# Author: Justin Henderson
#         SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Email: justin@hasecuritysolution.com
# Last Update: 12/9/2016

filter {
  if [type] == "fortinet" {
    mutate {
      gsub => [ "message", "= ", "=NA " ]
    }

    grok {
       match => ["message", "type=%{DATA:event_type}\s+"]
       tag_on_failure => []
    }
    grok {
       match => ["message", "<%{DATA}>%{GREEDYDATA:kv}"]
       tag_on_failure => []
    }
    kv {
      source => "kv"
      exclude_keys => [ "type" ]
    }
    mutate {
      gsub => [ "log", "= ", "=NA " ]
    }
    kv {
      source => "log"
      target => "SubLog"
    }
    grok {
       match => ["message", "custom: DOM-ALL, dns_query=%{DATA:dns_query};"]
       tag_on_failure => [ "" ]
    }
    mutate {
      rename => {  "action" => "action" }
      rename => {  "addr" => "addr_ip" }
      rename => {  "age" => "age" }
      rename => {  "assigned" => "assigned_ip" }
      rename => {  "assignip" => "assign_ip" }
      rename => {  "ap" => "access_point" }
      rename => {  "app" => "application" }
      rename => {  "appcat" => "application_category" }
      rename => {  "applist" => "application_list" }
      rename => {  "apprisk" => "application_risk" }
      rename => {  "approfile" => "accessPoint_profile" }
      rename => {  "apscan" => "access_point_scan" }
      rename => {  "apstatus" => "acces_point_status" }
      rename => {  "aptype" => "access_point_type" }
      rename => {  "authproto" => "authentication_protocol" }
      rename => {  "bandwidth" => "bandwidth" }
      rename => {  "banned_src" => "banned_source" }
      rename => {  "cat" => "category" }
      rename => {  "catdesc" => "category_description" }
      rename => {  "cfgattr" => "configuration_attribute" }
      rename => {  "cfgobj" => "configuration_object" }
      rename => {  "cfgpath" => "configuration_path" }
      rename => {  "cfgtid" => "configuration_transaction_id" }
      rename => {  "channel" => "channel" }
      rename => {  "community" => "community" }
      rename => {  "cookies" => "cookies" }
      rename => {  "craction" => "cr_action" }
      rename => {  "crlevel" => "cr_level" }
      rename => {  "crscore" => "cr_score" }
      rename => {  "datarange" => "data_range" }
      rename => {  "desc" => "description" }
      rename => {  "detectionmethod" => "detection_method" }
      rename => {  "devid" => "device_id" }
      rename => {  "devname" => "device_name" }
      rename => {  "devtype" => "device_type" }
      rename => {  "dhcp_msg" => "dhcp_message" }
      rename => {  "disklograte" => "disk_lograte" }
      rename => {  "dstcountry" => "destination_country" }
      rename => {  "dstintf" => "destination_interface" }
      rename => {  "dstip" => "destination_ip" }
      rename => {  "dstport" => "destination_port" }
      rename => {  "duration" => "elapsed_time" }
      rename => {  "error_num" => "error_number" }
      rename => {  "espauth" => "esp_authentication" }
      rename => {  "esptransform" => "esp_transform" }
      rename => {  "eventid" => "event_id" }
      rename => {  "eventtype" => "event_type" }
      rename => {  "fazlograte" => "faz_lograte" }
      rename => {  "filename" => "file_name" }
      rename => {  "filesize" => "file_size" }
      rename => {  "filetype" => "file_type" }
      rename => {  "hostname" => "hostname" }
      rename => {  "ip" => "source_ip" }
      rename => {  "localip" => "source_ip" }
      rename => {  "locip" => "local_ip" }
      rename => {  "locport" => "source_port" }
      rename => {  "logid" => "log_id" }
      rename => {  "logver" => "log_version" }
      rename => {  "manuf" => "manufacturer" }
      rename => {  "mem" => "memory" }
      rename => {  "meshmode" => "mesh_mode" }
      rename => {  "msg" => "message" }
      rename => {  "nextstat" => "next_stat" }
      rename => {  "onwire" => "on_wire" }
      rename => {  "osname" => "os_name" }
      rename => {  "osversion" => "unauthenticated_user" }
      rename => {  "outintf" => "outbound_interface" }
      rename => {  "peer_notif" => "peer_notification" }
      rename => {  "phase2_name" => "phase2_name" }
      rename => {  "policyid" => "policy_id" }
      rename => {  "policytype" => "policy_type" }
      rename => {  "port" => "port" }
      rename => {  "probeproto" => "probe_protocol" }
      rename => {  "proto" => "protocol_number" }
      rename => {  "radioband" => "radio_band" }
      rename => {  "radioidclosest" => "radio_id_closest" }
      rename => {  "radioiddetected" => "radio_id_detected" }
      rename => {  "rcvd" => "bytes_received" }
      rename => {  "rcvdbyte" => "bytes_received" }
      rename => {  "rcvdpkt" => "packets_received" }
      rename => {  "remip" => "destination_ip" }
      rename => {  "remport" => "remote_port" }
      rename => {  "reqtype" => "request_type" }
      rename => {  "scantime" => "scan_time" }
      rename => {  "securitymode" => "security_mode" }
      rename => {  "sent" => "bytes_sent" }
      rename => {  "sentbyte" => "bytes_sent" }
      rename => {  "sentpkt" => "packets_sent" }
      rename => {  "session_id" => "session_id" }
      rename => {  "setuprate" => "setup_rate" }
      rename => {  "sn" => "serial" }
      rename => {  "snclosest" => "serial_closest_access_point" }
      rename => {  "sndetected" => "serial_access_point_that_detected_rogue_ap" }
      rename => {  "snmeshparent" => "serial_mesh_parent" }
      rename => {  "srccountry" => "source_country" }
      rename => {  "srcip" => "source_ip" }
      rename => {  "srcmac" => "source_mac" }
      rename => {  "srcname" => "source_name" }
      rename => {  "srcintf" => "source_interface" }
      rename => {  "srcport" => "source_port" }
      rename => {  "stacount" => "station_count" }
      rename => {  "stamac" => "static_mac" }
      rename => {  "srccountry" => "source_country" }
      rename => {  "srcip" => "source_ip" }
      rename => {  "srcmac" => "source_mac" }
      rename => {  "srcname" => "source_name" }
      rename => {  "sn" => "serial" }
      rename => {  "srcintf" => "source_interface" }
      rename => {  "srcport" => "source_port" }
      rename => {  "total" => "total_bytes" }
      rename => {  "totalsession" => "total_sessions" }
      rename => {  "trandisp" => "nat_translation_type" }
      rename => {  "tranip" => "nat_destination_ip" }
      rename => {  "tranport" => "nat_destination_port" }
      rename => {  "transip" => "nat_source_ip" }
      rename => {  "transport" => "nat_source_port" }
      rename => {  "tunnelid" => "tunnel_id" }
      rename => {  "tunnelip" => "tunnel_ip" }
      rename => {  "tunneltype" => "tunnel_type" }
      rename => {  "unauthuser" => "unauthenticated_user_source" }
      rename => {  "unauthusersource" => "os_version" }
      rename => {  "vendorurl" => "vendor_url" }
      rename => {  "vpntunnel" => "vpn_tunnel" }
      rename => {  "vulncat" => "vulnerability_category" }
      rename => {  "vulncmt" => "vulnerability_count" }
      rename => {  "vulnid" => "vulnerability_id" }
      rename => {  "vulnname" => "vulnerability_name" }
      rename => {  "vulnref" => "vulnerability_reference" }
      rename => {  "vulnscore" => "vulnerability_score" }
      rename => {  "xauthgroup" => "x_authentication_group" }
      rename => {  "xauthuser" => "x_authentication_user" }
      rename => {  "[SubLog][appid]" => "sub_application_id" }
      rename => {  "[SubLog][devid]" => "sub_device_id" }
      rename => {  "[SubLog][dstip]" => "sub_destination_ip" }
      rename => {  "[SubLog][srcip]" => "sub_source_ip" }
      rename => {  "[SubLog][dstport]" => "sub_destination_port" }
      rename => {  "[SubLog][eventtype]" => "sub_event_type" }
      rename => {  "[SubLog][proto]" => "sub_protocol_number" }
      rename => {  "[SubLog][date]" => "sub_date" }
      rename => {  "[SubLog][time]" => "sub_time" }
      rename => {  "[SubLog][srcport]" => "sub_source_port" }
      rename => {  "[SubLog][subtype]" => "sub_subtype" }
      rename => {  "[SubLog][devname]" => "sub_device_name" }
      rename => {  "[SubLog][itime]" => "sub_itime" }
      rename => {  "[SubLog][level]" => "sub_level" }
      rename => {  "[SubLog][logid]" => "sub_log_id" }
      rename => {  "[SubLog][logver]" => "sub_log_version" }
      rename => {  "[SubLog][type]" => "sub_event_type" }
      rename => {  "[SubLog][vd]" => "sub_vd" }
      rename => {  "[SubLog][action]" => "sub_action" }
      rename => {  "[SubLog][logdesc]" => "sub_destination_ip" }
      rename => {  "[SubLog][policyid]" => "sub_olicy_id" }
      rename => {  "[SubLog][reason]" => "sub_reason" }
      rename => {  "[SubLog][service]" => "sub_service" }
      rename => {  "[SubLog][sessionid]" => "sub_session_id" }
      rename => {  "[SubLog][src]" => "sub_source_ip" }
      rename => {  "[SubLog][status]" => "sub_status" }
      rename => {  "[SubLog][ui]" => "sub_ui" }
      rename => {  "[SubLog][urlfilteridx]" => "sub_url_filter_idx" }
      strip => [ "bytes_sent", "bytes_received" ]
      convert => [ "bytes_sent", "integer" ]
      convert => [ "bytes_received", "integer" ]
      convert => [ "cr_score", "integer" ]
      convert => [ "cr_action", "integer" ]
      convert => [ "elapsed_time", "integer" ]
      convert => [ "destination_port", "integer" ]
      convert => [ "source_port", "integer" ]
      convert => [ "local_port", "integer" ]
      convert => [ "remote_port", "integer" ]
      convert => [ "packets_sent", "integer" ]
      convert => [ "packets_received", "integer" ]
      convert => [ "port", "integer" ]
      convert => [ "ProtocolNumber", "integer" ]
      convert => [ "XAuthUser", "string" ]
      remove_field => [ "kv", "log" ]
    }
    if [tunnel_ip] == "N/A" {
      mutate {
        remove_field => [ "tunnel_ip" ]
      }
    }
    if [nat_destination_ip] {
      mutate {
        add_field => { "ips" => [ "%{nat_destination_ip}" ] }
        add_field => { "destination_ips" => [ "%{nat_destination_ip}" ] }
      }
    }
    if [sub_destination_ip] {
      mutate {
        add_field => { "ips" => [ "%{sub_destination_ip}" ] }
        add_field => { "destination_ips" => [ "%{sub_destination_ip}" ] }
      }
    }
    if [nat_source_ip] {
      mutate {
        add_field => { "ips" => [ "%{nat_source_ip}" ] }
        add_field => { "source_ips" => [ "%{nat_source_ip}" ] }
      }
    }
    if [sub_source_ip] {
      mutate {
        add_field => { "ips" => [ "%{sub_source_ip}" ] }
        add_field => { "source_ips" => [ "%{sub_source_ip}" ] }
      }
    }
    if [addr_ip] {
      mutate {
        add_field => { "ips" => [ "%{addr_ip}" ] }
      }
    }
    if [assign_ip] {
      mutate {
        add_field => { "ips" => [ "%{assign_ip}" ] }
      }
    }
    if [assigned_ip] {
      mutate {
        add_field => { "ips" => [ "%{assigned_ip}" ] }
      }
    }
    grok {
       match => ["message", "type=%{DATA:event_type}\s+"]
    }
    if [date] and [time] {
      mutate {
        add_field => { "receive_time" => "%{date} %{time}" }
        remove_field => [ "date", "time" ]
      }
      date {
        timezone => "America/Chicago"
        match => [ "receive_time", "YYYY-MM-dd HH:mm:ss" ]
        target => "receive_time"
      }
      mutate {
        rename => { "receive_time" => "@timestamp" }
      }
    } else {
      mutate {
        add_tag => [ "missing_date" ]
      }
    }
	mutate {
		#add_tag => [ "conf_file_6200"]
	}
  }
}
