[MODEL: dataset="manageengine_adauditplus_raw"]
alter 
    xdm.session_context_id = coalesce(to_string(cn2),to_string(cn3)),
    xdm.event.id = to_string(cn1),
    xdm.source.ipv4 = if(cs2 ~= "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}",cs2,null),
    xdm.source.host.hostname = shost,
    xdm.alert.subcategory = cs4,
    xdm.alert.description = msg,
    xdm.target.user.identifier = duid,
    xdm.target.identity.identifier = duid,
    xdm.source.user.identifier = suid,
    xdm.source.identity.identifier = suid,
    xdm.event.type = coalesce(cs1,type),
    xdm.target.user.username = duser,
    xdm.target.identity.username = duser,
    xdm.source.process.name = sproc,
    xdm.source.user.username = suser,
    xdm.source.identity.username = suser,
    xdm.event.outcome_reason = reason,
    xdm.source.user.domain = sntdom,
    xdm.source.identity.domain = sntdom,
    xdm.alert.category = coalesce(cefName,cat),
    xdm.event.outcome = outcome,
    xdm.target.file.filename = fileName,
    xdm.target.file.path = filePath,
    xdm.alert.severity = coalesce(cs5,cefSeverity),
    xdm.target.file.directory = fileLocation,
    xdm.observer.version = cefDeviceVersion,
    xdm.observer.type = cefDeviceEventClassId,
    xdm.intermediate.host.hostname = cs3;