How to write a data model to map to an authentication story

Hisashi_Abe — Sat, 15 Feb 2025 12:50:58 GMT

We are creating a data model and have questions like:

==============================================

We are aware that the method of mapping to an authentication story requires defining the following,
as described in the documentation.

However, we are experiencing issues where the authentication story is not mapped.
Specifically, We have created the data model rules as follows, but do you know the cause?

After creating the data model, we have confirmed that the actual data is mapped to the following six schemas.

■Required Schemas
https://docs-cortex.paloaltonetworks.com/r/Cortex-XSIAM/Cortex-XSIAM-Administrator-Guide/MODEL
xdm.source.ipv4
xdm.source.user.upn ※Automatic enrichment
xdm.event.original_event_type
xdm.event.outcome
xdm.event.outcome_reason
xdm.event.operation

■Created data model
[MODEL: dataset=xxx_xxxxx_raw]
alter
xdm.event.type = "authentication",
xdm.event.description = "authentication",
xdm.source.ipv4 = json_extract_scalar(_raw_log , "$.ip"),
xdm.source.user.username= json_extract_scalar(_raw_log , "$.username"),
xdm.source.user.domain= "XXX.LOCAL",
xdm.source.user.user_type = XDM_CONST.USER_TYPE_REGULAR,
xdm.event.original_event_type = "Logon",
xdm.event.outcome = if(lowercase(json_extract_scalar(_raw_log , "$.login_successful")) = "true", XDM_CONST.OUTCOME_SUCCESS, lowercase(json_extract_scalar(_raw_log , "$.login_successful")) = "false", XDM_CONST.OUTCOME_FAILED, null),
xdm.event.outcome_reason = if(json_extract_scalar(_raw_log , "$.reason") != null,json_extract_scalar(_raw_log , "$.reason"), lowercase(json_extract_scalar(_raw_log , "$.login_successful")) = "true", "SUCCESS",null),
xdm.event.operation = XDM_CONST.OPERATION_TYPE_AUTH_LOGIN,
xdm.auth.service = json_extract_scalar(_raw_log , "$.service_name"),
xdm.auth.auth_method = json_extract_scalar(_raw_log , "$.login_type"),
xdm.auth.privilege_level = XDM_CONST.PRIVILEGE_LEVEL_USER,
xdm.logon.type = XDM_CONST.LOGON_TYPE_SERVICE,
xdm.event.operation_sub_type = "LOGIN_EVENT";

topic How to write a data model to map to an authentication story in Cortex XSIAM Discussions

How to write a data model to map to an authentication story