[MODEL: dataset="ibm_ldap_raw"]
alter
    ldap_operation_type = _raw_log -> opDetails.type,
    ldap_operation_scope = _raw_log -> opDetails.scope,
    ldap_auth_choice = _raw_log -> opDetails.choice,
    client_ip_address = client -> ip,
    fix_filter = replex(_raw_log ,"filter", "filter_used"),
    event_outcome = _raw_log -> result
| alter
    client_ipv4 = if(client_ip_address ~= "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}", client_ip_address ,null),
    client_ipv6 = if(client_ip_address ~= "^((?:[a-fA-F\d]{0,4}\:){2,7}[a-fA-F\d]{0,4})$", client_ip_address ,null)
| alter
    xdm.event.type = level,
    xdm.source.host.hostname = hostname,
    xdm.event.description = _raw_log,
    xdm.source.ipv4 = client_ipv4,
    xdm.source.ipv6 = client_ipv6,
    xdm.network.ldap.attributes = arraycreate(_raw_log -> bindDn, _raw_log -> opDetails.base),
    xdm.event.outcome = if(event_outcome = "Success", XDM_CONST.OUTCOME_SUCCESS, event_outcome),
    xdm.event.operation = _raw_log -> operation,
    xdm.network.ldap.filter = fix_filter -> opDetails.filter_used,
    xdm.network.ldap.returned_entries = to_integer(_raw_log -> opDetails.numberOfEntriesReturned),
    xdm.network.ldap.scope = if(ldap_operation_scope = "baseObject", XDM_CONST.LDAP_SCOPE_BASE_OBJECT,ldap_operation_scope = "wholeSubtree",XDM_CONST.LDAP_SCOPE_WHOLE_SUBTREE,ldap_operation_type = "singleLevel",XDM_CONST.LDAP_SCOPE_SINGLE_LEVEL,ldap_operation_scope),
    xdm.network.ldap.operation = if(ldap_operation_type = "search", XDM_CONST.LDAP_OPERATION_SEARCH_REQUEST , ldap_operation_type = "bind", XDM_CONST.LDAP_OPERATION_BIND_REQUEST,ldap_operation_type = "unbind", XDM_CONST.LDAP_OPERATION_UNBIND_REQUEST ,ldap_operation_type),
    xdm.network.ldap.bind_auth_type = if(ldap_auth_choice = "simple", XDM_CONST.LDAP_BIND_AUTH_TYPE_SIMPLE,ldap_auth_choice = "sasl", XDM_CONST.LDAP_BIND_AUTH_TYPE_SASL, ldap_auth_choice);