fix(filters): normalize actionResult to canonical values

definitions/filters/antivirus/bitdefender_gz.yaml

@@ -264,6 +264,14 @@ pipeline:
             - origin.port
           to: int
 
+      # Adding action result
+      - add:
+          function: string
+          params:
+            key: actionResult
+            value: "blocked"
+          where: 'oneOf("action", ["blocked", "quarantined", "deleted", "disinfected"])'
+
       # Removing unused fields
       - delete:
           fields:

definitions/filters/antivirus/deceptive-bytes.yaml

@@ -450,6 +450,14 @@ pipeline:
           valueSplit: "="
           source: log.pidStatusToKv
 
+      # Adding action result
+      - add:
+          function: string
+          params:
+            key: actionResult
+            value: "blocked"
+          where: 'exists("log.action") && oneOf("log.action", ["blocked", "prevented"])'
+
       # Adding severity based on log.severityLabelCharacter
       - add:
           function: 'string'

definitions/filters/antivirus/esmc-eset.yaml

@@ -63,6 +63,7 @@ pipeline:
           from:
             - log.event
           to: actionResult
+          where: '!regexMatch("log.result", "(?i)\b(?:denied|blocked|failed)\b")'
       - rename:
           from:
             - log.sourceaddress
@@ -83,6 +84,28 @@ pipeline:
           from:
             - log.targetport
           to: target.port
+
+      # Adding action result
+      - add:
+          function: 'string'
+          params:
+            key: actionResult
+            value: 'denied'
+          where: regexMatch("log.event", "(?i)\bdenied\b")
+
+      - add:
+          function: 'string'
+          params:
+            key: actionResult
+            value: 'blocked'
+          where: regexMatch("log.event", "(?i)\bblocked\b")
+
+      - add:
+          function: 'string'
+          params:
+            key: actionResult
+            value: 'failed'
+          where: regexMatch("log.event", "(?i)\bfailed\b")
 
       # Adding severity field based on log.severity
       - add:

definitions/filters/antivirus/kaspersky.yaml

@@ -1102,6 +1102,21 @@ pipeline:
             destination: target.geolocation
           where: exists("target.ip")
 
+      # Adding action result
+      - add:
+          function: string
+          params:
+            key: actionResult
+            value: "Allow"
+          where: 'oneOf("action", ["Allow", "Allowed"])'
+
+      - add:
+          function: string
+          params:
+            key: actionResult
+            value: "blocked"
+          where: 'oneOf("action", ["Block", "Blocked", "blocked", "Redirect", "terminate", "delete", "quarantine"])'
+
       # .......................................................................#
       # Removing unused fields
       # .......................................................................#

definitions/filters/antivirus/sentinel-one.yaml

@@ -363,6 +363,26 @@ pipeline:
             - log.rt
           to: log.ruleTime
 
+      # Adding action result
+      - add:
+          function: string
+          params:
+            key: actionResult
+            value: "failed"
+          where: 'equals("log.threatStatus", "mitigation_failed")'
+      - add:
+          function: string
+          params:
+            key: actionResult
+            value: "failed"
+          where: 'equals("log.status", "failed") && !exists("actionResult")'
+      - add:
+          function: string
+          params:
+            key: actionResult
+            value: "failed"
+          where: 'contains("log.mitigationStatus", "fail") && !exists("actionResult")'
+
       # Removing unused fields
       - delete:
           fields:

definitions/filters/aws/aws.yaml

@@ -217,6 +217,26 @@ pipeline:
             - log.tlsDetails.tlsVersion
           to: log.tlsDetailsTlsVersion
 
+      # Adding action result
+      - add:
+          function: string
+          params:
+            key: actionResult
+            value: "success"
+          where: 'exists("log.eventName") && !exists("log.errorCode")'
+      - add:
+          function: string
+          params:
+            key: actionResult
+            value: "denied"
+          where: 'equals("log.errorCode", "AccessDenied")'
+      - add:
+          function: string
+          params:
+            key: actionResult
+            value: "failed"
+          where: 'exists("log.errorCode") && !equals("log.errorCode", "AccessDenied")'
+
       - delete:
           fields:
             - log.requestParameters