name: Security Onion Baseline Pipeline
priority: 90
transformations:
    - id: baseline_field_name_mapping
      type: field_name_mapping
      mapping:
        cs-method: http.method
        c-uri: http.uri
        c-useragent: http.useragent
        cs-version: http.version
        uid: user.uid
        sid: rule.uuid
        answer: answers
        query: dns.query.name
        src_ip: source.ip
        src_port: source.port
        dst_ip: destination.ip
        dst_port: destination.port
        winlog.event_data.User: user.name
        logtype: event.code # OpenCanary
      ## Start Temp Linux Mappings ##
        ProcessGuid: process.entity_id
        ProcessId: process.pid
        Image: process.executable
        CommandLine: process.command_line
        CurrentDirectory: process.working_directory
        ParentProcessGuid: process.parent.entity_id
        ParentProcessId: process.parent.pid
        ParentImage: process.parent.executable
        ParentCommandLine: process.parent.command_line
        User: user.name
     ## End Temp Linux Mappings ##
        document_id: _id
        rule.type: event.module
        related_ip: related.ip
        community_id: network.community_id
        event_dataset: event.dataset
        hostname: host.name
    # Maps "opencanary" product to SO IDH logs
    - id: opencanary_idh_add-fields
      type: add_condition
      conditions:
        event.module: 'opencanary'
        event.dataset: 'opencanary.idh'
      rule_conditions:
      - type: logsource
        product: opencanary
    # Maps "antivirus" category to Windows Defender logs shipped by Elastic Agent Winlog Integration
    # winlog.event_data.threat_name has to be renamed prior to ingestion, it is originally winlog.event_data.Threat Name
    - id: antivirus_field-mappings_windows-defender
      type: field_name_mapping
      mapping:
        Signature: winlog.event_data.threat_name
      rule_conditions:
      - type: logsource
        category: antivirus
    - id: antivirus_add-fields_windows-defender
      type: add_condition
      conditions:
        winlog.channel: 'Microsoft-Windows-Windows Defender/Operational'
        winlog.provider_name: 'Microsoft-Windows-Windows Defender'
        event.code: "1116"
      rule_conditions:
      - type: logsource
        category: antivirus
    # Transforms the `Hashes` field to ECS fields
    # ECS fields are used by the hash fields emitted by Elastic Defend
    # If shipped with Elastic Agent, sysmon logs will also have hashes mapped to ECS fields    
    - id: hashes_break_out_field
      type: hashes_fields
      valid_hash_algos: ["MD5", "SHA1", "SHA256", "SHA512", "IMPHASH"]
      field_prefix: "file"
      drop_algo_prefix: False
      field_name_conditions:
        - type: include_fields
          fields:
            - winlog.event_data.Hashes
    - id: hashes_process-creation
      type: field_name_mapping
      mapping:
        fileSHA256: process.hash.sha256
        fileSHA1: process.hash.sha1
        fileMD5: process.hash.md5
        fileIMPHASH: process.pe.imphash
      rule_conditions:
      - type: logsource
        product: windows
        category: process_creation
    - id: hashes_image-load
      type: field_name_mapping
      mapping:
        fileSHA256: dll.hash.sha256
        fileSHA1: dll.hash.sha1
        fileMD5: dll.hash.md5
        fileIMPHASH: dll.pe.imphash
      rule_conditions:
      - type: logsource
        product: windows
        category: image_load
    - id: hashes_driver-load
      type: field_name_mapping
      mapping:
        fileSHA256: dll.hash.sha256
        fileSHA1: dll.hash.sha1
        fileMD5: dll.hash.md5
        fileIMPHASH: dll.pe.imphash
      rule_conditions:
      - type: logsource
        product: windows
        category: driver_load
    - id: linux_security_add-fields
      type: add_condition
      conditions:
        event.module: 'system'
        event.dataset: 'system.auth'
      rule_conditions:
      - type: logsource
        product: linux
        service: auth
    # event.code should always be a string
    - id: convert_event_code_to_string
      type: convert_type
      target_type: 'str'
      field_name_conditions:
        - type: include_fields
          fields:
          - event.code
    # Maps process_creation rules to endpoint process creation logs
    # This is an OS-agnostic mapping, to account for logs that don't specify source OS
    - id: endpoint_process_create_windows_add-fields
      type: add_condition
      conditions:
        event.category: 'process'
        event.type: 'start'
      rule_conditions:
      - type: logsource
        category: process_creation
    # Maps file_event rules to endpoint file creation logs
    # This is an OS-agnostic mapping, to account for logs that don't specify source OS
    - id: endpoint_file_create_add-fields
      type: add_condition
      conditions:
        event.category: 'file'
        event.type: 'creation'
      rule_conditions:
      - type: logsource
        category: file_event
    # Maps network rules to all network logs
    # This targets all network logs, all services, generated from endpoints and network
    - id: network_add-fields
      type: add_condition
      conditions:
        event.category: 'network'
      rule_conditions:
      - type: logsource
        category: network
    # Maps network_connection rules to endpoint network creation logs
    # This is an OS-agnostic mapping, to account for logs that don't specify source OS
    - id: endpoint_network_connection_add-fields
      type: add_condition
      conditions:
        event.category: 'network'
        event.type: 'start'
      rule_conditions:
      - type: logsource
        category: network_connection
    # Maps "alert" category to SO Alert events
    - id: alert_so_add-fields
      type: add_condition
      conditions:
        tags: 'alert'
      rule_conditions:
      - type: logsource
        category: alert
    # Maps "network + connection" to SO connection logs
    - id: network_connection_so_add-fields
      type: add_condition
      conditions:
        tags: 'conn'
      rule_conditions:
      - type: logsource
        category: network
        service: connection
    # Maps "network + dns" to SO DNS logs
    - id: network_dns_so_add-fields
      type: add_condition
      conditions:
        tags: 'dns'
      rule_conditions:
      - type: logsource
        category: network
        service: dns
    # Maps "network + http" to SO HTTP logs
    - id: network_http_so_add-fields
      type: add_condition
      conditions:
        tags: 'http'
      rule_conditions:
      - type: logsource
        category: network
        service: http
    # Maps "network + file" to SO file logs
    - id: network_file_so_add-fields
      type: add_condition
      conditions:
        event.category: 'network'
        tags: 'file'
      rule_conditions:
      - type: logsource
        category: network
        service: file
    # Maps "network + x509" to SO x509 logs
    - id: network_x509_so_add-fields
      type: add_condition
      conditions:
        event.category: 'network'
        tags: 'x509'
      rule_conditions:
      - type: logsource
        category: network
        service: x509
    # Maps "network + ssl" to SO ssl logs
    - id: network_ssl_so_add-fields
      type: add_condition
      conditions:
        event.category: 'network'
        tags: 'ssl'
      rule_conditions:
      - type: logsource
        category: network
        service: ssl
    # Maps file to host or network file events
    - id: file_so_add-fields
      type: add_condition
      conditions:
        tags: '*file'
      rule_conditions:
      - type: logsource
        category: file