_protocol = "133",XDM_CONST.IP_PROTOCOL_FC, msg_protocol = "134",XDM_CONST.IP_PROTOCOL_RSVP_E2E_IGNORE, msg_protocol = "135",XDM_CONST.IP_PROTOCOL_MOBILITY, msg_protocol = "136",XDM_CONST.IP_PROTOCOL_UDPLITE, msg_protocol = "137",XDM_CONST.IP_PROTOCOL_MPLS_IN_IP, msg_protocol = "138",XDM_CONST.IP_PROTOCOL_MANET, msg_protocol = "139",XDM_CONST.IP_PROTOCOL_HIP, msg_protocol = "140",XDM_CONST.IP_PROTOCOL_SHIM6, msg_protocol = "141",XDM_CONST.IP_PROTOCOL_WESP, msg_protocol = "142",XDM_CONST.IP_PROTOCOL_ROHC, msg_protocol = "255",XDM_CONST.IP_PROTOCOL_RESERVED, msg_protocol), xdm.target.resource.name = msg_resource_name, xdm.network.http.response_code = if( msg_status_code = null, null, msg_status_code = "100", XDM_CONST.HTTP_RSP_CODE_CONTINUE, msg_status_code = "101", XDM_CONST.HTTP_RSP_CODE_SWITCHING_PROTOCOLS, msg_status_code = "102", XDM_CONST.HTTP_RSP_CODE_PROCESSING, msg_status_code = "103", XDM_CONST.HTTP_RSP_CODE_EARLY_HINTS, msg_status_code = "200", XDM_CONST.HTTP_RSP_CODE_OK, msg_status_code = "201", XDM_CONST.HTTP_RSP_CODE_CREATED, msg_status_code = "202", XDM_CONST.HTTP_RSP_CODE_ACCEPTED, msg_status_code = "203", XDM_CONST.HTTP_RSP_CODE_NON__AUTHORITATIVE_INFORMATION, msg_status_code = "204", XDM_CONST.HTTP_RSP_CODE_NO_CONTENT, msg_status_code = "205", XDM_CONST.HTTP_RSP_CODE_RESET_CONTENT, msg_status_code = "206", XDM_CONST.HTTP_RSP_CODE_PARTIAL_CONTENT, msg_status_code = "207", XDM_CONST.HTTP_RSP_CODE_MULTI__STATUS, msg_status_code = "208", XDM_CONST.HTTP_RSP_CODE_ALREADY_REPORTED, msg_status_code = "226", XDM_CONST.HTTP_RSP_CODE_IM_USED, msg_status_code = "300", XDM_CONST.HTTP_RSP_CODE_MULTIPLE_CHOICES, msg_status_code = "301", XDM_CONST.HTTP_RSP_CODE_MOVED_PERMANENTLY, msg_status_code = "302", XDM_CONST.HTTP_RSP_CODE_FOUND, msg_status_code = "303", XDM_CONST.HTTP_RSP_CODE_SEE_OTHER, msg_status_code = "304", XDM_CONST.HTTP_RSP_CODE_NOT_MODIFIED, msg_status_code = "305", XDM_CONST.HTTP_RSP_CODE_USE_PROXY, msg_status_code = "307", XDM_CONST.HTTP_RSP_CODE_TEMPORARY_REDIRECT, msg_status_code = "308", XDM_CONST.HTTP_RSP_CODE_PERMANENT_REDIRECT, msg_status_code = "400", XDM_CONST.HTTP_RSP_CODE_BAD_REQUEST, msg_status_code = "401", XDM_CONST.HTTP_RSP_CODE_UNAUTHORIZED, msg_status_code = "402", XDM_CONST.HTTP_RSP_CODE_PAYMENT_REQUIRED, msg_status_code = "403", XDM_CONST.HTTP_RSP_CODE_FORBIDDEN, msg_status_code = "404", XDM_CONST.HTTP_RSP_CODE_NOT_FOUND, msg_status_code = "405", XDM_CONST.HTTP_RSP_CODE_METHOD_NOT_ALLOWED, msg_status_code = "406", XDM_CONST.HTTP_RSP_CODE_NOT_ACCEPTABLE, msg_status_code = "407", XDM_CONST.HTTP_RSP_CODE_PROXY_AUTHENTICATION_REQUIRED, msg_status_code = "408", XDM_CONST.HTTP_RSP_CODE_REQUEST_TIMEOUT, msg_status_code = "409", XDM_CONST.HTTP_RSP_CODE_CONFLICT, msg_status_code = "410", XDM_CONST.HTTP_RSP_CODE_GONE, msg_status_code = "411", XDM_CONST.HTTP_RSP_CODE_LENGTH_REQUIRED, msg_status_code = "412", XDM_CONST.HTTP_RSP_CODE_PRECONDITION_FAILED, msg_status_code = "413", XDM_CONST.HTTP_RSP_CODE_CONTENT_TOO_LARGE, msg_status_code = "414", XDM_CONST.HTTP_RSP_CODE_URI_TOO_LONG, msg_status_code = "415", XDM_CONST.HTTP_RSP_CODE_UNSUPPORTED_MEDIA_TYPE, msg_status_code = "416", XDM_CONST.HTTP_RSP_CODE_RANGE_NOT_SATISFIABLE, msg_status_code = "417", XDM_CONST.HTTP_RSP_CODE_EXPECTATION_FAILED, msg_status_code = "421", XDM_CONST.HTTP_RSP_CODE_MISDIRECTED_REQUEST, msg_status_code = "422", XDM_CONST.HTTP_RSP_CODE_UNPROCESSABLE_CONTENT, msg_status_code = "423", XDM_CONST.HTTP_RSP_CODE_LOCKED, msg_status_code = "424", XDM_CONST.HTTP_RSP_CODE_FAILED_DEPENDENCY, msg_status_code = "425", XDM_CONST.HTTP_RSP_CODE_TOO_EARLY, msg_status_code = "426", XDM_CONST.HTTP_RSP_CODE_UPGRADE_REQUIRED, msg_status_code = "428", XDM_CONST.HTTP_RSP_CODE_PRECONDITION_REQUIRED, msg_status_code = "429", XDM_CONST.HTTP_RSP_CODE_TOO_MANY_REQUESTS, msg_status_code = "431", XDM_CONST.HTTP_RSP_CODE_REQUEST_HEADER_FIELDS_TOO_LARGE, msg_status_code = "451", XDM_CONST.HTTP_RSP_CODE_UNAVAILABLE_FOR_LEGAL_REASONS, msg_status_code = "500", XDM_CONST.HTTP_RSP_CODE_INTERNAL_SERVER_ERROR, msg_status_code = "501", XDM_CONST.HTTP_RSP_CODE_NOT_IMPLEMENTED, msg_status_code = "502", XDM_CONST.HTTP_RSP_CODE_BAD_GATEWAY, msg_status_code = "503", XDM_CONST.HTTP_RSP_CODE_SERVICE_UNAVAILABLE, msg_status_code = "504", XDM_CONST.HTTP_RSP_CODE_GATEWAY_TIMEOUT, msg_status_code = "505", XDM_CONST.HTTP_RSP_CODE_HTTP_VERSION_NOT_SUPPORTED, msg_status_code = "506", XDM_CONST.HTTP_RSP_CODE_VARIANT_ALSO_NEGOTIATES, msg_status_code = "507", XDM_CONST.HTTP_RSP_CODE_INSUFFICIENT_STORAGE, msg_status_code = "508", XDM_CONST.HTTP_RSP_CODE_LOOP_DETECTED, msg_status_code = "511", XDM_CONST.HTTP_RSP_CODE_NETWORK_AUTHENTICATION_REQUIRED, msg_status_code), xdm.event.outcome = if( msg ~= "failed", XDM_CONST.OUTCOME_FAILED, msg ~= "success", XDM_CONST.OUTCOME_SUCCESS, msg_status_code IN("200","201","202","203","204","205","207","208","226"), XDM_CONST.OUTCOME_SUCCESS, msg_status_code IN("4*","5*"),XDM_CONST.OUTCOME_FAILED, msg_status_code IN("206"), XDM_CONST.OUTCOME_PARTIAL, XDM_CONST.OUTCOME_UNKNOWN), xdm.event.outcome_reason = msg_failed_login_reason; /* ========================================== Agent logs mapping ========================================== */ filter cefName ~= "Agent" | alter trg_os = parsed_cs1 -> os_name, trg_hostname = arrayindex(regextract(cs1, "^([^\s]+)"),0) | alter //XDM mapping xdm.observer.version = cefDeviceVersion, xdm.event.type = cefName, xdm.event.id = id, xdm.source.host.hostname = shost, xdm.event.description = msg, xdm.target.ipv4 = if(is_ipv4(parsed_cs1 -> ip) = TRUE, parsed_cs1 -> ip), xdm.target.ipv6 = if(is_ipv6(parsed_cs1 -> ip) = TRUE, parsed_cs1 -> ip), xdm.target.host.os = trg_os, xdm.target.zone = parsed_cs1 -> Environment, xdm.target.host.os_family = if( trg_os ~= "Windows", XDM_CONST.OS_FAMILY_WINDOWS, trg_os ~= "Mac", XDM_CONST.OS_FAMILY_MACOS, trg_os ~= "Linux", XDM_CONST.OS_FAMILY_LINUX, trg_os ~= "Ubuntu", XDM_CONST.OS_FAMILY_UBUNTU), xdm.target.host.hostname = trg_hostname, xdm.target.resource.name = trg_hostname, xdm.target.resource.type = parsed_cs1 -> Role, xdm.target.application.name = parsed_cs1 -> App, xdm.event.outcome = if( msg IN ("Success*","*success*", "*status flag was raised*"), XDM_CONST.OUTCOME_SUCCESS, msg ~= "[Ff]ail", XDM_CONST.OUTCOME_FAILED, XDM_CONST.OUTCOME_UNKNOWN), xdm.alert.severity = cefSeverity; /* ========================================== System logs mapping ========================================== */ filter cefName ~= "System" | alter //XDM mapping xdm.observer.version = cefDeviceVersion, xdm.event.type = cefName, xdm.event.id = id, xdm.event.log_level = if( cefSeverity ~= "EMERGENCY" , XDM_CONST.LOG_LEVEL_EMERGENCY, cefSeverity ~= "ALERT" , XDM_CONST.LOG_LEVEL_ALERT, cefSeverity ~= "CRITICAL" ,XDM_CONST.LOG_LEVEL_CRITICAL, cefSeverity ~= "ERROR" ,XDM_CONST.LOG_LEVEL_ERROR, cefSeverity ~= "WARNING" ,XDM_CONST.LOG_LEVEL_WARNING, cefSeverity ~= "NOTICE" ,XDM_CONST.LOG_LEVEL_NOTICE, cefSeverity ~= "INFO" ,XDM_CONST.LOG_LEVEL_INFORMATIONAL, cefSeverity ~= "DEBUG" ,XDM_CONST.LOG_LEVEL_DEBUG, cefSeverity), xdm.event.is_completed = if(cefSeverity ~= "COMPLETE", to_boolean(TRUE), to_boolean(FALSE)), xdm.source.user_agent = src, xdm.source.host.hostname = shost, xdm.event.description = msg; /* ========================================== Network logs mapping ========================================== */ filter cefName ~= "Network" | alter proto = to_string(proto), cs3_process_name = if(cs3 IN ("*\*"), arrayindex(regextract(cs3, "[^\\]+$"),0), cs3 IN ("*/*"), arrayindex(regextract(cs3, "[^\/]+$"),0)), cs14_process_name = if(cs14 IN ("*\*"), arrayindex(regextract(cs14, "[^\\]+$"),0), cs14 IN ("*/*"), arrayindex(regextract(cs14, "[^\/]+$"),0)), cs15_process_name = if(cs15 IN ("*\*"), arrayindex(regextract(cs15, "[^\\]+$"),0), cs15 IN ("*/*"), arrayindex(regextract(cs15, "[^\/]+$"),0)), drpoc_process_name = if(drpoc IN ("*\*"), arrayindex(regextract(cs15, "[^\\]+$"),0), drpoc IN ("*/*"), arrayindex(regextract(drpoc, "[^\/]+$"),0)) | alter //XDM mapping xdm.observer.version = cefDeviceVersion, xdm.event.type = cefName, xdm.event.id = id, xdm.source.ipv4 = if(is_ipv4(src) = TRUE, src), xdm.source.ipv6 = if(is_ipv6(src) = TRUE, src), xdm.source.host.hostname = shost, xdm.source.user.username = suser, xdm.source.identity.username = suser, xdm.target.ipv4 = if(is_ipv4(dst) = TRUE, dst), xdm.target.ipv6 = if(is_ipv6(dst) = TRUE, dst), xdm.target.port = to_integer(dpt), xdm.target.host.hostname = dhost, xdm.target.user.username = duser, xdm.target.identity.username = duser, xdm.network.ip_protocol = if( proto = "HOPOPT",XDM_CONST.IP_PROTOCOL_HOPOPT, proto = "ICMP",XDM_CONST.IP_PROTOCOL_ICMP, proto = "IGMP",XDM_CONST.IP_PROTOCOL_IGMP, proto = "GGP",XDM_CONST.IP_PROTOCOL_GGP, proto = "IP",XDM_CONST.IP_PROTOCOL_IP, proto = "ST",XDM_CONST.IP_PROTOCOL_ST, proto = "TCP",XDM_CONST.IP_PROTOCOL_TCP, proto = "CBT",XDM_CONST.IP_PROTOCOL_CBT, proto = "EGP",XDM_CONST.IP_PROTOCOL_EGP, proto = "IGP",XDM_CONST.IP_PROTOCOL_IGP, proto = "BBN_RCC_MON",XDM_CONST.IP_PROTOCOL_BBN_RCC_MON, proto = "NVP_II",XDM_CONST.IP_PROTOCOL_NVP_II, proto = "PUP",XDM_CONST.IP_PROTOCOL_PUP, proto = "ARGUS",XDM_CONST.IP_PROTOCOL_ARGUS, proto = "EMCON",XDM_CONST.IP_PROTOCOL_EMCON, proto = "XNET",XDM_CONST.IP_PROTOCOL_XNET, proto = "CHAOS",XDM_CONST.IP_PROTOCOL_CHAOS, proto = "UDP",XDM_CONST.IP_PROTOCOL_UDP, proto = "MUX",XDM_CONST.IP_PROTOCOL_MUX, proto = "DCN_MEAS",XDM_CONST.IP_PROTOCOL_DCN_MEAS, proto = "HMP",XDM_CONST.IP_PROTOCOL_HMP, proto = "PRM",XDM_CONST.IP_PROTOCOL_PRM, proto = "XNS_IDP",XDM_CONST.IP_PROTOCOL_XNS_IDP, proto = "TRUNK_1",XDM_CONST.IP_PROTOCOL_TRUNK_1, proto = "TRUNK_2",XDM_CONST.IP_PROTOCOL_TRUNK_2, proto = "LEAF_1",XDM_CONST.IP_PROTOCOL_LEAF_1, proto = "LEAF_2",XDM_CONST.IP_PROTOCOL_LEAF_2, proto = "RDP",XDM_CONST.IP_PROTOCOL_RDP, proto = "IRTP",XDM_CONST.IP_PROTOCOL_IRTP, proto = "ISO_TP4",XDM_CONST.IP_PROTOCOL_ISO_TP4, proto = "NETBLT",XDM_CONST.IP_PROTOCOL_NETBLT, proto = "MFE_NSP",XDM_CONST.IP_PROTOCOL_MFE_NSP, proto = "MERIT_INP",XDM_CONST.IP_PROTOCOL_MERIT_INP, proto = "DCCP",XDM_CONST.IP_PROTOCOL_DCCP, proto = "3PC",XDM_CONST.IP_PROTOCOL_3PC, proto = "IDPR",XDM_CONST.IP_PROTOCOL_IDPR, proto = "XTP",XDM_CONST.IP_PROTOCOL_XTP, proto = "DDP",XDM_CONST.IP_PROTOCOL_DDP, proto = "IDPR_CMTP",XDM_CONST.IP_PROTOCOL_IDPR_CMTP, proto = "TP",XDM_CONST.IP_PROTOCOL_TP, proto = "IL",XDM_CONST.IP_PROTOCOL_IL, proto = "IPV6",XDM_CONST.IP_PROTOCOL_IPV6, proto = "SDRP",XDM_CONST.IP_PROTOCOL_SDRP, proto = "IPV6_ROUTE",XDM_CONST.IP_PROTOCOL_IPV6_ROUTE, proto = "IPV6_FRAG",XDM_CONST.IP_PROTOCOL_IPV6_FRAG, proto = "IDRP",XDM_CONST.IP_PROTOCOL_IDRP, proto = "RSVP",XDM_CONST.IP_PROTOCOL_RSVP, proto = "GRE",XDM_CONST.IP_PROTOCOL_GRE, proto = "DSR",XDM_CONST.IP_PROTOCOL_DSR, proto = "BNA",XDM_CONST.IP_PROTOCOL_BNA, proto = "ESP",XDM_CONST.IP_PROTOCOL_ESP, proto = "AH",XDM_CONST.IP_PROTOCOL_AH, proto = "I_NLSP",XDM_CONST.IP_PROTOCOL_I_NLSP, proto = "SWIPE",XDM_CONST.IP_PROTOCOL_SWIPE, proto = "NARP",XDM_CONST.IP_PROTOCOL_NARP, proto = "MOBILE",XDM_CONST.IP_PROTOCOL_MOBILE, proto = "TLSP",XDM_CONST.IP_PROTOCOL_TLSP, proto = "SKIP",XDM_CONST.IP_PROTOCOL_SKIP, proto = "IPV6_ICMP",XDM_CONST.IP_PROTOCOL_IPV6_ICMP, proto = "IPV6_NONXT",XDM_CONST.IP_PROTOCOL_IPV6_NONXT, proto = "IPV6_OPTS",XDM_CONST.IP_PROTOCOL_IPV6_OPTS, proto = "CFTP",XDM_CONST.IP_PROTOCOL_CFTP, proto = "SAT_EXPAK",XDM_CONST.IP_PROTOCOL_SAT_EXPAK, proto = "KRYPTOLAN",XDM_CONST.IP_PROTOCOL_KRYPTOLAN, proto = "RVD",XDM_CONST.IP_PROTOCOL_RVD, proto = "IPPC",XDM_CONST.IP_PROTOCOL_IPPC, proto = "SAT_MON",XDM_CONST.IP_PROTOCOL_SAT_MON, proto = "VISA",XDM_CONST.IP_PROTOCOL_VISA, proto = "IPCV",XDM_CONST.IP_PROTOCOL_IPCV, proto = "CPNX",XDM_CONST.IP_PROTOCOL_CPNX, proto = "CPHB",XDM_CONST.IP_PROTOCOL_CPHB, proto = "WSN",XDM_CONST.IP_PROTOCOL_WSN, proto = "PVP",XDM_CONST.IP_PROTOCOL_PVP, proto = "BR_SAT_MON",XDM_CONST.IP_PROTOCOL_BR_SAT_MON, proto = "SUN_ND",XDM_CONST.IP_PROTOCOL_SUN_ND, proto = "WB_MON",XDM_CONST.IP_PROTOCOL_WB_MON, proto = "WB_EXPAK",XDM_CONST.IP_PROTOCOL_WB_EXPAK, proto = "ISO_IP",XDM_CONST.IP_PROTOCOL_ISO_IP, proto = "VMTP",XDM_CONST.IP_PROTOCOL_VMTP, proto = "SECURE_VMTP",XDM_CONST.IP_PROTOCOL_SECURE_VMTP, proto = "VINES",XDM_CONST.IP_PROTOCOL_VINES, proto = "TTP",XDM_CONST.IP_PROTOCOL_TTP, proto = "NSFNET_IGP",XDM_CONST.IP_PROTOCOL_NSFNET_IGP, proto = "DGP",XDM_CONST.IP_PROTOCOL_DGP, proto = "TCF",XDM_CONST.IP_PROTOCOL_TCF, proto = "EIGRP",XDM_CONST.IP_PROTOCOL_EIGRP, proto = "OSPFIGP",XDM_CONST.IP_PROTOCOL_OSPFIGP, proto = "SPRITE_RPC",XDM_CONST.IP_PROTOCOL_SPRITE_RPC, proto = "LARP",XDM_CONST.IP_PROTOCOL_LARP, proto = "MTP",XDM_CONST.IP_PROTOCOL_MTP, proto = "AX25",XDM_CONST.IP_PROTOCOL_AX25, proto = "IPIP",XDM_CONST.IP_PROTOCOL_IPIP, proto = "MICP",XDM_CONST.IP_PROTOCOL_MICP, proto = "SCC_SP",XDM_CONST.IP_PROTOCOL_SCC_SP, proto = "ETHERIP",XDM_CONST.IP_PROTOCOL_ETHERIP, proto = "ENCAP",XDM_CONST.IP_PROTOCOL_ENCAP, proto = "GMTP",XDM_CONST.IP_PROTOCOL_GMTP, proto = "IFMP",XDM_CONST.IP_PROTOCOL_IFMP, proto = "PNNI",XDM_CONST.IP_PROTOCOL_PNNI, proto = "PIM",XDM_CONST.IP_PROTOCOL_PIM, proto = "ARIS",XDM_CONST.IP_PROTOCOL_ARIS, proto = "SCPS",XDM_CONST.IP_PROTOCOL_SCPS, proto = "QNX",XDM_CONST.IP_PROTOCOL_QNX, proto = "AN",XDM_CONST.IP_PROTOCOL_AN, proto = "IPCOMP",XDM_CONST.IP_PROTOCOL_IPCOMP, proto = "SNP",XDM_CONST.IP_PROTOCOL_SNP, proto = "COMPAQ_PEER",XDM_CONST.IP_PROTOCOL_COMPAQ_PEER, proto = "IPX_IN_IP",XDM_CONST.IP_PROTOCOL_IPX_IN_IP, proto = "VRRP",XDM_CONST.IP_PROTOCOL_VRRP, proto = "PGM",XDM_CONST.IP_PROTOCOL_PGM, proto = "L2TP",XDM_CONST.IP_PROTOCOL_L2TP, proto = "DDX",XDM_CONST.IP_PROTOCOL_DDX, proto = "IATP",XDM_CONST.IP_PROTOCOL_IATP, proto = "STP",XDM_CONST.IP_PROTOCOL_STP, proto = "SRP",XDM_CONST.IP_PROTOCOL_SRP, proto = "UTI",XDM_CONST.IP_PROTOCOL_UTI, proto = "SMP",XDM_CONST.IP_PROTOCOL_SMP, proto = "SM",XDM_CONST.IP_PROTOCOL_SM, proto = "PTP",XDM_CONST.IP_PROTOCOL_PTP, proto = "ISIS",XDM_CONST.IP_PROTOCOL_ISIS, proto = "FIRE",XDM_CONST.IP_PROTOCOL_FIRE, proto = "CRTP",XDM_CONST.IP_PROTOCOL_CRTP, proto = "CRUDP",XDM_CONST.IP_PROTOCOL_CRUDP, proto = "SSCOPMCE",XDM_CONST.IP_PROTOCOL_SSCOPMCE, proto = "IPLT",XDM_CONST.IP_PROTOCOL_IPLT, proto = "SPS",XDM_CONST.IP_PROTOCOL_SPS, proto = "PIPE",XDM_CONST.IP_PROTOCOL_PIPE, proto = "SCTP",XDM_CONST.IP_PROTOCOL_SCTP, proto = "FC",XDM_CONST.IP_PROTOCOL_FC, proto = "RSVP_E2E_IGNORE",XDM_CONST.IP_PROTOCOL_RSVP_E2E_IGNORE, proto = "MOBILITY",XDM_CONST.IP_PROTOCOL_MOBILITY, proto = "UDPLITE",XDM_CONST.IP_PROTOCOL_UDPLITE, proto = "MPLS_IN_IP",XDM_CONST.IP_PROTOCOL_MPLS_IN_IP, proto = "MANET",XDM_CONST.IP_PROTOCOL_MANET, proto = "HIP",XDM_CONST.IP_PROTOCOL_HIP, proto = "SHIM6",XDM_CONST.IP_PROTOCOL_SHIM6, proto = "WESP",XDM_CONST.IP_PROTOCOL_WESP, proto = "ROHC",XDM_CONST.IP_PROTOCOL_ROHC, proto = "RESERVED",XDM_CONST.IP_PROTOCOL_RESERVED, proto = "0",XDM_CONST.IP_PROTOCOL_HOPOPT, proto = "1",XDM_CONST.IP_PROTOCOL_ICMP, proto = "2",XDM_CONST.IP_PROTOCOL_IGMP, proto = "3",XDM_CONST.IP_PROTOCOL_GGP, proto = "4",XDM_CONST.IP_PROTOCOL_IP, proto = "5",XDM_CONST.IP_PROTOCOL_ST, proto = "6",XDM_CONST.IP_PROTOCOL_TCP, proto = "7",XDM_CONST.IP_PROTOCOL_CBT, proto = "8",XDM_CONST.IP_PROTOCOL_EGP, proto = "9",XDM_CONST.IP_PROTOCOL_IGP, proto = "10",XDM_CONST.IP_PROTOCOL_BBN_RCC_MON, proto = "11",XDM_CONST.IP_PROTOCOL_NVP_II, proto = "12",XDM_CONST.IP_PROTOCOL_PUP, proto = "13",XDM_CONST.IP_PROTOCOL_ARGUS, proto = "14",XDM_CONST.IP_PROTOCOL_EMCON, proto = "15",XDM_CONST.IP_PROTOCOL_XNET, proto = "16",XDM_CONST.IP_PROTOCOL_CHAOS, proto = "17",XDM_CONST.IP_PROTOCOL_UDP, proto = "18",XDM_CONST.IP_PROTOCOL_MUX, proto = "19",XDM_CONST.IP_PROTOCOL_DCN_MEAS, proto = "20",XDM_CONST.IP_PROTOCOL_HMP, proto = "21",XDM_CONST.IP_PROTOCOL_PRM, proto = "22",XDM_CONST.IP_PROTOCOL_XNS_IDP, proto = "23",XDM_CONST.IP_PROTOCOL_TRUNK_1, proto = "24",XDM_CONST.IP_PROTOCOL_TRUNK_2, proto = "25",XDM_CONST.IP_PROTOCOL_LEAF_1, proto = "26",XDM_CONST.IP_PROTOCOL_LEAF_2, proto = "27",XDM_CONST.IP_PROTOCOL_RDP, proto = "28",XDM_CONST.IP_PROTOCOL_IRTP, proto = "29",XDM_CONST.IP_PROTOCOL_ISO_TP4, proto = "30",XDM_CONST.IP_PROTOCOL_NETBLT, proto = "31",XDM_CONST.IP_PROTOCOL_MFE_NSP, proto = "32",XDM_CONST.IP_PROTOCOL_MERIT_INP, proto = "33",XDM_CONST.IP_PROTOCOL_DCCP, proto = "34",XDM_CONST.IP_PROTOCOL_3PC, proto = "35",XDM_CONST.IP_PROTOCOL_IDPR, proto = "36",XDM_CONST.IP_PROTOCOL_XTP, proto = "37",XDM_CONST.IP_PROTOCOL_DDP, proto = "38",XDM_CONST.IP_PROTOCOL_IDPR_CMTP, proto = "39",XDM_CONST.IP_PROTOCOL_TP, proto = "40",XDM_CONST.IP_PROTOCOL_IL, proto = "41",XDM_CONST.IP_PROTOCOL_IPV6, proto = "42",XDM_CONST.IP_PROTOCOL_SDRP, proto = "43",XDM_CONST.IP_PROTOCOL_IPV6_ROUTE, proto = "44",XDM_CONST.IP_PROTOCOL_IPV6_FRAG, proto = "45",XDM_CONST.IP_PROTOCOL_IDRP, proto = "46",XDM_CONST.IP_PROTOCOL_RSVP, proto = "47",XDM_CONST.IP_PROTOCOL_GRE, proto = "48",XDM_CONST.IP_PROTOCOL_DSR, proto = "49",XDM_CONST.IP_PROTOCOL_BNA, proto = "50",XDM_CONST.IP_PROTOCOL_ESP, proto = "51",XDM_CONST.IP_PROTOCOL_AH, proto = "52",XDM_CONST.IP_PROTOCOL_I_NLSP, proto = "53",XDM_CONST.IP_PROTOCOL_SWIPE, proto = "54",XDM_CONST.IP_PROTOCOL_NARP, proto = "55",XDM_CONST.IP_PROTOCOL_MOBILE, proto = "56",XDM_CONST.IP_PROTOCOL_TLSP, proto = "57",XDM_CONST.IP_PROTOCOL_SKIP, proto = "58",XDM_CONST.IP_PROTOCOL_IPV6_ICMP, proto = "59",XDM_CONST.IP_PROTOCOL_IPV6_NONXT, proto = "60",XDM_CONST.IP_PROTOCOL_IPV6_OPTS, proto = "62",XDM_CONST.IP_PROTOCOL_CFTP, proto = "64",XDM_CONST.IP_PROTOCOL_SAT_EXPAK, proto = "65",XDM_CONST.IP_PROTOCOL_KRYPTOLAN, proto = "66",XDM_CONST.IP_PROTOCOL_RVD, proto = "67",XDM_CONST.IP_PROTOCOL_IPPC, proto = "69",XDM_CONST.IP_PROTOCOL_SAT_MON, proto = "70",XDM_CONST.IP_PROTOCOL_VISA, proto = "71",XDM_CONST.IP_PROTOCOL_IPCV, proto = "72",XDM_CONST.IP_PROTOCOL_CPNX, proto = "73",XDM_CONST.IP_PROTOCOL_CPHB, proto = "74",XDM_CONST.IP_PROTOCOL_WSN, proto = "75",XDM_CONST.IP_PROTOCOL_PVP, proto = "76",XDM_CONST.IP_PROTOCOL_BR_SAT_MON, proto = "77",XDM_CONST.IP_PROTOCOL_SUN_ND, proto = "78",XDM_CONST.IP_PROTOCOL_WB_MON, proto = "79",XDM_CONST.IP_PROTOCOL_WB_EXPAK, proto = "80",XDM_CONST.IP_PROTOCOL_ISO_IP, proto = "81",XDM_CONST.IP_PROTOCOL_VMTP, proto = "82",XDM_CONST.IP_PROTOCOL_SECURE_VMTP, proto = "83",XDM_CONST.IP_PROTOCOL_VINES, proto = "84",XDM_CONST.IP_PROTOCOL_TTP, proto = "85",XDM_CONST.IP_PROTOCOL_NSFNET_IGP, proto = "86",XDM_CONST.IP_PROTOCOL_DGP, proto = "87",XDM_CONST.IP_PROTOCOL_TCF, proto = "88",XDM_CONST.IP_PROTOCOL_EIGRP, proto = "89",XDM_CONST.IP_PROTOCOL_OSPFIGP, proto = "90",XDM_CONST.IP_PROTOCOL_SPRITE_RPC, proto = "91",XDM_CONST.IP_PROTOCOL_LARP, proto = "92",XDM_CONST.IP_PROTOCOL_MTP, proto = "93",XDM_CONST.IP_PROTOCOL_AX25, proto = "94",XDM_CONST.IP_PROTOCOL_IPIP, proto = "95",XDM_CONST.IP_PROTOCOL_MICP, proto = "96",XDM_CONST.IP_PROTOCOL_SCC_SP, proto = "97",XDM_CONST.IP_PROTOCOL_ETHERIP, proto = "98",XDM_CONST.IP_PROTOCOL_ENCAP, proto = "100",XDM_CONST.IP_PROTOCOL_GMTP, proto = "101",XDM_CONST.IP_PROTOCOL_IFMP, proto = "102",XDM_CONST.IP_PROTOCOL_PNNI, proto = "103",XDM_CONST.IP_PROTOCOL_PIM, proto = "104",XDM_CONST.IP_PROTOCOL_ARIS, proto = "105",XDM_CONST.IP_PROTOCOL_SCPS, proto = "106",XDM_CONST.IP_PROTOCOL_QNX, proto = "107",XDM_CONST.IP_PROTOCOL_AN, proto = "108",XDM_CONST.IP_PROTOCOL_IPCOMP, proto = "109",XDM_CONST.IP_PROTOCOL_SNP, proto = "110",XDM_CONST.IP_PROTOCOL_COMPAQ_PEER, proto = "111",XDM_CONST.IP_PROTOCOL_IPX_IN_IP, proto = "112",XDM_CONST.IP_PROTOCOL_VRRP, proto = "113",XDM_CONST.IP_PROTOCOL_PGM, proto = "115",XDM_CONST.IP_PROTOCOL_L2TP, proto = "116",XDM_CONST.IP_PROTOCOL_DDX, proto = "117",XDM_CONST.IP_PROTOCOL_IATP, proto = "118",XDM_CONST.IP_PROTOCOL_STP, proto = "119",XDM_CONST.IP_PROTOCOL_SRP, proto = "120",XDM_CONST.IP_PROTOCOL_UTI, proto = "121",XDM_CONST.IP_PROTOCOL_SMP, proto = "122",XDM_CONST.IP_PROTOCOL_SM, proto = "123",XDM_CONST.IP_PROTOCOL_PTP, proto = "124",XDM_CONST.IP_PROTOCOL_ISIS, proto = "125",XDM_CONST.IP_PROTOCOL_FIRE, proto = "126",XDM_CONST.IP_PROTOCOL_CRTP, proto = "127",XDM_CONST.IP_PROTOCOL_CRUDP, proto = "128",XDM_CONST.IP_PROTOCOL_SSCOPMCE, proto = "129",XDM_CONST.IP_PROTOCOL_IPLT, proto = "130",XDM_CONST.IP_PROTOCOL_SPS, proto = "131",XDM_CONST.IP_PROTOCOL_PIPE, proto = "132",XDM_CONST.IP_PROTOCOL_SCTP, proto = "133",XDM_CONST.IP_PROTOCOL_FC, proto = "134",XDM_CONST.IP_PROTOCOL_RSVP_E2E_IGNORE, proto = "135",XDM_CONST.IP_PROTOCOL_MOBILITY, proto = "136",XDM_CONST.IP_PROTOCOL_UDPLITE, proto = "137",XDM_CONST.IP_PROTOCOL_MPLS_IN_IP, proto = "138",XDM_CONST.IP_PROTOCOL_MANET, proto = "139",XDM_CONST.IP_PROTOCOL_HIP, proto = "140",XDM_CONST.IP_PROTOCOL_SHIM6, proto = "141",XDM_CONST.IP_PROTOCOL_WESP, proto = "142",XDM_CONST.IP_PROTOCOL_ROHC, proto = "255",XDM_CONST.IP_PROTOCOL_RESERVED, proto), xdm.source.process.name = coalesce(cs3,cs14), xdm.source.user.identifier = cs11, xdm.source.identity.identifier = cs11, xdm.event.outcome_reason = cs6, xdm.network.rule = cs7, xdm.target.user.identifier = cs12, xdm.target.identity.identifier = cs12, xdm.source.process.executable.filename = coalesce(cs3_process_name, cs14_process_name), xdm.source.process.executable.path = coalesce(cs13, cs14), xdm.target.process.executable.filename = cs15_process_name, xdm.target.process.executable.path = coalesce(cs15, drpoc_process_name), xdm.target.application.name = cs16, xdm.observer.action = act, xdm.event.outcome = if( cs1 ~= "SUCCESS", XDM_CONST.OUTCOME_SUCCESS, cs1 ~= "FAIL", XDM_CONST.OUTCOME_FAILED, XDM_CONST.OUTCOME_UNKNOWN ); /* ========================================== Label logs mapping ========================================== */ filter cefName ~= "Label" | alter //XDM mapping xdm.observer.version = cefDeviceVersion, xdm.event.type = cefName, xdm.alert.severity = cefSeverity, xdm.event.id = id, xdm.event.description = msg; /* ========================================== Incidents logs mapping ========================================== */ filter cefName NOT IN ("System*", "Audit*", "Agent*", "Network*", "Label*") | alter //extract fields cs5_app = arrayindex(regextract(cs5, "App\:\s([^,]+)"),0), cs5_os = arrayindex(regextract(cs5, "OS\:\s([^,]+)"),0), cs5_env = arrayindex(regextract(cs5, "Environment\:\s([^,]+)"),0) | alter //XDM mapping xdm.event.type = cefDeviceEventClassId, xdm.observer.version = cefDeviceVersion, xdm.event.description = cefName, xdm.alert.severity = if( to_string(cefSeverity) = "8", "High", to_string(cefSeverity) = "5", "Medium", to_string(cefSeverity) = "3", "Low", cefSeverity), xdm.observer.action = act, xdm.target.ipv4 = if(is_ipv4(dvc) = TRUE, dvc), xdm.target.ipv6 = if(is_ipv6(dvc) = TRUE, dvc), xdm.target.host.hostname = dvchost, xdm.event.id = cs1, xdm.alert.source_url = cs2, xdm.event.tags = split(cs3, ", "), xdm.target.host.device_id = cs4, xdm.target.application.name = cs5_app, xdm.target.host.os = cs5_os, xdm.target.host.os_family = if( cs5_os ~= "Windows", XDM_CONST.OS_FAMILY_WINDOWS, cs5_os ~= "Mac", XDM_CONST.OS_FAMILY_MACOS, cs5_os ~= "Linux", XDM_CONST.OS_FAMILY_LINUX, cs5_os ~= "Ubuntu", XDM_CONST.OS_FAMILY_UBUNTU), xdm.target.zone = cs5_env;