[MODEL: dataset = tenable_io_raw]
alter 
    xdm.source.user.identifier = json_extract_scalar(actor, "$.id"),
    xdm.source.identity.identifier = json_extract_scalar(actor, "$.id"),
    xdm.source.user.username = json_extract_scalar(actor, "$.name"),
    xdm.source.identity.username = json_extract_scalar(actor, "$.name"),
    xdm.event.description = description,
    xdm.target.resource.id = json_extract_scalar(`target`, "$.id"),
    xdm.target.resource.name = json_extract_scalar(`target`, "$.name"),
    xdm.target.resource.type = json_extract_scalar(`target`, "$.type"),
    xdm.event.id = id,
    xdm.event.operation = action,
    xdm.event.type = action,
    xdm.source.ipv4 = arraystring(arraymap(json_extract_array(`fields`, "$."), if(json_extract_scalar("@element", "$.key") = "X-Forwarded-For",json_extract_scalar("@element", "$.value"), null)),","),
    xdm.source.agent.identifier = arraystring(arraymap(json_extract_array(`fields`, "$."), if(json_extract_scalar("@element", "$.key") = "X-Request-Uuid",json_extract_scalar("@element", "$.value"), null)),","),
    xdm.event.outcome_reason = arraystring(arraymap(json_extract_array(`fields`, "$."), if(json_extract_scalar("@element", "$.key") = "message",json_extract_scalar("@element", "$.value"), null)),","),
    xdm.event.operation_sub_type = arraystring(arraymap(json_extract_array(`fields`, "$."), if(json_extract_scalar("@element", "$.key") = "serviceName",json_extract_scalar("@element", "$.value"), null)),","),
    xdm.session_context_id = arraystring(arraymap(json_extract_array(`fields`, "$."), if(json_extract_scalar("@element", "$.key") = "X-Session-Uuid",json_extract_scalar("@element", "$.value"), null)),",");

[MODEL: dataset = tenable_io_vulnerabilities_raw]
alter
    xdm.target.host.hostname = replace(json_extract(asset,"$.hostname"),"\"",""),
    xdm.target.host.ipv4_addresses = arraycreate(replace(json_extract(asset,"$.ipv4"),"\"","")),
    xdm.target.host.device_id = replace(json_extract(asset,"$.uuid"),"\"",""),
    xdm.target.host.os = replace(arrayindex(json_extract_array(asset,"$.operating_system"),0),"\"",""),
    xdm.alert.description = replace(json_extract(plugin,"$.description"),"\"",""),
    xdm.alert.name = replace(json_extract(plugin,"$.name"),"\"",""),
    xdm.alert.severity = severity,
    xdm.event.description = output,
    xdm.source.host.fqdn = replace(json_extract(asset,"$.fqdn"),"\"",""),
    xdm.target.host.fqdn = replace(json_extract(asset,"$.fqdn"),"\"",""),
    xdm.alert.category = replace(json_extract(plugin,"$.family"),"\"",""),
    xdm.alert.original_alert_id = json_extract_scalar(plugin,"$.id");