name: Vectra-Detect-QUX
fieldsToBeRemovedBeforeParsing: []
testCases:
- event:
    rawString: '<13>Jul 25 07:13:01 A21000000000248 vectra_json_v2 -: {"detection_id":
      2328, "category": "INFO", "severity": 0, "threat": 0, "certainty": 0, "d_type":
      "cm_x509_info", "d_type_vname": "Cognito - Compliance - x509 - Certificate Has
      Expired", "triaged": false, "headend_addr": "192.168.51.13", "dvchost": "x29-1-13.sc.tvec",
      "href": "https://x29-1-13.sc.tvec/detections/2328?detail_id=46179", "dd_dst_ip":
      "13.107.237.70", "dd_dst_port": 443, "dd_dst_dns": "IP-192.168.150.50", "dd_bytes_sent":
      0, "dd_bytes_rcvd": 0, "mitre": [], "host_name": "IP-192.168.150.50", "host_ip":
      "192.168.150.50", "dd_proto": "", "version": "8.6", "vectra_timestamp": "1721891581"}'
- event:
    rawString: '<13>Jul 23 18:05:39 VHEec20ce5d6f3161e29238a4c902a3e67b vectra_json_account_v2
      -: {"account_id": 15, "headend_addr": "10.11.6.11", "account_uid": "O365:jane@corp.example.com",
      "threat": 73, "certainty": 10, "quadrant": "high", "score_decreases": true,
      "privilege": null, "href": "https://54.185.139.21/accounts/15", "category":
      "ACCOUNT SCORING", "tags": [], "host_access_history": [], "service_access_history":
      [], "last_detection_type": "M365 Suspicious Power Automate Flow Creation", "version":
      "8.5", "vectra_timestamp": "1721757939"}'
- event:
    rawString: '<13>Jul 23 18:05:38 VHEec20ce5d6f3161e29238a4c902a3e67b vectra_json_account_v2
      -: {"account_id": 7, "headend_addr": "10.11.6.11", "account_uid": "O365:conrad@corp.example.com",
      "threat": 82, "certainty": 67, "quadrant": "critical", "score_decreases": true,
      "privilege": null, "href": "https://54.185.139.21/accounts/7", "category": "ACCOUNT
      SCORING", "tags": [], "host_access_history": [], "service_access_history": [],
      "last_detection_type": "M365 Ransomware", "version": "8.5", "vectra_timestamp":
      "1721757938"}'
- event:
    rawString: '<13>Jul 24 03:07:33 VHEec20ce5d63161e29238a4c902a3e67b vectra_json_vectra_match_v2
      -: {"vectra":{"orig_hostname":"piper-desktop","orig_huid":"AUzu1Kji","orig_sluid":"vst-aN4Z","resp_hostname":"","resp_huid":"","resp_sluid":"vt7--FNe","sensor_uid":"rcde9z89","sensor_name":"V564d59972a21610020cc773752cbe7b6"},"timestamp":"2024-07-24T03:07:34.905796+0000","flow_id":1916229244213483,"event_type":"alert","vlan":[199],"src_ip":"192.168.150.100","src_port":51305,"dest_ip":"192.168.55.178","dest_port":7680,"proto":"TCP","pkt_src":"wire/pcap","alert":{"action":"allowed","gid":1,"signature_id":2027766,"rev":2,"signature":"ET
      POLICY Windows Update P2P Activity","category":"Not Suspicious Traffic","severity":3,"metadata":{"created_at":["2019_07_31"],"updated_at":["2019_07_31"]}},"direction":"to_server","flow":{"pkts_toserver":3,"pkts_toclient":1,"bytes_toserver":267,"bytes_toclient":70,"start":"2024-07-24T03:07:34.904908+0000","src_ip":"192.168.150.100","dest_ip":"192.168.55.178","src_port":51305,"dest_port":7680},"payload":"DlN3YXJtIHByb3RvY29sAAAAAAAQAABSxtIyqnsI79CRuTyIjcP1N6N9UrtABLha46e2FgionSYvBNP63WRHj4kuJSR/u5UAAAAA","payload_printable":".Swarm
      protocol........R..2.{.....<....7.}R.@..Z.......&/....dG...%$.......","stream":0,"packet":"1B1x0fgRAFBWk7CJgQAAxwgARQAAc2E3QACABknmwKiWZMCoN7LIaR4AQcbmmGed9ytQGCAUJIYAAA5Td2FybSBwcm90b2NvbAAAAAAAEAAAUsbSMqp7CO/Qkbk8iI3D9TejfVK7QAS4WuOnthYIqJ0mLwTT+t1kR4+JLiUkf7uVAAAAAA==","packet_info":{"linktype":1}}'
- event:
    rawString: '<13>Jul 24 03:09:59 VHEec20ce5d6f3161e29238a4c902a3e67b vectra_json_v2
      -: {"proxied_dst": null, "detection_id": 325, "category": "EXFILTRATION", "severity":
      7.1, "threat": 71, "certainty": 48, "d_type": "smuggler", "d_type_vname": "Data
      Smuggler", "triaged": false, "headend_addr": "10.11.6.11", "dvchost": "54.185.139.21",
      "href": "https://54.185.139.21/detections/325?detail_id=3415", "dd_dst_ip":
      "192.168.60.4", "dd_dst_port": 445, "dd_dst_dns": "", "dd_bytes_sent": 199119,
      "dd_bytes_rcvd": 786614643, "mitre": ["T1020", "T1002", "T1022", "T1030", "T1048",
      "T1074", "T1039"], "host_name": "IP-192.168.40.32", "host_ip": "192.168.40.32",
      "dd_proto": "tcp", "version": "8.5", "vectra_timestamp": "1721790599"}'
- event:
    rawString: '<109>Jul 23 22:12:05 VHEec2d45a9c082b693bff2c73189335341 vectra_json_audit
      -: {"user": "SAML:rsweet@vectra.ai", "role": "Admin", "source_ip": "44.231.206.230",
      "headend_addr": "10.11.6.10", "dvchost": "54.184.25.172", "result": "success",
      "message": "log in", "version": "8.5", "vectra_timestamp": "1721772725"}'
- event:
    rawString: |
      <13>Jul 23 21:39:14 VHEec2d45a9c082b693bff2c73189335341 vectra_json_v2 -: {"host_id": 499, "headend_addr": "10.11.6.10", "host_name": "IP-192.168.40.32", "dvchost": "54.184.25.172", "host_ip": "192.168.40.32", "threat": 74, "certainty": 81, "privilege": 0, "score_decreases": false, "href": "https://54.184.25.172/hosts/499", "host_roles": "", "src_key_asset": false, "dst_key_asset": false, "category": "HOST SCORING", "quadrant": "critical", "sensor": "V421365856FD0434DF521D2FED22BE08E", "detection_profile": {"name": "external_adversary", "vname": "External Adversary", "scoringDetections": ["Data Smuggler", "Hidden HTTPS Tunnel (C&C)", "RPC Targeted Recon"]}, "host_groups": [], "tags": [], "account_access_history": [{"id": 7, "uid": "johnh@lab.tme.local", "privilege": null, "privilegeCategory": null, "lastSeen": "2024-07-20T03:13:11+00:00"}], "service_access_history": [{"id": 17, "uid": "http/win-fs-02.lab.tme.local@lab.tme.local", "privilege": null, "privilegeCategory": null, "lastSeen": "2024-07-20T03:13:11+00:00"}, {"id": 12, "uid": "krbtgt/lab.tme.local@lab.tme.local", "privilege": null, "privilegeCategory": null, "lastSeen": "2024-07-20T03:13:04+00:00"}, {"id": 11, "uid": "cifs/win-fs-02.lab.tme.local@lab.tme.local", "privilege": null, "privilegeCategory": null, "lastSeen": "2024-07-20T03:13:04+00:00"}], "mac_address": null, "mac_vendor": null, "last_detection_type": "RPC Targeted Recon", "version": "8.5", "vectra_timestamp": "1721770754"}
- event:
    rawString: |
      <13>Jul 23 22:44:59 A21000000000354 vectra_json_v2 -: {"host_id": 4128, "headend_addr": "192.168.52.37", "host_name": "IP-192.168.30.189", "dvchost": "x29-1-37.sc.tvec", "host_ip": "192.168.30.189", "threat": 28, "certainty": 28, "privilege": 0, "score_decreases": false, "href": "https://x29-1-37.sc.tvec/hosts/4128", "host_roles": "", "src_key_asset": false, "dst_key_asset": false, "category": "HOST SCORING", "quadrant": "low", "sensor": "V4213a6b39d614b2a8fd7385b47db8156", "detection_profile": {"name": "discovery", "vname": "IT Discovery", "scoringDetections": ["Port Sweep"]}, "host_groups": [], "tags": [], "account_access_history": [{"id": 1, "uid": "johnh@lab.tme.local", "privilege": null, "privilegeCategory": null, "lastSeen": "2024-07-11T03:12:35+00:00"}], "service_access_history": [{"id": 3, "uid": "http/win-fs-02.lab.tme.local@lab.tme.local", "privilege": null, "privilegeCategory": null, "lastSeen": "2024-07-11T03:12:35+00:00"}, {"id": 1, "uid": "krbtgt/lab.tme.local@lab.tme.local", "privilege": null, "privilegeCategory": null, "lastSeen": "2024-07-11T03:12:29+00:00"}, {"id": 2, "uid": "cifs/win-fs-02.lab.tme.local@lab.tme.local", "privilege": null, "privilegeCategory": null, "lastSeen": "2024-07-11T03:12:29+00:00"}], "mac_address": null, "mac_vendor": null, "last_detection_type": "Port Sweep", "version": "8.6", "vectra_timestamp": "1721774699"}
- event:
    rawString: '<109>Jul 23 23:01:25 VHEec2d45a9c082b693bff2c73189335341 vectra_json_audit
      -: {"user": null, "role": null, "source_ip": "44.231.206.230", "headend_addr":
      "10.11.6.10", "dvchost": "54.184.25.172", "result": "failure", "message": "invalid
      authentication token ''fc80********'' used for API request", "version": "8.5",
      "vectra_timestamp": "1721775685"}'
$schema: https://schemas.humio.com/parser/v0.3.0
script: |2-

  // Vectra AI Detect for On-premise
  //



  regex("vectra_json_(?<syslog_header>\S+) -: (?<jsonContent>{.+})$") |
  parseJson(prefix="Vendor.", removePrefixes="[0].events[0].attributes.", excludeEmpty=true, handleNull=discard, field=jsonContent)

  /************************************************************
  ****** Static Metadata Definitions
  ************************************************************/

  | Parser.version:="1.0.0"
  | Cps.version := "1.0.0"
  | Vendor:="vectra"
  | event.module := "quadrant-ux"
  | ecs.version:="8.11.0"
  | event.kind:="event"



  //Normalization for categorization
  | case {
          syslog_header = "audit"
                  | event.category[0] := "network"
                  | Vendor.category:="audit"
                  | event.dataset := "quadrant-ux.audit";
          syslog_header = "health"
                  | event.category:="health"
                  | Vendor.category := "health"
                  | event.dataset := "quadrant-ux.health";
          syslog_header = "campaigns"
                  | event.category := "campaigns"
                  | Vendor.category := "campaigns"
                  | event.dataset := "quadrant-ux.campaigns";
          Vendor.category = "HOST_LOCKDOWN"
                  | event.category[0] := "host"
                  | lower(Vendor.category, as="Vendor.category")
                  | event.dataset := "quadrant-ux.lockdown"
                  //Host normalization
                  | host.hostname := rename(Vendor.host_name)
                  | host.ip := rename(Vendor.source_ip);
          Vendor.category = "LOCKDOWN"
                  | event.category[0] := "iam"
                  | lower(Vendor.category, as="Vendor.category")
                  | event.dataset := "quadrant-ux.lockdown";
          Vendor.category = "HOST SCORING"
                  | event.category[0] := "host"
                  | event.dataset := "quadrant-ux.scoring"
                  | lower(Vendor.category, as="Vendor.category")
                  //Host normalization
                  | host.hostname := rename(Vendor.host_name)
                  | host.ip := rename(Vendor.host_ip)
                  | host.type := rename(Vendor.host.type)
                  | host.mac := rename(Vendor.mac_address)
                  //Risk information
                  | host.risk.calculated_level := Vendor.quadrant
                  | host.risk.calculated_score_norm := Vendor.threat;
          Vendor.category = "ACCOUNT SCORING"
                  | event.category[0] := "iam"
                  | event.dataset := "quadrant-ux.scoring"
                  | lower(Vendor.category, as="Vendor.category")
                  //User normalization
                  | user.name := rename(Vendor.account_uid)
                  //Risk information
                  | user.risk.calculated_level := Vendor.quadrant
                  | user.risk.calculated_score_norm := Vendor.threat;
          syslog_header = "account_detection"
                  | Vendor.category := "account detection"
                  | event.kind := "alert"
                  | event.category[0] := "threat"
                  | event.category[1] := "network"
                  | event.type[0] := "indicator"
                  | event.dataset := "quadrant-ux.detections"
                  //| event.module := "ai-models"
                  //User normalization
                  | user.name := rename(Vendor.account_name)
                  // threat
                  | threat.technique.name[0] := Vendor.d_type_vname
                  //severity
                  | case {
                          Vendor.certainty < 50 and Vendor.threat < 50
                                  | event.severity := "20"
                                  | threat.enrichments.indicator.confidence := "Low";
                          Vendor.certainty >= 50 and Vendor.threat < 50
                                  | event.severity := "50"
                                  | threat.enrichments.indicator.confidence := "Medium";
                          Vendor.certainty < 50 and Vendor.threat >= 50
                                  | event.severity := "70"
                                  | threat.enrichments.indicator.confidence := "High";
                          Vendor.certainty >= 50 and Vendor.threat >= 50
                                  | event.severity := "90"
                                  | threat.enrichments.indicator.confidence := "High";
                          *
                          };
          syslog_header = "v2"
                  | Vendor.tactics := category
                  | Vendor.category := "host detection"
                  | event.kind := "alert"
                  | event.category[0] := "threat"
                  | event.category[1] := "network"
                  | event.type[0] := "indicator"
                  | event.dataset := "quadrant-ux.detections"
                  //| event.module := "ai-models"
                  //Host normalization
                  | host.hostname := rename(Vendor.host_name)
                  | host.ip := rename(Vendor.host_ip)
                  // Source normalization
                  | source.ip := rename(Vendor.host_ip)
                  | source.bytes := rename(Vendor.dd_bytes_sent)
                  // Destination normalization
                  | destination.ip := rename(Vendor.dd_dst_ip)
                  | destination.port := rename(Vendor.dd_dst_port)
                  | destination.bytes := rename(Vendor.dd_bytes_rcvd)
                  //Network normalization
                  | network.transport := rename(Vendor.dd_proto)
                  // it does not look like it can handle mutliple TTP. mapping technique.name to our detection for now
                  | case {
                          Vendor.mitre[0] = *
                                  | Vendor.mitre[0] =~ match("epp/lookups/MitreMappings-ecs.csv", column="threat.technique.id[0]", mode=glob, ignoreCase=true, strict=false)
                                  | case {
                                  threat.framework = *
                                          | array:append(array="__techId[]", values=[Vendor.mitre[0]])
                                          | array:append(array="__techName[]", values=[threat.technique.name[0]])
                                          | array:append(array="__techRef[]", values=[threat.technique.reference[0]])
                                          | array:append(array="__tacticId[]", values=[threat.tactic.id[0]])
                                          | array:append(array="__tacticName[]", values=[threat.tactic.name[0]])
                                          | __tr := format("https://attack.mitre.org/tactics/%s", field=threat.tactic.id[0])
                                          | array:append(array="__tacticRef[]", values=[__tr]);
                                  *;
                                  }
                                  | drop(threat.framework);
                          *;
                  }
                  | case {
                  Vendor.mitre[1] = *
                          | Vendor.mitre[1] =~ match("epp/lookups/MitreMappings-ecs.csv", column=threat.technique.id[0], ignoreCase=true, strict=false)
                          | case {
                          threat.framework = *
                                  | array:append(array="__techId[]", values=[Vendor.mitre[1]])
                                  | array:append(array="__techName[]", values=[threat.technique.name[0]])
                                  | array:append(array="__techRef[]", values=[threat.technique.reference[0]])
                                  | array:append(array="__tacticId[]", values=[threat.tactic.id[0]])
                                  | array:append(array="__tacticName[]", values=[threat.tactic.name[0]])
                                  | __tr := format("https://attack.mitre.org/tactics/%s", field=threat.tactic.id[0])
                                  | array:append(array="__tacticRef[]", values=[__tr]);
                          }
                          | drop(threat.framework);
                  *;
                  }
                  | case {
                  Vendor.mitre[2] = *
                          | Vendor.mitre[2] =~ match("epp/lookups/MitreMappings-ecs.csv", column=threat.technique.id[0], ignoreCase=true, strict=false)
                          | case {
                          threat.framework = *
                                  | array:append(array="__techId[]", values=[Vendor.mitre[2]])
                                  | array:append(array="__techName[]", values=[threat.technique.name[0]])
                                  | array:append(array="__techRef[]", values=[threat.technique.reference[0]])
                                  | array:append(array="__tacticId[]", values=[threat.tactic.id[0]])
                                  | array:append(array="__tacticName[]", values=[threat.tactic.name[0]])
                                  | __tr := format("https://attack.mitre.org/tactics/%s", field=threat.tactic.id[0])
                                  | array:append(array="__tacticRef[]", values=[__tr]);
                          }
                          | drop(threat.framework);
                  *;
                  }
                  | case {
                  Vendor.mitre[3] = *
                          | Vendor.mitre[3] =~ match("epp/lookups/MitreMappings-ecs.csv", column=threat.technique.id[0], ignoreCase=true, strict=false)
                          | case {
                          threat.framework = *
                                  | array:append(array="__techId[]", values=[Vendor.mitre[3]])
                                  | array:append(array="__techName[]", values=[threat.technique.name[0]])
                                  | array:append(array="__techRef[]", values=[threat.technique.reference[0]])
                                  | array:append(array="__tacticId[]", values=[threat.tactic.id[0]])
                                  | array:append(array="__tacticName[]", values=[threat.tactic.name[0]])
                                  | __tr := format("https://attack.mitre.org/tactics/%s", field=threat.tactic.id[0])
                                  | array:append(array="__tacticRef[]", values=[__tr]);
                          }
                          | drop(threat.framework);
                  *;
                  }
                  | case {
                  Vendor.mitre[4] = *
                          | Vendor.mitre[4] =~ match("epp/lookups/MitreMappings-ecs.csv", column=threat.technique.id[0], ignoreCase=true, strict=false)
                          | case {
                          threat.framework = *
                                  | array:append(array="__techId[]", values=[Vendor.mitre[4]])
                                  | array:append(array="__techName[]", values=[threat.technique.name[0]])
                                  | array:append(array="__techRef[]", values=[threat.technique.reference[0]])
                                  | array:append(array="__tacticId[]", values=[threat.tactic.id[0]])
                                  | array:append(array="__tacticName[]", values=[threat.tactic.name[0]])
                                  | __tr := format("https://attack.mitre.org/tactics/%s", field=threat.tactic.id[0])
                                  | array:append(array="__tacticRef[]", values=[__tr]);
                          }
                          | drop(threat.framework);
                  *;
                  }
                  | case {
                  Vendor.mitre[5] = *
                          | Vendor.mitre[5] =~ match("epp/lookups/MitreMappings-ecs.csv", column=threat.technique.id[0], ignoreCase=true, strict=false)
                          | case {
                          threat.framework = *
                                  | array:append(array="__techId[]", values=[Vendor.mitre[5]])
                                  | array:append(array="__techName[]", values=[threat.technique.name[0]])
                                  | array:append(array="__techRef[]", values=[threat.technique.reference[0]])
                                  | array:append(array="__tacticId[]", values=[threat.tactic.id[0]])
                                  | array:append(array="__tacticName[]", values=[threat.tactic.name[0]])
                                  | __tr := format("https://attack.mitre.org/tactics/%s", field=threat.tactic.id[0])
                                  | array:append(array="__tacticRef[]", values=[__tr]);
                          }
                          | drop(threat.framework);
                  *;
                  }
                  | case {
                  Vendor.mitre[6] = *
                          | Vendor.mitre[6] =~ match("epp/lookups/MitreMappings-ecs.csv", column=threat.technique.id[0], ignoreCase=true, strict=false)
                          | case {
                          threat.framework = *
                                  | array:append(array="__techId[]", values=[Vendor.mitre[6]])
                                  | array:append(array="__techName[]", values=[threat.technique.name[0]])
                                  | array:append(array="__techRef[]", values=[threat.technique.reference[0]])
                                  | array:append(array="__tacticId[]", values=[threat.tactic.id[0]])
                                  | array:append(array="__tacticName[]", values=[threat.tactic.name[0]]);
                          }
                          | drop(threat.framework);
                  *;
                  }
                  | case {
                  Vendor.mitre[7] = *
                          | Vendor.mitre[7] =~ match("epp/lookups/MitreMappings-ecs.csv", column=threat.technique.id[0], ignoreCase=true, strict=false)
                          | case {
                          threat.framework = *
                                  | array:append(array="__techId[]", values=[Vendor.mitre[7]])
                                  | array:append(array="__techName[]", values=[threat.technique.name[0]])
                                  | array:append(array="__techRef[]", values=[threat.technique.reference[0]])
                                  | array:append(array="__tacticId[]", values=[threat.tactic.id[0]])
                                  | array:append(array="__tacticName[]", values=[threat.tactic.name[0]])
                                  | __tr := format("https://attack.mitre.org/tactics/%s", field=threat.tactic.id[0])
                                  | array:append(array="__tacticRef[]", values=[__tr]);
                          }
                          | drop(threat.framework);
                  *;
                  }
                  | case {
                  Vendor.mitre[8] = *
                          | Vendor.mitre[8] =~ match("epp/lookups/MitreMappings-ecs.csv", column=threat.technique.id[0], ignoreCase=true, strict=false)
                          | case {
                          threat.framework = *
                                  | array:append(array="__techId[]", values=[Vendor.mitre[8]])
                                  | array:append(array="__techName[]", values=[threat.technique.name[0]])
                                  | array:append(array="__techRef[]", values=[threat.technique.reference[0]])
                                  | array:append(array="__tacticId[]", values=[threat.tactic.id[0]])
                                  | array:append(array="__tacticName[]", values=[threat.tactic.name[0]])
                                  | __tr := format("https://attack.mitre.org/tactics/%s", field=threat.tactic.id[0])
                                  | array:append(array="__tacticRef[]", values=[__tr]);
                          }
                          | drop(threat.framework);
                  *;
                  }
                  | case {
                  Vendor.mitre[9] = *
                          | Vendor.mitre[9] =~ match("epp/lookups/MitreMappings-ecs.csv", column=threat.technique.id[0], ignoreCase=true, strict=false)
                          | case {
                          threat.framework = *
                                  | array:append(array="__techId[]", values=[Vendor.mitre[9]])
                                  | array:append(array="__techName[]", values=[threat.technique.name[0]])
                                  | array:append(array="__techRef[]", values=[threat.technique.reference[0]])
                                  | array:append(array="__tacticId[]", values=[threat.tactic.id[0]])
                                  | array:append(array="__tacticName[]", values=[threat.tactic.name[0]])
                                  | __tr := format("https://attack.mitre.org/tactics/%s", field=threat.tactic.id[0])
                                  | array:append(array="__tacticRef[]", values=[__tr]);
                          }
                          | drop(threat.framework);
                  *;
                  }
                  | case {
                  Vendor.mitre[10] = *
                          | Vendor.mitre[10] =~ match("epp/lookups/MitreMappings-ecs.csv", column=threat.technique.id[0], ignoreCase=true, strict=false)
                          | case {
                          threat.framework = *
                                  | array:append(array="__techId[]", values=[Vendor.mitre[10]])
                                  | array:append(array="__techName[]", values=[threat.technique.name[0]])
                                  | array:append(array="__techRef[]", values=[threat.technique.reference[0]])
                                  | array:append(array="__tacticId[]", values=[threat.tactic.id[0]])
                                  | array:append(array="__tacticName[]", values=[threat.tactic.name[0]])
                                  | __tr := format("https://attack.mitre.org/tactics/%s", field=threat.tactic.id[0])
                                  | array:append(array="__tacticRef[]", values=[__tr]);
                          }
                          | drop(threat.framework);
                  *;
                  }

                  | __techId := concatArray("__techId", separator=",")
                  | __techName := concatArray("__techName", separator=",")
                  | __techRef := concatArray("__techRef", separator=",")
                  | __tacticId := concatArray("__tacticId", separator=",")
                  | __tacticName := concatArray("__tacticName", separator=",")
                  | __tacticRef := concatArray("__tacticRef", separator=",")
                  | array:filter("__techId[]",var="v",function={false})
                  | array:filter("__techName[]",var="v",function={false})
                  | array:filter("__techRef[]",var="v",function={false})
                  | array:filter("__tacticId[]",var="v",function={false})
                  | array:filter("__tacticName[]",var="v",function={false})
                  | array:filter("__tacticRef[]",var="v",function={false})
                  | threat.technique.id := splitString(by=",", __techId) // nolint: array-check, ignoring b/c split into array
                  | threat.technique.name := splitString(by=",", __techName) // nolint: array-check, ignoring b/c split into array
                  | threat.technique.reference := splitString(by=",", __techRef) // nolint: array-check, ignoring b/c split into array
                  | threat.tactic.id := splitString(by=",", __tacticId) // nolint: array-check, ignoring b/c split into array
                  | threat.tactic.name := splitString(by=",", __tacticName) // nolint: array-check, ignoring b/c split into array
                  | threat.tactic.reference := splitString(by=",", __tacticRef) // nolint: array-check, ignoring b/c split into array

                  // override detection name for unified detection view
                  | threat.technique.name[0] := Vendor.d_type_vname
                  //severity
                  | case {
                          Vendor.certainty < 50 and Vendor.threat < 50
                                  | event.severity := "20"
                                  | threat.enrichments.indicator.confidence := "Low";
                          Vendor.certainty >= 50 and Vendor.threat < 50
                                  | event.severity := "50"
                                  | threat.enrichments.indicator.confidence := "Medium";
                          Vendor.certainty < 50 and Vendor.threat >= 50
                                  | event.severity := "70"
                                  | threat.enrichments.indicator.confidence := "High";
                          Vendor.certainty >= 50 and Vendor.threat >= 50
                                  | event.severity := "90"
                                  | threat.enrichments.indicator.confidence := "High";
                          *
                          };
          syslog_header = "vectra_match_v2"
                  | Vendor.category:="match"
                  | event.kind := "alert"
                  | event.category[0] := "intrusion_detection"
                  | event.category[1] := "network"
                  // override module name to easily filters AI based detection versus Match in the unified detection view
                  | event.module := "qux-ids"
                  //Host normalization
                  | host.hostname := rename(Vendor.vectra.orig_hostname)
                  | host.ip := rename(Vendor.src_ip)
                  // Source normalization
                  | source.ip := rename(Vendor.src_ip)
                  | source.address := rename(Vendor.src_ip)
                  | source.port := rename(Vendor.src_port)
                  | source.bytes := rename(Vendor.flow.bytes_toserver)
                  | source.packets := rename(Vendor.flow.pkts_toserver)
                  // Destination normalization
                  | destination.ip := rename(Vendor.dest_ip)
                  | destination.address := rename(Vendor.dest_ip)
                  | destination.port := rename(Vendor.dest_port)
                  | destination.bytes := rename(Vendor.flow.bytes_toclient)
                  | destination.packets := rename(Vendor.flow.pkts_toclient)
                  //Network normalization
                  | network.transport := rename(Vendor.proto)
                  //threat
                  | threat.technique.name[0] := Vendor.alert.signature;
    *
  }

  | Vendor.category match {
          in(values=["audit", "health", "detection", "host scoring", "host detection", "account detection", "account scoring" ]) =>
                  parseTimestamp("unixTimeSeconds", field=Vendor.vectra_timestamp, timezone="Etc/UTC");

          //"match" => parseTimestamp(field=timestamp);
          * => * ;
  }

  | Vendor.category match {
          in(values=["audit", "health", "detection", "host scoring", "host detection", "account detection", "account scoring" ]) =>
                  parseTimestamp("unixTimeSeconds", field=Vendor.vectra_timestamp, timezone="Etc/UTC");

          //"match" => parseTimestamp(field=timestamp) | test := "aaa";
          * => * ;
  }

  // We no longer need the jsonContent & syslog_header fields. (Don't include them in the event's fields)
  | drop([jsonContent, syslog_header])
tagFields:
- Cps.version
- Vendor
- ecs.version
- event.dataset
- event.kind
- event.module
- event.outcome
- observer.type
