收集 Zscaler Web 代理日志

支持的平台：

Google SecOps SIEM

本文档介绍了如何通过设置 Google Security Operations Feed 来导出 Zscaler Webproxy 日志，以及日志字段如何映射到 Google SecOps Unified Data Model (UDM) 字段。

如需了解详情，请参阅将数据注入 Google SecOps 概览。

典型部署包括 Zscaler Webproxy 和配置为将日志发送到 Google SecOps 的 Google SecOps Webhook Feed。每个客户部署都可能有所不同，并且可能更复杂。

部署包含以下组件：

Zscaler Webproxy：您从中收集日志的平台。
Google SecOps Feed：从 Zscaler Webproxy 获取日志并将日志写入 Google SecOps 的 Google SecOps Feed。
Google SecOps：保留和分析日志。

注入标签用于标识将原始日志数据标准化为结构化 UDM 格式的解析器。本文档中的信息适用于具有 ZSCALER_WEBPROXY 注入标签的解析器。

准备工作

确保您满足以下前提条件：

访问 Zscaler Internet Access 控制台的权限。如需了解详情，请参阅 Secure Internet and SaaS Access ZIA 帮助。
Zscaler Webproxy 2024 或更高版本
部署架构中的所有系统都使用世界协调时间 (UTC) 时区进行配置。
在 Google Security Operations 中完成 Feed 设置所需的 API 密钥。如需了解详情，请参阅设置 API 密钥。

设置 Feed

您可以通过两种不同的入口点在 Google SecOps 平台中设置 Feed：

SIEM 设置 > Feed
内容中心 > 内容包

通过 SIEM 设置 > Feed 设置 Feed

如需为相应产品系列中的不同日志类型配置多个 Feed，请参阅按产品配置 Feed。

如需配置单个 Feed，请按以下步骤操作：

依次前往 SIEM 设置 > Feed。
点击添加新 Feed。
在下一页上，点击配置单个 Feed。
在 Feed 名称字段中，输入 Feed 的名称，例如 Zscaler Webproxy Logs。
选择 Webhook 作为来源类型。
选择 Zscaler 作为日志类型。
点击下一步。
可选：为以下输入参数输入值：
1. 拆分定界符：用于分隔日志行的定界符。如果不使用定界符，请留空。
2. 资产命名空间：资产命名空间。
3. 提取标签：要应用于相应 Feed 中事件的标签。
点击下一步。
检查新的 Feed 配置，然后点击提交。
点击生成密钥，生成用于验证此 Feed 的密钥。

设置来自内容中心的 Feed

为以下字段指定值：

拆分定界符：用于分隔日志行的定界符，例如 \n。

高级选项

Feed 名称：用于标识 Feed 的预填充值。
来源类型：用于将日志收集到 Google SecOps 中的方法。
资产命名空间：资产命名空间。
提取标签：应用于相应 Feed 中事件的标签。
点击下一步。
在最终确定界面中查看 Feed 配置，然后点击提交。
点击生成密钥，生成用于对此 Feed 进行身份验证的密钥。

设置 Zscaler Web 代理

在 Zscaler Internet Access 控制台中，依次点击管理 > Nanolog 流式传输服务 > Cloud NSS Feed，然后点击添加 Cloud NSS Feed。
系统随即会显示添加 Cloud NSS Feed 窗口。在该窗口中，输入详细信息。
在Feed Name 字段中输入 Feed 的名称。
在 NSS 类型中选择 NSS for Web。
从状态列表中选择相应状态，以启用或停用 NSS Feed。
将 SIEM 速率下拉菜单中的值保留为无限制。如需因许可或其他限制而抑制输出流，请更改该值。
在 SIEM 类型列表中，选择其他。
在 OAuth 2.0 身份验证列表中，选择已停用。
根据 SIEM 的最佳实践，在 Max Batch Size 中输入单个 HTTP 请求载荷的大小限制。例如，512 KB。
以以下格式在 API 网址中输入 Chronicle API 端点的 HTTPS 网址：
```
  https://<CHRONICLE_REGION>-chronicle.googleapis.com/v1alpha/projects/<GOOGLE_PROJECT_NUMBER>/locations/<LOCATION>/instances/<CUSTOMER_ID>/feeds/<FEED_ID>:importPushLogs
```
- CHRONICLE_REGION：Chronicle 实例的托管区域。例如，美国。
- GOOGLE_PROJECT_NUMBER： Google Cloud 项目编号。
- LOCATION：Chronicle 区域。例如，美国。
- CUSTOMER_ID：Chronicle 客户 ID。
- FEED_ID：在创建的新 Webhook 的 Feed 界面上显示的 Feed ID
- API 网址示例：
```
https://us-chronicle.googleapis.com/v1alpha/projects/12345678910/locations/US/instances/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/feeds/yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyyy:importPushLogs
```
点击添加 HTTP 标头，然后添加以下格式的 HTTP 标头：
- Header 1：Key1： X-goog-api-key 和 Value1：在 Google Cloud的 API 凭据中生成的 API 密钥。
- Header 2：Key2： X-Webhook-Access-Key 和 Value2：在 Webhook 的“SECRET KEY”（密钥）中生成的 API 密钥。
在日志类型列表中选择 Web 日志。
在 Feed 输出类型列表中，选择 JSON。
停用 JSON 数组表示法。
将Feed 转义字符设置为 , \ "。
如需向 Feed 输出格式添加新字段，请在 Feed 输出类型列表中选择自定义。

将以下Feed 输出格式复制并粘贴到默认的Feed 输出格式中：

  \{ "sourcetype" : "zscalernss-web", "event" : \{"datetime":"%04d{yyyy}-%02d{mth}-%02d{dd} %02d{hh}:%02d{mm}:%02d{ss}","reason":"%s{reason}","event_id":"%d{recordid}","protocol":"%s{proto}","action":"%s{action}","transactionsize":"%d{totalsize}","responsesize":"%d{respsize}","requestsize":"%d{reqsize}","urlcategory":"%s{urlcat}","serverip":"%s{sip}","requestmethod":"%s{reqmethod}","refererURL":"%s{ereferer}","useragent":"%s{eua}","product":"NSS","location":"%s{elocation}","ClientIP":"%s{cip}","status":"%s{respcode}","user":"%s{elogin}","url":"%s{eurl}","vendor":"Zscaler","hostname":"%s{ehost}","clientpublicIP":"%s{cintip}","threatcategory":"%s{malwarecat}","threatname":"%s{threatname}","filetype":"%s{filetype}","appname":"%s{appname}","app_status":"%s{app_status}","pagerisk":"%d{riskscore}","threatseverity":"%s{threatseverity}","department":"%s{edepartment}","urlsupercategory":"%s{urlsupercat}","appclass":"%s{appclass}","dlpengine":"%s{dlpeng}","urlclass":"%s{urlclass}","threatclass":"%s{malwareclass}","dlpdictionaries":"%s{dlpdict}","fileclass":"%s{fileclass}","bwthrottle":"%s{bwthrottle}","contenttype":"%s{contenttype}","unscannabletype":"%s{unscannabletype}","deviceowner":"%s{deviceowner}","devicehostname":"%s{devicehostname}","keyprotectiontype":"%s{keyprotectiontype}"\}\}

如需添加其他字段，请相应地更新Feed 输出格式，并确保键名称与官方 Zscaler Webproxy 文档中显示的实际字段名称一致。如需详细了解支持的字段，请参阅字段映射参考。
在时区列表中，选择输出文件中时间字段的时区。默认情况下，时区设置为组织的时区。
查看配置的设置。
点击保存以测试连接。如果连接成功，系统会显示一个绿色对勾，并附带消息 Test Connectivity Successful: OK (200)。

如需详细了解 Google SecOps Feed，请参阅 Google SecOps Feed 文档。如需了解每种 Feed 类型的要求，请参阅按类型配置 Feed。

如果您在创建 Feed 时遇到问题，请与 Google SecOps 支持团队联系。

支持的 Zscaler Web 代理日志格式

Zscaler Webproxy 解析器支持 JSON 格式的日志。

支持的 Zscaler Web 代理示例日志

JSON

  {
    "event": {
      "ClientIP": "198.51.100.0",
      "action": "Allowed",
      "appclass": "Sales and Marketing",
      "appname": "Trend Micro",
      "bwthrottle": "NO",
      "clientpublicIP": "198.51.100.1",
      "contenttype": "Other",
      "datetime": "2024-05-06 10:56:04",
      "department": "Mid-Continent%20Companies",
      "devicehostname": "dummyhostname",
      "deviceowner": "dummydeviceowner",
      "dlpdictionaries": "None",
      "dlpengine": "None",
      "event_id": "7365838693731467265",
      "fileclass": "None",
      "filetype": "None",
      "hostname": "dummyhostname.com",
      "keyprotectiontype": "N/A",
      "location": "Road%20Warrior",
      "pagerisk": "0",
      "product": "NSS",
      "protocol": "HTTP_PROXY",
      "reason": "Allowed",
      "refererURL": "None",
      "requestmethod": "CONNECT",
      "requestsize": "606",
      "responsesize": "65",
      "serverip": "198.51.10.2",
      "status": "200",
      "threatcategory": "None",
      "threatclass": "None",
      "threatname": "None",
      "threatseverity": "None",
      "transactionsize": "671",
      "unscannabletype": "None",
      "url": "dummyurl.com:443",
      "urlcategory": "SSL - DNI - Bypass",
      "urlclass": "Bandwidth Loss",
      "urlsupercategory": "User-defined",
      "user": "abc@xyz.com",
      "useragent": "dummyuseragent",
      "vendor": "Zscaler"
    },
    "sourcetype": "zscalernss-web"
  }

字段映射参考

下表列出了 ZSCALER_WEBPROXY 日志类型的日志字段及其对应的 UDM 字段。

Log field	UDM mapping	Logic
	`metadata.vendor_name`	The `metadata.vendor_name` UDM field is set to `Zscaler`.
	`metadata.event_type`	If the `ClientIP` log field value is not empty and the `serverip` log field value is not empty and the `proto` log field value contain one of the following values, then the `metadata.event_type` UDM field is set to `NETWORK_HTTP`. `HTTPS` `HTTP` Else, if the `ClientIP` log field value is not empty and the `serverip` log field value is not empty, then the `metadata.event_type` UDM field is set to `NETWORK_CONNECTION`. Else, if the `user` log field value is not empty or the `deviceowner` log field value is not empty, then the `metadata.event_type` UDM field is set to `USER_UNCATEGORIZED`. Else, the `metadata.event_type` UDM field is set to `GENERIC_EVENT`.
	`metadata.product_name`	The `metadata.product_name` UDM field is set to `Web Proxy`.
`sourcetype`	`additional.fields[sourcetype]`
`datetime`	`metadata.event_timestamp`
`tz`	`additional.fields[tz]`
`ss`	`additional.fields[ss]`
`mm`	`additional.fields[mm]`
`hh`	`additional.fields[hh]`
`dd`	`additional.fields[dd]`
`mth`	`additional.fields[mth]`
`yyyy`	`additional.fields[yyyy]`
`mon`	`additional.fields[mon]`
`day`	`additional.fields[day]`
`department`	`principal.user.department`
`b64dept`	`principal.user.department`
`edepartment`	`principal.user.department`
`user`	`principal.user.email_addresses`
`user`	`principal.user.userid`	The `EMAILLOCALPART` field is extracted from `user` log field using the Grok pattern, and the `EMAILLOCALPART` log field is mapped to the `principal.user.userid` UDM field.
`b64login`	`principal.user.email_addresses`
`b64login`	`principal.user.userid`	The `EMAILLOCALPART` field is extracted from `b64login` log field using the Grok pattern, and the `EMAILLOCALPART` log field is mapped to the `principal.user.userid` UDM field.
`elogin`	`principal.user.email_addresses`
`elogin`	`principal.user.userid`	The `EMAILLOCALPART` field is extracted from `elogin` log field using the Grok pattern, and the `EMAILLOCALPART` log field is mapped to the `principal.user.userid` UDM field.
`ologin`	`principal.user.email_addresses`
`ologin`	`principal.user.userid`	The `EMAILLOCALPART` field is extracted from `ologin` log field using the Grok pattern, and the `EMAILLOCALPART` log field is mapped to the `principal.user.userid` UDM field.
`cloudname`	`intermediary.resource.attribute.labels[cloudname]`
`company`	`principal.user.company_name`
`throttlereqsize`	`security_result.detection_fields[throttlereqsize]`
`throttlerespsize`	`security_result.detection_fields[throttlerespsize]`
`bwthrottle`	`security_result.detection_fields[bwthrottle]`
	`security_result.category`	If the `bwthrottle` log field value is equal to `Yes`, then the `security_result.category` UDM field is set to `POLICY_VIOLATION`.
`bwclassname`	`security_result.detection_fields[bwclassname]`
`obwclassname`	`security_result.detection_fields[obwclassname]`
`bwrulename`	`security_result.rule_name`
`appname`	`target.application`
`appclass`	`security_result.detection_fields[appclass]`
`module`	`security_result.detection_fields[module]`
`app_risk_score`	`security_result.risk_score`	If the `app_risk_score` log field value matches the regular expression pattern `[0-9]+`, then the `app_risk_score` log field is mapped to the `security_result.risk_score` UDM field.
`datacenter`	`target.location.name`
`datacentercity`	`target.location.city`
`datacentercountry`	`target.location.country_or_region`
`dlpdictionaries`	`security_result.detection_fields[dlpdictionaries]`
`odlpdict`	`security_result.detection_fields[odlpdict]`
`dlpdicthitcount`	`security_result.detection_fields[dlpdicthitcount]`
`dlpengine`	`security_result.detection_fields[dlpengine]`
`odlpeng`	`security_result.detection_fields[odlpeng]`
`dlpidentifier`	`security_result.detection_fields[dlpidentifier]`
`dlpmd5`	`security_result.detection_fields[dlpmd5]`
`dlprulename`	`security_result.rule_name`
`b64dlprulename`	`security_result.rule_name`
`odlprulename`	`security_result.rule_name`
`fileclass`	`additional.fields[fileclass]`
`filetype`	`target.file.file_type`	If the `filetype` log field value matches the regular expression `(?i)(xlsx)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_XLSX`. Else, if the `filetype` log field value matches the regular expression `(?i)(xls)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_XLS`. Else, if the `filetype` log field value matches the regular expression `(?i)(cab)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_CAB`. Else, if the `filetype` log field value matches the regular expression `(?i)(pcapng\|pcap\|cap)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_CAP`. Else, if the `filetype` log field value matches the regular expression `(?i)(tar.gz\|egg)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PYTHON_PKG`. Else, if the `filetype` log field value matches the regular expression `(?i)(gzip\|tgz\|gz)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_GZIP`. Else, if the `filetype` log field value matches the regular expression `(?i)(zip)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ZIP`. Else, if the `filetype` log field value matches the regular expression `(?i)(gif)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_GIF`. Else, if the log message matches the regular expression `(?i)(\\bdos\\b)` AND the `filetype` log field value matches the regular expression `(?i)(exe\|com)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_DOS_EXE`. Else, if the log message matches the regular expression `(?i)(\\bne_exe\\b)` AND the `filetype` log field value matches the regular expression `(?i)(exe)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_NE_EXE`. Else, if the `filetype` log field value matches the regular expression `(?i)(exe)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PE_EXE`. Else, if the `filetype` log field value matches the regular expression `(?i)(msi)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_MSI`. Else, if the `filetype` log field value matches the regular expression `(?i)(ocx\|sys)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PE_DLL`. Else, if the `filetype` log field value matches the regular expression `(?i)(pdf\|(portable\\sdocument\\sformat))`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PDF`. Else, if the `filetype` log field value matches the regular expression `(?i)(docx)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_DOCX`. Else, if the `filetype` log field value matches the regular expression `(?i)(doc)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_DOC`. Else, if the `filetype` log field value matches the regular expression `(?i)(html\|htm)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_HTML`. Else, if the `filetype` log field value matches the regular expression `(?i)(jar)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_JAR`. Else, if the `filetype` log field value matches the regular expression `(?i)(jpeg\|jpg)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_JPEG`. Else, if the `filetype` log field value matches the regular expression `(?i)(mov)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_MOV`. Else, if the `filetype` log field value matches the regular expression `(?i)(mp3)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_MP3`. Else, if the `filetype` log field value matches the regular expression `(?i)(mp4)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_MP4`. Else, if the `filetype` log field value matches the regular expression `(?i)(png)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PNG`. Else, if the `filetype` log field value matches the regular expression `(?i)(pptx)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PPTX`. Else, if the `filetype` log field value matches the regular expression `(?i)(ppt)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PPT`. Else, if the `filetype` log field value matches the regular expression `(?i)(rar)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_RAR`. Else, if the `filetype` log field value matches the regular expression `(?i)(ace)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ACE`. Else, if the `filetype` log field value matches the regular expression `(?i)(apk\|aar\|dex)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ANDROID`. Else, if the `filetype` log field value matches the regular expression `(?i)(plist)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_APPLE_PLIST`. Else, if the `filetype` log field value matches the regular expression `(?i)(applescript)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_APPLESCRIPT`. Else, if the `filetype` log field value matches the regular expression `(?i)(app)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_APPLE`. Else, if the `filetype` log field value matches the regular expression `(?i)(scpt)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_APPLESCRIPT_COMPILED`. Else, if the `filetype` log field value matches the regular expression `(?i)(arc)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ARC`. Else, if the `filetype` log field value matches the regular expression `(?i)(arj)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ARJ`. Else, if the `filetype` log field value matches the regular expression `(?i)(asd)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ASD`. Else, if the `filetype` log field value matches the regular expression `(?i)(asf)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ASF`. Else, if the `filetype` log field value matches the regular expression `(?i)(avi)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_AVI`. Else, if the `filetype` log field value matches the regular expression `(?i)(awk)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_AWK`. Else, if the `filetype` log field value matches the regular expression `(?i)(bmp)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_BMP`. Else, if the `filetype` log field value matches the regular expression `(?i)(dib)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_DIB`. Else, if the `filetype` log field value matches the regular expression `(?i)(bz2)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_BZIP`. Else, if the `filetype` log field value matches the regular expression `(?i)(chm)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_CHM`. Else, if the `filetype` log field value matches the regular expression `(?i)(cljc\|cljs\|clj)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_CLJ`. Else, if the `filetype` log field value matches the regular expression `(?i)(crt\|cer)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_CRT`. Else, if the `filetype` log field value matches the regular expression `(?i)(crx)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_CRX`. Else, if the `filetype` log field value matches the regular expression `(?i)(csv)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_CSV`. Else, if the `filetype` log field value matches the regular expression `(?i)(deb)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_DEB`. Else, if the `filetype` log field value matches the regular expression `(?i)(dmg)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_DMG`. Else, if the `filetype` log field value matches the regular expression `(?i)(divx)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_DIVX`. Else, if the `filetype` log field value matches the regular expression `(?i)(com)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_DOS_COM`. Else, if the `filetype` log field value matches the regular expression `(?i)(dwg)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_DWG`. Else, if the `filetype` log field value matches the regular expression `(?i)(dxf)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_DXF`. Else, if the `filetype` log field value matches the regular expression `(?i)(dyalog)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_DYALOG`. Else, if the `filetype` log field value matches the regular expression `(?i)(dzip)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_DZIP`. Else, if the `filetype` log field value matches the regular expression `(?i)(epub\|mobi\|azw)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_EBOOK`. Else, if the `filetype` log field value matches the regular expression `(?i)(elf)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ELF`. Else, if the `filetype` log field value matches the regular expression `(?i)(eml)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_EMAIL_TYPE`. Else, if the `filetype` log field value matches the regular expression `(?i)(emf)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_EMF`. Else, if the `filetype` log field value matches the regular expression `(?i)(eot)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_EOT`. Else, if the `filetype` log field value matches the regular expression `(?i)(eps)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_EPS`. Else, if the `filetype` log field value matches the regular expression `(?i)(flac)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_FLAC`. Else, if the `filetype` log field value matches the regular expression `(?i)(fla)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_FLA`. Else, if the `filetype` log field value matches the regular expression `(?i)(fli)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_FLI`. Else, if the `filetype` log field value matches the regular expression `(?i)(flc)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_FLC`. Else, if the `filetype` log field value matches the regular expression `(?i)(flv)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_FLV`. Else, if the `filetype` log field value matches the regular expression `(?i)(fpx)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_FPX`. Else, if the `filetype` log field value matches the regular expression `(?i)(xcf)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_GIMP`. Else, if the `filetype` log field value matches the regular expression `(?i)(go)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_GOLANG`. Else, if the `filetype` log field value matches the regular expression `(?i)(gul)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_GUL`. Else, if the `filetype` log field value matches the regular expression `(?i)(hwp)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_HWP`. Else, if the `filetype` log field value matches the regular expression `(?i)(ico)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ICO`. Else, if the `filetype` log field value matches the regular expression `(?i)(indd\|idml)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_IN_DESIGN`. Else, if the `filetype` log field value matches the regular expression `(?i)(ipa)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_IPHONE`. Else, if the `filetype` log field value matches the regular expression `(?i)(ips)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_IPS`. Else, if the `filetype` log field value matches the regular expression `(?i)(iso)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ISOIMAGE`. Else, if the `filetype` log field value matches the regular expression `(?i)(java)` AND the `filetype` log field value does NOT match the regular expression `(?i)(javascript)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_JAVA`. Else, if the `filetype` log field value matches the regular expression `(?i)(class)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_JAVA_BYTECODE`. Else, if the `filetype` log field value matches the regular expression `(?i)(jmod)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_JMOD`. Else, if the `filetype` log field value matches the regular expression `(?i)(jng)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_JNG`. Else, if the `filetype` log field value matches the regular expression `(?i)(json)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_JSON`. Else, if the `filetype` log field value matches the regular expression `(?i)(js)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_JAVASCRIPT`. Else, if the `filetype` log field value matches the regular expression `(?i)(kgb)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_KGB`. Else, if the `filetype` log field value matches the regular expression `(?i)(tex)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_LATEX`. Else, if the `filetype` log field value matches the regular expression `(?i)(lzfse)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_LZFSE`. Else, if the `filetype` log field value matches the regular expression `(?i)(vmlinuz\|ko)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_LINUX_KERNEL`. Else, if the `filetype` log field value matches the regular expression `(?i)(bundle\|framework)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_MACH_O`. Else, if the log message matches the regular expression `(?i)(\\bmach\\b)` AND the `filetype` log field value matches the regular expression `(?i)(dylib\|o)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_MACH_O`. Else, if the `filetype` log field value matches the regular expression `(?i)(so\|initrd\|vmlinux\|pkg.tar.zst\|ext4\|ext3\|ext2\|swap)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_LINUX`. Else, if the `filetype` log field value matches the regular expression `(?i)(ini)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_INI`. Else, if the log message matches the regular expression `(?i)(\\blinux\\b)` AND the `filetype` log field value matches the regular expression `sfs`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_LINUX`. Else, if the `filetype` log field value matches the regular expression `(?i)(lnk)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_LNK`. Else, if the `filetype` log field value matches the regular expression `(?i)(m4)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_M4`. Else, if the `filetype` log field value matches the regular expression `(?i)(midi\|mid)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_MIDI`. Else, if the `filetype` log field value matches the regular expression `(?i)(mkv)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_MKV`. Else, if the `filetype` log field value matches the regular expression `(?i)(mpg\|mpeg)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_MPEG`. Else, if the `filetype` log field value matches the regular expression `(?i)(sz_)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_MSCOMPRESS`. Else, if the `filetype` log field value matches the regular expression `(?i)(dll)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_NE_DLL`. Else, if the `filetype` log field value matches the regular expression `(?i)(odg)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ODG`. Else, if the `filetype` log field value matches the regular expression `(?i)(odp)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ODP`. Else, if the `filetype` log field value matches the regular expression `(?i)(ods)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ODS`. Else, if the `filetype` log field value matches the regular expression `(?i)(odt)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ODT`. Else, if the `filetype` log field value matches the regular expression `(?i)(ogg\|oga\|ogv)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_OGG`. Else, if the `filetype` log field value matches the regular expression `(?i)(one)` AND the `filetype` log field value does NOT match the regular expression `(?i)(none)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ONE_NOTE`. Else, if the `filetype` log field value matches the regular expression `(?i)(pst\|ost)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_OUTLOOK`. Else, if the log message matches the regular expression `(?i)(\\boutlook\\b)` AND the `filetype` log field value matches the regular expression `(?i)(msg)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_OUTLOOK`. Else, if the log message matches the regular expression `(?i)(\\bemail\\b)` AND the `filetype` log field value matches the regular expression `(?i)(msg)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_EMAIL_TYPE`. Else, if the `filetype` log field value matches the regular expression `(?i)(prc)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PALMOS`. Else, if the `filetype` log field value matches the regular expression `(?i)(pdb)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PDB`. Else, if the `filetype` log field value matches the regular expression `(?i)(pem)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PEM`. Else, if the `filetype` log field value matches the regular expression `(?i)(pgp\|gpg\|asc)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PGP`. Else, if the `filetype` log field value matches the regular expression `(?i)(php)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PHP`. Else, if the `filetype` log field value matches the regular expression `(?i)(pkg)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PKG`. Else, if the `filetype` log field value matches the regular expression `(?i)(ps1\|psm1)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_POWERSHELL`. Else, if the `filetype` log field value matches the regular expression `(?i)(ppsx)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PPSX`. Else, if the `filetype` log field value matches the regular expression `(?i)(psd)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PSD`. Else, if the `filetype` log field value matches the regular expression `(?i)(ps)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PS`. Else, if the `filetype` log field value matches the regular expression `(?i)(pyc)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PYC`. Else, if the `filetype` log field value matches the regular expression `(?i)(py\|pyw)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PYTHON`. Else, if the `filetype` log field value matches the regular expression `(?i)(whl)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PYTHON_WHL`. Else, if the `filetype` log field value matches the regular expression `(?i)(qt)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_QUICKTIME`. Else, if the `filetype` log field value matches the regular expression `(?i)(rm\|rmvb)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_RM`. Else, if the `filetype` log field value matches the regular expression `(?i)(rom\|bin)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ROM`. Else, if the `filetype` log field value matches the regular expression `(?i)(rpm)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_RPM`. Else, if the `filetype` log field value matches the regular expression `(?i)(rtf)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_RTF`. Else, if the `filetype` log field value matches the regular expression `(?i)(rb)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_RUBY`. Else, if the `filetype` log field value matches the regular expression `(?i)(rz)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_RZIP`. Else, if the `filetype` log field value matches the regular expression `(?i)(7z)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_SEVENZIP`. Else, if the `filetype` log field value matches the regular expression `(?i)(sgml\|sgm)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_SGML`. Else, if the `filetype` log field value matches the regular expression `(?i)(bash\|csh\|zsh)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_SHELLSCRIPT`. Else, if the `filetype` log field value matches the regular expression `(?i)(sql)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_SQL`. Else, if the `filetype` log field value matches the regular expression `(?i)(sqfs\|sfs)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_SQUASHFS`. Else, if the `filetype` log field value matches the regular expression `(?i)(svg)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_SVG`. Else, if the `filetype` log field value matches the regular expression `(?i)(swf)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_SWF`. Else, if the `filetype` log field value matches the regular expression `(?i)(sis\|sisx)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_SYMBIAN`. Else, if the `filetype` log field value matches the regular expression `(?i)(3gp)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_T3GP`. Else, if the `filetype` log field value matches the regular expression `(?i)(tar)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_TAR`. Else, if the `filetype` log field value matches the regular expression `(?i)(tga)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_TARGA`. Else, if the `filetype` log field value matches the regular expression `(?i)(3ds\|max)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_THREEDS`. Else, if the `filetype` log field value matches the regular expression `(?i)(tif\|tiff)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_TIFF`. Else, if the `filetype` log field value matches the regular expression `(?i)(torrent)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_TORRENT`. Else, if the `filetype` log field value matches the regular expression `(?i)(ttf)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_TTF`. Else, if the `filetype` log field value matches the regular expression `(?i)(vba)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_VBA`. Else, if the `filetype` log field value matches the regular expression `(?i)(vhd\|vhdx)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_VHD`. Else, if the `filetype` log field value matches the regular expression `(?i)(wav)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_WAV`. Else, if the `filetype` log field value matches the regular expression `(?i)(webm)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_WEBM`. Else, if the `filetype` log field value matches the regular expression `(?i)(webp)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_WEBP`. Else, if the `filetype` log field value matches the regular expression `(?i)(wer)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_WER`. Else, if the `filetype` log field value matches the regular expression `(?i)(wma)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_WMA`. Else, if the `filetype` log field value matches the regular expression `(?i)(wmv)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_WMV`. Else, if the `filetype` log field value matches the regular expression `(?i)(woff\|woff2)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_WOFF`. Else, if the `filetype` log field value matches the regular expression `(?i)(xml)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_XML`. Else, if the `filetype` log field value matches the regular expression `(?i)(xpi)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_XPI`. Else, if the `filetype` log field value matches the regular expression `(?i)(xwd)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_XWD`. Else, if the `filetype` log field value matches the regular expression `(?i)(zst)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ZST`. Else, if the `filetype` log field value matches the regular expression `(?i)(Makefile\|makefile\|mk)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_MAKEFILE`. Else, if the `filetype` log field value matches the regular expression `(?i)(zlib)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ZLIB`. Else, if the `filetype` log field value matches the regular expression `(?i)(hqx)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_MACINTOSH`. Else, if the `filetype` log field value matches the regular expression `(?i)(hfs\|dsk\|toast)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_MACINTOSH_HFS`. Else, if the `filetype` log field value matches the regular expression `(?i)(bh\|log\|dat)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_BLACKHOLE`. Else, if the log message matches the regular expression `(?i)(\\bcookie\\b)` AND the `filetype` log field value matches the regular expression `(?i)(txt)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_COOKIE`. Else, if the `filetype` log field value matches the regular expression `(?i)(txt)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_TEXT`. Else, if the `filetype` log field value matches the regular expression `(?i)(docx\|xlsx\|pptx)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_OOXML`. Else, if the `filetype` log field value matches the regular expression `(?i)(odt\|ods\|odp\|odg)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ODF`. Else, if the `filetype` log field value matches the regular expression `(?i)(for\|f90\|f95)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_FORTRAN`. Else, if the log message matches the regular expression `(?i)(\\bwince\\b)` AND the `filetype` log field value matches the regular expression `(?i)(exe\|cab\|dll)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_WINCE`. Else, if the log message matches the regular expression `(?i)(\\bscript\\b)` AND the `filetype` log field value matches the regular expression `(?i)(py\|js\|pl\|rb)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_SCRIPT`. Else, if the log message matches the regular expression `(?i)(\\bapplesingle\\b)` AND the `filetype` log field value matches the regular expression `(?i)(as\|bin)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_APPLESINGLE`. Else, if the log message matches the regular expression `(?i)(\\bmacintosh\\b)` AND the `filetype` log field value matches the regular expression `(?i)(dylib\|a)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_MACINTOSH_LIB`. Else, if the log message matches the regular expression `(?i)(\\bappledouble\\b)` AND the `filetype` log field value matches the regular expression `(?i)(ad\|._)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_APPLEDOUBLE`. Else, if the log message matches the regular expression `(?i)(\\bobjetivec\\b)` AND the `filetype` log field value matches the regular expression `(?i)(m\|mm\|h)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_OBJETIVEC`. Else, if the `filetype` log field value matches the regular expression `(?i)(obj\|lib)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_COFF`. Else, if the log message matches the regular expression `(?i)(\\bcpp\\b)` AND the `filetype` log field value matches the regular expression `(?i)(hpp\|cpp\|cc\|cxx\|h)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_CPP`. Else, if the `filetype` log field value matches the regular expression `(?i)(pas\|pp)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PASCAL`. Else, if the `filetype` log field value matches the regular expression `(?i)(pl\|pm)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PERL`. Else, if the `filetype` log field value matches the regular expression `(?i)\\bsh\\b`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_SHELLSCRIPT`. Else, if the `filetype` log field value matches the regular expression `(?i)\\bc\\b$`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_C`. Else, if the `filetype` log field value matches the regular expression `(?i)\\bn\\b$`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_NEKO`. Else, if the `filetype` log field value matches the regular expression `(?i)\\bf\\b`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_FORTRAN`. Else, the UDM field `additional.fields.key` is set to `file_type` and the log field value `filetype` is mapped to the `additional.fields.value` UDM field, provided the `filetype` value is not empty.
`filename`	`target.file.full_path`
`b64filename`	`target.file.full_path`
`efilename`	`target.file.full_path`
`filesubtype`	`additional.fields[filesubtype]`
`upload_fileclass`	`additional.fields[upload_fileclass]`
`upload_filetype`	`target.file.file_type`	If the `filetype` log field value is empty or equal to `None` and the `upload_filetype` log field value is not empty and not equal to `None`, then: If the `upload_filetype` log field value matches the regular expression `(?i)(xlsx)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_XLSX`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(xls)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_XLS`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(cab)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_CAB`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(pcapng\|pcap\|cap)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_CAP`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(tar.gz\|egg)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PYTHON_PKG`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(gzip\|tgz\|gz)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_GZIP`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(zip)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ZIP`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(gif)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_GIF`. Else, if the log message matches the regular expression `(?i)(\\bdos\\b)` AND the `upload_filetype` log field value matches the regular expression `(?i)(exe\|com)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_DOS_EXE`. Else, if the log message matches the regular expression `(?i)(\\bne_exe\\b)` AND the `upload_filetype` log field value matches the regular expression `(?i)(exe)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_NE_EXE`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(exe)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PE_EXE`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(msi)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_MSI`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(ocx\|sys)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PE_DLL`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(pdf\|(portable\\sdocument\\sformat))`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PDF`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(docx)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_DOCX`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(doc)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_DOC`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(html\|htm)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_HTML`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(jar)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_JAR`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(jpeg\|jpg)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_JPEG`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(mov)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_MOV`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(mp3)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_MP3`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(mp4)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_MP4`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(png)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PNG`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(pptx)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PPTX`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(ppt)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PPT`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(rar)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_RAR`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(ace)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ACE`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(apk\|aar\|dex)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ANDROID`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(plist)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_APPLE_PLIST`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(applescript)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_APPLESCRIPT`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(app)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_APPLE`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(scpt)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_APPLESCRIPT_COMPILED`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(arc)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ARC`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(arj)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ARJ`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(asd)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ASD`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(asf)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ASF`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(avi)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_AVI`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(awk)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_AWK`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(bmp)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_BMP`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(dib)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_DIB`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(bz2)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_BZIP`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(chm)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_CHM`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(cljc\|cljs\|clj)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_CLJ`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(crt\|cer)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_CRT`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(crx)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_CRX`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(csv)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_CSV`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(deb)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_DEB`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(dmg)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_DMG`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(divx)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_DIVX`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(com)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_DOS_COM`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(dwg)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_DWG`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(dxf)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_DXF`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(dyalog)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_DYALOG`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(dzip)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_DZIP`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(epub\|mobi\|azw)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_EBOOK`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(elf)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ELF`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(eml)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_EMAIL_TYPE`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(emf)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_EMF`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(eot)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_EOT`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(eps)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_EPS`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(flac)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_FLAC`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(fla)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_FLA`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(fli)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_FLI`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(flc)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_FLC`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(flv)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_FLV`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(fpx)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_FPX`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(xcf)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_GIMP`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(go)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_GOLANG`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(gul)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_GUL`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(hwp)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_HWP`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(ico)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ICO`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(indd\|idml)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_IN_DESIGN`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(ipa)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_IPHONE`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(ips)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_IPS`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(iso)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ISOIMAGE`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(java)` AND the `upload_filetype` log field value does NOT match the regular expression `(?i)(javascript)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_JAVA`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(class)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_JAVA_BYTECODE`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(jmod)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_JMOD`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(jng)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_JNG`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(json)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_JSON`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(js)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_JAVASCRIPT`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(kgb)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_KGB`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(tex)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_LATEX`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(lzfse)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_LZFSE`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(vmlinuz\|ko)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_LINUX_KERNEL`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(bundle\|framework)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_MACH_O`. Else, if the log message matches the regular expression `(?i)(\\bmach\\b)` AND the `upload_filetype` log field value matches the regular expression `(?i)(dylib\|o)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_MACH_O`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(so\|initrd\|vmlinux\|pkg.tar.zst\|ext4\|ext3\|ext2\|swap)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_LINUX`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(ini)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_INI`. Else, if the log message matches the regular expression `(?i)(\\blinux\\b)` AND the `upload_filetype` log field value matches the regular expression `sfs`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_LINUX`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(lnk)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_LNK`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(m4)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_M4`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(midi\|mid)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_MIDI`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(mkv)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_MKV`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(mpg\|mpeg)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_MPEG`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(sz_)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_MSCOMPRESS`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(dll)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_NE_DLL`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(odg)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ODG`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(odp)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ODP`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(ods)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ODS`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(odt)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ODT`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(ogg\|oga\|ogv)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_OGG`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(one)` AND the `upload_filetype` log field value does NOT match the regular expression `(?i)(none)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ONE_NOTE`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(pst\|ost)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_OUTLOOK`. Else, if the log message matches the regular expression `(?i)(\\boutlook\\b)` AND the `upload_filetype` log field value matches the regular expression `(?i)(msg)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_OUTLOOK`. Else, if the log message matches the regular expression `(?i)(\\bemail\\b)` AND the `upload_filetype` log field value matches the regular expression `(?i)(msg)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_EMAIL_TYPE`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(prc)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PALMOS`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(pdb)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PDB`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(pem)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PEM`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(pgp\|gpg\|asc)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PGP`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(php)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PHP`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(pkg)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PKG`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(ps1\|psm1)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_POWERSHELL`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(ppsx)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PPSX`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(psd)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PSD`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(ps)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PS`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(pyc)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PYC`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(py\|pyw)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PYTHON`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(whl)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PYTHON_WHL`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(qt)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_QUICKTIME`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(rm\|rmvb)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_RM`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(rom\|bin)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ROM`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(rpm)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_RPM`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(rtf)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_RTF`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(rb)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_RUBY`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(rz)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_RZIP`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(7z)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_SEVENZIP`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(sgml\|sgm)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_SGML`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(bash\|csh\|zsh)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_SHELLSCRIPT`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(sql)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_SQL`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(sqfs\|sfs)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_SQUASHFS`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(svg)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_SVG`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(swf)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_SWF`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(sis\|sisx)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_SYMBIAN`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(3gp)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_T3GP`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(tar)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_TAR`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(tga)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_TARGA`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(3ds\|max)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_THREEDS`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(tif\|tiff)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_TIFF`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(torrent)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_TORRENT`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(ttf)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_TTF`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(vba)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_VBA`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(vhd\|vhdx)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_VHD`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(wav)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_WAV`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(webm)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_WEBM`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(webp)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_WEBP`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(wer)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_WER`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(wma)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_WMA`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(wmv)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_WMV`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(woff\|woff2)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_WOFF`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(xml)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_XML`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(xpi)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_XPI`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(xwd)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_XWD`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(zst)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ZST`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(Makefile\|makefile\|mk)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_MAKEFILE`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(zlib)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ZLIB`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(hqx)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_MACINTOSH`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(hfs\|dsk\|toast)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_MACINTOSH_HFS`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(bh\|log\|dat)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_BLACKHOLE`. Else, if the log message matches the regular expression `(?i)(\\bcookie\\b)` AND the `upload_filetype` log field value matches the regular expression `(?i)(txt)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_COOKIE`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(txt)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_TEXT`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(docx\|xlsx\|pptx)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_OOXML`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(odt\|ods\|odp\|odg)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ODF`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(for\|f90\|f95)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_FORTRAN`. Else, if the log message matches the regular expression `(?i)(\\bwince\\b)` AND the `upload_filetype` log field value matches the regular expression `(?i)(exe\|cab\|dll)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_WINCE`. Else, if the log message matches the regular expression `(?i)(\\bscript\\b)` AND the `upload_filetype` log field value matches the regular expression `(?i)(py\|js\|pl\|rb)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_SCRIPT`. Else, if the log message matches the regular expression `(?i)(\\bapplesingle\\b)` AND the `upload_filetype` log field value matches the regular expression `(?i)(as\|bin)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_APPLESINGLE`. Else, if the log message matches the regular expression `(?i)(\\bmacintosh\\b)` AND the `upload_filetype` log field value matches the regular expression `(?i)(dylib\|a)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_MACINTOSH_LIB`. Else, if the log message matches the regular expression `(?i)(\\bappledouble\\b)` AND the `upload_filetype` log field value matches the regular expression `(?i)(ad\|._)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_APPLEDOUBLE`. Else, if the log message matches the regular expression `(?i)(\\bobjetivec\\b)` AND the `upload_filetype` log field value matches the regular expression `(?i)(m\|mm\|h)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_OBJETIVEC`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(obj\|lib)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_COFF`. Else, if the log message matches the regular expression `(?i)(\\bcpp\\b)` AND the `upload_filetype` log field value matches the regular expression `(?i)(hpp\|cpp\|cc\|cxx\|h)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_CPP`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(pas\|pp)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PASCAL`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(pl\|pm)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PERL`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)\\bsh\\b`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_SHELLSCRIPT`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)\\bc\\b$`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_C`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)\\bn\\b$`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_NEKO`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)\\bf\\b`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_FORTRAN`. Else, the UDM field `additional.fields.key` is set to `file_type` and the log field value `upload_filetype` is mapped to the `additional.fields.value` UDM field, provided the `upload_filetype` value is not empty.
`upload_filename`	`target.file.full_path`	If the `filename` log field value is equal to `None` and the `upload_filename` log field value is not equal to `None`, then the `upload_filename` log field is mapped to the `target.file.full_path` UDM field. Else, if the `filename` log field value is not equal to `None` and the `upload_filename` log field value is not equal to `None`, then the `upload_filename` log field is mapped to the `target.resource.attribute.labels[upload_filename]` UDM field.
`b64upload_filename`	`target.file.full_path`	If the `filename` log field value is equal to `None` and the `b64upload_filename` log field value is not equal to `None`, then the `b64upload_filename` log field is mapped to the `target.file.full_path` UDM field. Else, if the `filename` log field value is not equal to `None` and the `b64upload_filename` log field value is not equal to `None`, then the `b64upload_filename` log field is mapped to the `target.resource.attribute.labels[upload_filename]` UDM field.
`eupload_filename`	`target.file.full_path`	If the `filename` log field value is equal to `None` and the `eupload_filename` log field value is not equal to `None`, then the `eupload_filename` log field is mapped to the `target.file.full_path` UDM field. Else, if the `filename` log field value is not equal to `None` and the `eupload_filename` log field value is not equal to `None`, then the `eupload_filename` log field is mapped to the `target.resource.attribute.labels[upload_filename]` UDM field.
`upload_filesubtype`	`additional.fields[upload_filesubtype]`
`upload_doctypename`	`additional.fields[upload_doctypename]`
`unscannabletype`	`security_result.detection_fields[unscannabletype]`
`rdr_rulename`	`security_result.rule_name`
`b64rdr_rulename`	`security_result.rule_name`
`ordr_rulename`	`security_result.rule_name`
`fwd_type`	`intermediary.resource.attribute.labels[fwd_type]`
`fwd_gw_name`	`intermediary.resource.name`
`b64fwd_gw_name`	`intermediary.resource.name`
`ofwd_gw_name`	`intermediary.resource.name`
`fwd_gw_ip`	`intermediary.ip`
`zpa_app_seg_name`	`additional.fields[zpa_app_seg_name]`
`b64zpa_app_seg_name`	`additional.fields[zpa_app_seg_name]`
`ozpa_app_seg_name`	`additional.fields[ozpa_app_seg_name]`
`reqdatasize`	`additional.fields[reqdatasize]`
`reqhdrsize`	`additional.fields[reqhdrsize]`
`requestsize`	`network.sent_bytes`
`respdatasize`	`additional.fields[respdatasize]`
`resphdrsize`	`additional.fields[resphdrsize]`
`responsesize`	`network.received_bytes`
`transactionsize`	`additional.fields[transactionsize]`
`contenttype`	`target.file.mime_type`
`df_hosthead`	`security_result.detection_fields[df_hosthead]`
`df_hostname`	`security_result.detection_fields[df_hostname]`
`hostname`	`target.hostnametarget.asset.hostname`
`b64host`	`target.hostnametarget.asset.hostname`
`ehost`	`target.hostnametarget.asset.hostname`
`refererURL`	`network.http.referral_url`
`b64referer`	`network.http.referral_url`
`ereferer`	`network.http.referral_url`
`erefererpath`	`additional.fields[erefererpath]`
`refererhost`	`additional.fields[refererhost]`
`erefererhost`	`additional.fields[refererhost]`
`requestmethod`	`network.http.method`
`reqversion`	`additional.fields[reqversion]`
`status`	`network.http.response_code`
`respversion`	`additional.fields[respversion]`
`ua_token`	`additional.fields[ua_token]`
`useragent`	`network.http.user_agent`
`b64ua`	`network.http.user_agent`
`eua`	`network.http.user_agent`
`useragent`	`network.http.parsed_user_agent`
`b64ua`	`network.http.parsed_user_agent`
`eua`	`network.http.parsed_user_agent`
`uaclass`	`additional.fields[uaclass]`
`url`	`target.url`
`b64url`	`target.url`
`eurl`	`target.url`
`eurlpath`	`additional.fields[eurlpath]`
`mobappname`	`additional.fields[mobappname]`
`b64mobappname`	`additional.fields[mobappname]`
`emobappname`	`additional.fields[mobappname]`
`mobappcat`	`security_result.detection_fields[mobappcat]`
`mobdevtype`	`security_result.detection_fields[mobdevtype]`
`clt_sport`	`principal.port`
`ClientIP`	`principal.ip`
`ocip`	`principal.ip`
`cpubip`	`principal.ip`
`ocpubip`	`principal.ip`
`clientpublicIP`	`principal.nat_ip`
`serverip`	`target.ip`
	`network.application_protocol`	If the `protocol` log field value contain one of the following values, then the `network.application_protocol` UDM field is set to `HTTP`. `HTTP` `HTTP_PROXY` Else, if the `protocol` log field value contain one of the following values, then the `network.application_protocol` UDM field is set to `HTTPS`. `HTTPS` `SSL` `TUNNEL_SSL` `DNSOVERHTTPS` `TUNNEL` Else, the `network.application_protocol` UDM field is set to `UNKNOWN_APPLICATION_PROTOCOL`.
`alpnprotocol`	`additional.fields[alpnprotocol]`
`trafficredirectmethod`	`intermediary.resource.attribute.labels[trafficredirectmethod]`
`location`	`principal.location.name`
`elocation`	`principal.location.name`
`userlocationname`	`principal.location.name`	If the `userlocationname` log field value is not equal to `None`, then the `userlocationname` log field is mapped to the `principal.location.name` UDM field.
`b64userlocationname`	`principal.location.name`
`euserlocationname`	`principal.location.name`
`rulelabel`	`security_result.rule_name`	If the `action` log field value is equal to `Blocked`, then the `rulelabel` log field is mapped to the `security_result.rule_name` UDM field.
`b64rulelabel`	`security_result.rule_name`
`erulelabel`	`security_result.rule_name`
`ruletype`	`security_result.rule_type`
`reason`	`security_result.description`
`action`	`security_result.action_details`
	`security_result.action`	If the `action` log field value is equal to `Allowed`, then the `security_result.action` UDM field is set to `ALLOW`. Else, if the `action` log field value is equal to `Blocked`, then the `security_result.action` UDM field is set to `BLOCK`.
`urlfilterrulelabel`	`security_result.rule_name`
`b64urlfilterrulelabel`	`security_result.rule_name`
`eurlfilterrulelabel`	`security_result.rule_name`
`ourlfilterrulelabel`	`security_result.rule_name`
`apprulelabel`	`security_result.rule_name`
`eapprulelabel`	`security_result.rule_name`
`b64apprulelabel`	`security_result.rule_name`
`oapprulelabel`	`security_result.rule_name`
`bamd5`	`target.file.md5`
`sha256`	`target.file.sha256`
`ssldecrypted`	`security_result.detection_fields[ssldecrypted]`
`externalspr`	`security_result.detection_fields[externalspr]`
`keyprotectiontype`	`security_result.detection_fields[keyprotectiontype]`
`clientsslcipher`	`network.tls.client.supported_ciphers`
`clienttlsversion`	`network.tls.version`
`clientsslsessreuse`	`security_result.detection_fields[clientsslsessreuse]`
`cltsslfailreason`	`security_result.summary`
`cltsslfailcount`	`security_result.detection_fields[cltsslfailcount]`
`srvsslcipher`	`network.tls.cipher`
`srvtlsversion`	`security_result.detection_fields[srvtlsversion]`
`srvocspresult`	`security_result.detection_fields[srvocspresult]`
`srvcertchainvalpass`	`security_result.detection_fields[srvcertchainvalpass]`
`srvwildcardcert`	`security_result.detection_fields[srvwildcardcert]`
`serversslsessreuse`	`security_result.detection_fields[server_ssl_sess_reuse]`
`srvcertvalidationtype`	`security_result.detection_fields[srvcertvalidationtype]`
`srvcertvalidityperiod`	`security_result.detection_fields[srvcertvalidityperiod]`
`is_ssluntrustedca`	`security_result.detection_fields[is_ssluntrustedca]`
`is_sslselfsigned`	`security_result.detection_fields[is_sslselfsigned]`
`is_sslexpiredca`	`security_result.detection_fields[is_sslexpiredca]`
`pagerisk`	`security_result.risk_score`
	`security_result.severity`	If the `pagerisk` log field value is greater than or equal to `90` and the `pagerisk` log field value is less than or equal to `100`, then the `security_result.severity` UDM field is set to `CRITICAL`. If the `pagerisk` log field value is greater than or equal to `75` and the `pagerisk` log field value is less than or equal to `89`, then the `security_result.severity` UDM field is set to `HIGH`. If the `pagerisk` log field value is greater than or equal to `46` and the `pagerisk` log field value is less than or equal to `74`, then the `security_result.severity` UDM field is set to `MEDIUM`. If the `pagerisk` log field value is greater than or equal to `1` and the `pagerisk` log field value &is less than or equal to `45`, then the `security_result.severity` UDM field is set to `LOW`. If the `pagerisk` log field value is equal to `0`, then the `security_result.severity` UDM field is set to `NONE`.
`threatseverity`	`security_result.severity_details`	If the `pagerisk` log field value is not empty and the `threatseverity` log field value is not empty, then the `security_result.severity_details` UDM field is set to `%{pagerisk} - %{threatseverity}`. Else, if the `threatseverity` log field value is not empty, then the `threatseverity` log field is mapped to the `security_result.severity_details` UDM field.
`activity`	`metadata.product_event_type`
`is_dst_cntry_risky`	`security_result.detection_fields[is_dst_cntry_risky]`
`is_src_cntry_risky`	`security_result.detection_fields[is_src_cntry_risky]`
`prompt_req`	`additional.fields[prompt_req]`
`srcip_country`	`principal.ip_geo_artifact.location.country_or_region`
`pcapid`	`security_result.about.file.full_path`
`all_dlprulenames`	`security_result.rule_labels[all_dlprulenames]`
`other_dlprulenames`	`security_result.rule_labels[other_dlprulenames]`
`trig_dlprulename`	`security_result.rule_name`
`dstip_country`	`target.ip_geo_artifact.location.country_or_region`
`srv_dport`	`target.port`
`inst_level2_name`	`target.resource_ancestors.name`
`inst_level3_name`	`target.resource_ancestors.name`
`inst_level2_id`	`target.resource_ancestors.product_object_id`
`inst_level3_id`	`target.resource_ancestors.product_object_id`
`inst_level2_type`	`target.resource_ancestors.resource_subtype`
`inst_level3_type`	`target.resource_ancestors.resource_subtype`
	`target.resource_ancestors.resource_type`	If the `inst_level2_type` log field value matches the regular expression pattern `organization` then, the `target.resource_ancestors.resource_type` UDM field is set to `CLOUD_ORGANIZATION`. Else, if `inst_level2_type` log field value matches the regular expression pattern `service` then, the `target.resource_ancestors.resource_type` UDM field is set to `BACKEND_SERVICE`. Else, if `inst_level2_type` log field value matches the regular expression pattern `policy` then, the `target.resource_ancestors.resource_type` UDM field is set to `ACCESS_POLICY`. Else, if `inst_level2_type` log field value matches the regular expression pattern `project` then, the `target.resource_ancestors.resource_type` UDM field is set to `CLOUD_PROJECT`. Else, if `inst_level2_type` log field value matches the regular expression pattern `cluster` then, the `target.resource_ancestors.resource_type` UDM field is set to `CLUSTER`. Else, if `inst_level2_type` log field value matches the regular expression pattern `container` then, the `target.resource_ancestors.resource_type` UDM field is set to `CONTAINER`. Else, if `inst_level2_type` log field value matches the regular expression pattern `pod` then, the `target.resource_ancestors.resource_type` UDM field is set to `POD`. Else, if `inst_level2_type` log field value matches the regular expression pattern `repository` then, the `target.resource_ancestors.resource_type` UDM field is set to `REPOSITORY`. If the `inst_level3_type` log field value matches the regular expression pattern `organization` then, the `target.resource_ancestors.resource_type` UDM field is set to `CLOUD_ORGANIZATION`. Else, if `inst_level3_type` log field value matches the regular expression pattern `service` then, the `target.resource_ancestors.resource_type` UDM field is set to `BACKEND_SERVICE`. Else, if `inst_level3_type` log field value matches the regular expression pattern `policy` then, the `target.resource_ancestors.resource_type` UDM field is set to `ACCESS_POLICY`. Else, if `inst_level3_type` log field value matches the regular expression pattern `project` then, the `target.resource_ancestors.resource_type` UDM field is set to `CLOUD_PROJECT`. Else, if `inst_level3_type` log field value matches the regular expression pattern `cluster` then, the `target.resource_ancestors.resource_type` UDM field is set to `CLUSTER`. Else, if `inst_level3_type` log field value matches the regular expression pattern `container` then, the `target.resource_ancestors.resource_type` UDM field is set to `CONTAINER`. Else, if `inst_level3_type` log field value matches the regular expression pattern `pod` then, the `target.resource_ancestors.resource_type` UDM field is set to `POD`. Else, if `inst_level3_type` log field value matches the regular expression pattern `repository` then, the `target.resource_ancestors.resource_type` UDM field is set to `REPOSITORY`.
`inst_level1_name`	`target.resource.name`
`inst_level1_id`	`target.resource.product_object_id`
`inst_level1_type`	`target.resource.resource_subtype`
	`target.resource.resource_type`	If the `inst_level1_type` log field value matches the regular expression pattern `organization` then, the `target.resource.resource_type` UDM field is set to `CLOUD_ORGANIZATION`. Else, if `inst_level1_type` log field value matches the regular expression pattern `service` then, the `target.resource.resource_type` UDM field is set to `BACKEND_SERVICE`. Else, if `inst_level1_type` log field value matches the regular expression pattern `policy` then, the `target.resource.resource_type` UDM field is set to `ACCESS_POLICY`. Else, if `inst_level1_type` log field value matches the regular expression pattern `project` then, the `target.resource.resource_type` UDM field is set to `CLOUD_PROJECT`. Else, if `inst_level1_type` log field value matches the regular expression pattern `cluster` then, the `target.resource.resource_type` UDM field is set to `CLUSTER`. Else, if `inst_level1_type` log field value matches the regular expression pattern `container` then, the `target.resource.resource_type` UDM field is set to `CONTAINER`. Else, if `inst_level1_type` log field value matches the regular expression pattern `pod` then, the `target.resource.resource_type` UDM field is set to `POD`. Else, if `inst_level1_type` log field value matches the regular expression pattern `repository` then, the `target.resource.resource_type` UDM field is set to `REPOSITORY`.
`app_status`	`security_result.detection_fields[app_status]`
`threatname`	`security_result.threat_name`
`b64threatname`	`security_result.threat_name`
`threatcategory`	`security_result.associations.name`
`threatclass`	`security_result.associations.description`
`urlclass`	`security_result.detection_fields[urlclass]`
`urlsupercategory`	`security_result.category_details`
`urlcategory`	`security_result.category_details`
`b64urlcat`	`security_result.category_details`
`ourlcat`	`security_result.category_details`
`urlcatmethod`	`security_result.detection_fields[urlcatmethod]`
`bypassed_traffic`	`security_result.detection_fields[bypassed_traffic]`
`bypassed_etime`	`security_result.detection_fields[bypassed_etime]`
`deviceappversion`	`principal.asset.platform_software.platform_version`
`devicehostname`	`principal.asset.hostname`
`edevicehostname`	`principal.asset.hostname`
`odevicehostname`	`principal.asset.hostname`
`devicemodel`	`principal.asset.hardware.model`
`devicename`	`principal.asset.asset_id`
`edevicename`	`principal.asset.asset_id`
`odevicename`	`principal.asset.asset_id`
	`principal.asset.platform_software.platform`	If the `deviceostype` log field value matches the regular expression pattern `(?i)iOS`, then the `principal.asset.platform_software.platform` UDM field is set to `IOS`. Else, if the `deviceostype` log field value matches the regular expression pattern `(?i)Android`, then the `principal.asset.platform_software.platform` UDM field is set to `ANDROID`. Else, if the `deviceostype` log field value matches the regular expression pattern `(?i)Windows`, then the `principal.asset.platform_software.platform` UDM field is set to `WINDOWS`. Else, if the `deviceostype` log field value matches the regular expression pattern `(?i)MAC`, then the `principal.asset.platform_software.platform` UDM field is set to `MAC`. Else, if the `deviceostype` log field value matches the regular expression pattern `(?i)Other`, then the `principal.asset.platform_software.platform` UDM field is set to `UNKNOWN_PLATFORM`.
`deviceosversion`	`principal.asset.software.version`
`deviceowner`	`principal.asset.attribute.labels[deviceowner]`
`odeviceowner`	`principal.asset.attribute.labels[deviceowner]`
`devicetype`	`principal.asset.category`
`external_devid`	`additional.fields[external_devid]`
`flow_type`	`additional.fields[flow_type]`
`ztunnelversion`	`additional.fields[ztunnelversion]`
`event_id`	`metadata.product_log_id`
`productversion`	`metadata.product_version`
`nsssvcip`	`about.ip`
`eedone`	`additional.fields[eedone]`
`ssl_rulename`	`security_result.rule_name`
`client_tls_keyex_pqc_offers`	`additional.fields[client_tls_keyex_pqc_offers]`
`client_tls_keyex_hybrid_offers`	`additional.fields[client_tls_keyex_hybrid_offers]`
`client_tls_keyex_unknown_offers`	`additional.fields[client_tls_keyex_unknown_offers]`
`client_tls_sig_pqc_offers`	`additional.fields[client_tls_sig_pqc_offers]`
`client_tls_sig_non_pqc_offers`	`additional.fields[client_tls_sig_non_pqc_offers]`
`client_tls_sig_hybrid_offers`	`additional.fields[client_tls_sig_hybrid_offers]`
`client_tls_sig_unknown_offers`	`additional.fields[client_tls_sig_unknown_offers]`
`client_tls_keyex_alg`	`additional.fields[client_tls_keyex_alg]`
`client_tls_sig_alg`	`additional.fields[client_tls_sig_alg]`
`server_tls_keyex_alg`	`additional.fields[server_tls_keyex_alg]`
`server_tls_sig_alg`	`additional.fields[server_tls_sig_alg]`
`time`	`additional.fields[time]`
`ft_rulename`	`security_result.rule_name`
`upload_doc_sub_type`	`additional.fields[upload_doc_sub_type]`
`client_tls_keyex_non_pqc_offers`	`additional.fields[client_tls_keyex_non_pqc_offers]`

更新日志

查看相应解析器的更改日志