[INGEST:vendor="beyondtrust", product="passwordsafe", target_dataset="beyondtrust_passwordsafe_raw", no_hit=keep]
/* This filter supports events which include a LogTime/ChangeDt or CreatedDate timestamp fields,  
   for PBPS (PowerBroker Password Safe) agent events & AppAudit agent events, respectively. 
   The supported timestamp format for these if events is %m/%d/%Y %I:%M:%S %p. 
   Examples: ChangeDt: "1/15/2024 11:00:00 AM", LogTime: "12/30/2023 10:42:22 PM", "CreateDate: 1/22/2024 5:32:19 PM". */
filter _raw_log ~= "(?:LogTime|ChangeDt|CreateDate):\s\"?\d{1,2}\/\d{1,2}\/\d{4}\s\d{1,2}:\d{1,2}:\d{1,2}\s(?:A|P)M"
| alter tmp_raw_timestamp = arrayindex(regextract(_raw_log, "(?:LogTime|ChangeDt|CreateDate):\s\"?(\w.*?)\"?(?:,|\s{4}|\t)") , 0)
| alter _time = parse_timestamp("%m/%d/%Y %I:%M:%S %p", tmp_raw_timestamp)
| fields - tmp*;

/*  This filter is provided as a fallback for events that do not include LogTime/ChangeDt/CreateDate fields.
    It Supports RFC 5424 compatible syslog header timestamps (RFC3339 format).
    Examples: "2024-22-20T11:18:59.123Z", "2024-22-20T11:18:59Z", "2024-02-22T11:18:59.152+03:00". */
filter _raw_log !~= "LogTime|ChangeDt|CreateDate" and _raw_log ~= "\d{4}\-\d{2}\-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:[+-]\d{2}:\d{2}|Z)"
| alter tmp_raw_timestamp = arrayindex(regextract(_raw_log, "\d{4}\-\d{2}\-\d{2}T\d{2}:\d{2}:\d{2}\S+"), 0)
| alter tmp_timestamp = replace(to_string(tmp_raw_timestamp), "Z", "+00:00")
| alter _time =  parse_timestamp("%FT%H:%M:%E*S%Ez", tmp_timestamp)
| fields - tmp*;