[MODEL: dataset= "sailpoint_identitynow_raw"]
alter
    get_src_name = actor -> name,
    get_dst_name = `target` -> name,
    get_objects = objects-> []
| alter
    set_src_email = arrayindex(regextract(get_src_name, "\S+\@\S+"),0),
    set_dst_email = arrayindex(regextract(get_dst_name, "\S+\@\S+"),0),
    set_objects = arraymap(get_objects , trim("@element", "\""))
| alter
    xdm.event.original_event_type = action,
    xdm.event.id = id,
    xdm.alert.name = name,
    xdm.event.tags = set_objects,
    xdm.event.operation_sub_type = operation,
    xdm.source.user.ou = org,
    xdm.source.cloud.region = pod,
    xdm.event.outcome = if(status in ("PASSED", "SUCCESS","APPROVED","PROCESSED","UPDATED","CREATED","DELETED","ENABLED","DISABLED","FORWARDED","ESCALATED","DETECTED", "ACCESSED", "CANCELLED"), XDM_CONST.OUTCOME_SUCCESS, status in ("FAILED","BLOCKED", "REJECTED"), XDM_CONST.OUTCOME_FAILED, status in ("STARTED", "REMEDIATE"), XDM_CONST.OUTCOME_UNKNOWN,status),
    xdm.event.is_completed = if(status in ("PASSED", "SUCCESS","APPROVED","PROCESSED","UPDATED","CREATED","DELETED","ENABLED","DISABLED","FORWARDED","ESCALATED","DETECTED", "ACCESSED", "CANCELLED", "FAILED", "BLOCKED", "REJECTED"), True, status in ("STARTED","REMEDIATE"), False),
    xdm.event.type = type,
    xdm.target.resource.name = if(stack = "", null, stack),
    xdm.target.resource.type = "Stack",
    xdm.target.ipv4 = if(is_ipv4(ipAddress), if(incidr(ipAddress, "0.0.0.0/0"), ipAddress, null), null),
    xdm.target.ipv6  = arrayindex(regextract(ipAddress, "(?:[a-fA-F\d]{0,4}\:){7}[\wa-fA-F]{0,4}"), 0),
    xdm.source.user.username = if(
        set_src_email != null, arrayindex(regextract(set_src_email, "(\S+)\@"),0),
        get_src_name !~= "@", get_src_name
    ),
    xdm.source.user.upn = set_src_email,
    xdm.target.user.username = if(
        set_dst_email != null, arrayindex(regextract(set_dst_email, "(\S+)\@"),0), 
        get_dst_name !~= "@", get_dst_name
    ),
    xdm.target.user.upn = set_dst_email,
    xdm.event.description = attributes;