Updated 2020-08-27

=__BASE64Decode
=__LOOKUP
=__byteArrayToIPv6
=__byteArrayToIPv6String
=__collection
=__concatenate
=__concatenateDeleting
=__createGMTTimeStamp
=__createLocalTimeStampFromGMT
=__createLocalTimeStampFromGMTSecondsMillis
=__createLocalTimeStampFromNTP
=__createLocalTimeStampFromNanoSeconds
=__createLocalTimeStampFromSecondsMicrosZone
=__createLocalTimeStampFromSecondsSinceEpoch
=__createLocalTimeStampStringFromGMTMilliseconds
=__createLocalTimeStampStringFromLocalMilliseconds
=__createOptionalTimeStampFromString
=__createSafeLocalTimeStamp
=__createTimeStamp
=__createTimeStampByHexEncodedTime
=__createTimeStampByStartTimeElapsed
=__createTimeStampForOpsecStartTime
=__doubleToAddress
=__extractNTDomain
=__extractNTUser
=__extractProtocol
=__foundScanHostName
=__getCEFSeverity
=__getDeviceDirection
=__getIpV6AddressFromHighLow
=__getIronMailActions
=__getIronMailAlertImpact
=__getIronMailEventStatus
=__getLongMACAddressByHexString
=__getLongMACAddressByString
=__getManhuntPriority
=__getNormalizedOS
=__getNotZeroPort
=__getOriginator
=__getOriginatorFromSourcePort
=__getProtocolName
=__getProtocolNameFromString
=__getSymantecNSPriority
=__getTimeZone
=__getTrendMicroHostName
=__getTrendMircoUser
=__getType
=__getVendor
=__getVulnerabilityCategory
=__getXForceStringFor
=__hexStringToAddress
=__hexStringToIPV6Address
=__hexStringToLong
=__hexStringToString
=__hourMinuteSecondsToSeconds
=__ifAorBThenElse
=__ifGreaterOrEqual
=__ifThenElse
=__ifThenElseAddress
=__ifTrueThenElse
=__ignoreZeroIp
=__ignoreZeroMac
=__integerConstant
=__integerToAddressMcAfee
=__integerToLong
=__length
=__longToDot4QuadAddress
=__longToInteger
=__longToString
=__longToTimeStamp
=__mazuProfilerDestinationAddress
=__multilineRegexToken
=__noDot4QuadStringsToAddress
=__numberToAddress
=__oneOf
=__oneOfAddress
=__oneOfDateTime
=__oneOfHostName
=__oneOfInteger
=__oneOfLong
=__oneOfMac
=__oneOfNetBIOSName
=__parseMultipleTimeStamp
=__parseMutableTimeStamp
=__parseMutableTimeStampSilently
=__parseSignedLong
=__regexToken
=__regexTokenAsAddress
=__regexTokenAsInteger
=__regexTokenAsLong
=__regexTokenFindAndJoin
=__regexTokenNoWarning
=__replaceAll
=__replaceFirst
=__safeToDate
=__safeToDouble
=__safeToInteger
=__safeToLong
=__safeToRoundedLong
=__setYearToCurrentYear
=__signedNumberToAddress
=__simpleMap
=__split
=__splitAsAddress
=__splitAsInteger
=__stringConstant
=__stringToIPv6Address
=__stringTrim
=__subParse
=__sum
=__toGMTTimeStamp
=__toHex
=__toLocalTimeStamp
=__toLongTimeStamp
=__toLowerCase
=__toUpperCase
=__uri
=__useCurrentYear
=__variableTypeToAddress
=__verifyHexString

Examples
event.deviceCustomString3=__BASE64Decode(fromAttacker)
event.deviceCustomString4=__BASE64Decode(fromVictim)
event.deviceCustomString3=__BASE64Decode(fromAttacker)
event.deviceCustomString4=__BASE64Decode(__oneOf(fromTarget,contextFromTarget))
event.deviceCustomString3=__BASE64Decode(fromAttacker)

token[1].format=__LOOKUP(datablock,${BlockType})
token[1].format=__LOOKUP(datablock2,${BlockType})
token[4].format=__LOOKUP(record,${RecordType})
token[2].format=__LOOKUP(record,${RecordType})
token[10].format=__LOOKUP(rna-event-2.0,${EventType},${EventSubtype})

event.deviceCustomString2=__byteArrayToIPv6String(sourceIPv6)
event.deviceCustomString3=__byteArrayToIPv6String(targetIPv6)
event.deviceCustomIPv6Address2=__byteArrayToIPv6(sourceIPv6)
event.deviceCustomIPv6Address3=__byteArrayToIPv6(targetIPv6)
event.deviceCustomIPv6Address3=__byteArrayToIPv6(IPV6)

event.deviceCustomString2=__byteArrayToIPv6String(sourceIPv6)
event.deviceCustomString3=__byteArrayToIPv6String(targetIPv6)
event.deviceCustomString2=__byteArrayToIPv6String(ThreatSourceIPv6)
event.deviceCustomString3=__byteArrayToIPv6String(IPv6)
event.deviceCustomString2=__byteArrayToIPv6String(ThreatSourceIPv6)

token[1].format=__collection(Name,false,false)

event.deviceCustomString1=__concatenate(inode,rest)
event.message=__concatenate(mergedevent.message,__concatenate(inode,rest))
event.deviceEventClassId=__concatenate(EventSource,":",EventID)
conditionalmap[4].mappings[0].event.deviceCustomString6=__concatenate(Target Domain,"\\",Target Account Name)
conditionalmap[4].mappings[1].event.deviceCustomString6=__concatenate(New Domain,"\\",New Account Name)

extra.queries[0].event.deviceEventClassId=__concatenateDeleting("AppDetective=",CheckID,"#",CheckName,"#",Risk,"#","::Description:: ",VulnerabilityDescription," ::Solution:: ",Fix,"%CVE=",CVEReference,"%|#=/@*")
extra.queries[0].event.deviceEventClassId=__concatenateDeleting("Nessus=",naslId,"#",PluginName,"#",naslRisk,"#",vulnName,"%|#=/@")
extra.queries[0].event.deviceEventClassId=__concatenateDeleting("Faultline=",FaultlineID,"#",Name,"#",Risk,"#","::Description:: ",Description," ::Observation:: ",Observation," ::RiskText:: ",RiskText," ::Recommendation:: ",Recommendation,"%CVE=",CVE,"%Bugtraq=",BID,"%X-Force=",ISSID,"%|#=/@")
extra.queries[0].event.deviceEventClassId=__concatenateDeleting("Faultline=",FaultlineID,"#",Name,"#",Risk,"#","::Description:: ",Description," ::Observation:: ",Observation," ::RiskText:: ",RiskText," ::Recommendation:: ",Recommendation,"%CVE=",CVE,"%|#=/@")
extra.queries[0].event.deviceEventClassId=__concatenateDeleting("Faultline=",FaultlineID,"#",VulnName,"#",Risk,"#","::Description:: ",VulnDescription," ::Observation:: ",Observation," ::RiskText:: ",RiskText," ::Recommendation:: ",Recommendation,"%CVE=",CVE,"%|#=/@")

event.detectTime=__createGMTTimeStamp(Date,Time)
event.detectTime=__createGMTTimeStamp(LocalDatestamp,LocalTimestamp)
event.detectTime=__createGMTTimeStamp(LocalDatestamp,LocalTimestamp)
event.deviceReceiptTime=__createGMTTimeStamp(date,time)
event.deviceReceiptTime=__createGMTTimeStamp(LocalDatestamp,LocalTimestamp)

event.deviceReceiptTime=__createLocalTimeStampFromGMT(GMTDatestamp,GMTTimestamp)
event.detectTime=__createLocalTimeStampFromGMT(GMTDatestamp,GMTTimestamp)
event.deviceReceiptTime=__createLocalTimeStampFromGMT(date,time)
event.deviceReceiptTime=__createLocalTimeStampFromGMT(date,time)
event.deviceReceiptTime=__createLocalTimeStampFromGMT(date,time)

event.detectTime=__createLocalTimeStampFromGMTSecondsMillis(tv_sec,tv_usec)

event.deviceReceiptTime=__createLocalTimeStampFromNTP(sidaAlertTimeStamp)
event.deviceReceiptTime=__createLocalTimeStampFromNTP(sidaAlertTimeStamp)

event.deviceReceiptTime=__createLocalTimeStampFromNanoSeconds(time)
event.deviceReceiptTime=__createLocalTimeStampFromNanoSeconds(time)
event.deviceReceiptTime=__createLocalTimeStampFromNanoSeconds(time)
event.deviceReceiptTime=__createLocalTimeStampFromNanoSeconds(time)
event.deviceReceiptTime=__createLocalTimeStampFromNanoSeconds(time)

event.deviceReceiptTime=__createLocalTimeStampFromSecondsMicrosZone(SECONDS,MSECONDS,null)
event.startTime=__createLocalTimeStampFromSecondsMicrosZone(STARTTIME,null,null)
event.endTime=__createLocalTimeStampFromSecondsMicrosZone(STOPTIME,null,null)
event.deviceReceiptTime=__createLocalTimeStampFromSecondsMicrosZone(__hexStringToLong(__regexToken(timeStamp,"(0x.{8}).*")),__hexStringToLong(__regexToken(timeStamp,"0x.{8}(.*)")),"GMT")
event.deviceReceiptTime=__createLocalTimeStampFromSecondsMicrosZone(Timestamp,0,)

event.deviceCustomDate1=__createLocalTimeStampFromSecondsSinceEpoch(start_time)
event.deviceCustomDate2=__createLocalTimeStampFromSecondsSinceEpoch(stop_time)
event.deviceReceiptTime=__createLocalTimeStampFromSecondsSinceEpoch(Timestamp)
event.startTime=__createLocalTimeStampFromSecondsSinceEpoch(__safeToLong(Start))
event.endTime=__createLocalTimeStampFromSecondsSinceEpoch(__safeToLong(End))

extra.queries[0].event.deviceCustomString3=__createLocalTimeStampStringFromGMTMilliseconds(TimeResolved)
extra.queries[0].event.deviceCustomString4=__createLocalTimeStampStringFromGMTMilliseconds(LastModified)
extra.queries[0].event.deviceCustomString5=__createLocalTimeStampStringFromGMTMilliseconds(TimeRaised)

event.customString6=__createLocalTimeStampStringFromLocalMilliseconds(CollectionTime)

submessage[11].pattern[1].extramappings=event.deviceCustomString1=__stringConstant("done")|event.deviceCustomDate2=__createOptionalTimeStampFromString($5,"yyyy-MM-dd HH:mm:ss zzz")|event.deviceCustomString6Label=__stringConstant("Managed Object")|event.deviceCustomNumber2Label=__stringConstant("Duration")
submessage[12].pattern[1].extramappings=event.deviceCustomString1=__stringConstant("done")|event.deviceCustomDate2=__createOptionalTimeStampFromString($5,"yyyy-MM-dd HH:mm:ss zzz")|event.deviceCustomString6Label=__stringConstant("Managed Object")|event.deviceCustomNumber2Label=__stringConstant("Duration")
submessage[13].pattern[1].extramappings=event.deviceCustomString1=__stringConstant("done")|event.deviceCustomDate2=__createOptionalTimeStampFromString($4,"yyyy-MM-dd HH:mm:ss zzz")|event.deviceCustomString6Label=__stringConstant("Managed Object")
submessage[14].pattern[1].extramappings=event.deviceCustomString1=__stringConstant("done")|event.deviceCustomDate2=__createOptionalTimeStampFromString($4,"yyyy-MM-dd HH:mm:ss zzz")|event.deviceCustomString6Label=__stringConstant("Managed Object")
submessage[15].pattern[1].extramappings=event.deviceCustomString1=__stringConstant("done")|event.deviceCustomDate2=__createOptionalTimeStampFromString($1,"yyyy-MM-dd HH:mm:ss zzz")

conditionalmap[17].mappings[0].event.deviceCustomDate1=__createSafeLocalTimeStamp(__ifThenElse(__regexToken(Previous Date,"(\\d+/\\d+/\\d+)"),,Previous Time,__concatenate(Previous Time," ",Previous Date)),"hh:mm:ss aa MM/dd/yyyy")
conditionalmap[18].mappings[0].event.deviceCustomDate2=__createSafeLocalTimeStamp(__ifThenElse(__regexToken(New Date,"(\\d+/\\d+/\\d+)"),,New Time,__concatenate(New Time," ",New Date)),"hh:mm:ss aa MM/dd/yyyy")
event.deviceReceiptTime=__createSafeLocalTimeStamp(__regexToken(eventTime,"(.*)Z"),"yyyy-MM-dd'T'HH\:mm\:ss")
extra.queries[0].event.deviceReceiptTime=__createSafeLocalTimeStamp(StartTime,"yyyyMMddHHmmss")
extra.queries[1].event.deviceReceiptTime=__createSafeLocalTimeStamp(StartTime,"yyyyMMddHHmmss")

event.deviceReceiptTime=__createTimeStamp(Date,Time)
event.deviceReceiptTime=__createTimeStamp(Date,Time)
event.deviceReceiptTime=__createTimeStamp(Date,Time)
event.deviceReceiptTime=__createTimeStamp(Date,Time)
event.deviceReceiptTime=__createTimeStamp(Date,Time)

event.deviceReceiptTime=__createTimeStampByHexEncodedTime(HexEncodedTime)
event.deviceReceiptTime=__createTimeStampByHexEncodedTime(HexEncodedTime)
event.deviceReceiptTime=__createTimeStampByHexEncodedTime(HexEncodedTime)

event.endTime=__createTimeStampByStartTimeElapsed(start_time,elapsed)
event.endTime=__createTimeStampByStartTimeElapsed(start_time,elapsed)
event.endTime=__createTimeStampByStartTimeElapsed(start_time,elapsed)

event.startTime=__createTimeStampForOpsecStartTime(start_time)
event.startTime=__createTimeStampForOpsecStartTime(start_time)
event.deviceReceiptTime=__createTimeStampForOpsecStartTime(time)
event.deviceReceiptTime=__createTimeStampForOpsecStartTime(time)
event.startTime=__createTimeStampForOpsecStartTime(start_time)

extra.queries[0].event.destinationAddress=__doubleToAddress(IPAddress)
extra.queries[1].event.destinationAddress=__doubleToAddress(IPAddress)
extra.queries[2].event.destinationAddress=__doubleToAddress(IPAddress)
extra.queries[5].event.destinationAddress=__doubleToAddress(IPAddress)
extra.queries[0].event.destinationAddress=__doubleToAddress(IPAddress)

conditionalmap[6].mappings[0].event.sourceNtDomain=__extractNTDomain(User)
conditionalmap[7].mappings[1].event.destinationNtDomain=__extractNTDomain(Supplied Realm Name)
conditionalmap[7].mappings[2].event.destinationNtDomain=__extractNTDomain(User Domain)
conditionalmap[7].mappings[3].event.destinationNtDomain=__extractNTDomain(User ID)
conditionalmap[7].mappings[4].event.destinationNtDomain=__extractNTDomain(Logon by)

conditionalmap[2].mappings[0].event.sourceUserName=__extractNTUser(__oneOf(Caller User Name,Client User Name,Account,Account Name,Logon account,User account,User Name))
conditionalmap[2].mappings[2].event.sourceUserName=__extractNTUser(User)
conditionalmap[3].mappings[0].event.destinationUserName=__extractNTUser(__oneOf(New Account Name,Primary User Name,Target Account Name,Assigned To,Target User Name,User))
conditionalmap[3].mappings[2].event.destinationUserName=__extractNTUser(Logon account)
conditionalmap[3].mappings[3].event.destinationUserName=__extractNTUser(User Name)

event.protocol=__extractProtocol(InputType)
event.protocol=__extractProtocol(InputType)
event.protocol=__extractProtocol(InputType)

extra.queries[0].event.destinationHostName=__foundScanHostName(DNSName)
extra.queries[1].event.destinationHostName=__foundScanHostName(DNSName)
extra.queries[2].event.destinationHostName=__foundScanHostName(DNSName)
extra.queries[5].event.destinationHostName=__foundScanHostName(DNSName)
extra.queries[0].event.destinationHostName=__foundScanHostName(DNSName)

event.agentSeverity=__getCEFSeverity(Severity)
event.agentSeverity=__getCEFSeverity(Severity)
event.agentSeverity=__getCEFSeverity(__stringConstant(Low))

conditionalmap[0].mappings[2].event.deviceDirection=__getDeviceDirection(Method)
event.deviceDirection=__getDeviceDirection(connectionDirection)
submessage[29].pattern[34].extramappings=event.deviceEventClassId\=__stringConstant("srv_S1_VPN_IKEv2\: Deleting SPI")|event.name\=__stringConstant("Deleting SPI")|event.deviceCustomString2Label\=__stringConstant("SPI")|event.deviceCustomString6Label\=__stringConstant("Tunnel")|event.deviceDirection\=__getDeviceDirection($6)
submessage[29].pattern[37].extramappings=event.deviceEventClassId\=__stringConstant("srv_S1_VPN_IKEv2\: Query SA")|event.name\=__stringConstant("Query SA")|event.deviceCustomString2Label\=__stringConstant("SPI")|event.deviceCustomString6Label\=__stringConstant("Tunnel")|event.deviceDirection\=__getDeviceDirection($6)
submessage[29].pattern[39].extramappings=event.deviceEventClassId\=__stringConstant("srv_S1_VPN_IKEv2\: SA Direction")|event.name\=__stringConstant("SA Direction")|event.deviceCustomString6Label\=__stringConstant("Tunnel")|event.deviceDirection\=__getDeviceDirection($5)

additionaldata.SourceIpV6Address=__getIpV6AddressFromHighLow(SrcIPv6High,SrcIPv6Low)
additionaldata.DestinationIpV6Address=__getIpV6AddressFromHighLow(DestIPv6High,DestIPv6Low)
additionaldata.SourceIpV6Address=__getIpV6AddressFromHighLow(SrcIPv6High,SrcIPv6Low)
additionaldata.DestinationIpV6Address=__getIpV6AddressFromHighLow(DestIPv6High,DestIPv6Low)
additionaldata.SourceIpV6Address=__getIpV6AddressFromHighLow(SrcIPv6High,SrcIPv6Low)

event.deviceAction=__getIronMailActions(sidaAlertActionsTaken)
event.deviceAction=__getIronMailActions(sidaAlertActionsTaken)

event.name=__getIronMailAlertImpact(sidaAlertImpact)

event.deviceCustomString1=__getIronMailEventStatus(sidaAlertEventStatus)

event.sourceMacAddress=__getLongMACAddressByHexString(__oneOf(in_src_mac,out_src_mac,__ifThenElse(direction,"1",staMacAddress,)))
event.destinationMacAddress=__getLongMACAddressByHexString(__oneOf(in_dst_mac,out_dst_mac,__ifThenElse(direction,"0",staMacAddress,)))
event.deviceMacAddress=__getLongMACAddressByHexString(wtpMacAddress)
event.sourceMacAddress=__getLongMACAddressByHexString(sourceMAC)
event.sourceMacAddress=__getLongMACAddressByHexString(MAC_Address)

event.sourceMacAddress=__getLongMACAddressByString(__oneOf(OffenderMac,__ifThenElse(Offender,,__regexToken(device,"^([\\w:]+).*$"),__regexToken(Offender,"^.*?,([\\w:]+).*$"))))
event.destinationMacAddress=__getLongMACAddressByString(__oneOf(SensorMac,__regexToken(sensor,"^([\\w:]+).*$"),Sensor))
event.sourceMacAddress=__getLongMACAddressByString(mac)
submessage[0].pattern[0].extramappings=event.name=__concatenate("Station ",$4," KEY_MGMT")|event.destinationMacAddress=__getLongMACAddressByString($3)
submessage[1].pattern[0].extramappings=event.name=__stringConstant(Deauthenticating Station)|event.destinationMacAddress=__getLongMACAddressByString($2)

event.deviceSeverity=__getManhuntPriority(SEVERITY,RELIABILITY)
extra.queries[0].event.deviceSeverity=__getManhuntPriority(SEVERITY,RELIABILITY)
event.deviceSeverity=__getManhuntPriority(SEVERITY,RELIABILITY)
extra.queries[0].event.deviceSeverity=__getManhuntPriority(SEVERITY,RELIABILITY)
event.deviceSeverity=__getManhuntPriority(SEVERITY,RELIABILITY)

extra.queries[2].event.filePath=__getNormalizedOS(os)
extra.queries[2].event.filePath=__getNormalizedOS(OSName)
extra.queries[2].event.filePath=__getNormalizedOS(OSName)
extra.queries[1].event.filePath=__getNormalizedOS(OSName)
extra.queries[1].event.filePath=__getNormalizedOS(OSName)

event.sourcePort=__getNotZeroPort(srcport)
event.destinationPort=__getNotZeroPort(dstport)
event.sourcePort=__getNotZeroPort(srcport)
event.destinationPort=__getNotZeroPort(dstport)

submessage[6].pattern[2].extramappings=event.originator=__getOriginatorFromSourcePort($3,1024)
submessage[0].pattern[8].extramappings=event.name=__concatenate($8," time stamp reply")|event.deviceCustomString3Label=__stringConstant("Protocol")|event.deviceCustomNumber1Label=__stringConstant(TTL)|event.deviceCustomNumber2Label=__stringConstant(IPID)|event.deviceCustomNumber3Label=__stringConstant(IPLength)|event.deviceCustomString6Label=__stringConstant(IPFlags)|event.deviceEventClassId=__concatenate($8," time stamp reply")|event.originator=__getOriginator(Destination)
submessage[0].pattern[10].extramappings=event.name=__concatenate($8," time exceeded in-transit")|event.deviceCustomString3Label=__stringConstant("Protocol")|event.deviceCustomNumber1Label=__stringConstant(TTL)|event.deviceCustomNumber2Label=__stringConstant(IPID)|event.deviceCustomNumber3Label=__stringConstant(IPLength)|event.deviceCustomString6Label=__stringConstant(IPFlags)|event.deviceEventClassId=__concatenate($8," time exceeded in-transit")|event.originator=__getOriginator(Destination)
submessage[0].pattern[11].extramappings=event.name=__concatenate($8," router solicitation")|event.deviceCustomString3Label=__stringConstant("Protocol")|event.deviceCustomNumber1Label=__stringConstant(TTL)|event.deviceCustomNumber2Label=__stringConstant(IPID)|event.deviceCustomNumber3Label=__stringConstant(IPLength)|event.deviceCustomString6Label=__stringConstant(IPFlags)|event.deviceEventClassId=__concatenate($8," router solicitation")|event.originator=__getOriginator(Destination)
submessage[0].pattern[14].extramappings=event.deviceCustomString3Label=__stringConstant(Fragment)|event.deviceCustomNumber1Label=__stringConstant(TTL)|event.deviceCustomNumber2Label=__stringConstant(IPID)|event.deviceCustomNumber3Label=__stringConstant(IPLength)|event.name=__concatenate($10," packet")|event.deviceCustomString6Label=__stringConstant(IPFlags)|event.deviceEventClassId=__concatenate($10," packet")|event.originator=__getOriginatorFromSourcePort($7,1024)

submessage[6].pattern[2].extramappings=event.originator=__getOriginatorFromSourcePort($3,1024)
submessage[0].pattern[14].extramappings=event.deviceCustomString3Label=__stringConstant(Fragment)|event.deviceCustomNumber1Label=__stringConstant(TTL)|event.deviceCustomNumber2Label=__stringConstant(IPID)|event.deviceCustomNumber3Label=__stringConstant(IPLength)|event.name=__concatenate($10," packet")|event.deviceCustomString6Label=__stringConstant(IPFlags)|event.deviceEventClassId=__concatenate($10," packet")|event.originator=__getOriginatorFromSourcePort($7,1024)
submessage[0].pattern[15].extramappings=event.deviceCustomString3Label=__stringConstant(Fragment)|event.deviceCustomNumber1Label=__stringConstant(TTL)|event.deviceCustomNumber2Label=__stringConstant(IPID)|event.deviceCustomNumber3Label=__stringConstant(IPLength)|event.name=__concatenate("Failed ",$10," packet")|event.deviceCustomString6Label=__stringConstant(IPFlags)|event.deviceEventClassId=__concatenate("Failed ",$10," packet")|event.originator=__getOriginatorFromSourcePort($7,1024)
submessage[0].pattern[35].extramappings=event.deviceCustomNumber1Label=__stringConstant(TTL)|event.deviceCustomNumber2Label=__stringConstant(IPID)|event.deviceCustomNumber3Label=__stringConstant(IPLength)|event.name=__stringConstant(DNS PTR request)|event.deviceCustomString1Label=__stringConstant(requestedAddress)|event.applicationProtocol=__stringConstant(DNS)|event.deviceCustomString6Label=__stringConstant(IPFlags)|event.deviceEventClassId=__stringConstant(DNS PTR request)|event.originator=__getOriginatorFromSourcePort($7,1024)
submessage[0].pattern[36].extramappings=event.deviceCustomNumber1Label=__stringConstant(TTL)|event.deviceCustomNumber2Label=__stringConstant(IPID)|event.deviceCustomNumber3Label=__stringConstant(IPLength)|event.name=__stringConstant(Failed DNS PTR request)|event.deviceCustomString1Label=__stringConstant(requestedAddress)|event.applicationProtocol=__stringConstant(DNS)|event.deviceCustomString6Label=__stringConstant(IPFlags)|event.deviceEventClassId=__stringConstant(Failed DNS PTR request)|event.originator=__getOriginatorFromSourcePort($7,1024)

event.applicationProtocol=__getProtocolName(proto)
event.transportProtocol=__getProtocolName(protocol)
event.protocol=__getProtocolName(DragonProtocol)
event.protocol=__getProtocolName(DragonProtocol)
event.transportProtocol=__getProtocolName(protocol)

event.applicationProtocol=__getProtocolNameFromString(service)

submessage[0].pattern[0].extramappings=event.deviceSeverity=__getSymantecNSPriority($1,$2)|event.deviceCustomNumber1Label=__stringConstant("Severity")|event.deviceCustomNumber2Label=__stringConstant("Reliability")|event.deviceCustomString2Label=__stringConstant("IncidentID")

event.deviceTimeZone=__getTimeZone(timezone)
event.deviceTimeZone=__getTimeZone(__regexToken(timezone,"\\-?(.*)"))
event.deviceTimeZone=__getTimeZone(TimeZone)
event.deviceTimeZone=__getTimeZone(offset)
event.deviceTimeZone=__getTimeZone(offset)

event.sourceHostName=__getTrendMicroHostName(VLF_InfectionSource)
event.destinationHostName=__getTrendMicroHostName(VLF_InfectionDestination)
event.sourceHostName=__getTrendMicroHostName(VLF_InfectionSource)
event.destinationHostName=__getTrendMicroHostName(VLF_InfectionDestination)
event.sourceHostName=__getTrendMicroHostName(VLF_InfectionSource)

event.sourceUserName=__getTrendMircoUser(VLF_InfectionSource)
event.destinationUserName=__getTrendMircoUser(VLF_InfectionDestination,FVL_LoginUser)
event.sourceUserName=__getTrendMircoUser(VLF_InfectionSource)
event.destinationUserName=__getTrendMircoUser(VLF_InfectionDestination,FVL_LoginUser)
event.sourceUserName=__getTrendMircoUser(VLF_InfectionSource)

event.type=__getType("AGGREGATED")
event.type=__getType("AGGREGATED")
submessage[4].pattern[1].extramappings=event.type=__getType("AGGREGATED")|event.deviceEventClassId=__stringConstant(arcsight:4:1)
submessage[10].pattern[21].extramappings=event.type=__getType("AGGREGATED")|event.deviceEventClassId=__stringConstant(arcsight:10:20)
submessage[0].pattern[4].extramappings=event.type=__getType("AGGREGATED")

event.deviceVendor=__getVendor("Microsoft")
event.deviceVendor=__getVendor(Microsoft)
event.deviceVendor=__getVendor(Microsoft)
event.deviceVendor=__getVendor(Microsoft)
event.deviceVendor=__getVendor(Microsoft)

extra.queries[0].event.categoryTechnique=__getVulnerabilityCategory(0)
extra.queries[1].event.categoryTechnique=__getVulnerabilityCategory(1)
extra.queries[0].event.categoryTechnique=__getVulnerabilityCategory(4)
extra.queries[0].event.categoryTechnique=__getVulnerabilityCategory(4)
extra.queries[0].event.categoryTechnique=__getVulnerabilityCategory(0)

extra.queries[0].event.deviceEventClassId=__getXForceStringFor(vulnId)
extra.queries[0].event.deviceEventClassId=__getXForceStringFor(vulnId)

submessage[1566].pattern[9].mappings=__hexStringToAddress($1)|__hexStringToAddress($2)
submessage[1566].pattern[12].mappings=__hexStringToAddress($1)|__hexStringToAddress($2)
event.sourceAddress=__hexStringToAddress(SOURCE_IP)
event.targetAddress=__hexStringToAddress(TARGET_IP)
event.deviceAddress=__hexStringToAddress(SENSOR_IP)

event.deviceCustomIPv6Address2=__hexStringToIPV6Address(SOURCE_IP)
event.deviceCustomIPv6Address3=__hexStringToIPV6Address(TARGET_IP)
event.deviceCustomIPv6Address1=__hexStringToIPV6Address(SENSOR_IP)
event.deviceCustomIPv6Address2=__hexStringToIPV6Address(SOURCE_IP)
event.deviceCustomIPv6Address3=__hexStringToIPV6Address(TARGET_IP)

event.deviceCustomNumber1=__hexStringToLong(numberOfReads)
event.fileSize=__hexStringToLong(fileSize)
event.bytesIn=__hexStringToLong(bytesWritten)
event.bytesOut=__hexStringToLong(bytesRead)

event.requestUrl=__hexStringToString(Resource)
additionaldata.request=__hexStringToString(Request)
event.destinationUserName=__hexStringToString(user)
event.requestUrl=__hexStringToString(Resource)
additionaldata.decryption_failure=__hexStringToString(Decryption_failure)

submessage[111].pattern[0].extramappings=event.deviceCustomNumber3=__hourMinuteSecondsToSeconds($14)|event.bytesIn=__safeToInteger($15)|event.deviceAction=__stringConstant("Teardown connection")
submessage[111].pattern[1].extramappings=event.deviceCustomNumber3=__hourMinuteSecondsToSeconds($13)|event.bytesIn=__safeToInteger($14)|event.deviceAction=__stringConstant("Teardown connection")
submessage[111].pattern[2].extramappings=event.deviceCustomNumber3=__hourMinuteSecondsToSeconds($14)|event.bytesIn=__safeToInteger($15)|event.deviceAction=__stringConstant("Teardown connection")
submessage[111].pattern[3].extramappings=event.deviceCustomNumber3=__hourMinuteSecondsToSeconds($14)|event.bytesIn=__safeToInteger($15)|event.deviceAction=__stringConstant("Teardown connection")
submessage[111].pattern[4].extramappings=event.deviceCustomNumber3=__hourMinuteSecondsToSeconds($12)|event.bytesIn=__safeToInteger($13)|event.deviceAction=__stringConstant("Teardown connection")

conditionalmap[2].mappings[4].event.sourceUserName=__ifAorBThenElse(\
conditionalmap[3].mappings[1].event.destinationUserName=__ifAorBThenElse(\
event.oldFileName=__ifAorBThenElse(__regexTokenNoWarning(AUTHENTICATION_TYPE,".*?HOST=(\\d+\\.\\d+\\.\\d+\\.\\d+).*"),"",,,__concatenate("Host : ",__regexTokenNoWarning(AUTHENTICATION_TYPE,".*?HOST=(\\d+\\.\\d+\\.\\d+\\.\\d+).*"),"   Port : ",__regexTokenNoWarning(AUTHENTICATION_TYPE,".*?PORT=(\\d+).*"),"   Protocol : ",__regexTokenNoWarning(AUTHENTICATION_TYPE,".*?PROTOCOL=(\\S*?)\\)\\(.*")))
event.oldFilePath=__ifAorBThenElse(__regexTokenNoWarning(COMMENT_TEXT,".*?HOST=(\\d+\\.\\d+\\.\\d+\\.\\d+).*"),"",,,__concatenate("Host : ",__regexTokenNoWarning(COMMENT_TEXT,".*?HOST=(\\d+\\.\\d+\\.\\d+\\.\\d+).*"),"    Port : ",__regexTokenNoWarning(COMMENT_TEXT,".*?PORT=(\\d+).*"),"   Protocol : ",__regexTokenNoWarning(COMMENT_TEXT,".*?PROTOCOL=(\\S*?)\\)\\(.*")))
event.deviceCustomDate1Label=__ifAorBThenElse(threatTime,,"",,__stringConstant("Threat Time"))

event.eventOutcome=__ifGreaterOrEqual(EventStatus,"0","Success","Failure")
event.eventOutcome=__ifGreaterOrEqual(EventStatus,"0","Success","Failure")
event.eventOutcome=__ifGreaterOrEqual(EventStatus,"0","Success","Failure")
event.eventOutcome=__ifGreaterOrEqual(EventStatus,"0","Success","Failure")
event.eventOutcome=__ifGreaterOrEqual(EventStatus,"0","Success","Failure")

event.flexString2Label=__ifThenElse(ppid,,,__stringConstant("Parent Process ID"))
event.deviceCustomString6=__ifThenElse(terminal,"?",,terminal)
event.sourceHostName=__ifThenElse(hostname,__regexToken(hostname,"([^?&&\\S]+).*"),__split(hostname,",",1),)
event.flexString2Label=__ifThenElse(direction,,,__stringConstant("Device Direction"))
conditionalmap[14].mappings[1].event.destinationHostName=__ifThenElse(Client Address,"127.0.0.1",ComputerName,Client Address)

event.sourceAddress=__ifThenElseAddress(ID,"30",__ifThenElseAddress(_DEVICE_VERSION,"2003",__splitAsAddress(__reverseDottedDecimalAddressByteOrder(__longToDot4QuadAddress(IP_Address)),,),IP_Address),IP_Address)
conditionalmap[0].mappings[4].event.destinationAddress=__ifThenElseAddress(mergedevent.destinationAddress,,ip,mergedevent.destinationAddress)

event.sourceHostName=__ifTrueThenElse(__contains(UserName,"::"),__split(UserName,"::","1"),)
event.sourceHostName=__ifTrueThenElse(__contains(user,"::"),__split(user,"::","1"),)
event.sourceHostName=__ifTrueThenElse(__contains(User,"::"),__split(__regexTokenNoWarning(User,"(\\S+)"),"::","1"),)
additionaldata.defaultHostName=__ifTrueThenElse(__contains(User,"::"),__split(User,"::","1"),)
additionaldata.FIELDNAME=__ifTrueThenElse(__contains(FIELDNAME,"."),__replaceAll(__regexToken(FIELDNAME,".*\\.(.*)")," ",""),FIELDNAME)

event.destinationAddress=__ignoreZeroIp(IP_ADDR1)
event.deviceAddress=__ignoreZeroIp(SERVER_IP)
conditionalmap[0].mappings[0].event.sourceAddress=__ignoreZeroIp(LOCAL_HOST_IP)
conditionalmap[0].mappings[0].event.destinationAddress=__ignoreZeroIp(REMOTE_HOST_IP)
conditionalmap[0].mappings[1].event.sourceAddress=__ignoreZeroIp(REMOTE_HOST_IP)

conditionalmap[0].mappings[0].event.sourceMacAddress=__ignoreZeroMac(__getLongMACAddressByHexString(LOCAL_HOST_MAC))
conditionalmap[0].mappings[0].event.destinationMacAddress=__ignoreZeroMac(__getLongMACAddressByHexString(REMOTE_HOST_MAC))
conditionalmap[0].mappings[1].event.sourceMacAddress=__ignoreZeroMac(__getLongMACAddressByHexString(REMOTE_HOST_MAC))
conditionalmap[0].mappings[1].event.destinationMacAddress=__ignoreZeroMac(__getLongMACAddressByHexString(LOCAL_HOST_MAC))
conditionalmap[0].mappings[0].event.sourceMacAddress=__ignoreZeroMac(__getLongMACAddressByHexString(LOCAL_HOST_MAC))

submessage[0].pattern[1].extramappings=event.destinationPort=__integerConstant(80)
submessage[0].pattern[2].extramappings=event.destinationPort=__integerConstant(443)
submessage[0].pattern[4].extramappings=event.destinationPort=__integerConstant(80)
submessage[0].pattern[5].extramappings=event.destinationPort=__integerConstant(443)

event.sourceAddress=__integerToAddressMcAfee(__safeToInteger(sourceaddress))
event.destinationAddress=__integerToAddressMcAfee(__safeToInteger(targetipaddress))
event.sourceAddress=__integerToAddressMcAfee(__safeToInteger(ThreatSourceIPv4))
event.destinationAddress=__integerToAddressMcAfee(__safeToInteger(IPv4))
event.sourceAddress=__integerToAddressMcAfee(__safeToInteger(ThreatSourceIPv4))

event.deviceCustomNumber1=__integerToLong(count)
event.deviceCustomNumber1=__integerToLong(vlanid)

conditionalmap[0].mappings[3].event.deviceCustomNumber3=__length(%3)

event.deviceCustomString1=__longToDot4QuadAddress(nexthop)
event.deviceCustomString1=__longToDot4QuadAddress(ipv4_next_hop)
event.deviceCustomString1=__longToDot4QuadAddress(ip_next_hop)

conditionalmap[0].mappings[6].event.destinationProcessId=__longToInteger(__oneOfLong(__ifThenElse(Process Information:Process ID,,"",__hexStringToLong(__ifThenElse(Process Information:Process ID,,"",Process Information:Process ID)))))
conditionalmap[0].mappings[10].event.destinationProcessId=__longToInteger(__oneOfLong(__ifThenElse(Process Information:Process ID,,"",__hexStringToLong(__ifThenElse(Process Information:Process ID,,"",Process Information:Process ID)))))
conditionalmap[0].mappings[11].event.sourceProcessId=__longToInteger(__oneOfLong(__ifThenElse(Process Information:Caller Process ID,,"",__hexStringToLong(__ifThenElse(Process Information:Caller Process ID,,"",Process Information:Caller Process ID)))))
conditionalmap[0].mappings[14].event.destinationProcessId=__longToInteger(__oneOfLong(__ifThenElse(Process Information:Process ID,,"",__hexStringToLong(__ifThenElse(Process Information:Process ID,,"",Process Information:Process ID)))))
conditionalmap[0].mappings[22].event.destinationProcessId=__longToInteger(__oneOfLong(__ifThenElse(Process Information:Process ID,,"",__hexStringToLong(__ifThenElse(Process Information:Process ID,,"",Process Information:Process ID)))))

event.deviceCustomString5=__longToString(HOSTID)
event.flexString1=__longToString(AnalyzerContentCreationDate)
event.deviceInboundInterface=__longToString(interface_input_snmp)
event.deviceOutboundInterface=__longToString(interface_output_snmp)
event.deviceSeverity=__longToString(__oneOfLong(__safeToLong(status),__hexStringToLong(status)))

event.deviceReceiptTime=__longToTimeStamp(__safeToLong(__regexTokenFindAndJoin(timestamp,"(\\d+)",,,)))
event.deviceCustomDate1=__longToTimeStamp(registeredAt)
conditionalmap[0].mappings[2].event.deviceCustomDate1=__longToTimeStamp(__safeToLong(__concatenate(time,"000")))
conditionalmap[0].mappings[3].event.deviceCustomDate1=__longToTimeStamp(__safeToLong(__concatenate(time,"000")))
conditionalmap[0].mappings[4].event.deviceCustomDate1=__longToTimeStamp(__safeToLong(__concatenate(time,"000")))

event.destinationAddress=__mazuProfilerDestinationAddress(__longToString(__safeToLong(type)),dst_ip_csv)

event.deviceCustomString1=__multilineRegexToken(Result,"(?s)(.{0,1023}).*")
additionaldata.expltDescription=__multilineRegexToken(ExpltDescription,"(?s)(.{0,1023}).*")
additionaldata.expltDescription=__multilineRegexToken(ExpltDescription,"(?s)(.{0,1023}).*")
conditionalmap[0].mappings[13].event.deviceCustomString1=__multilineRegexToken(%5,"(?s).*Unrepairable virus (.*) was found.*")
conditionalmap[0].mappings[13].event.deviceCustomString4=__multilineRegexToken(%4,"(?s).*Rule:\\s*(.*)\\s*")

event.targetAddress=__noDot4QuadStringsToAddress(DSTIP_A,DSTIP_B,DSTIP_C,DSTIP_D)
event.sourceAddress=__noDot4QuadStringsToAddress(SRCIP_A,SRCIP_B,SRCIP_C,SRCIP_D)
event.targetAddress=__noDot4QuadStringsToAddress(dest_ip1,dest_ip2,dest_ip3,dest_ip4)
event.sourceAddress=__noDot4QuadStringsToAddress(src_ip1,src_ip2,src_ip3,src_ip4)

event.deviceAddress=__numberToAddress(__safeToLong(orig))
event.sourceAddress=__numberToAddress(__safeToLong(client_ip))
event.deviceAddress=__numberToAddress(__oneOfLong(orig,endpoint_ip))
event.sourceAddress=__numberToAddress(__oneOfLong(src,Src))
event.destinationAddress=__numberToAddress(__oneOfLong(dst,Dst))

event.sourcePort=__oneOfInteger(src,sport,rport)
event.sourceProcessId=__oneOfInteger(pid,Spid)
event.destinationProcessName=__oneOf(exe,comm)
event.destinationUserId=__oneOf(__regexToken(auid,"([a-zA-Z0-9:?]*)"),new auid,__oneOf(old auid,old-auid))
event.destinationPort=__oneOfInteger(dest,dport,__regexToken(lport,"(\\d+).*"))

event.sourceAddress=__oneOfAddress(Client Address,Source Network Address)
conditionalmap[0].mappings[1].event.destinationAddress=__oneOfAddress(Key[0])
conditionalmap[0].mappings[3].event.sourceAddress=__oneOfAddress(Key[0])
conditionalmap[0].mappings[11].event.destinationAddress=__oneOfAddress(Key[0])
conditionalmap[0].mappings[26].event.destinationAddress=__oneOfAddress(Key[1])

event.deviceReceiptTime=__oneOfDateTime(__safeToDate(__concatenate(date," ",time," GMT"),"yyyy-MM-dd HH:mm:ss Z"),__safeToDate(__regexTokenNoWarning(localtime,"\\[([^\\]]+)\\]"),"dd/MMM/yyyy:HH:mm:ss Z"))
event.deviceReceiptTime=__oneOfDateTime(__safeToDate(__concatenate(date," ",time," GMT"),"yyyy-MM-dd HH:mm:ss Z"),__safeToDate(__regexTokenNoWarning(localtime,"\\[([^\\]]+)\\]"),"dd/MMM/yyyy:HH:mm:ss Z"))
event.deviceReceiptTime=__oneOfDateTime(__safeToDate(__concatenate(date," ",time," GMT"),"yyyy-MM-dd HH:mm:ss Z"),__safeToDate(__regexTokenNoWarning(localtime,"\\[([^\\]]+)\\]"),"dd/MMM/yyyy:HH:mm:ss Z"))
event.deviceReceiptTime=__oneOfDateTime(__safeToDate(__concatenate(date," ",time," GMT"),"yyyy-MM-dd HH:mm:ss Z"),__safeToDate(__regexTokenNoWarning(localtime,"\\[([^\\]]+)\\]"),"dd/MMM/yyyy:HH:mm:ss Z"))
event.deviceCustomDate1=__oneOfDateTime(__createTimeStampForOpsecStartTime(local_time),__createTimeStampByStartTimeElapsed(start_time,elapsed))

event.destinationHostName=__oneOfHostName(TargetHostName,TargetHostNameRegistered)
event.destinationHostName=__oneOfHostName(TargetHostName,TargetHostNameRegistered)
event.targetHostName=__oneOfHostName(TargetHostName,TargetHostNameRegistered)
event.destinationHostName=__oneOfHostName(TargetHostName,TargetHostNameRegistered)
event.destinationHostName=__oneOfHostName(TargetHostName,TargetHostNameRegistered)

event.sourcePort=__oneOfInteger(src,sport,rport)
event.sourceProcessId=__oneOfInteger(pid,Spid)
event.destinationPort=__oneOfInteger(dest,dport,__regexToken(lport,"(\\d+).*"))
event.destinationProcessId=__oneOfInteger(Process ID,Target Process ID,Source Process ID,New Process ID)
conditionalmap[0].mappings[10].event.bytesOut=__oneOfInteger(Key[9])

event.deviceCustomNumber2=__oneOfLong(ses,new ses,__oneOfLong(old ses,old-ses))
conditionalmap[0].mappings[10].event.deviceCustomNumber1=__oneOfLong(Key[7])
conditionalmap[0].mappings[10].event.deviceCustomNumber2=__oneOfLong(Key[8])
submessage[29].pattern[28].extramappings=event.deviceEventClassId\=__stringConstant("srv_S1_VPN_IKEv2\: Policy Refcount")|event.name\=__stringConstant("Policy Refcount")|event.deviceCustomNumber2\=__oneOfLong($6,$7)|event.deviceCustomNumber2Label\=__stringConstant("Refcount")|event.deviceCustomString6Label\=__stringConstant("Tunnel")|event.deviceCustomString2Label\=__stringConstant("Policy")
event.deviceCustomNumber1=__oneOfLong(Payload,__hourMinuteSecondsToSeconds(elapsed))

event.destinationMacAddress=__oneOfMac(DestMac)
event.sourceMacAddress=__oneOfMac(SourceMacAddress)
event.destinationMacAddress=__oneOfMac(DestinationMacAddress)
event.deviceMacAddress=__oneOfMac(__regexTokenNoWarning(Accesspoint,"(\\S+)\\@\\S+"))
event.sourceMacAddress=__oneOfMac(Calling-Station-ID)

event.sourceHostName=__oneOfNetBIOSName(Address,Source Workstation,Workstation Name,Workstation,Caller Machine Name,Client Name)
event.sourceHostName=__oneOfNetBIOSName(Subject:Client Name,Network Information:Workstation Name,Source Workstation,Additional Information:Client Name)
conditionalmap[18].mappings[0].event.sourceHostName=__oneOfNetBIOSName(Address,Source Workstation,Workstation Name,Workstation,Caller Machine Name,Client Name)
conditionalmap[0].mappings[12].event.sourceHostName=__oneOfNetBIOSName(WorkstationName)
conditionalmap[0].mappings[19].event.sourceHostName=__oneOfNetBIOSName(WorkstationName)

conditionalmap[0].mappings[6].event.deviceCustomDate1=__parseMultipleTimeStamp(__ifThenElse(__regexToken(Previous Date,"(\\d+/\\d+/\\d+)"),,Previous Time,__concatenate(Previous Date," ",Previous Time)),"MM/dd/yyyy hh:mm:ss aa","yyyy-MM-dd'T'HH:mm:ss")
conditionalmap[0].mappings[6].event.deviceCustomDate2=__parseMultipleTimeStamp(__ifThenElse(__regexToken(New Date,"(\\d+/\\d+/\\d+)"),,New Time,__concatenate(New Date," ",New Time)),"MM/dd/yyyy hh:mm:ss aa","yyyy-MM-dd'T'HH:mm:ss")
conditionalmap[0].mappings[11].event.deviceCustomDate1=__parseMultipleTimeStamp(Previous Time,"MM/dd/yyyy hh:mm:ss aa","yyyy-MM-dd'T'HH:mm:ss")
conditionalmap[0].mappings[11].event.deviceCustomDate2=__parseMultipleTimeStamp(New Time,"MM/dd/yyyy hh:mm:ss aa","yyyy-MM-dd'T'HH:mm:ss")
conditionalmap[0].mappings[10].event.startTime=__parseMultipleTimeStamp(__concatenate(Key[3]," ",Key[4]),"MM/dd/yyyy hh:mm aa")

event.startTime=__parseMutableTimeStampSilently(start)
event.endTime=__parseMutableTimeStampSilently(end)
event.deviceReceiptTime=__parseMutableTimeStampSilently(rt)
event.agentReceiptTime=__parseMutableTimeStampSilently(art)
event.managerReceiptTime=__parseMutableTimeStampSilently(mrt)

event.startTime=__parseMutableTimeStampSilently(start)
event.endTime=__parseMutableTimeStampSilently(end)
event.deviceReceiptTime=__parseMutableTimeStampSilently(rt)
event.agentReceiptTime=__parseMutableTimeStampSilently(art)
event.managerReceiptTime=__parseMutableTimeStampSilently(mrt)

event.deviceCustomNumber1=__parseSignedLong(delta)

event.sourceUserName=__regexToken(__oneOf(user,old-seuser),"([a-zA-Z0-9]*).*?")
event.sourceAddress=__regexTokenAsAddress(__oneOf(addr,saddr),"([0-9.]*).*")
event.sourceUserId=__regexToken(__oneOf(sauid,uid),"([a-zA-Z0-9?]*)")
event.destinationUserName=__regexToken(__oneOf(new-seuser,acct),"([a-zA-Z0-9]*).*?")
event.destinationAddress=__regexTokenAsAddress(__oneOf(daddr,laddr),"([0-9.]*).*")

event.sourceAddress=__regexTokenAsAddress(__oneOf(addr,saddr),"([0-9.]*).*")
event.destinationAddress=__regexTokenAsAddress(__oneOf(daddr,laddr),"([0-9.]*).*")
event.sourceAddress=__regexTokenAsAddress(addr,"([0-9.]*).*")
event.destinationAddress=__regexTokenAsAddress(laddr,"([0-9.]*).*")
conditionalmap[0].mappings[7].event.sourceAddress=__regexTokenAsAddress(Key[0],"(\\d+.\\d+.\\d+.\\d+):\\d+")

event.destinationPort=__regexTokenAsInteger(lport,"(\\d+).*")
event.sourcePort=__regexTokenAsInteger(rport,"(\\d+).*")
event.targetPort=__regexTokenAsInteger(Port number,"\\s*(\\d+)")
conditionalmap[0].mappings[4].event.sourcePort=__regexTokenAsInteger(Key[2],"\\S+-(\\d+)")
conditionalmap[0].mappings[5].event.sourcePort=__regexTokenAsInteger(Key[1],"\\S+-(\\d+)")

conditionalmap[0].mappings[37].event.deviceCustomNumber3=__regexTokenAsLong(Key[1],"(\\d*)")
conditionalmap[0].mappings[30].event.deviceCustomNumber3=__regexTokenAsLong(Key[1],"(\\d*)")
event.fileSize=__regexTokenAsLong(file_size,".*(\\d*)")
event.deviceCustomNumber1=__regexTokenAsLong(EscalationValue,"0*(\\d*)")
event.deviceCustomNumber2=__regexTokenAsLong(datversion,\\d.\\d.(\\d+))

event.deviceCustomString2=__regexTokenFindAndJoin(INFO,"((?:CVE|CAN)\\-\\d+\\-\\d+)",",","","")
conditionalmap[0].mappings[3].event.deviceCustomString6=__regexTokenFindAndJoin(__replaceAll(%3,"\\n","\\$\\$"),"((?:Invoke\\-WmiMethod|Get\\-WmiObject|Get\\-CimAssociatedInstance|Get\\-CimClass|Get\\-CimInstance|Get\\-CimSession|Set\\-WmiInstance|Set\\-CmiInstance|Invoke\\-WmiMethod|Invode\\-CimMethod|New\\-CimInstance|New\\-CimSesstion|New\\-CimSesstionOption|Register\\-CmiIndicationEvent|Register\\-WmiEvent|Remove\\-CimInstance|Remove\\-WmiObject|Remove\\-CimSession) .*?)\\$\\$","|",,)

conditionalmap[0].mappings[0].event.destinationHostName=__regexTokenNoWarning(additionalEventData,.*loginTo.*?:\\"([^\"]+)\\".*)
conditionalmap[0].mappings[0].event.eventOutcome=__regexTokenNoWarning(responseElements,".*ConsoleLogin:\"([^\"]+)\"")
conditionalmap[0].mappings[0].event.deviceCustomString6=__regexTokenNoWarning(additionalEventData,.*MFAUsed.*?:\\"([^\"]+)\\".*)
conditionalmap[0].mappings[0].event.deviceCustomString5=__regexTokenNoWarning(additionalEventData,.*SamlProviderArn.*?:\\"([^\"]+)\\".*)
conditionalmap[0].mappings[1].event.destinationHostName=__regexTokenNoWarning(requestParameters,.*bucketName.*?:\\"([^\"]+)\\".*)

conditionalmap[4].mappings[3].event.deviceCustomString6=__replaceAll(Changes made,";  ","|")
conditionalmap[4].mappings[4].event.deviceCustomString6=__replaceAll(Changes made,";  ","|")
conditionalmap[0].mappings[61].event.deviceCustomString6=__replaceAll(Changes Made,";  ","|")
conditionalmap[0].mappings[62].event.deviceCustomString6=__replaceAll(Changes Made,";  ","|")
submessage[61].pattern[0].extramappings=event.deviceCustomString3Label=__stringConstant("Track Type")|event.deviceCustomNumber3Label=__stringConstant("Preced")|event.deviceCustomNumber2Label=__stringConstant("Channel")|event.name=__replaceAll($2,"\\,","")

event.name=__replaceFirst(Operation,"([\\s\\.]*$)","")
event.deviceEventClassId=__replaceFirst(Operation,"([\\s\\.]*$)","")
event.deviceAction=__replaceFirst(Operation,"([\\s\\.]*$)","")

event.deviceCustomDate1=__safeToDate(userIdentity->sessionContext->attributes->creationDate,"yyyy-MM-dd'T'HH:mm:ssX")
submessage[0].pattern[0].extramappings=event.deviceCustomDate1=__safeToDate($1,"HH:mm MM/dd/yy")
submessage[1].pattern[0].extramappings=event.deviceCustomDate1=__safeToDate($1,"HH:mm MM/dd/yy")
submessage[4].pattern[0].extramappings=event.startTime=__safeToDate($3,"HH:mm MM/dd/yy")
event.endTime=__safeToDate(last-became-relevant,"EEE, dd MMM yyyy HH:mm:ss Z")

event.deviceCustomFloatingPoint1=__safeToDouble(eventVersion)
event.deviceCustomFloatingPoint1=__safeToDouble(eventVersion)
event.deviceCustomFloatingPoint1=__safeToDouble(suppress_for)
conditionalmap[0].mappings[2].event.deviceCustomFloatingPoint2=__safeToDouble(flags)
conditionalmap[0].mappings[2].event.deviceCustomFloatingPoint3=__safeToDouble(sequencenum)

event.sourcePort=__safeToInteger(__oneOf(Source Port,Port number))
event.sourcePort=__safeToInteger(__oneOf(Network Information:Source Port,Network Information:Port,Network Information:Client Port))
event.destinationPort=__safeToInteger(Network Information:Destination Port)
event.sourcePort=__safeToInteger(__oneOf(Network Information:Source Port,Network Information:Port,Network Information:Client Port))
event.destinationPort=__safeToInteger(Network Information:Destination Port)

event.deviceCustomNumber3=__safeToLong(__regexToken(uid,"([a-zA-Z0-9?]*)"))
conditionalmap[11].mappings[0].event.deviceCustomNumber3=__safeToLong(Number of audit messages discarded)
event.deviceCustomNumber1=__safeToLong(__oneOf(Logon Type,Pre-Authentication Type))
event.deviceCustomNumber2=__safeToLong(New Process ID)
event.deviceCustomNumber1=__safeToLong(session_id)

event.deviceCustomNumber1=__safeToRoundedLong(triggerDistance)
event.deviceCustomNumber2=__safeToRoundedLong(distance)

event.deviceReceiptTime=__setYearToCurrentYear(Date)
event.deviceReceiptTime=__setYearToCurrentYear(Date)
event.detectTime=__setYearToCurrentYear(Date)
event.deviceReceiptTime=__setYearToCurrentYear(DetectTime)

event.sourceAddress=__signedNumberToAddress(ip_src)
event.targetAddress=__signedNumberToAddress(ip_dst)

conditionalmap[0].mappings[58].event.deviceCustomString5=__simpleMap(Trust Information:Trust Type,"1=The other domain is pre-Win2k (NTLM only supported)","2=The other domain is Win2k or later (Windows Kerberos supported)","3=Other domain is actually an MIT Kerberos Realm (probably UNIX)","4=The trusted domain is a DCE realm")
conditionalmap[0].mappings[58].event.deviceCustomString3=__simpleMap(Trust Information:Trust Direction,"0=Disabled","1=Inbound","2=Outbound","3=Bidirectional")
conditionalmap[0].mappings[64].event.deviceCustomString5=__simpleMap(New Trust Information:Trust Type,"1=The other domain is pre-Win2k (NTLM only supported)","2=The other domain is Win2k or later (Windows Kerberos supported)","3=Other domain is actually an MIT Kerberos Realm (probably UNIX)","4=The trusted domain is a DCE realm")
conditionalmap[0].mappings[64].event.deviceCustomString3=__simpleMap(New Trust Information:Trust Direction,"0=Disabled","1=Inbound","2=Outbound","3=Bidirectional")
conditionalmap[0].mappings[64].event.deviceCustomString5=__simpleMap(Trust Information:Trust Type,"1=The other domain is pre-Win2k (NTLM only supported)","2=The other domain is Win2k or later (Windows Kerberos supported)","3=Other domain is actually an MIT Kerberos Realm (probably UNIX)","4=The trusted domain is a DCE realm")

conditionalmap[2].mappings[1].event.sourceUserName=__split(Assigned By,"=",2)
conditionalmap[5].mappings[0].additionaldata.SamAccountName=__split(Changed Attributes,"=",2)
event.sourceAddress=__splitAsAddress(__ifThenElse(EventID,"30",__reverseDottedDecimalAddressByteOrder(Address),Address),,)
extra.queries[0].event.destinationAddress=__splitAsAddress(IPAddress,,)
extra.queries[1].event.destinationAddress=__splitAsAddress(IPAddress,,)

event.sourceAddress=__splitAsAddress(__ifThenElse(EventID,"30",__reverseDottedDecimalAddressByteOrder(Address),Address),,)
extra.queries[0].event.destinationAddress=__splitAsAddress(IPAddress,,)
extra.queries[1].event.destinationAddress=__splitAsAddress(IPAddress,,)
extra.queries[0].event.destinationAddress=__splitAsAddress(IPAddress,,)
extra.queries[1].event.destinationAddress=__splitAsAddress(IPAddress,,)

conditionalmap[0].mappings[19].event.destinationPort=__splitAsInteger(addr,":",2)
event.sourcePort=__splitAsInteger(src,"/",2)
event.destinationPort=__splitAsInteger(dst,"/",2)
event.translatedSourcePort=__splitAsInteger(svsrc,"/",2)

event.deviceCustomString1Label=__stringConstant(dev)
event.deviceCustomString2Label=__stringConstant(key)
event.deviceCustomNumber2Label=__stringConstant(ses)
event.deviceCustomString3Label=__stringConstant(success/res)
event.deviceCustomString4Label=__stringConstant(syscall)

event.deviceCustomIPv6Address2=__stringToIPv6Address(__oneOf(Network Information:Source Network Address,Local Network Address,Additional Information:Client Address,Network Information:Network Address,Network Information:Source Address,Client Machine:Calling Station Identifier,Network Information:Client Address))
conditionalmap[0].mappings[115].event.deviceCustomIPv6Address3=__stringToIPv6Address(Network Information:Client Address)
conditionalmap[0].mappings[116].event.deviceCustomIPv6Address3=__stringToIPv6Address(Network Information:Client Address)
conditionalmap[0].mappings[117].event.deviceCustomIPv6Address3=__stringToIPv6Address(Network Information:Client Address)
conditionalmap[0].mappings[118].event.deviceCustomIPv6Address3=__stringToIPv6Address(Network Information:Client Address)

conditionalmap[0].mappings[0].event.fileName=__stringTrim(ASSSODSN)
conditionalmap[0].mappings[0].event.sourceUserName=__stringTrim(ACSMFLID)
conditionalmap[0].mappings[0].event.deviceCustomString1=__stringTrim(JOB)
conditionalmap[0].mappings[1].event.sourceUserName=__stringTrim(ACSMFLID)
conditionalmap[0].mappings[1].event.deviceCustomString1=__stringTrim(JOB)

token[3].format=__subParse(azure_active_directory/azure_active_directory.base.subparsers.map.csv)
token[15].format=__subParse(exchange/exchange.mailbox.subparsers.map.csv)
token[1].format=__subParse(office365.subparsers.map.csv)
token[5].format=__subParse(sharepoint/sharepoint.base.subparsers.map.csv)

event.baseEventCount=__sum(RepeatCount,1)

event.detectTime=__toGMTTimeStamp(LocalTimestamp)
event.detectTime=__toGMTTimeStamp(TimeStamp)
event.detectTime=__toGMTTimeStamp(TimeStamp)
event.detectTime=__toGMTTimeStamp(TimeStamp)
event.deviceReceiptTime=__toGMTTimeStamp(TimeStamp)

event.deviceCustomString2=__toHex(PacketFlags,4)
event.deviceEventClassId=__toHex(EVENT_ID,8)
event.externalId=__toHex(EVENT_ID,8)
event.deviceEventClassId=__toHex(EVENT_ID,4)

event.deviceReceiptTime=__toLocalTimeStamp(CreationTime)
event.deviceCustomDate1=__toLocalTimeStamp(CollectionTime)
event.deviceCustomDate2=__toLocalTimeStamp(TIME_CREATED)
event.detectTime=__toLocalTimeStamp(EVENTTIME)
event.deviceCustomDate1=__toLocalTimeStamp(STARTTIME)

event.flexNumber1=__toLongTimeStamp(reportStartTime)
event.flexNumber2=__toLongTimeStamp(reportEndTime)
event.flexNumber1=__toLongTimeStamp(reportStartTime)
event.flexNumber2=__toLongTimeStamp(reportEndTime)
event.flexNumber1=__toLongTimeStamp(reportStartTime)

event.destinationNtDomain=__toLowerCase(__oneOf(Supplied Realm Name,New Domain,Primary Domain,Target Domain,Domain Name,Domain,User Domain,__extractNTDomain(New Account Name),__extractNTDomain(Primary User Name),__extractNTDomain(Target Account Name),__extractNTDomain(Assigned To),__extractNTDomain(User)))
event.deviceHostName=__toLowerCase(__oneOf(__regexToken(ComputerName,"(.*?)\\..*"),ComputerName))
conditionalmap[6].mappings[1].event.sourceNtDomain=__toLowerCase(\
conditionalmap[7].mappings[0].event.destinationNtDomain=__toLowerCase(\
conditionalmap[13].mappings[1].event.sourceHostName=__toLowerCase(\

event.transportProtocol=__toUpperCase(proto)
event.transportProtocol=__toUpperCase(proto)
event.transportProtocol=__toUpperCase(proto)
event.protocol=__toUpperCase(protocol)
event.deviceCustomString4=__toUpperCase(__regexTokenNoWarning(sourceMAC,"(\\S{1,6}).*"))

token[1].format=__uri()
token[2].format=__uri()
token[3].format=__uri()
token[1].format=__uri()
token[2].format=__uri()

event.deviceReceiptTime=__useCurrentYear(__parseMultipleTimeStamp(datetime,"MMM dd HH:mm:ss"))

extra.queries[0].event.destinationAddress=__variableTypeToAddress(IPAddress)
extra.queries[1].event.destinationAddress=__variableTypeToAddress(IPAddress)
extra.queries[2].event.destinationAddress=__variableTypeToAddress(IPAddress)
extra.queries[5].event.destinationAddress=__variableTypeToAddress(IPAddress)

event.fileHash=__verifyHexString(__ifThenElse(__oneOf(proctitle,data),,,__concatenate(__ifThenElse(proctitle,,"data","proctitle"),": ",__verifyHexString(__oneOf(proctitle,data)))))