@@ -132,11 +132,15 @@ processors:
132132 if (!(ctx.o365audit.Actions instanceof List)) {
133133 ctx.o365audit.Actions = [ctx.o365audit.Actions];
134134 }
135+
136+ // Actions contains both a human readable `QueryTime` using AM/PM and an ISO8601 format `QueryTime`
137+ // We remove the AM/PM containing `QueryTime` to avoid duplicate field errors on flattening.
138+ def queryTimePattern = /,"QueryTime":"[0-9\/]+\s[0-9]+:[0-9]+:[0-9]+\s[AP]M"|"QueryTime":"[0-9\/]+\s[0-9]+:[0-9]+:[0-9]+\s[AP]M",/;
135139 for (def e: ctx.o365audit.Actions) {
136140 if (e instanceof Map) {
137141 actions.add(e);
138142 } else if (e instanceof String) {
139- ctx._tmp.action_strings.add(e );
143+ ctx._tmp.action_strings.add(queryTimePattern.matcher(e).replaceAll('') );
140144 }
141145 }
142146 if (actions.length == ctx.o365audit.Actions.length) {
@@ -672,11 +676,11 @@ processors:
672676 target_field : file.extension
673677 ignore_missing : true
674678 if : ctx.event?.code != null && ["SharePointFileOperation", "SharePointSharingOperation"].contains(ctx.event.code)
675- - append :
679+ - append :
676680 field : event.category
677681 value : file
678682 if : ' ctx.event?.action != null && ["FileAccessed", "FileDeleted", "FileDownloaded", "FileModified", "FileMoved", "FileRenamed", "FileRestored", "FileUploaded", "FolderCopied", "FolderCreated", "FolderDeleted", "FolderModified", "FolderMoved", "FolderRenamed", "FolderRestored"].contains(ctx.event?.action)'
679- - append :
683+ - append :
680684 field : event.category
681685 value : configuration
682686 if : ctx.event?.action == "ComplianceSettingChanged"
@@ -1398,6 +1402,26 @@ processors:
13981402 } else {
13991403 ctx.o365audit.YammerNetworkId = ctx.o365audit.YammerNetworkId.toString();
14001404 }
1405+ script :
1406+ tag : convert_runningtime
1407+ description : Ensure that RunningTime is not rendered with e-notation or other numeric
1408+ if : ctx.o365audit?.RunningTime != null
1409+ source : |-
1410+ if (ctx.o365audit.RunningTime instanceof double) {
1411+ ctx.o365audit.RunningTime = ((long)ctx.o365audit.RunningTime).toString();
1412+ } else {
1413+ ctx.o365audit.RunningTime = ctx.o365audit.RunningTime.toString();
1414+ }
1415+ script :
1416+ tag : convert_operationcount
1417+ description : Ensure that OperationCount is not rendered with e-notation or other numeric
1418+ if : ctx.o365audit?.OperationCount != null
1419+ source : |-
1420+ if (ctx.o365audit.OperationCount instanceof Number) {
1421+ ctx.o365audit.OperationCount = ((long)ctx.o365audit.OperationCount).toString();
1422+ } else {
1423+ ctx.o365audit.OperationCount = ctx.o365audit.OperationCount.toString();
1424+ }
14011425append :
14021426 field : email.message_id
14031427 value : " {{{o365audit.InternetMessageId}}}"
@@ -1446,6 +1470,7 @@ processors:
14461470 field : o365audit.EndTimeUtc
14471471 target_field : o365audit.EndTimeUtc
14481472 tag : date_EndTimeUtc
1473+ timezone : " UTC"
14491474 formats :
14501475 - ISO8601
14511476 if : ctx.o365audit?.EndTimeUtc != null
@@ -1789,6 +1814,66 @@ processors:
17891814 copy_from : o365audit.ApplicationDisplayName
17901815 tag : set_application_name
17911816 ignore_empty_value : true
1817+
1818+ # ExchangeItemAggregated Schema
1819+ - append :
1820+ field : event.type
1821+ value : access
1822+ if : ctx.o365audit?.RecordType == "50"
1823+ - append :
1824+ field : event.category
1825+ value : email
1826+ if : ctx.o365audit?.RecordType == "50"
1827+ - rename :
1828+ field : o365audit.Messages
1829+ target_field : o365audit.ExchangeAggregatedMessages
1830+ tag : rename_messages_exchange
1831+ description : ' move generic Messages field to the ExchangeAggregatedMessages field type'
1832+ if : ctx.o365audit?.Messages != null && ctx.o365audit.RecordType == "50"
1833+ - script :
1834+ tag : convert_exchange_message_size_to_long
1835+ if : ctx.o365audit?.ExchangeAggregatedMessages != null
1836+ lang : painless
1837+ source : |
1838+ for (def i = 0; i < ctx.o365audit.ExchangeAggregatedMessages.length; i++) {
1839+ if (ctx.o365audit.ExchangeAggregatedMessages[i].MessageItems == null) {
1840+ continue;
1841+ }
1842+ for (def j = 0; j < ctx.o365audit.ExchangeAggregatedMessages[i].MessageItems.length; j++) {
1843+ def size = ctx.o365audit.ExchangeAggregatedMessages[i].MessageItems[j].SizeInBytes;
1844+ if (size instanceof String) {
1845+ ctx.o365audit.ExchangeAggregatedMessages[i].MessageItems[j].SizeInBytes = Long.parseLong(size);
1846+ } else {
1847+ ctx.o365audit.ExchangeAggregatedMessages[i].MessageItems[j].SizeInBytes = (long)size;
1848+ }
1849+ }
1850+ }
1851+
1852+ rename :
1853+ field : o365audit.Folders
1854+ target_field : o365audit.ExchangeAggregatedFolders
1855+ tag : rename_folders_exchange
1856+ description : ' move generic Folders field to the O365 ExchangeAggregatedFolders field type'
1857+ if : ctx.o365audit?.Folders != null && ctx.o365audit.RecordType == "50"
1858+ - script :
1859+ tag : convert_exchange_folder_size_to_long
1860+ if : ctx.o365audit?.ExchangeAggregatedFolders != null
1861+ lang : painless
1862+ source : |
1863+ for (def i = 0; i < ctx.o365audit.ExchangeAggregatedFolders.length; i++) {
1864+ if (ctx.o365audit.ExchangeAggregatedFolders[i].FolderItems == null) {
1865+ continue;
1866+ }
1867+ for (def j = 0; j < ctx.o365audit.ExchangeAggregatedFolders[i].FolderItems.length; j++) {
1868+ def size = ctx.o365audit.ExchangeAggregatedFolders[i].FolderItems[j].SizeInBytes;
1869+ if (size instanceof String) {
1870+ ctx.o365audit.ExchangeAggregatedFolders[i].FolderItems[j].SizeInBytes = Long.parseLong(size);
1871+ } else {
1872+ ctx.o365audit.ExchangeAggregatedFolders[i].FolderItems[j].SizeInBytes = (long)size;
1873+ }
1874+ }
1875+ }
1876+
17921877script :
17931878 description : Handle _tmp.entities.ThreatDetectionMethods containing list of lists.
17941879 lang : painless
0 commit comments