# Author: Justin Henderson
#         SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Email: justin@hasecuritysolution.com
# Last Update: 12/9/2016

filter {
  if [destination_ip] {
    if [destination_ip] =~ "10\." or [destination_ip] =~ "192\.168\." or [destination_ip] =~ "172\.(1[6-9]|2[0-9]|3[0-1])\." {
      mutate {
        add_tag => [ "internal_destination" ]
      }
    } else {
      mutate {
        add_tag => [ "external_destination" ]
      }
    }
    if "internal_destination" not in [tags] {
      if [destination_ip] == "198.41.0.4" or [destination_ip] == "192.228.79.201" or [destination_ip] == "192.33.4.12" or [destination_ip] == "199.7.91.13" or [destination_ip] == "192.203.230.10" or [destination_ip] == "192.5.5.241" or [destination_ip] == "192.112.36.4" or [destination_ip] == "198.97.190.53" or [destination_ip] == "192.36.148.17" or [destination_ip] == "192.58.128.30" or [destination_ip] == "193.0.14.129" or [destination_ip] == "199.7.83.42" or [destination_ip] == "202.12.27.33" {
        mutate {
          add_tag => [ "root_dns_server" ]
        }
      }
    }
    # Customize this section to your environment
    if [destination_ip] == "74.40.74.40" or [destination_ip] == "74.40.74.41" {
      mutate {
        add_tag => [ "authorized_dns_server" ]
      }
    }
  }
  if [source_ip] {
    if [source_ip] =~ "10\." or [source_ip] =~ "192\.168\." or [source_ip] =~ "172\.(1[6-9]|2[0-9]|3[0-1])\." {
      mutate {
        add_tag => [ "internal_source" ]
      }
    } else {
      mutate {
        add_tag => [ "external_source" ]
      }
    }
    if "internal_source" not in [tags] {
      if [source_ip] == "198.41.0.4" or [source_ip] == "192.228.79.201" or [source_ip] == "192.33.4.12" or [source_ip] == "199.7.91.13" or [source_ip] == "192.203.230.10" or [source_ip] == "192.5.5.241" or [source_ip] == "192.112.36.4" or [source_ip] == "198.97.190.53" or [source_ip] == "192.36.148.17" or [source_ip] == "192.58.128.30" or [source_ip] == "193.0.14.129" or [source_ip] == "199.7.83.42" or [source_ip] == "202.12.27.33" {
        mutate {
          add_tag => [ "root_dns_server" ]
        }
      }
    }
    # Customize this section to your environment
    if [destination_ip] == "74.40.74.40" and "authorized_dns_server" not in [tags] or [destination_ip] == "74.40.74.41" and "authorized_dns_server" not in [tags] {
      mutate {
        add_tag => [ "authorized_dns_server" ]
      }
    }
	mutate {
		##add_tag => [ "conf_file_8200"]
	}
  }
  if [type] =~ /ossec|snort|firewall/ or "firewall" in [tags] {
      mutate {
          remove_tag => [ "syslog" ]
      }
  }
}
