[MODEL: dataset = "proofpoint_ps_raw"]
  alter action = parsed_fields -> action
| alter xdm.observer.name = arrayindex(regextract(_raw_log, "^\<\d+\>\d{4}\-\d{1,2}\-\d{1,2}T\d{2}:\d{2}:\d{2}\.\d+[+-]\d{2}:\d{2}\s+(\S+)"),0),
       xdm.event.type = arrayindex(regextract(_raw_log, "^\<\d+\>\d{4}\-\d{1,2}\-\d{1,2}T\d{2}:\d{2}:\d{2}\.\d+[+-]\d{2}:\d{2}\s+\w+\s+([^\[]+)"),0),
       xdm.event.description = parsed_fields,
       xdm.email.subject = ltrim(rtrim(parsed_fields -> subject,"\""),"\""),
       xdm.observer.type = coalesce(parsed_fields -> module, parsed_fields -> mod),
       xdm.network.rule = coalesce(parsed_fields -> rule, parsed_fields -> policy),
       xdm.alert.name = ltrim(rtrim(parsed_fields -> alert,"\""),"\""),
       xdm.network.application_protocol = parsed_fields -> proto,
       xdm.email.sender = ltrim(rtrim(parsed_fields -> from,"\>"),"\<"),
       xdm.source.ipv4 = arrayindex(regextract(parsed_fields -> ip,"\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}"),0),
       xdm.source.host.hostname = parsed_fields -> host,
       xdm.event.duration = to_integer(multiply(to_float(parsed_fields -> duration),1000)),
       xdm.email.attachment.size = to_integer(parsed_fields -> size),
       xdm.email.attachment.extension = parsed_fields -> oext,
       xdm.email.attachment.file_type = to_string(parsed_fields -> type),
       xdm.email.mime = to_string(parsed_fields -> mime),
       xdm.email.attachment.filename = parsed_fields -> file,
       xdm.email.message_id = parsed_fields -> s,
       xdm.event.id = parsed_fields -> x,
       xdm.event.outcome = if(action = "accept" or action = "continue", XDM_CONST.OUTCOME_SUCCESS, action = "reject" or action = "discard", XDM_CONST.OUTCOME_FAILED, to_string(action)),
       xdm.event.operation_sub_type = parsed_fields -> cmd,
       xdm.email.recipients = arraymap(split(parsed_fields -> to,","),ltrim(rtrim("@element","\>"),"\<"));