- name: Demo rules with CyberArk syslog as source
  hosts: localhost 
  sources:
    - cyberark.pas.syslog:
        host: 0.0.0.0 
        port: 1514
  rules:
    - name: Check For User Suspension Event, Then Disable The User and Notify
      condition: event.cyberark.syslog.audit_record.Severity == "Error" and event.cyberark.syslog.audit_record.MessageID == "5"
      action:
        run_playbook:
          name: disable_user.yml
          extra_vars:
            username: "{{ event.cyberark.syslog.audit_record.Issuer }}"  
    - name: Check For PTA irregular IP OR irregular Hours Access and Notify
      condition: event.cyberark.DeviceEventClassID == "25" or event.cyberark.DeviceEventClassID == "23"
      action:
        run_playbook:
          name: pta_disable_notify.yml
          extra_vars:
            username: "{{ event.cyberark.suser }}"
            #username: "{{ event.cyberark.suser | ansible.builtin.regex_search('^[a-zA-Z0-9_]+') }}"
            eventname: "{{ event.cyberark.DeviceName }}"
            eventurl: "{{ event.cyberark.PTALink }}"
            station: "{{ event.cyberark.shost }}"