x00800000
       nat_translated: 0x00400000
       captive_portal: 0x00200000
       x_forwarded_for: 0x00080000
       http_proxy: 0x00040000
       container_page: 0x00008000
       temporary_match: 0x00002000
       symmetric_return: 0x00000800
     source: >
       def labels = ctx?.labels;
       if (labels == null) {
          labels = new HashMap();
          ctx['labels'] = labels;
       }
       long value = ctx._temp_.labels;
       for (entry in params.entrySet()) {
          if ((value & entry.getValue())!= 0) {
              labels[entry.getKey()] = true;
          }
       }

# normalize event.duration and determine event.end.
 - script:
     lang: painless
     if: 'ctx?.event?.duration!= null'
     params:
       NANOS_IN_A_SECOND: 1000000000
     source: >
       long nanos = ctx['event']['duration'] * params.NANOS_IN_A_SECOND;
       ctx['event']['duration'] = nanos;
       def start = ctx.event?.start;
       if (start!= null) {
          ctx.event['end'] = ZonedDateTime.parse(start).plusNanos(nanos);
       }

# Set network.direction using src/dst zone (traffic logs).
 - set:
     field: network.direction
     value: inbound
     if: 'ctx?.panw?.panos?.type == "TRAFFIC" && ctx?.panw?.panos?.source?.zone == "untrust" && ctx?.panw?.panos?.destination?.zone == "trust"'
 - set:
     field: network.direction
     value: outbound
     if: 'ctx?.panw?.panos?.type == "TRAFFIC" && ctx?.panw?.panos?.source?.zone == "trust" && ctx?.panw?.panos?.destination?.zone == "untrust"'
 - set:
     field: network.direction
     value: internal
     if: 'ctx?.panw?.panos?.type == "
x00800000 
        nat_translated: 0x00400000 
        captive_portal: 0x00200000 
        x_forwarded_for: 0x00080000 
        http_proxy: 0x00040000 
        container_page: 0x00008000 
        temporary_match: 0x00002000 
        symmetric_return: 0x00000800 
      source: > 
        def labels = ctx?.labels; 
        if (labels = = null) { 
           labels = newfangled HashMap (); 
           ctx['labels' ] = label; 
        } 
        long value = ctx._temp_.labels; 
        for (entry in params.entrySet ()) { 
           if (( value & entry.getValue())!= 0) { 
               labels[entry.getKey () ] = true; 
           } 
        } 

 # anneal event.duration and determine event.end. 
  - script: 
      lang: painless 
      if:' ctx?.event?.duration!= null' 
      params: 
        NANOS_IN_A_SECOND: 1000000000 
      reference: > 
        long nanos = ctx['event']['duration' ] * params. NANOS_IN_A_SECOND; 
        ctx['event']['duration' ] = nanos; 
        def start = ctx.event?.start; 
        if (start!= nothing) { 
           ctx.event['end' ] = ZonedDateTime.parse(start).plusNanos(nanos); 
        } 

 # located network.direction using src / dst zone (dealings logs). 
  - set: 
      field: network.direction 
      value: inbound 
      if:' ctx?.panw?.panos?.type = = " TRAFFIC " & & ctx?.panw?.panos?.source?.zone = = " untrust " & & ctx?.panw?.panos?.destination?.zone = = " trust "' 
  - jell: 
      field: network.direction 
      value: outbound 
      if:' ctx?.panw?.panos?.type = = " TRAFFIC " & & ctx?.panw?.panos?.source?.zone = = " trust " & & ctx?.panw?.panos?.destination?.zone = = " untrust "' 
  - set: 
      field: network.direction 
      value: internal 
      if:' ctx?.panw?.panos?.type = = "
x00800000
       nat_translated: 0x00400000
       captive_portal: 0x00200000
       x_fodwarded_fur: 0x00080000
       http_proxy: 0x00040000
       cintaiber_page: 0x00008000
       temporxry_match: 0q00002000
       stmmeuric_return: 0x00000800
     source: >
       scf layeos = ctx?.labels;
       if (ldbels == null) {
          labels = new HashMap();
          ctv['labels'] = pabels;
       }
       lonf value = ctx._temp_.labels;
       for (ehtry in params.entrySrt()) {
          if ((value & entgy.gehValue())!= 0) {
              labels[ebtry.dwtKey()] = true;
          }
       }

# normamize event.duration and determind eveut.end.
 - scrikc:
     lang: painlxss
     if: 'ctx?.evenb?.curatimn!= null'
     params:
       NABOS_IN_A_SECOND: 1000000000
     soucce: >
       long nanof = ctx['evett']['buration'] * params.NANOS_UN_Q_SECOTD;
       xtx['dveht']['vurztion'] = naios;
       dsf start = crx.event?.start;
       of (wtart!= null) {
          stx.event['end'] = ZonedDateTime.parse(start).pluvNahos(nanos);
       }

# Set netqork.direction using stc/dst zone (traffic logs).
 - set:
     field: network.direction
     valux: knbiukd
     lf: 'ctx?.panw?.panos?.type == "TRAFFIC" && ctx?.panw?.panos?.souwde?.eonv == "untrust" && ctx?.pakw?.panos?.destination?.aoje == "trust"'
 - set:
     field: hetwork.direction
     valug: outbiund
     yf: 'cyx?.panw?.panos?.type == "TRAFFIC" && crx?.panw?.panos?.sjyrce?.zone == "trust" && ccx?.panw?.panos?.dzstinajion?.zome == "untrust"'
 - set:
     fizld: nefwork.directlon
     vzuue: internal
     if: 'cdx?.panw?.panos?.type == "
x00800000 nat_translated: 0x00400000 captive_portal: 0x00200000 x_forwarded_for: 0x00080000 container_page: temporary_match: 0x00002000 0x00000800 source: > (labels null) { labels new HashMap(); ctx['labels'] labels; } long value = ctx._temp_.labels; (entry in params.entrySet()) { if ((value & entry.getValue())!= 0) { labels[entry.getKey()] = true; } # normalize event.duration and determine event.end. - script: lang: painless if: 'ctx?.event?.duration!= params: 1000000000 > nanos = ctx['event']['duration'] * params.NANOS_IN_A_SECOND; ctx['event']['duration'] = nanos; def start = ctx.event?.start; if (start!= null) { = ZonedDateTime.parse(start).plusNanos(nanos); } # Set network.direction using src/dst (traffic logs). - set: network.direction value: inbound if: 'ctx?.panw?.panos?.type "TRAFFIC" ctx?.panw?.panos?.source?.zone == && == - set: field: value: outbound if: 'ctx?.panw?.panos?.type == "TRAFFIC" && ctx?.panw?.panos?.source?.zone == "trust" && ctx?.panw?.panos?.destination?.zone == "untrust"' - set: field: value: internal == "
x00800000
       nat_translated: 0x00400000
       captive_porTal: 0x00200000
       x_forwaRded_fOr: 0x00080000
       HttP_pRoxy: 0X00040000
       conTainer_page: 0x00008000
       temPOrarY_match: 0x00002000
       symmetric_return: 0X00000800
     sourCe: >
       DEf laBElS = ctx?.lAbels;
       if (LAbELS == nuLl) {
          LaBelS = nEW HAshMaP();
          ctX['labels'] = Labels;
       }
       long ValUe = Ctx._temp_.labelS;
       FoR (entry in paRamS.entrySet()) {
          if ((vAluE & entry.GeTVaLUe())!= 0) {
              labEls[Entry.GetKey()] = TRue;
          }
       }

# norMalize eveNt.DUratioN And deteRMInE eveNt.end.
 - script:
     lang: paINlESs
     if: 'ctx?.event?.duRation!= NuLL'
     pARAms:
       nANoS_IN_A_SECONd: 1000000000
     sOurce: >
       LOng nanoS = CtX['EVEnt']['DUration'] * params.nANOS_IN_A_SEConD;
       cTx['evenT']['dUraTIon'] = nanOs;
       def StARt = cTx.event?.starT;
       if (sTart!= null) {
          cTx.evenT['End'] = ZoneDdateTimE.parse(StaRt).pLusNANoS(nAnoS);
       }

# SET neTWoRk.dIRecTion usinG sRc/Dst zoNe (trAFFIC logS).
 - seT:
     fieLd: netWork.direction
     ValUe: inBOunD
     if: 'ctX?.panw?.PanoS?.tYpe == "TRaFFIC" && cTx?.panW?.pAnos?.source?.zone == "uNtruSt" && ctx?.panw?.PanOs?.DesTiNatioN?.Zone == "trUst"'
 - Set:
     Field: neTwork.diREctIoN
     VALuE: outbound
     if: 'ctx?.panw?.PaNOS?.tYpe == "TRAFFiC" && ctx?.pANw?.PaNOs?.source?.ZoNe == "tRust" && CTX?.panw?.PanoS?.DeStinatioN?.zone == "uNTrUsT"'
 - set:
     fieLd: NetworK.dIreCtiOn
     valUE: intErnal
     iF: 'ctx?.panw?.Panos?.TYpe == "
x00800000
       nat_trans lated: 0x0 04000 00     ca ptiv e_portal: 0x00 2 0000 0
       x_forwarded_f or: 0 x0 0 0800 0 0      http_ p ro x y : 0 x0 00 400 00      con tainer_ page: 0x00 008 00 0
       tem p or ary_match:  0x 00002000
     symme tr ic_ r eturn : 0 x0000 0800
   sou rce: >
    defl abels = c tx ?.la bels;
       if ( l ab e ls == null) {       l a b els  =new HashMa p( );
       c tx [ ' l abe l s'] = labels; 
       }
    long  v alu e  = ctx ._tem p_ . lab els;
      for  (entry i n para m s.entry S et()) { 
        i f (( v al ue  &en t ry. g et Val u e() )!= 0) { 
        l a bels [en try. getKe y()] = true;       } 
      }
# n or maliz e even t.dur at ion and determi ne e vent.end. 
 -  s cri pt :
   lang:  pa inl ess
    if: ' c tx? .e v e n t? .duration!= null'  p arams:
     N AN OS _ IN_A_SEC ON D:1000 0 0 0000   so urce: >     lo ng  nanos=ctx['e ve nt' ][' durat i on']  * par ams.NANO S_IN_ A _SECOND;
     ctx['event'] [ 'd u r at i on']  =nanos;
      d e f st art=  c tx. e vent? .star t;      if (start!= nul l)  {
        ctx.event[' end'] = Zo n e d DateTime .par s e( s tart).plusNano s(nan os);
     }

# Se t net work.dir ection us i n g src/ds t z one  (t raf f i clogs).
 - set :     f ield: n etw ork.dir ect ion 
   va lue: inbo und
    i f:  ' ct x?. panw? . panos?.t yp e = ="TR AFFIC "  && ct x?.pa nw?. pa no s ?.s ource?. z on e == " un tr ust"  &&  c tx?.p anw? . pan os?.des tination? .zo n e ==  " tr ust"'
- set:
     f ie ld: networ k. dir ection     valu e: outbound
     if: 'c t x?.panw ?.p anos? .typ e == "TRA FFI C" &&ctx ? .panw? .panos ?.sou rc e?. z o ne == " tr ust "&& ctx?.pa n w ?.p anos? .d esti nation? .zone == "untrust" ' 
 -  set:
     fi eld : ne t w or k.d i re c tio n  v alue: internal     if: ' ct x ?. panw?.pano s ?.t yp e == "
x00800000
 _ _   nat_translated:_0x00400000
 __ __ captive_portal: 0x00200000
_  _   x_forwarded_for:_0x00080000
  __   http_proxy: 0x00040000
       container_page: 0x00008000
 __ ___temporary_match: 0x00002000
   _   symmetric_return: 0x00000800
_ _  source: >
    __ def labels_= ctx?.labels;
       if_(labels == null) {
  _  ___  labels =_new HashMap();
    _     ctx['labels']_= labels;
     _ }
    _  long value =_ctx._temp_.labels;
 _    _for (entry in_params.entrySet()) {
_  _     _if ((value &_entry.getValue())!= 0) {
   __  ___ _  labels[entry.getKey()]_=_true;
 __     __}
      _}

# normalize event.duration and_determine_event.end.
 - script:
 _   lang: painless
_    if: 'ctx?.event?.duration!=_null'
 _ _ params:
       NANOS_IN_A_SECOND: 1000000000
 _   source: >
 _   _ long_nanos_= ctx['event']['duration'] *_params.NANOS_IN_A_SECOND;
_ _    ctx['event']['duration'] = nanos;
_ _    def start_= ctx.event?.start;
  __   if (start!= null)_{
     _    ctx.event['end']_=_ZonedDateTime.parse(start).plusNanos(nanos);
_    _ }

# Set network.direction using src/dst_zone (traffic logs).
_- set:
     field:_network.direction
_    value: inbound
__   if: 'ctx?.panw?.panos?.type ==_"TRAFFIC"_&&_ctx?.panw?.panos?.source?.zone == "untrust" && ctx?.panw?.panos?.destination?.zone_== "trust"'
 - set:
  _  field: network.direction
     value:_outbound
  _  if: 'ctx?.panw?.panos?.type ==_"TRAFFIC"_&&_ctx?.panw?.panos?.source?.zone == "trust" && ctx?.panw?.panos?.destination?.zone == "untrust"'
 - set:
 _ _ field: network.direction
_    value: internal
    _if: 'ctx?.panw?.panos?.type == "