[MODEL: dataset = "oracle_oam_raw"]
alter
	IAU_EVENTSTATUS_int = to_integer(IAU_EVENTSTATUS),
	IAU_REMOTEIP_ipv4 = if(IAU_REMOTEIP ~= "(?:\d{1,3}\.){3}\d{1,3}", IAU_REMOTEIP),
	IAU_REMOTEIP_ipv6 = if(IAU_REMOTEIP ~= "(?:[a-fA-F\d]{0,4}\:){2,7}[a-fA-F\d]{0,4}", IAU_REMOTEIP),
	IAU_HOSTNWADDR_ipv4 = if(IAU_HOSTNWADDR ~= "(?:\d{1,3}\.){3}\d{1,3}", IAU_HOSTNWADDR),
	IAU_HOSTNWADDR_ipv6 = if(IAU_HOSTNWADDR ~= "(?:[a-fA-F\d]{0,4}\:){2,7}[a-fA-F\d]{0,4}", IAU_HOSTNWADDR),
	IAU_CLIENTIPADDRESS_ipv4 = if(IAU_CLIENTIPADDRESS ~= "(?:\d{1,3}\.){3}\d{1,3}", IAU_CLIENTIPADDRESS),
	IAU_CLIENTIPADDRESS_ipv6 = if(IAU_CLIENTIPADDRESS ~= "(?:[a-fA-F\d]{0,4}\:){2,7}[a-fA-F\d]{0,4}", IAU_CLIENTIPADDRESS)
| alter
	xdm.source.application.name = coalesce(IAU_APPLICATIONNAME, IAU_APPLICATIONDOMAINNAME),
	xdm.observer.name = IAU_COMPONENTTYPE,
	xdm.source.zone = coalesce(IAU_IDENTITYDOMAIN, IAU_DOMAINNAME),
	xdm.session_context_id = IAU_ECID,
	xdm.event.original_event_type = IAU_EVENTCATEGORY,
	xdm.event.outcome = if(IAU_EVENTSTATUS_int = 0, XDM_CONST.OUTCOME_FAILED, IAU_EVENTSTATUS_int = 1, XDM_CONST.OUTCOME_SUCCESS),
	xdm.event.type = IAU_EVENTTYPE,
	xdm.source.host.device_id = coalesce(IAU_RESOURCEHOST, IAU_HOSTID),
	xdm.source.host.hostname = IAU_SERVERNAME,
	xdm.event.id = coalesce(to_string(IAU_THREADID), to_string(IAU_REQUESTID)),
	xdm.source.user.identifier = coalesce(IAU_INITIATOR, IAU_USERID),
	xdm.target.resource.name = IAU_RESOURCE,
	xdm.source.user.username = IAU_AUDITUSER,
	xdm.event.description = coalesce(IAU_MESSAGETEXT, IAU_ADDITIONALINFO),
	xdm.auth.auth_method = coalesce(IAU_AUTHENTICATIONMETHOD, IAU_AUTHENTICATIONSCHEMEID),
	xdm.event.outcome_reason = if(IAU_EVENTSTATUS_int = 0, IAU_FAILURECODE),
	xdm.alert.description = object_create("IAU_COMPONENTDATA", IAU_COMPONENTDATA, "IAU_COMPONENTID", IAU_COMPONENTID, "IAU_COMPONENTNAME", IAU_COMPONENTNAME, "IAU_CONTEXTFIELDS", IAU_CONTEXTFIELDS),
	xdm.observer.type = IAU_ORACLEHOME,
	xdm.source.process.pid = to_integer(IAU_PROCESSID),
	xdm.network.session_id = IAU_SESSIONID,
	xdm.target.user.identifier = IAU_TARGET,
	xdm.target.resource.type = IAU_TARGETCOMPONENTTYPE,
	xdm.target.host.device_id = IAU_TENANTID,
	xdm.source.ipv4 = coalesce(IAU_REMOTEIP_ipv4, IAU_CLIENTIPADDRESS_ipv4),
	xdm.source.ipv6 = coalesce(IAU_REMOTEIP_ipv6, IAU_CLIENTIPADDRESS_ipv6),
	xdm.source.host.ipv4_addresses = if(
	    incidr(IAU_HOSTNWADDR_ipv4, "10.0.0.0/8")
	    or incidr(IAU_HOSTNWADDR_ipv4, "172.16.0.0/12")
	    or incidr(IAU_HOSTNWADDR_ipv4, "192.168.0.0/16")
	    or incidr(IAU_HOSTNWADDR_ipv4, "127.0.0.0/8")
	    or incidr(IAU_HOSTNWADDR_ipv4, "169.254.0.0/16")
	    or incidr(IAU_HOSTNWADDR_ipv4, "100.64.0.0/10"),
	    arraycreate(IAU_HOSTNWADDR_ipv4)
	),
	xdm.source.host.ipv4_public_addresses = if(
		incidr(IAU_HOSTNWADDR_ipv4, "10.0.0.0/8")
		or incidr(IAU_HOSTNWADDR_ipv4, "172.16.0.0/12")
		or incidr(IAU_HOSTNWADDR_ipv4, "192.168.0.0/16")
		or incidr(IAU_HOSTNWADDR_ipv4, "127.0.0.0/8")
		or incidr(IAU_HOSTNWADDR_ipv4, "169.254.0.0/16")
		or incidr(IAU_HOSTNWADDR_ipv4, "100.64.0.0/10"),
		null , arraycreate(IAU_HOSTNWADDR_ipv4)
	),	 
	xdm.source.host.ipv6_addresses = arraycreate(IAU_HOSTNWADDR_ipv6),
	xdm.source.agent.identifier = IAU_AGENTID,
	xdm.target.resource_before.value = coalesce(IAU_OLDATTRIBUTES, IAU_OLDSETTINGS),
	xdm.target.resource.value = coalesce(IAU_NEWATTRIBUTES, IAU_NEWSETTINGS),
	xdm.target.url = IAU_RESOURCEURI,
	xdm.auth.service = IAU_SERVICEURI;