integrations-core/cofense_triage/assets/logs/cofense-triage.yaml at 956cf7eb5b1f195a289e4ba28abadf2904dae6a5 · DataDog/integrations-core · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
# bypass-global-no-service-config-checks
id: cofense-triage
metric_id: cofense-triage
backend_only: false
facets:
  - groups:
      - User
    name: User Email
    path: usr.email
    source: log
pipeline:
  type: pipeline
  name: Cofense Triage
  enabled: true
  filter:
    query: source:cofense-triage
  processors:
    - type: date-remapper
      name: Define `attributes.updated_at` as the official date of the log
      enabled: true
      sources:
        - attributes.updated_at
    - type: pipeline
      name: Reports
      enabled: true
      filter:
        query: service:reports
      processors:
        - type: attribute-remapper
          name: Map `attributes.from_address` to `usr.email`
          enabled: true
          sources:
            - attributes.from_address
          sourceType: attribute
          target: usr.email
          targetType: attribute
          preserveSource: false
          overrideOnConflict: false
        - type: category-processor
          name: Category for `@attributes.risk_score` to `status`
          enabled: true
          categories:
            - filter:
                query: "@attributes.risk_score:>=80"
              name: alert
            - name: critical
              filter:
                query: "@attributes.risk_score:(>=41 <80)"
            - name: warning
              filter:
                query: "@attributes.risk_score:(>=21 <40)"
            - name: info
              filter:
                query: "@attributes.risk_score:<=20"
          target: status
        - type: status-remapper
          name: Define `status` as the official status of the log
          enabled: true
          sources:
            - status