[MODEL: dataset=paloaltonetworks_saassecurity_raw]
alter
    xdm.event.type = log_type,
    xdm.source.ipv4 = coalesce(ip, source_ip, _reporting_device_ip),
    xdm.event.operation_sub_type = coalesce(event_type, log_type),
    xdm.target.resource.type = item_type,
    xdm.target.resource.name = action,
    xdm.event.operation = coalesce(remoteAddress, target_name),
    xdm.target.resource_before.value = resource_value_old,
    xdm.target.resource.value = resource_value_new,
    xdm.target.resource.id = asset_id,
    xdm.source.user.username = coalesce(user, admin_role),
    xdm.source.application.name = cloud_app_instance,
    xdm.source.location.city = location;