fix(filters): normalize actionResult to canonical values

filters/antivirus/esmc-eset.yml

@@ -63,6 +63,7 @@ pipeline:
           from:
             - log.event
           to: actionResult
+          where: '!regexMatch("log.result", "(?i)\b(?:denied|blocked|failed)\b")'
       - rename:
           from:
             - log.sourceaddress
@@ -83,6 +84,28 @@ pipeline:
           from:
             - log.targetport
           to: target.port
+
+      # Adding action result
+      - add:
+          function: 'string'
+          params:
+            key: actionResult
+            value: 'denied'
+          where: regexMatch("log.event", "(?i)\bdenied\b")
+
+      - add:
+          function: 'string'
+          params:
+            key: actionResult
+            value: 'blocked'
+          where: regexMatch("log.event", "(?i)\bblocked\b")
+
+      - add:
+          function: 'string'
+          params:
+            key: actionResult
+            value: 'failed'
+          where: regexMatch("log.event", "(?i)\bfailed\b")
 
       # Adding severity field based on log.severity
       - add:

filters/azure/azure-eventhub.yml

@@ -797,22 +797,47 @@ pipeline:
           from:
             - log.properties.result
           to: actionResult
+          where: '!regexMatch("log.properties.result", "(?i)\b(?:denied|blocked|failed)\b")'
 
       - rename:
           from:
             - log.Properties.Result
           to: actionResult
+          where: '!regexMatch("log.properties.result", "(?i)\b(?:denied|blocked|failed)\b")'
 
       - rename:
           from:
             - log.properties.resultType
           to: actionResult
+          where: '!regexMatch("log.properties.result", "(?i)\b(?:denied|blocked|failed)\b")'
 
       - rename:
           from:
             - log.properties.userAgent
           to: log.propertiesUserAgent
 
+      # Adding action result
+      - add:
+          function: 'string'
+          params:
+            key: actionResult
+            value: 'denied'
+          where: regexMatch("log.properties.result", "(?i)\bdenied\b")
+
+      - add:
+          function: 'string'
+          params:
+            key: actionResult
+            value: 'blocked'
+          where: regexMatch("log.properties.result", "(?i)\bblocked\b")
+
+      - add:
+          function: 'string'
+          params:
+            key: actionResult
+            value: 'failed'
+          where: regexMatch("log.properties.result", "(?i)\bfailed\b")
+
       # .......................................................................#
       # Adding severity based on log.level
       # .......................................................................#

filters/google/gcp.yml

@@ -483,7 +483,7 @@ pipeline:
           function: "string"
           params:
             key: actionResult
-            value: "failure"
+            value: "failed"
           where: 'exists("log.protoPayloadMethodName") && greaterThan("log.protoPayloadStatusCode", 0)'
 
       # Adding geolocation to origin.ip

filters/linux/linux.yml

@@ -275,7 +275,7 @@ pipeline:
           from:
             - log.JOBRESULT
           to: actionResult
-          where: exists("log.JOBRESULT")
+          where: exists("log.JOBRESULT") && !regexMatch("log.JOBRESULT", "(?i)\b(?:denied|blocked|failed)\b")
 
       - rename:
           from:
@@ -418,7 +418,28 @@ pipeline:
           from:
             - log.result
           to: actionResult
-          where: 'equals("log.type", "auditd") && exists("log.result")'
+          where: 'equals("log.type", "auditd") && exists("log.result") && !regexMatch("log.result", "(?i)\b(?:denied|blocked|failed)\b")'
+
+      - add:
+          function: 'string'
+          params:
+            key: actionResult
+            value: 'denied'
+          where: regexMatch("log.type", "(?i)\bdenied\b")
+
+      - add:
+          function: 'string'
+          params:
+            key: actionResult
+            value: 'blocked'
+          where: regexMatch("log.type", "(?i)\bblocked\b")
+
+      - add:
+          function: 'string'
+          params:
+            key: actionResult
+            value: 'failed'
+          where: regexMatch("log.type", "(?i)\bfailed\b")
 
       # Map exe to origin.process (full path to executable)
       # Only if journald's COMM didn't already set origin.process

filters/office365/o365.yml

@@ -62,11 +62,6 @@ pipeline:
             - log.ClientIP
           to: origin.ip
 
-      - rename:  
-          from:
-            - log.ResultStatus
-          to: actionResult
-
       - rename:  
           from:
             - log.UserId
@@ -92,6 +87,21 @@ pipeline:
             - log.DestFolder.Path
           to: log.destFolderPath
 
+      # Adding action result
+      - add:
+          function: 'string'
+          params:
+            key: actionResult
+            value: 'success'
+          where: oneOf("log.ResultStatus", ["Succeeded", "Success", "Successful", "PartiallySucceeded", "True"])
+
+      - add:
+          function: 'string'
+          params:
+            key: actionResult
+            value: 'failed'
+          where: oneOf("log.ResultStatus", ["Failure", "Failed"])
+
       # Adding geolocation to origin ip
       - dynamic:
           plugin: com.utmstack.geolocation

filters/sophos/sophos_xg_firewall.yml

@@ -689,14 +689,14 @@ pipeline:
           params:
             key: actionResult
             value: 'denied'
-          where: exists("log.subType") && equals("log.subType", "Denied")
+          where: exists("log.subType") && regexMatch("log.subType", "(?i)\bdenied\b")
 
       - add:
           function: 'string'
           params:
             key: actionResult
             value: 'accepted'
-          where: exists("log.subType") && equals("log.subType", "Accepted") || equals("log.subType", "Allowed")
+          where: exists("log.subType") && oneOf("log.subType", ["Accepted", "Allowed"])
 
       # Renaming "log.statusCode" to "statusCode" to add it to the event structure
       - rename: