[MODEL: dataset = mcafee_database_security_raw]
alter act = uppercase(act)
| alter
        xdm.database.operation = if(act = "QUERY", XDM_CONST.DB_OPERATION_QUERY, act = "UPDATE", XDM_CONST.DB_OPERATION_UPDATE, act = "CREATE", XDM_CONST.DB_OPERATION_CREATE, act = "DELETE", XDM_CONST.DB_OPERATION_DELETE, act = "ALTER", XDM_CONST.DB_OPERATION_ALTER, to_string(act)),
        xdm.source.ipv4 = if(src ~= "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}", src, null),
        xdm.source.ipv6 = if(src ~= "[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}", src, null),
        xdm.source.agent.identifier = dst,
        xdm.target.process.name = dproc,
        xdm.target.user.username = duser,
        xdm.target.identity.username = duser,
        xdm.source.host.hostname = shost,
        xdm.source.user.username = suser,
        xdm.source.identity.username = suser,
        xdm.event.type = cefDeviceEventClassId,
        xdm.event.id = externalId,
        xdm.event.description = cefName,
        xdm.alert.severity = cefSeverity,
        xdm.database.name = if(cs1Label = "DBMS", cs1, null),
        xdm.database.statement = if(cs2Label = "SqlStatement", cs2, null),
        xdm.target.resource.name = if(cs3Label contains "AccessedObjects", cs3, null);