[MODEL: dataset=cisco_ise_raw]

// CISE_Passed_Authentications, CISE_Failed_Attempts, CISE_RADIUS_Diagnostics, CISE_RADIUS_Accounting, CISE_TACACS_Accounting Parsing
/* --------------------------------------------------------------------------------
Key_Values
   - Acct-Input-Packets=
   - Acct-Output-Packets=
   - Acct-Session-Id=
   - Acct-Status-Type=
   - AcsSessionID=
   - Authen-Method=
   - AuthenticationMethod=
   - Called-Station-ID=
   - Calling-Station-ID=
   - CmdSet=
   - DestinationIPAddress=
   - DestinationPort=
   - Device IP Address=
   - Device Port=
   - Device Type=
   - EapAuthentication=
   - EndPointMACAddress=
   - FailureReason=
   - Framed-IP-Address=
   - IdentityPolicyMatchedRule=
   - NAS-IP-Address=
   - NAS-Port=
   - NAS-Port-Id=
   - NetworkDeviceGroups=
   - NetworkDeviceName=
   - Privilege-Level=
   - Protocol=
   - Remote-Address=
   - Service=
   - Service-Argument=
   - User-Name=
   - UserName=
   - User=
   -------------------------------------------------------------------------------*/

alter 
    logType = arrayindex(regextract(_raw_log, "<\d+>\w+\s*\d+\s\d+:\d+:\d+\s[\S]+\s(\w+)\s"),0)
| filter logType in ("CISE_Passed_Authentications", "CISE_Failed_Attempts", "CISE_RADIUS_Diagnostics", "CISE_RADIUS_Accounting", "CISE_TACACS_Accounting")
| alter
        Acct_Input_Packets = arrayindex(regextract(_raw_log, "Acct-Input-Packets=([^\,\;]+)"),0),
        Acct_Output_Packets = arrayindex(regextract(_raw_log, "Acct-Output-Packets=([^\,\;]+)"),0),
        Acct_Session_Id = arrayindex(regextract(_raw_log, "Acct-Session-Id=([^\,\;]+)"),0),
        Acct_Status_Type = arrayindex(regextract(_raw_log, "Acct-Status-Type=([^\,\;]+)"),0),
        AcsSessionID = arrayindex(regextract(_raw_log, "AcsSessionID=([^\,]+)"),0),
        AuthenticationMethod = arrayindex(regextract(_raw_log, "AuthenticationMethod=([^\,;]+)"),0),
        Authen_Method = arrayindex(regextract(_raw_log, "Authen-Method=([^\,;]+)"),0),
        Called_Station_ID_ipv4 = arrayindex(regextract(_raw_log, "Called-Station-ID=(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"),0),
        Called_Station_ID_ipv6 = arrayindex(regextract(_raw_log, "Called-Station-ID=((?:(?:[A-Fa-f0-9]{1,4}:){7}[A-Fa-f0-9]{1,4}|(?:[A-Fa-f0-9]{1,4}:){1,7}:|(?:[A-Fa-f0-9]{1,4}:){1,6}:[A-Fa-f0-9]{1,4}|(?:[A-Fa-f0-9]{1,4}:){1,5}(?::[A-Fa-f0-9]{1,4}){1,2}|(?:[A-Fa-f0-9]{1,4}:){1,4}(?::[A-Fa-f0-9]{1,4}){1,3}|(?:[A-Fa-f0-9]{1,4}:){1,3}(?::[A-Fa-f0-9]{1,4}){1,4}|(?:[A-Fa-f0-9]{1,4}:){1,2}(?::[A-Fa-f0-9]{1,4}){1,5}|[A-Fa-f0-9]{1,4}:(?:(?::[A-Fa-f0-9]{1,4}){1,6})|:(?::[A-Fa-f0-9]{1,4}){1,7}|::))"),0),
        Called_Station_ID_mac = arrayindex(regextract(_raw_log, "Called-Station-ID=(\S{2}[:-]\S{2}[:-]\S{2}[:-]\S{2}[:-]\S{2}[:-]\S{2}|[a-fA-F\d]{12})"), 0),
        Calling_Station_ID_ipv4 = arrayindex(regextract(_raw_log, "Calling-Station-ID=(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"),0),
        Calling_Station_ID_ipv6 = arrayindex(regextract(_raw_log, "Calling-Station-ID=((?:(?:[A-Fa-f0-9]{1,4}:){7}[A-Fa-f0-9]{1,4}|(?:[A-Fa-f0-9]{1,4}:){1,7}:|(?:[A-Fa-f0-9]{1,4}:){1,6}:[A-Fa-f0-9]{1,4}|(?:[A-Fa-f0-9]{1,4}:){1,5}(?::[A-Fa-f0-9]{1,4}){1,2}|(?:[A-Fa-f0-9]{1,4}:){1,4}(?::[A-Fa-f0-9]{1,4}){1,3}|(?:[A-Fa-f0-9]{1,4}:){1,3}(?::[A-Fa-f0-9]{1,4}){1,4}|(?:[A-Fa-f0-9]{1,4}:){1,2}(?::[A-Fa-f0-9]{1,4}){1,5}|[A-Fa-f0-9]{1,4}:(?:(?::[A-Fa-f0-9]{1,4}){1,6})|:(?::[A-Fa-f0-9]{1,4}){1,7}|::))"),0),
        Calling_Station_ID_mac = arrayindex(regextract(_raw_log, "Calling-Station-ID=(\S{2}[:-]\S{2}[:-]\S{2}[:-]\S{2}[:-]\S{2}[:-]\S{2}|[a-fA-F\d]{12})"),0),
        CmdSet = arrayindex(regextract(_raw_log, "CmdSet=([^\,;]+)"),0),
        Description1 = arrayindex(regextract(_raw_log, "(?:DEBUG|INFO|WARN|ERROR|FATAL|CRITICAL|NOTICE)\s*([^:]+\:\s+[^,]+)"), 0),
        Description2 = arrayindex(regextract(_raw_log, "<\d+>\w+\s*\d+\s\d+:\d+:\d+\s\S+\s\w+\s\d+\s+(.*)"), 0),
        DestinationIPAddress_ipv4 = arrayindex(regextract(_raw_log, "DestinationIPAddress=(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}),"),0),
        DestinationIPAddress_ipv6 = arrayindex(regextract(_raw_log, "DestinationIPAddress=((?:[a-fA-F\d]{0,4}\:){2,7}[a-fA-F\d]{0,4}),"),0),
        DestinationPort = arrayindex(regextract(_raw_log, "DestinationPort=(\d+),"),0),
        DeviceIPAddress_ipv4 = arrayindex(regextract(_raw_log, "Device IP Address=(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}),"),0),
        DeviceIPAddress_ipv6 = arrayindex(regextract(_raw_log, "Device IP Address=((?:[a-fA-F\d]{0,4}\:){2,7}[a-fA-F\d]{0,4}),"),0),
        Device_Port = arrayindex(regextract(_raw_log, "Device Port=([^\,\;]+)"),0),
        Device_Type = arrayindex(regextract(_raw_log, "Device Type=Device Type#([^\,]+)"), 0),
        EapAuthentication = arrayindex(regextract(_raw_log, "EapAuthentication=([^\,]+)"),0),
        EndPointMACAddress = arrayindex(regextract(_raw_log, "EndPointMACAddress=([^\,]+)"),0),
        FailureReason = arrayindex(regextract(_raw_log, "FailureReason=([^\,]+)"),0),
        framedIP_ipv4 = arrayindex(regextract(_raw_log, "Framed-IP-Address=(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}),"),0),
        framedIP_ipv6 = arrayindex(regextract(_raw_log, "Framed-IP-Address=((?:[a-fA-F\d]{0,4}\:){2,7}[a-fA-F\d]{0,4}),"),0),
        IdentityPolicyMatchedRule = arrayindex(regextract(_raw_log, "IdentityPolicyMatchedRule=([^\,]+)"),0),
        logSeverity = lowercase(arrayindex(regextract(_raw_log, "\s+(DEBUG|INFO|WARN|ERROR|FATAL|CRITICAL|NOTICE)[\s:]+"),0)),
        NAS_IP_Address_ipv4 = arrayindex(regextract(_raw_log, "NAS-IP-Address=(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}),"),0),
        NAS_IP_Address_ipv6 = arrayindex(regextract(_raw_log, "NAS-IP-Address=((?:[a-fA-F\d]{0,4}\:){2,7}[a-fA-F\d]{0,4}),"),0),
        NAS_Port = arrayindex(regextract(_raw_log, "NAS-Port=(\d+),"),0),
        NAS_Port_Id = arrayindex(regextract(_raw_log, "NAS-Port-Id=([^\,\;]+)"),0),
        NetworkDeviceGroups_DeviceType = arrayindex(regextract(_raw_log, "NetworkDeviceGroups=Device Type#([^\,]+)"), 0),
        NetworkDeviceName = arrayindex(regextract(_raw_log, "NetworkDeviceName=([^,]+),"),0),
        Privilege_Level = arrayindex(regextract(_raw_log, "Privilege-Level=([^\,;]+)"),0),
        Protocol = arrayindex(regextract(_raw_log, "Protocol=([^,]+),"),0),
        Remote_Address_ipv4 = arrayindex(regextract(_raw_log, "Remote-Address=(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}),"),0),
        Remote_Address_ipv6 = arrayindex(regextract(_raw_log, "Remote-Address=((?:[a-fA-F\d]{0,4}\:){2,7}[a-fA-F\d]{0,4}),"),0),
        Service = arrayindex(regextract(_raw_log, "Service=([^\,;]+)"),0),
        Service_Argument = arrayindex(regextract(_raw_log, "Service-Argument=([^\,;]+)"),0),
        User = arrayindex(regextract(_raw_log, "User=([^\,;]+)"),0),
        UserName1 = arrayindex(regextract(_raw_log, "User-Name=([a-zA-Z0-9\@\-\\\/\\\._]+)"),0),
        UserName2 = arrayindex(regextract(_raw_log, "UserName=([a-zA-Z0-9\@\-\\\/\\\._]+)"),0)
| alter
        Remote_Address_Hostname = if(Remote_Address_ipv4 = null and Remote_Address_ipv6 = null, arrayindex(regextract(_raw_log, "Remote-Address=([^,]+),"),0), null),
        SourceIPv4_type_identifier = if(Calling_Station_ID_ipv4 != null, "Calling_Station_ID", Remote_Address_ipv4 != null, "Remote_Address", framedIP_ipv4 != null, "framedIP", DeviceIPAddress_ipv4 != null, "DeviceIPAddress", NAS_IP_Address_ipv4 != null, "NAS_IP_Address", null),
        SourceIPv6_type_identifier = if(Calling_Station_ID_ipv6 != null, "Calling_Station_ID", Remote_Address_ipv6 != null, "Remote_Address", framedIP_ipv6 != null, "framedIP", DeviceIPAddress_ipv6 != null, "DeviceIPAddress", NAS_IP_Address_ipv6 != null, "NAS_IP_Address", null)
| alter
        xdm.observer.name = arrayindex(regextract(_raw_log, "<\d+>\w+\s*\d+\s\d+:\d+:\d+\s([\S]+)"),0),
        xdm.event.type = logType,
        xdm.event.description = coalesce(Description1, Description2),
        xdm.event.log_level = if(logSeverity ~= "debug", XDM_CONST.LOG_LEVEL_DEBUG, logSeverity ~= "info", XDM_CONST.LOG_LEVEL_INFORMATIONAL, logSeverity ~= "warn", XDM_CONST.LOG_LEVEL_WARNING, logSeverity ~= "error", XDM_CONST.LOG_LEVEL_ERROR, logSeverity = "fatal", XDM_CONST.LOG_LEVEL_EMERGENCY, logSeverity ~= "critical", XDM_CONST.LOG_LEVEL_CRITICAL, logSeverity ~= "notice", XDM_CONST.LOG_LEVEL_NOTICE, logSeverity = null, null, XDM_CONST.LOG_LEVEL_NOTICE),
        xdm.event.original_event_type = arrayindex(regextract(_raw_log, "(\d+)\s(?:DEBUG|INFO|WARN|ERROR|FATAL|CRITICAL|NOTICE)"),0),
        xdm.event.id = arrayindex(regextract(_raw_log, "<\d+>\w+\s*\d+\s\d+:\d+:\d+\s[\S]+\s\w+\s(\d+)"),0),
        xdm.event.outcome = if(Description1 ~= "[Ss][Uu][Cc][Cc][Ee]", XDM_CONST.OUTCOME_SUCCESS, Description1 ~= "[Ff][Aa][Ii][Ll]", XDM_CONST.OUTCOME_FAILED, null),
        xdm.event.outcome_reason = FailureReason,
        xdm.event.operation = Service,
        xdm.event.operation_sub_type = coalesce(Acct_Status_Type, Service_Argument),
        xdm.source.host.hostname = if(SourceIPv4_type_identifier in("DeviceIPAddress", "NAS_IP_Address") or SourceIPv6_type_identifier in ("DeviceIPAddress", "NAS_IP_Address"), NetworkDeviceName, Remote_Address_Hostname),
        xdm.source.ipv4 = coalesce(Calling_Station_ID_ipv4, Remote_Address_ipv4, framedIP_ipv4, DeviceIPAddress_ipv4, NAS_IP_Address_ipv4),
        xdm.source.ipv6 = coalesce(Calling_Station_ID_ipv6, Remote_Address_ipv6, framedIP_ipv6, DeviceIPAddress_ipv6, NAS_IP_Address_ipv6),
        xdm.source.port = if(SourceIPv4_type_identifier in ("DeviceIPAddress", "NAS_IP_Address") or SourceIPv6_type_identifier in ("DeviceIPAddress", "NAS_IP_Address"), coalesce(to_integer(Device_Port), to_integer(NAS_Port)), null),
        xdm.source.process.command_line = CmdSet,
        xdm.source.interface = NAS_Port_Id,
        xdm.source.host.mac_addresses = arraydistinct(arraycreate(EndPointMACAddress, Calling_Station_ID_mac)),
        xdm.source.host.device_category = if(SourceIPv4_type_identifier in("DeviceIPAddress", "NAS_IP_Address") or SourceIPv6_type_identifier in ("DeviceIPAddress", "NAS_IP_Address"), coalesce(Device_Type, NetworkDeviceGroups_DeviceType), null),
        xdm.source.user.username = coalesce(UserName1, UserName2, User),
        xdm.source.sent_packets = to_integer(Acct_Output_Packets),
        xdm.intermediate.host.hostname = if((SourceIPv4_type_identifier not in ("DeviceIPAddress", "NAS_IP_Address") or SourceIPv4_type_identifier = null) and (SourceIPv6_type_identifier not in ("DeviceIPAddress", "NAS_IP_Address") or SourceIPv6_type_identifier = null), NetworkDeviceName, null),
        xdm.intermediate.ipv4 = if(SourceIPv4_type_identifier in ("Calling_Station_ID", "Remote_Address"), coalesce(framedIP_ipv4, DeviceIPAddress_ipv4, NAS_IP_Address_ipv4), SourceIPv4_type_identifier = "framedIP", coalesce(DeviceIPAddress_ipv4, NAS_IP_Address_ipv4), null),
        xdm.intermediate.ipv6 = if(SourceIPv6_type_identifier in ("Calling_Station_ID", "Remote_Address"), coalesce(framedIP_ipv6, DeviceIPAddress_ipv6, NAS_IP_Address_ipv6), SourceIPv6_type_identifier = "framedIP", coalesce(DeviceIPAddress_ipv6, NAS_IP_Address_ipv6), null),
        xdm.intermediate.port = if((SourceIPv4_type_identifier not in ("DeviceIPAddress", "NAS_IP_Address") or SourceIPv4_type_identifier = null) and (SourceIPv6_type_identifier not in ("DeviceIPAddress", "NAS_IP_Address") or SourceIPv6_type_identifier = null), coalesce(to_integer(NAS_Port), to_integer(Device_Port)), null),
        xdm.intermediate.host.device_category = if((SourceIPv4_type_identifier not in ("DeviceIPAddress", "NAS_IP_Address") or SourceIPv4_type_identifier = null) and (SourceIPv6_type_identifier not in ("DeviceIPAddress", "NAS_IP_Address") or SourceIPv6_type_identifier = null), coalesce(Device_Type, NetworkDeviceGroups_DeviceType), null),
        xdm.target.host.mac_addresses = arraycreate(Called_Station_ID_mac),
        xdm.target.ipv4 = coalesce(DestinationIPAddress_ipv4, Called_Station_ID_ipv4),
        xdm.target.ipv6 = coalesce(DestinationIPAddress_ipv6, Called_Station_ID_ipv6),
        xdm.target.port = to_integer(DestinationPort),
        xdm.target.sent_packets = to_integer(Acct_Input_Packets),
        xdm.network.session_id = coalesce(AcsSessionID, Acct_Session_Id),
        xdm.network.application_protocol = Protocol,
        xdm.network.rule = IdentityPolicyMatchedRule,
        xdm.auth.auth_method = coalesce(AuthenticationMethod, Authen_Method, EapAuthentication),
        xdm.auth.privilege_level = if(Privilege_Level = "0", XDM_CONST.PRIVILEGE_LEVEL_GUEST, Privilege_Level = "1", XDM_CONST.PRIVILEGE_LEVEL_USER, Privilege_Level = "15", XDM_CONST.PRIVILEGE_LEVEL_ADMIN, Privilege_Level);

// CISE_Alarm Parsing
/* --------------------------------------------------------------------------------
Key_Values
   - Admin=
   - Calling Station Id=
   - Cause=
   - Endpoint=
   - back up file name:
   - From
   - To
   - NAD Address=
   - NAS IP Address=
   - NAS Identifier=
   - Network device IP=
   - Network Device Name=
   - Object Name=
   - Object Type=
   - Repository Name:
   - Server=
   -------------------------------------------------------------------------------*/

alter 
    logType = arrayindex(regextract(_raw_log, "<\d+>\w+\s*\d+\s\d+:\d+:\d+\s[\S]+\s(\w+)\s"),0)
| filter logType = "CISE_Alarm"
| alter
    Admin = arrayindex(regextract(_raw_log, "Admin=([^\,\;]+)"),0),
    Calling_Station_Id_ipv4 = arrayindex(regextract(_raw_log, "Calling Station Id=(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"),0),
    Calling_Station_Id_ipv6 = arrayindex(regextract(_raw_log, "Calling Station Id=((?:(?:[A-Fa-f0-9]{1,4}:){7}[A-Fa-f0-9]{1,4}|(?:[A-Fa-f0-9]{1,4}:){1,7}:|(?:[A-Fa-f0-9]{1,4}:){1,6}:[A-Fa-f0-9]{1,4}|(?:[A-Fa-f0-9]{1,4}:){1,5}(?::[A-Fa-f0-9]{1,4}){1,2}|(?:[A-Fa-f0-9]{1,4}:){1,4}(?::[A-Fa-f0-9]{1,4}){1,3}|(?:[A-Fa-f0-9]{1,4}:){1,3}(?::[A-Fa-f0-9]{1,4}){1,4}|(?:[A-Fa-f0-9]{1,4}:){1,2}(?::[A-Fa-f0-9]{1,4}){1,5}|[A-Fa-f0-9]{1,4}:(?:(?::[A-Fa-f0-9]{1,4}){1,6})|:(?::[A-Fa-f0-9]{1,4}){1,7}|::))"),0),
    Calling_Station_Id_mac = arrayindex(regextract(_raw_log, "Calling Station Id=(\S{2}[:-]\S{2}[:-]\S{2}[:-]\S{2}[:-]\S{2}[:-]\S{2}|[a-fA-F\d]{12})"),0),
    Cause = arrayindex(regextract(_raw_log, "Cause=([^\=]+)"),0),
    Description = rtrim(arrayindex(regextract(_raw_log, "<\d+>\w+\s*\d+\s\d+:\d+:\d+\s[\S]+\s\w+\s\w+:\s([^:]+)"),0)),
    Endpoint_ipv4 = arrayindex(regextract(_raw_log, "Endpoint=(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"),0),
    Endpoint_ipv6 = arrayindex(regextract(_raw_log, "Endpoint=((?:[a-fA-F\d]{0,4}\:){2,7}[a-fA-F\d]{0,4})"),0),
    File_name = arrayindex(regextract(_raw_log, "back up file name: \'([^\']+)\'"),0),
    Hostname_From = arrayindex(regextract(_raw_log, "From\s+(\S+)\s+To\s+\S+\;"),0),
    Hostname_To = arrayindex(regextract(_raw_log, "From\s+\S+\s+To\s+(\S+)\;"),0),
    logSeverity = lowercase(arrayindex(regextract(_raw_log, "\s+(DEBUG|INFO|WARN|ERROR|FATAL|CRITICAL|NOTICE)[\s:]+"),0)),
    NAD_IP_Address_ipv4 = arrayindex(regextract(_raw_log, "NAD Address=(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"),0),
    NAD_IP_Address_ipv6 = arrayindex(regextract(_raw_log, "NAD Address=((?:[a-fA-F\d]{0,4}\:){2,7}[a-fA-F\d]{0,4})"),0),
    NAS_IP_Address_ipv4 = arrayindex(regextract(_raw_log, "NAS IP Address=(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"),0),
    NAS_IP_Address_ipv6 = arrayindex(regextract(_raw_log, "NAS IP Address=((?:[a-fA-F\d]{0,4}\:){2,7}[a-fA-F\d]{0,4})"),0),
    NAS_Identifier = arrayindex(regextract(_raw_log, "NAS Identifier=([^\,\;]+)"),0),
    Network_device_IP_ipv4 = arrayindex(regextract(_raw_log, "Network device IP=(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"),0),
    Network_device_IP_ipv6 = arrayindex(regextract(_raw_log, "Network device IP=((?:[a-fA-F\d]{0,4}\:){2,7}[a-fA-F\d]{0,4})"),0),
    Network_Device_Name = arrayindex(regextract(_raw_log, "Network Device Name=([^\,\;]+)"),0),
    Object_Name = arrayindex(regextract(_raw_log, "Object Name=([^\,,\;]+)"),0),
    Object_Type = arrayindex(regextract(_raw_log, "Object Type=([^\,,\;]+)"),0),
    Observer = arrayindex(regextract(_raw_log, "<\d+>\w+\s*\d+\s\d+:\d+:\d+\s([\S]+)"),0),
    Repository_Name = arrayindex(regextract(_raw_log, "Repository Name: \'([^\']+)\'"),0),
    Server = arrayindex(regextract(_raw_log, "Server=([^;,\s]+)"),0)
| alter
    xdm.observer.name = coalesce(Server, Observer),
    xdm.event.log_level = if(logSeverity ~= "debug", XDM_CONST.LOG_LEVEL_DEBUG, logSeverity ~= "info", XDM_CONST.LOG_LEVEL_INFORMATIONAL, logSeverity ~= "warn", XDM_CONST.LOG_LEVEL_WARNING, logSeverity ~= "error", XDM_CONST.LOG_LEVEL_ERROR, logSeverity = "fatal", XDM_CONST.LOG_LEVEL_EMERGENCY, logSeverity ~= "critical", XDM_CONST.LOG_LEVEL_CRITICAL, logSeverity ~= "notice", XDM_CONST.LOG_LEVEL_NOTICE, logSeverity = null, null, XDM_CONST.LOG_LEVEL_NOTICE),
    xdm.event.type = logType,
    xdm.event.description = Description,
    xdm.event.outcome_reason = Cause,
    xdm.intermediate.ipv4 = if(Calling_Station_Id_ipv4 != null or Endpoint_ipv4 != null, coalesce(NAS_IP_Address_ipv4, NAD_IP_Address_ipv4, Network_device_IP_ipv4), null),
    xdm.intermediate.ipv6 = if(Calling_Station_Id_ipv6 != null or Endpoint_ipv6 != null, coalesce(NAS_IP_Address_ipv6, NAD_IP_Address_ipv6, Network_device_IP_ipv6), null),
    xdm.intermediate.host.device_id = if((Calling_Station_Id_ipv4 != null or Endpoint_ipv4 != null) and (Calling_Station_Id_ipv6 != null or Endpoint_ipv6 != null), NAS_Identifier, null),
    xdm.intermediate.host.hostname = if(Calling_Station_Id_ipv4 = null and Endpoint_ipv4 = null and Calling_Station_Id_ipv6 = null and Endpoint_ipv6 = null, null, Network_Device_Name),
    xdm.source.ipv4 = coalesce(Calling_Station_Id_ipv4, Endpoint_ipv4, NAS_IP_Address_ipv4, NAD_IP_Address_ipv4, Network_device_IP_ipv4),
    xdm.source.ipv6 = coalesce(Calling_Station_Id_ipv6, Endpoint_ipv6, NAS_IP_Address_ipv6, NAD_IP_Address_ipv6, Network_device_IP_ipv6),
    xdm.source.user.username = Admin,
    xdm.source.host.mac_addresses = arraycreate(Calling_Station_Id_mac),
    xdm.source.host.hostname = if(Calling_Station_Id_ipv4 = null and Endpoint_ipv4 = null and Calling_Station_Id_ipv6 = null and Endpoint_ipv6 = null, Network_Device_Name, Hostname_From),
    xdm.source.host.device_id = if(Calling_Station_Id_ipv4 = null and Endpoint_ipv4 = null and Calling_Station_Id_ipv6 = null and Endpoint_ipv6 = null, NAS_Identifier, null),
    xdm.target.resource.name = coalesce(Object_Name, Repository_Name),
    xdm.target.resource.type = Object_Type,
    xdm.target.host.hostname = Hostname_To,
    xdm.target.file.filename = File_name,
    xdm.auth.privilege_level = if(Admin != null, XDM_CONST.PRIVILEGE_LEVEL_ADMIN, null);

// CISE_Administrative_and_Operational_Audit Parsing
/* --------------------------------------------------------------------------------
Key_Values
   - AdminIPAddress=
   - AdminName=
   - ConfigChangeData=
   - CertificateHash=
   - FailureFlag=
   - ObjectType=
   - ObjectName=
   - OperationMessageText=
   - PeerName=
   - ShutdownReason=
   - Targets=
   - UniqueConnectionIdentifier=
   -------------------------------------------------------------------------------*/

alter
    logType = arrayindex(regextract(_raw_log, "<\d+>\w+\s*\d+\s\d+:\d+:\d+\s[\S]+\s(\w+)\s"),0)
| filter (logType = "CISE_Administrative_and_Operational_Audit")
| alter
    logSeverity = lowercase(arrayindex(regextract(_raw_log, "\s+(DEBUG|INFO|WARN|ERROR|FATAL|CRITICAL|NOTICE)[\s:]+"),0)),
    Description = arrayindex(regextract(_raw_log, "\s+(?:DEBUG|INFO|WARN|ERROR|FATAL|CRITICAL|NOTICE)\s*([^,]+)"),0),
    AdminIPAddress = arrayindex(regextract(_raw_log, "AdminIPAddress\s*=\s*([^,]*),"),0),
    AdminName = arrayindex(regextract(_raw_log, "AdminName\s*=\s*([^,]*),"),0),
    ConfigChangeData = arrayindex(regextract(_raw_log, "ConfigChangeData\s*=\s*(.*?),\s[^=]+=[^=]+,"),0),
    CertificateHash = arrayindex(regextract(_raw_log, "CertificateHash\s*=\s*([^,]*),"),0),
    FailureFlag = lowercase(arrayindex(regextract(_raw_log, "FailureFlag\s*=\s*([^,]*),"),0)),
    ObjectType = arrayindex(regextract(_raw_log, "ObjectType\s*=\s*([^,]*),"),0),
    ObjectName = lowercase(arrayindex(regextract(_raw_log, "ObjectName\s*=\s*([^,]*),"),0)),
    OperationMessageText = arrayindex(regextract(_raw_log, "OperationMessageText\s*=\s*([^,]*),"),0),
    ShutdownReason = arrayindex(regextract(_raw_log, "ShutdownReason\s*=\s*([^,]*),"),0),
    UniqueConnectionIdentifier = arrayindex(regextract(_raw_log, "UniqueConnectionIdentifier\s*=\s*([^,]*),"),0)
| alter
    xdm.event.id = arrayindex(regextract(_raw_log, "<\d+>\w+\s*\d+\s\d+:\d+:\d+\s[\S]+\s\w+\s(\d+)"),0),
    xdm.event.type = logType,
    xdm.event.original_event_type = arrayindex(regextract(_raw_log, "(\d+)\s(?:DEBUG|INFO|WARN|ERROR|FATAL|CRITICAL|NOTICE)"),0),
    xdm.event.description = if(ConfigChangeData != null and OperationMessageText != null, concat(OperationMessageText, " - ", ConfigChangeData), coalesce(ConfigChangeData, OperationMessageText, Description)),
    xdm.event.outcome = if(FailureFlag = "false", XDM_CONST.OUTCOME_SUCCESS, FailureFlag = "true", XDM_CONST.OUTCOME_FAILED, null),
    xdm.event.outcome_reason = ShutdownReason,
    xdm.event.log_level = if(logSeverity ~= "debug", XDM_CONST.LOG_LEVEL_DEBUG, logSeverity ~= "info", XDM_CONST.LOG_LEVEL_INFORMATIONAL, logSeverity ~= "warn", XDM_CONST.LOG_LEVEL_WARNING, logSeverity ~= "error", XDM_CONST.LOG_LEVEL_ERROR, logSeverity = "fatal", XDM_CONST.LOG_LEVEL_EMERGENCY, logSeverity ~= "critical", XDM_CONST.LOG_LEVEL_CRITICAL, logSeverity ~= "notice", XDM_CONST.LOG_LEVEL_NOTICE, logSeverity = null, null, XDM_CONST.LOG_LEVEL_NOTICE),
    xdm.source.ipv4 = if(AdminIPAddress ~= "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}", AdminIPAddress,  null),
    xdm.source.ipv6 = if(AdminIPAddress ~= "(?:[a-fA-F\d]{0,4}\:){2,7}[a-fA-F\d]{0,4}", AdminIPAddress,  null),
    xdm.source.user.username = AdminName,
    xdm.network.tls.client_certificate.md5 = CertificateHash,
    xdm.target.resource.type = ObjectType,
    xdm.target.resource.name = ObjectName,
    xdm.logon.logon_guid = UniqueConnectionIdentifier;


// CISE_External_MDM Parsing
/* --------------------------------------------------------------------------------
Key_Values
   - EndPointMACAddress=
   - MDMFailureReason=
   - MDMServerName=
   - ServerType=
   - SessionId=
   -------------------------------------------------------------------------------*/

alter
    logType = arrayindex(regextract(_raw_log, "<\d+>\w+\s*\d+\s\d+:\d+:\d+\s[\S]+\s(\w+)\s"),0)
| filter logType = "CISE_External_MDM"
| alter
        Description = arrayindex(regextract(_raw_log, "\s+(?:DEBUG|INFO|WARN|ERROR|FATAL|CRITICAL|NOTICE)\s*([^,]+)"),0),
        EndPointMACAddress = arrayindex(regextract(_raw_log, "EndPointMACAddress\s*=\s*([^,]*),"),0),
        logSeverity = lowercase(arrayindex(regextract(_raw_log, "\s+(DEBUG|INFO|WARN|ERROR|FATAL|CRITICAL|NOTICE)[\s:]+"),0)),
        MDMFailureReason = arrayindex(regextract(_raw_log, "MDMFailureReason\s*=\s*([^,]*),"),0),
        MDMServerName = arrayindex(regextract(_raw_log, "MDMServerName\s*=\s*([^,]*),"),0),
        ServerType = arrayindex(regextract(_raw_log, "ServerType\s*=\s*([^,]*),"),0),
        SessionId = arrayindex(regextract(_raw_log, "SessionId\s*=\s*([^,]*),"),0)
| alter
        xdm.event.id = arrayindex(regextract(_raw_log, "<\d+>\w+\s*\d+\s\d+:\d+:\d+\s[\S]+\s\w+\s(\d+)"),0),
        xdm.event.type = logType,
        xdm.event.original_event_type = arrayindex(regextract(_raw_log, "(\d+)\s(?:DEBUG|INFO|WARN|ERROR|FATAL|CRITICAL|NOTICE)"),0),
        xdm.event.description = Description,
        xdm.event.log_level = if(logSeverity ~= "debug", XDM_CONST.LOG_LEVEL_DEBUG, logSeverity ~= "info", XDM_CONST.LOG_LEVEL_INFORMATIONAL, logSeverity ~= "warn", XDM_CONST.LOG_LEVEL_WARNING, logSeverity ~= "error", XDM_CONST.LOG_LEVEL_ERROR, logSeverity = "fatal", XDM_CONST.LOG_LEVEL_EMERGENCY, logSeverity ~= "critical", XDM_CONST.LOG_LEVEL_CRITICAL, logSeverity ~= "notice", XDM_CONST.LOG_LEVEL_NOTICE, logSeverity = null, null, XDM_CONST.LOG_LEVEL_NOTICE),
        xdm.event.outcome = if(Description ~= "[Ss][Uu][Cc][Cc][Ee]", XDM_CONST.OUTCOME_SUCCESS, Description ~= "[Ff][Aa][Ii][Ll]", XDM_CONST.OUTCOME_FAILED, null),
        xdm.event.outcome_reason = MDMFailureReason,
        xdm.source.host.mac_addresses = arraycreate(EndPointMACAddress),
        xdm.target.host.hostname = MDMServerName,
        xdm.target.host.device_category = ServerType,
        xdm.network.session_id = SessionId;

// ### Everything NOT - CISE_Passed_Authentications, CISE_Failed_Attempts, CISE_RADIUS_Diagnostics, CISE_RADIUS_Accounting, CISE_TACACS_Accounting, CISE_Alarm, CISE_Administrative_and_Operational_Audit, CISE_External_MDM
/* --------------------------------------------------------------------------------
Key_Values
   - AuthenticationMethod=
   - Authen-Method=
   - DestinationPort=
   - DestinationIPAddress=
   - Device Type=
   - EndpointNADAddress=
   - EndpointIPAddress=
   - FailureReason=
   - FeedUrl=
   - IdentitySelectionMatchedRule=
   - MESSAGE=
   - EndpointMacAddress=
   - MacAddress=
   - NAS-Port=
   - NetworkDeviceName=
   - NetworkDeviceGroups=
   - OperatingSystem=
   - AD-Operating-System=
   - OriginalUserName=
   - OperationMessageText=
   - PeerAddress=
   - posturePassCondition=
   - ProfilerErrorMessage=
   - System-Management:
   - ShutdownReason=
   - UniqueConnectionIdentifier=
   - UserType=
   - UserName=
   - User-Fetch-Organizational-Unit=

   -------------------------------------------------------------------------------*/

alter
    logType = arrayindex(regextract(_raw_log, "<\d+>\w+\s*\d+\s\d+:\d+:\d+\s[\S]+\s(\w+)\s"),0)
| filter logType not in ("CISE_Passed_Authentications", "CISE_Failed_Attempts", "CISE_RADIUS_Diagnostics", "CISE_RADIUS_Accounting", "CISE_TACACS_Accounting", "CISE_Alarm", "CISE_Administrative_and_Operational_Audit", "CISE_External_MDM")
| alter
    AuthenticationMethod = arrayindex(regextract(_raw_log, "AuthenticationMethod=([^\,;]+)"),0),
    Authen_Method = arrayindex(regextract(_raw_log, "Authen-Method=([^\,;]+)"),0),
    Description1 = arrayindex(regextract(_raw_log, "(?:DEBUG|INFO|WARN|ERROR|FATAL|CRITICAL|NOTICE)\s*([^:]+\:\s+[^,]+)"), 0),
    Description2 = arrayindex(regextract(_raw_log, "<\d+>\w+\s*\d+\s\d+:\d+:\d+\s\S+\s\w+\s\d+\s+(.*)"), 0),
    DestinationPort = arrayindex(regextract(_raw_log, "DestinationPort=([^\\,]+)"),0),
    DestinationIPAddress_ipv4 = arrayindex(regextract(_raw_log, "DestinationIPAddress=(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}),"),0),
    DestinationIPAddress_ipv6 = arrayindex(regextract(_raw_log, "DestinationIPAddress=((?:[a-fA-F\d]{0,4}\:){2,7}[a-fA-F\d]{0,4}),"),0),
    Device_Type = arrayindex(regextract(_raw_log, "Device Type=Device Type#([^\,]+)"), 0),
    EndpointNADAddress_ipv4 = arrayindex(regextract(_raw_log, "EndpointNADAddress=(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}),"),0),
    EndpointNADAddress_ipv6 = arrayindex(regextract(_raw_log, "EndpointNADAddress=((?:[a-fA-F\d]{0,4}\:){2,7}[a-fA-F\d]{0,4}),"),0),
    EndpointIPAddress_ipv4 = arrayindex(regextract(_raw_log, "EndpointIPAddress=(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}),"),0),
    EndpointIPAddress_ipv6 = arrayindex(regextract(_raw_log, "EndpointIPAddress=((?:[a-fA-F\d]{0,4}\:){2,7}[a-fA-F\d]{0,4}),"),0),
    FailureReason = arrayindex(regextract(_raw_log, "FailureReason=([^,\\;]+)"),0),
    FeedUrl = arrayindex(regextract(_raw_log, "FeedUrl=([^,]+)"),0),
    IdentitySelectionMatchedRule = arrayindex(regextract(_raw_log, "IdentitySelectionMatchedRule=([^,\\;]+)"),0),
    logSeverity = lowercase(arrayindex(regextract(_raw_log, "\s+(DEBUG|INFO|WARN|ERROR|FATAL|CRITICAL|NOTICE)[\s:]+"),0)),
    Message = arrayindex(regextract(_raw_log, "MESSAGE=([^\,]+)"),0),
    Mac_address = arrayindex(regextract(_raw_log, "(?:EndpointMacAddress|MacAddress)=([^,;\\]+)"),0),
    NAS_Port = arrayindex(regextract(_raw_log, "NAS-Port=(\d+)"),0),
    NetworkDeviceName = arrayindex(regextract(_raw_log, "NetworkDeviceName=([^,]+),"),0),
    NetworkDeviceGroups_DeviceType = arrayindex(regextract(_raw_log, "NetworkDeviceGroups=Device Type#([^\,]+)"), 0),
    OS = arrayindex(regextract(_raw_log, "(?:OperatingSystem|AD-Operating-System)=([^,;\\]+)"),0),
    OriginalUserName = arrayindex(regextract(_raw_log, "OriginalUserName=([^,\\;]+)"),0),
    OperationMessageText = arrayindex(regextract(_raw_log, "OperationMessageText=([^,\\;]+)"),0),
    PeerAddress_ipv4 = arrayindex(regextract(_raw_log, "PeerAddress=(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}),"),0),
    PeerAddress_ipv6 = arrayindex(regextract(_raw_log, "PeerAddress=((?:[a-fA-F\d]{0,4}\:){2,7}[a-fA-F\d]{0,4}),"),0),
    PosturePassCondition = arrayindex(regextract(_raw_log, "posturePassCondition=((?:\S+\\,\s)+[^\\,]+)"),0),
    ProfilerErrorMessage = arrayindex(regextract(_raw_log, "ProfilerErrorMessage=([^\,]+)"),0),
    Sys_mgmt = arrayindex(regextract(_raw_log, "System-Management:\s+([^\,]+)"),0),
    ShutdownReason = arrayindex(regextract(_raw_log, "ShutdownReason[\s+=]+([^,]+)"),0),
    UniqueConnectionIdentifier = arrayindex(regextract(_raw_log, "UniqueConnectionIdentifier[\s+=]+(\S+)\,"),0),
    UserType = arrayindex(regextract(_raw_log, "UserType=([^,\\;]+)"),0),
    UserName = arrayindex(regextract(_raw_log, "UserName=([a-zA-Z0-9\@\-\\\/\\\._]+)"),0),
    User_Fetch_Organizational_Unit = arrayindex(regextract(_raw_log, "User-Fetch-Organizational-Unit=([^,\\;]+)"),0)
| alter
    xdm.event.type = logType,
    xdm.event.original_event_type = arrayindex(regextract(_raw_log, "(\d+)\s(?:DEBUG|INFO|WARN|ERROR|FATAL|CRITICAL|NOTICE)"),0),
    xdm.event.description = coalesce(OperationMessageText, Description1, Description2),
    xdm.event.log_level = if(logSeverity ~= "debug", XDM_CONST.LOG_LEVEL_DEBUG, logSeverity ~= "info", XDM_CONST.LOG_LEVEL_INFORMATIONAL, logSeverity ~= "warn", XDM_CONST.LOG_LEVEL_WARNING, logSeverity ~= "error", XDM_CONST.LOG_LEVEL_ERROR, logSeverity = "fatal", XDM_CONST.LOG_LEVEL_EMERGENCY, logSeverity ~= "critical", XDM_CONST.LOG_LEVEL_CRITICAL, logSeverity ~= "notice", XDM_CONST.LOG_LEVEL_NOTICE, logSeverity = null, null, XDM_CONST.LOG_LEVEL_NOTICE),
    xdm.event.outcome = if(Description1 ~= "[Ss][Uu][Cc][Cc][Ee]" or Message ~= "[Ss][Uu][Cc][Cc][Ee]", XDM_CONST.OUTCOME_SUCCESS, Description1 ~= "[Ff][Aa][Ii][Ll]" or Message ~= "[Ff][Aa][Ii][Ll]", XDM_CONST.OUTCOME_FAILED, null),
    xdm.event.outcome_reason = coalesce(FailureReason, ProfilerErrorMessage, Sys_mgmt, ShutdownReason, Message),
    xdm.observer.name = arrayindex(regextract(_raw_log, "<\d+>\w+\s*\d+\s\d+:\d+:\d+\s([\S]+)"),0),
    xdm.auth.auth_method = coalesce(AuthenticationMethod, Authen_Method),
    xdm.network.rule = coalesce(PosturePassCondition, IdentitySelectionMatchedRule),
    xdm.network.session_id = UniqueConnectionIdentifier,
    xdm.target.port = to_integer(DestinationPort),
    xdm.target.ipv4 = coalesce(DestinationIPAddress_ipv4, PeerAddress_ipv4),
    xdm.target.ipv6 = coalesce(DestinationIPAddress_ipv6, PeerAddress_ipv6),
    xdm.target.url = FeedUrl,
    xdm.source.user.user_type = if(UserType = "User", XDM_CONST.USER_TYPE_REGULAR, UserType = "Host", XDM_CONST.USER_TYPE_MACHINE_ACCOUNT, UserType = null, null, to_string(UserType)),
    xdm.source.user.username = coalesce(OriginalUserName, UserName),
    xdm.source.user.ou = User_Fetch_Organizational_Unit,
    xdm.source.host.mac_addresses = arraycreate(Mac_address),
    xdm.source.host.os = OS,
    xdm.source.ipv4 = coalesce(EndpointIPAddress_ipv4, EndpointNADAddress_ipv4),
    xdm.source.ipv6 = coalesce(EndpointIPAddress_ipv6, EndpointNADAddress_ipv6),
    xdm.source.port = if(EndpointIPAddress_ipv4 = null and EndpointIPAddress_ipv6 = null, to_integer(NAS_Port), null),
    xdm.source.host.hostname = if(EndpointIPAddress_ipv4 = null and EndpointIPAddress_ipv6 = null, NetworkDeviceName, null),
    xdm.source.host.device_category = if(EndpointIPAddress_ipv4 = null and EndpointIPAddress_ipv6 = null, coalesce(Device_Type, NetworkDeviceGroups_DeviceType), null),
    xdm.intermediate.ipv4 = if(EndpointIPAddress_ipv4 != null, EndpointNADAddress_ipv4, null),
    xdm.intermediate.ipv6 = if(EndpointIPAddress_ipv6 != null, EndpointNADAddress_ipv6, null),
    xdm.intermediate.port = if(EndpointIPAddress_ipv4 != null or EndpointIPAddress_ipv6 != null, to_integer(NAS_Port), null),
    xdm.intermediate.host.hostname = if(EndpointIPAddress_ipv4 != null or EndpointIPAddress_ipv6 != null, NetworkDeviceName, null),
    xdm.intermediate.host.device_category = if(EndpointIPAddress_ipv4 != null or EndpointIPAddress_ipv6 != null, coalesce(Device_Type, NetworkDeviceGroups_DeviceType), null);