Ycsecurity/auditlogs/export-auditlogs-to-ArcSight/arcsight_content/flex/yc.jsonparser.properties

#Yandex Cloud Cloud Trail JSON log parser
#Author: Rodion Chekharin rch@ast-security.ru

trigger.node.location=/
token.count=22

token[0].name=event_id
token[0].type=String
token[0].location=event_id

token[1].name=event_type
token[1].type=String
token[1].location=event_type

token[2].name=event_time
token[2].type=String
token[2].location=event_time

token[3].name=authentication_subject_name
token[3].type=String
token[3].location=authentication//subject_name

token[4].name=authentication_subject_id
token[4].type=String
token[4].location=authentication//subject_id

token[5].name=authentication_subject_type
token[5].type=String
token[5].location=authentication//subject_type

token[6].name=event_source
token[6].type=String
token[6].location=event_source

token[7].name=event_status
token[7].type=String
token[7].location=event_status

token[8].name=request_metadata_remote_address
token[8].type=String
token[8].location=request_metadata//remote_address

token[9].name=request_metadata_user_agent
token[9].type=String
token[9].location=request_metadata//user_agent

token[10].name=request_metadata_request_id
token[10].type=String
token[10].location=request_metadata//request_id

token[11].name=details
token[11].type=String
token[11].format=__uri()
token[11].location=details

token[12].name=authentication_authenticated
token[12].type=String
token[12].location=authentication//authenticated

token[13].name=authorization_authorized
token[13].type=String
token[13].location=authorization//authorized

token[14].name=resource_metadata
token[14].type=String
token[14].format=__uri()
token[14].location=resource_metadata

token[15].name=rm_0_resource_type
token[15].type=String
token[15].location=resource_metadata//path[0]//resource_type

token[16].name=rm_0_resource_id
token[16].type=String
token[16].location=resource_metadata//path[0]//resource_id

token[17].name=rm_0_resource_name
token[17].type=String
token[17].location=resource_metadata//path[0]//resource_name


token[18].name=rm_1_resource_type
token[18].type=String
token[18].location=resource_metadata//path[1]//resource_type

token[19].name=rm_1_resource_id
token[19].type=String
token[19].location=resource_metadata//path[1]//resource_id

token[20].name=rm_1_resource_name
token[20].type=String
token[20].location=resource_metadata//path[1]//resource_name

token[21].name=error_message
token[21].type=String
token[21].location=error//message


event.name=event_type
event.sourceUserName=authentication_subject_name
event.sourceUserId=authentication_subject_id
event.sourceUserPrivileges=authentication_subject_type
event.sourceServiceName=event_source


event.requestClientApplication=request_metadata_user_agent
event.sourceHostName=request_metadata_remote_address
event.requestContext=request_metadata_request_id

event.deviceCustomString1=details
event.deviceCustomString1Label=__stringConstant("details")

event.deviceCustomString2=resource_metadata
event.deviceCustomString2Label=__stringConstant("resource_metadata")

event.deviceCustomString3=authentication_authenticated
event.deviceCustomString3Label=__stringConstant("authenticated")

event.deviceCustomString4=authorization_authorized
event.deviceCustomString4Label=__stringConstant("authorized")

event.deviceCustomString5=event_status
event.deviceCustomString5Label=__stringConstant("event_status")

event.deviceCustomString6=error_message
event.deviceCustomString6Label=__stringConstant("error_message")

event.fileName=rm_0_resource_name
event.filePath=rm_0_resource_id
event.fileType=rm_0_resource_type

event.oldFileName=rm_1_resource_name
event.oldFilePath=rm_1_resource_id
event.oldFileType=rm_1_resource_type

event.endTime=__parseMultipleTimeStamp(__regexTokenFindAndJoin(event_time,"(.*?)T(.*?)\\..*"," ","",""),"yyyy-MM-dd HH:mm:ss")
event.externalId=event_id

event.flexString1=event_time
event.fileId=__regexTokenNoWarning(details,".*?/details/source_uri:\\"(.*?)\\?.*")

event.deviceVendor=__stringConstant("Yandex Cloud")
event.deviceProduct=__stringConstant("Yandex Cloud")