description: Pipeline for Office 365 Audit logs

processors:
  - set:
      field: event.ingested
      value: '{{_ingest.timestamp}}'
  - user_agent:
      field: user_agent.original
      ignore_missing: true
  - json:
      tag: json-extract-stringly-OperationProperties
      field: o365.audit.OperationProperties
      if: ctx.o365?.audit?.OperationProperties instanceof String
      on_failure:
        - remove:
            field: o365.audit.OperationProperties
        - append:
            field: error.message
            value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}'
  # URL
  - uri_parts:
      field: url.original
      target_field: _temp_.url
      ignore_failure: true
      if: ctx?.url?.original != null
  - script:
      lang: painless
      description: Updates the URL ECS fields from the results of the URI parts processor to not overwrite the RSA mappings
      if: ctx?._temp_?.url != null
      source: |
        for (entry in ctx._temp_.url.entrySet()) {
          if (entry != null && entry.getValue() != null) {
            if(ctx.url[entry.getKey()] == null) {
              ctx.url[entry.getKey()] = entry.getValue();
            } else if (!ctx.url[entry.getKey()].contains(entry.getValue())) {
              ctx.url[entry.getKey()] = [ctx.url[entry.getKey()]];
              ctx.url[entry.getKey()].add(entry.getValue());
            }
          }
        }
  - remove:
      field: _temp_
      ignore_missing: true
  # IP Geolocation Lookup
  - geoip:
      field: source.ip
      target_field: source.geo
      ignore_missing: true
  # IP Autonomous System (AS) Lookup
  - geoip:
      database_file: GeoLite2-ASN.mmdb
      field: source.ip
      target_field: source.as
      properties:
        - asn
        - organization_name
      ignore_missing: true
  - rename:
      field: source.as.asn
      target_field: source.as.number
      ignore_missing: true
  - rename:
      field: source.as.organization_name
      target_field: source.as.organization.name
      ignore_missing: true

on_failure:
  - set:
      field: error.message
      value: '{{ _ingest.on_failure_message }}'
