fix(filters): normalize actionResult to canonical values

filters/antivirus/bitdefender_gz.yml

@@ -264,6 +264,14 @@ pipeline:
             - origin.port
           to: int
 
+      # Adding action result
+      - add:
+          function: string
+          params:
+            key: actionResult
+            value: "blocked"
+          where: 'oneOf("action", ["blocked", "quarantined", "deleted", "disinfected"])'
+
       # Removing unused fields
       - delete:
           fields:

filters/antivirus/deceptive-bytes.yml

@@ -450,6 +450,14 @@ pipeline:
           valueSplit: "="
           source: log.pidStatusToKv
 
+      # Adding action result
+      - add:
+          function: string
+          params:
+            key: actionResult
+            value: "blocked"
+          where: 'exists("log.action") && oneOf("log.action", ["blocked", "prevented"])'
+
       # Adding severity based on log.severityLabelCharacter
       - add:
           function: 'string'

filters/antivirus/esmc-eset.yml

@@ -63,6 +63,7 @@ pipeline:
           from:
             - log.event
           to: actionResult
+          where: '!regexMatch("log.result", "(?i)\b(?:denied|blocked|failed)\b")'
       - rename:
           from:
             - log.sourceaddress
@@ -83,6 +84,28 @@ pipeline:
           from:
             - log.targetport
           to: target.port
+
+      # Adding action result
+      - add:
+          function: 'string'
+          params:
+            key: actionResult
+            value: 'denied'
+          where: regexMatch("log.event", "(?i)\bdenied\b")
+
+      - add:
+          function: 'string'
+          params:
+            key: actionResult
+            value: 'blocked'
+          where: regexMatch("log.event", "(?i)\bblocked\b")
+
+      - add:
+          function: 'string'
+          params:
+            key: actionResult
+            value: 'failed'
+          where: regexMatch("log.event", "(?i)\bfailed\b")
 
       # Adding severity field based on log.severity
       - add:

filters/antivirus/kaspersky.yml

@@ -1102,6 +1102,21 @@ pipeline:
             destination: target.geolocation
           where: exists("target.ip")
 
+      # Adding action result
+      - add:
+          function: string
+          params:
+            key: actionResult
+            value: "Allow"
+          where: 'oneOf("action", ["Allow", "Allowed"])'
+
+      - add:
+          function: string
+          params:
+            key: actionResult
+            value: "blocked"
+          where: 'oneOf("action", ["Block", "Blocked", "blocked", "Redirect", "terminate", "delete", "quarantine"])'
+
       # .......................................................................#
       # Removing unused fields
       # .......................................................................#

filters/antivirus/sentinel-one.yml

@@ -363,6 +363,26 @@ pipeline:
             - log.rt
           to: log.ruleTime
 
+      # Adding action result
+      - add:
+          function: string
+          params:
+            key: actionResult
+            value: "failed"
+          where: 'equals("log.threatStatus", "mitigation_failed")'
+      - add:
+          function: string
+          params:
+            key: actionResult
+            value: "failed"
+          where: 'equals("log.status", "failed") && !exists("actionResult")'
+      - add:
+          function: string
+          params:
+            key: actionResult
+            value: "failed"
+          where: 'contains("log.mitigationStatus", "fail") && !exists("actionResult")'
+
       # Removing unused fields
       - delete:
           fields:

filters/aws/aws.yml

@@ -217,6 +217,26 @@ pipeline:
             - log.tlsDetails.tlsVersion
           to: log.tlsDetailsTlsVersion
 
+      # Adding action result
+      - add:
+          function: string
+          params:
+            key: actionResult
+            value: "success"
+          where: 'exists("log.eventName") && !exists("log.errorCode")'
+      - add:
+          function: string
+          params:
+            key: actionResult
+            value: "denied"
+          where: 'equals("log.errorCode", "AccessDenied")'
+      - add:
+          function: string
+          params:
+            key: actionResult
+            value: "failed"
+          where: 'exists("log.errorCode") && !equals("log.errorCode", "AccessDenied")'
+
       - delete:
           fields:
             - log.requestParameters

filters/azure/azure-eventhub.yml

@@ -797,22 +797,47 @@ pipeline:
           from:
             - log.properties.result
           to: actionResult
+          where: '!regexMatch("log.properties.result", "(?i)\b(?:denied|blocked|failed)\b")'
 
       - rename:
           from:
             - log.Properties.Result
           to: actionResult
+          where: '!regexMatch("log.properties.result", "(?i)\b(?:denied|blocked|failed)\b")'
 
       - rename:
           from:
             - log.properties.resultType
           to: actionResult
+          where: '!regexMatch("log.properties.result", "(?i)\b(?:denied|blocked|failed)\b")'
 
       - rename:
           from:
             - log.properties.userAgent
           to: log.propertiesUserAgent
 
+      # Adding action result
+      - add:
+          function: 'string'
+          params:
+            key: actionResult
+            value: 'denied'
+          where: regexMatch("log.properties.result", "(?i)\bdenied\b")
+
+      - add:
+          function: 'string'
+          params:
+            key: actionResult
+            value: 'blocked'
+          where: regexMatch("log.properties.result", "(?i)\bblocked\b")
+
+      - add:
+          function: 'string'
+          params:
+            key: actionResult
+            value: 'failed'
+          where: regexMatch("log.properties.result", "(?i)\bfailed\b")
+
       # .......................................................................#
       # Adding severity based on log.level
       # .......................................................................#

filters/cisco/cs_switch.yml

@@ -133,6 +133,64 @@ pipeline:
           fields:
             - log.facilityMnemonic
       #......................................................................#
+      # Extract ACL action word from log.ciscoMsg for ACL log events
+      - grok:
+          source: log.ciscoMsg
+          patterns:
+            - fieldName: ""
+              pattern: 'list'
+            - fieldName: log.aclName
+              pattern: '{{.notSpace}}'
+            - fieldName: log.aclAction
+              pattern: '{{.word}}'
+          where: oneOf("log.facilityMnemonic", ["IPACCESSLOGP", "IPACCESSLOGDP", "IPACCESSLOGRP", "IPACCESSLOGSP", "IPACCESSLOGNP", "ACCESSLOGP", "ACCESSLOGDP", "ACCESSLOGSP", "ACCESSLOGNP", "IPV6ACCESSLOGP"])
+      # Handle "access-list" prefix variant (some Cisco IOS variants emit "access-list" instead of "list")
+      - grok:
+          source: log.ciscoMsg
+          patterns:
+            - fieldName: ""
+              pattern: 'access-list'
+            - fieldName: log.aclName
+              pattern: '{{.notSpace}}'
+            - fieldName: log.aclAction
+              pattern: '{{.word}}'
+          where: 'oneOf("log.facilityMnemonic", ["IPACCESSLOGP", "IPACCESSLOGDP", "IPACCESSLOGRP", "IPACCESSLOGSP", "IPACCESSLOGNP", "ACCESSLOGP", "ACCESSLOGDP", "ACCESSLOGSP", "ACCESSLOGNP", "IPV6ACCESSLOGP"]) && !exists("log.aclAction")'
+      # Adding action result
+      - add:
+          function: string
+          params:
+            key: actionResult
+            value: success
+          where: equals("log.aclAction", "permitted")
+
+      - add:
+          function: string
+          params:
+            key: actionResult
+            value: denied
+          where: equals("log.aclAction", "denied")
+
+      - add:
+          function: string
+          params:
+            key: actionResult
+            value: failed
+          where: equals("log.facility", "DOT1X") && equals("log.facilityMnemonic", "FAIL")
+
+      - add:
+          function: string
+          params:
+            key: actionResult
+            value: success
+          where: equals("log.facility", "DOT1X") && equals("log.facilityMnemonic", "SUCCESS")
+
+      - add:
+          function: string
+          params:
+            key: actionResult
+            value: blocked
+          where: equals("log.facility", "SW_DAI") && oneOf("log.facilityMnemonic", ["DHCP_SNOOPING_DENY", "INVALID_ARP", "ACL_DENY"])
+      #......................................................................#
       # Decoding severity
       - add:
           function: 'string'
@@ -158,4 +216,6 @@ pipeline:
           fields:
             - log.switchHeader
             - log.irrelevant
-            - log.tmpFacilityMnemonic
+            - log.tmpFacilityMnemonic
+            - log.aclName
+            - log.aclAction