[MODEL: dataset="qualys_qualys_raw"] filter event_type in ("activity_log") | alter tmp_source_ipv4 = if(Details ~= "[\"\']?ips[\"\']?[:=][\"\']([^\"]+)[\"\']", arrayindex(regextract(Details, "[\"\']?ips[\"\']?[:=][\"\']((?:\d{1,3}\.){3}\d{1,3})[\"\']"), 0), null), tmp_source_ipv6 = if(Details ~= "[\"\']?ips[\"\']?[:=][\"\']([^\"]+)[\"\']", arrayindex(regextract(Details, "[\"\']?ips[\"\']?[:=][\"\']((?:[a-fA-F\d]{0,4}\:){2,7}[a-fA-F\d]{0,4})[\"\']"), 0), null), tmp_target_ipv4 = if(Details ~= "target:\s+(.*)$", arrayindex(regextract(Details, "target:\s+((?:\d{1,3}\.){3}\d{1,3})$"), 0), null), tmp_target_ipv6 = if(Details ~= "target:\s+(.*)$", arrayindex(regextract(Details, "target:\s+((?:[a-fA-F\d]{0,4}\:){2,7}[a-fA-F\d]{0,4})$"), 0), null), tmp_for_ipv4 = if(Details ~= "for\s([\d\.a-fA-F:]+)", arrayindex(regextract(Details, "for\s((?:\d{1,3}\.){3}\d{1,3})"), 0), null), tmp_for_ipv6 = if(Details ~= "for\s([\d\.a-fA-F:]+)", arrayindex(regextract(Details, "for\s((?:[a-fA-F\d]{0,4}\:){2,7}[a-fA-F\d]{0,4})"), 0), null), User_IP_ipv4 = if(User_IP ~= "(?:\d{1,3}\.){3}\d{1,3}", User_IP, null), User_IP_ipv6 = if(User_IP ~= "(?:[a-fA-F\d]{0,4}\:){2,7}[a-fA-F\d]{0,4}", User_IP, null), report_size_units = lowercase(if( Details ~= "Report Size:\s*([^,\)]+)" , arraystring(regextract(Details, "Report Size:\s*[^\s]+\s*([^,\)]+)"), ""), null)), report_size = to_number(if( Details ~= "Report Size:\s*([^\s,\)]+)" , arraystring(regextract(Details, "Report Size:\s*([^\s,\)]+)"), ""), null)), report_duration_units = lowercase(if( Details ~= "Report Duration:\s*([^,\)]+)" , arraystring(regextract(Details, "Report Duration:\s*[^\s]+\s*([^,\)]+)"), ""), null)), report_duration = to_number(if( Details ~= "Report Duration:\s*([^\s,\)]+)" , arraystring(regextract(Details, "Report Duration:\s*([^\s,\)]+)"), ""), null)), duration_seconds = to_number(if( Details ~= "duration:\s*([^\s,\)]+)" , arraystring(regextract(Details, "duration:\s*\d+:\d+:(\d+)"), ""), null)), duration_minutes = to_number(if( Details ~= "duration:\s*([^\s,\)]+)" , arraystring(regextract(Details, "duration:\s*\d+:(\d+):\d+"), ""), null)), duration_hours = to_number(if( Details ~= "duration:\s*([^\s,\)]+)" , arraystring(regextract(Details, "duration:\s*(\d+):\d+:\d+"), ""), null)) | alter asset_group_id = if( Details ~= "\"assetGroupId\":\"([^\"]+)" , arraystring(regextract(Details, "\"assetGroupId\":\"([^\"]+)"), ""), null), business_division = if( Details ~= "\"businessDivision\":\"([^\"]+)" , arraystring(regextract(Details, "\"businessDivision\":\"([^\"]+)"), ""), null), business_impact = if( Details ~= "\"businessImpact\":\"([^\"]+)" , arraystring(regextract(Details, "\"businessImpact\":\"([^\"]+)"), ""), null), comment = if( Details ~= "comment=\[([^\]]+)" , arraystring(regextract(Details, "comment=\[([^\]]+)"), ""), null), criticality = if( Details ~= "Criticality:([^\s]+)" , arraystring(regextract(Details, "Criticality:([^\s;]+)"), ""), null), duration = to_number(add(add(multiply(duration_seconds, 1000), multiply(multiply(duration_minutes, 60), 1000)), multiply(multiply(duration_hours, 3600), 1000))), entity_name = if( Details ~= "\"entityName\":\"([^\"]+)" , arraystring(regextract(Details, "\"entityName\":\"([^\"]+)"), ""), null), format = trim(if( Details ~= "FORMAT:([^\s]+)" , arraystring(regextract(Details, "FORMAT:([^\s]+)"), ""), null), ","), function = if( Details ~= "Function=\[([^\]]+)" , arraystring(regextract(Details, "Function=\[([^\]]+)"), ""), null), id_report = if( Details ~= "ID:([^\s]+)" , arraystring(regextract(Details, "ID:([^\s]+)"), ""), null), modules = if( Details ~= "\"modules\":\"([^\"]+)" , arraystring(regextract(Details, "\"modules\":\"([^\"]+)"), ""), null), name = if( Details ~= "\"name\":\"([^\"]+)" , arraystring(regextract(Details, "\"name\":\"([^\"]+)"), ""), null), operation = if( Details ~= "\"operation\":\"([^\"]+)", arraystring(regextract(Details, "\"operation\":\"([^\"]+)"), ""), null), owner = if( Details ~= "owner=([^\s]+)" , arraystring(regextract(Details, "owner=([^\s;]+)"), ""), null), report_duration = to_number(if(report_duration_units = "seconds", multiply(report_duration, 1000), report_duration_units = "minutes", multiply(multiply(report_duration, 60), 1000), report_duration_units = "hours", multiply(multiply(report_duration, 3600), 1000), null)), report_size = if(report_size_units = "kb", multiply(report_size, 1000), report_size_units = "mb", multiply(report_size, 1000000), report_size_units = "gb", multiply(report_size, 1000000000), null), status = if( Details ~= "Status:([^\s]+)" , arraystring(regextract(Details, "Status:([^\s]+)"), ""), null), req_id = if( Details ~= "\"requestId\":\"([^\"]+)" , arraystring(regextract(Details, "\"requestId\":\"([^\"]+)"), ""), null), title_capital = if( Details ~= "TITLE:([^\s]+)" , arraystring(regextract(Details, "TITLE:([^\s]+)"), ""), null), title_equal = if( Details ~= "title=([^\s]+)" , arraystring(regextract(Details, "title=\'([^\']+)\'"), ""), null) | alter xdm.observer.action = Action, xdm.observer.type = modules, xdm.event.id = coalesce(req_id, id_report), xdm.event.original_event_type = coalesce(concat(Module, " - ", Action), entity_name), xdm.event.type = event_type, xdm.event.description = Details, xdm.event.operation_sub_type = coalesce(operation, comment), xdm.event.outcome = status, xdm.event.outcome_reason = status, xdm.event.duration = coalesce(report_duration, duration), xdm.alert.severity = coalesce(business_impact, criticality), xdm.auth.privilege_level = User_Role, xdm.source.ipv4 = coalesce(User_IP_ipv4, tmp_source_ipv4), xdm.source.ipv6 = coalesce(User_IP_ipv6, tmp_source_ipv6), xdm.source.user.groups = arraycreate(asset_group_id), xdm.source.host.hostname = name, xdm.source.agent.identifier = owner, xdm.source.user.ou = coalesce(business_division, function), xdm.source.user.username = User_Name, xdm.target.ipv4 = coalesce(tmp_target_ipv4, tmp_for_ipv4), xdm.target.ipv6 = coalesce(tmp_target_ipv6, tmp_for_ipv6), xdm.target.file.size = to_number(report_size), xdm.target.file.extension = format, xdm.target.file.filename = coalesce(title_capital, title_equal); [MODEL: dataset="qualys_assets_raw"] filter event_type in ("host_list_detection") | alter tmp_severity = json_extract_scalar(DETECTION, "$.SEVERITY"), tmp_qds_severity = trim(json_extract(DETECTION, "$.QDS['@severity']"), "\""), tmp_ip_v4 = if(IP ~= "(?:\d{1,3}\.){3}\d{1,3}", IP, null), tmp_ip_v6 = if(IP ~= "(?:[a-fA-F\d]{0,4}\:){2,7}[a-fA-F\d]{0,4}", IP, null) | alter xdm.observer.action = json_extract_scalar(DETECTION, "$.STATUS"), xdm.observer.unique_identifier = QG_HOSTID, xdm.observer.type = TRACKING_METHOD, xdm.event.tags = arraycreate(coalesce(json_extract_scalar(`TAG`, "$.NAME"), json_extract_scalar(CLOUD_PROVIDER_TAGS, "$.NAME"))), xdm.event.type = event_type, xdm.alert.description = json_extract_scalar(DETECTION, "$.RESULTS"), xdm.alert.subcategory = json_extract_scalar(DETECTION, "$.TYPE"), xdm.alert.severity = if(tmp_qds_severity not in ("", null), tmp_qds_severity, tmp_severity = "1", "Minimal", tmp_severity = "2", "Medium", tmp_severity = "3", "Serious", tmp_severity = "4", "Critical", tmp_severity = "5", "Urgent", tmp_severity), xdm.alert.original_threat_id = json_extract_scalar(DETECTION, "$.QID"), xdm.network.session_id = NETWORK_ID, xdm.network.ip_protocol = json_extract_scalar(DETECTION, "$.PROTOCOL"), xdm.source.host.hardware_uuid = ID, xdm.source.agent.identifier = ASSET_ID, xdm.source.ipv4 = tmp_ip_v4, xdm.source.ipv6 = coalesce(tmp_ip_v6, IPV6), xdm.source.host.os = coalesce(OS, OS_CPE), xdm.source.host.hostname = coalesce(json_extract_scalar(DNS_DATA, "$.HOSTNAME"), json_extract_scalar(DETECTION, "$.INSTANCE")), xdm.source.host.fqdn = coalesce(json_extract_scalar(DNS_DATA, "$.FQDN"), json_extract_scalar(DETECTION, "$.FQDN")), xdm.source.cloud.provider = CLOUD_PROVIDER, xdm.source.cloud.project = coalesce(CLOUD_SERVICE, json_extract_scalar(METADATA, "$.EC2.NAME"), json_extract_scalar(METADATA, "$.GOOGLE.NAME"), json_extract_scalar(METADATA, "$.AZURE.NAME")), xdm.source.host.device_id = coalesce(EC2_INSTANCE_ID, CLOUD_RESOURCE_ID), xdm.source.user.netbios_domain = NETBIOS, xdm.source.port = to_integer(json_extract_scalar(DETECTION, "$.PORT")), xdm.source.application.name = json_extract_scalar(DETECTION, "$.SERVICE");