test_event_reason1.json

{
  "input": {
    "message": "1,2024/10/25 16:10:48,024101010000,SYSTEM,userid,2562,2024/10/25 16:10:48,,connect-ldap-sever,1.2.3.4,0,0,general,informational,\"ldap cfg joe_done connected to server 5.6.7.8:333, initiated by: 0.0.1.1\",73897065222988700000,0x0,0,0,0,0,,FFFFFF01,0,0,2024-10-25T16:10:48.575+02:00",
    "sekoiaio": {
      "intake": {
        "dialect": "Palo Alto NGFW",
        "dialect_uuid": "903ec1b8-f206-4ba5-8563-db21da09cafd"
      }
    }
  },
  "expected": {
    "message": "1,2024/10/25 16:10:48,024101010000,SYSTEM,userid,2562,2024/10/25 16:10:48,,connect-ldap-sever,1.2.3.4,0,0,general,informational,\"ldap cfg joe_done connected to server 5.6.7.8:333, initiated by: 0.0.1.1\",73897065222988700000,0x0,0,0,0,0,,FFFFFF01,0,0,2024-10-25T16:10:48.575+02:00",
    "event": {
      "category": [
        "network"
      ],
      "dataset": "system",
      "reason": "ldap cfg joe_done connected to server 5.6.7.8:333, initiated by: 0.0.1.1",
      "type": [
        "info"
      ]
    },
    "@timestamp": "2024-10-25T14:10:48.575000Z",
    "action": {
      "name": "connect-ldap-sever",
      "type": "userid"
    },
    "destination": {
      "address": "5.6.7.8",
      "ip": "5.6.7.8"
    },
    "log": {
      "hostname": "FFFFFF01",
      "level": "informational",
      "logger": "system"
    },
    "observer": {
      "name": "FFFFFF01",
      "product": "PAN-OS",
      "serial_number": "024101010000"
    },
    "paloalto": {
      "DGHierarchyLevel1": "0",
      "DGHierarchyLevel2": "0",
      "DGHierarchyLevel3": "0",
      "DGHierarchyLevel4": "0",
      "EventID": "connect-ldap-sever",
      "Threat_ContentType": "userid"
    },
    "related": {
      "ip": [
        "0.0.1.1",
        "5.6.7.8"
      ]
    },
    "source": {
      "address": "0.0.1.1",
      "ip": "0.0.1.1"
    }
  }
}