Splunk DB Connect: How to parse user name field form McAfee logs so it can support CIM?

[thambisetty]

Hi,

I have McAfee logs coming in to Splunk using Splunk DB Connect application. There are total 3 fields related to user name:
1. user
2. source_logon_user
3. logon_user

and the mcafee logs tagged to malware, attack, operations and the data is being accelerated by Malware datamodel. Malware data model looks for user and user field is available in McAfee logs, but the problem is I need to consider logon_user/source_logon_user not user field, I could simply rename source_logon_user/logon_user to user to work with CIM, again the problem with logon_user/source_logon_user has username like :

domain\username
username@domain.com
username

how to deal with the above scenarios, the reason why I would like to reformat the username field from above three scenarios to user, when we search something user=username , it will not return user=domain\username.

please help me out, if any spelunker already faced/solved this problem.

[mhoogcarspel_sp]

By looking at the CIM doc
http://docs.splunk.com/Documentation/CIM/4.9.1/User/Malware

you want to use "dest_nt_domain" field to extract the domain separately from the username.