[CRTX-187285] SQUID - update modeling rules to create network stories (#41913)

* SQUID - update modeling rules

Author: oatias

Packs/Squid/ModelingRules/Squid/Squid.xif

@@ -17,7 +17,8 @@ alter
         xdm.network.http.url = replex (URL, ":\d+", ""),
         xdm.target.port = to_number(arrayindex(regextract(URL ,":(\d+)"),0)),
         xdm.source.user.username = if(User != "-", User, null),
+        xdm.source.port = 0,
         xdm.event.operation_sub_type = arrayindex(regextract(_raw_log ,"\/\d*\s\d*\s[\S]*\s[\S]*\s[\S]*\s([^\/]+)/"),0),
-        xdm.intermediate.ipv4 = arrayindex(regextract(_raw_log ,"\/\d*\s\d*\s[\S]*\s[\S]*\s[\S]*\s[^\/]*/(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"),0),
-        xdm.intermediate.ipv6 = arrayindex(regextract(_raw_log ,"\/\d*\s\d*\s[\S]*\s[\S]*\s[\S]*\s[^\/]*/([a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5})"),0),
+        xdm.target.ipv4 = arrayindex(regextract(_raw_log ,"\/\d*\s\d*\s[\S]*\s[\S]*\s[\S]*\s[^\/]*/(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"),0),
+        xdm.target.ipv6 = arrayindex(regextract(_raw_log ,"\/\d*\s\d*\s[\S]*\s[\S]*\s[\S]*\s[^\/]*/([a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5})"),0),
         xdm.network.ip_protocol= if(Protocol="ICMP", XDM_CONST.IP_PROTOCOL_ICMP, Protocol="TCP", XDM_CONST.IP_PROTOCOL_TCP, Protocol="UDP", XDM_CONST.IP_PROTOCOL_UDP, to_string(Protocol));

Packs/Squid/ReleaseNotes/1_0_7.md

@@ -0,0 +1,6 @@
+
+#### Modeling Rules
+
+##### Squid Modeling Rule
+
+- Updated modeling rules to map the destination ip entries to xdm.target.ipv4 and xdm.target.ipv6 instead of xdm.intermediate.ipv4 and xdm.intermediate.ipv6

Packs/Squid/pack_metadata.json

@@ -2,7 +2,7 @@
     "name": "Squid",
     "description": "Squid is a caching proxy for the Web which reduces bandwidth and improves response times by caching and reusing frequently-requested web pages.",
     "support": "xsoar",
-    "currentVersion": "1.0.6",
+    "currentVersion": "1.0.7",
     "author": "Cortex XSOAR",
     "url": "https://www.paloaltonetworks.com/cortex",
     "email": "",