{
  attributes: {
    "dataSource.category": "security",
    "dataSource.name": "Azure AD",
    "dataSource.vendor": "Azure"
  },
  formats: [
    {
      format: ".*${parse=json}{attrBlacklist=(targetResources)}$"
      rewrites: [
        { input: "activityDateTime", output: "security_finding.time_dt", match: ".*", replace: "$0" },
        { input: "activityDisplayName", output: "security_finding.activity_name", match: ".*", replace: "$0" },
        { input: "category", output: "security_finding.category_name", match: ".*", replace: "$0" },
        { input: "correlationId", output: "metadata.correlation_uid", match: ".*", replace: "$0" },
        { input: "id", output: "security_finding.activity_id", match: ".*", replace: "$0" },
        { input: "initiatedByUserId", output: "user.account_uid", match: ".*", replace: "$0" },
        { input: "initiatedByUserIpAddress", output: "user.ip", match: ".*", replace: "$0" },
        { input: "initiatedByUserUserPrincipalName", output: "user.name", match: ".*", replace: "$0" },
        { input: "operationType", output: "security_finding.type_name", match: ".*", replace: "$0" },
        { input: "result", output: "security_finding.result", match: ".*", replace: "$0" },
        { input: "resultReason", output: "security_finding.result_reason", match: ".*", replace: "$0" }
      ]
    }, {
      format: ".*targetResources\":..$targetResources.{parse=json}$"
      rewrites: [
        { input: "targetResources.displayName", output: "target.name", match: ".*", replace: "$0" },
        { input: "targetResources.id", output: "target.id", match: ".*", replace: "$0" },
        { input: "targetResources.type", output: "target.type", match: ".*", replace: "$0" },
        { input: "targetResources.userPrincipalName", output: "target.userName", match: ".*", replace: "$0" }
      ]
    }
  ]
}