[MODEL: dataset = "keeper_security_raw"]
alter
    xdm.event.type = audit_event_type,
    xdm.event.id = to_string(id),
    xdm.source.ipv4 = if(ip_address ~= "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}", ip_address, null),
    xdm.source.ipv6 = if(ip_address ~= "[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}", ip_address, null),
    xdm.source.user.username = username,
    xdm.source.identity.username = username,
    xdm.source.user.ou = to_string(node_id),
    xdm.source.identity.ou = to_string(node_id),
    xdm.intermediate.user.username = from_username,
    xdm.intermediate.identity.username = from_username,
    xdm.target.user.username = if(lowercase(audit_event_type) in ("delete_pending_user", "auto_invite_user", "delete_user", "send_invitation"), email, coalesce(to_username, recipient)),
    xdm.target.identity.username = if(lowercase(audit_event_type) in ("delete_pending_user", "auto_invite_user", "delete_user", "send_invitation"), email, coalesce(to_username, recipient)),
    xdm.target.user.upn = email,
    xdm.target.identity.upn = email,
    xdm.observer.type = arrayindex(regextract(keeper_version, "([^\d]+)\s\d"), 0),
    xdm.observer.version = arrayindex(regextract(keeper_version, "\s([\d\.]+)"), 0),
    xdm.target.file.file_type = file_format,
    xdm.target.file.directory = folder_uid,
    xdm.target.file.filename = attachment_id,
    xdm.source.host.device_model = device_name,
    xdm.target.resource.id = coalesce(record_uid, node, role_id, team_uid, shared_folder_uid, plan, secret_uid, gateway_uid),
    xdm.target.resource.value = value,
    xdm.target.resource.type = enforcement,
    xdm.target.resource.name = coalesce(email_domain, report_name, name),
    xdm.event.outcome = if(lowercase(result_code) contains "fail", XDM_CONST.OUTCOME_FAILED, lowercase(result_code) contains "succ", XDM_CONST.OUTCOME_SUCCESS, null),
    xdm.event.outcome_reason = result_code,
    xdm.network.application_protocol = protocol;