# Original Author: Justin Henderson
#         SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Updated by: Doug Burks
# Last Update: 2/7/2018
#
# This conf file is based on accepting logs for x509.log from Bro systems

filter {
  if [type] == "bro_x509" {
        # If message looks like json, try to parse it as such. Otherwise, fall back to csv or grok.
        if [message] =~ /^{.*}$/ {
                json {
                        source => "message"
                }

                mutate {
                        rename => { "ts" => "timestamp" }
                        #id
                        rename => { "certificate.version" => "certificate_version" }
                        rename => { "certificate.serial" => "certificate_serial" }
                        rename => { "certificate.subject" => "certificate_subject" }
                        rename => { "certificate.issuer" => "certificate_issuer" }
                        rename => { "certificate.not_valid_before" => "certificate_not_valid_before" }
                        rename => { "certificate.not_valid_after" => "certificate_not_valid_after" }
                        rename => { "certificate.key_alg" => "certificate_key_algorithm" }
                        rename => { "certificate.sig_alg" => "certificate_signing_algorithm" }
                        rename => { "certificate.key_type" => "certificate_key_type" }
                        rename => { "certificate.key_length" => "certificate_key_length" }
                        rename => { "certificate.exponent" => "certificate_exponent" }
                        rename => { "certificate.curve" => "certificate_curve" }
                        rename => { "id" => "fuid" }
                        rename => { "san.dns" => "san_dns" }
                        rename => { "san.uri" => "san_uri" }
                        rename => { "san.email" => "san_email" }
                        rename => { "san.ip" => "san_ip" }
                        rename => { "basic_constraints.ca" => "basic_constraints_ca" }
                        rename => { "basic_constraints.path_length" => "basic_constraints_path_length" }
		}
	} else {
	    grok {
	      match => [ "message", "(?<timestamp>(.*?))\t(?<fuid>(.*?))\t(?<certificate_version>(.*?))\t(?<certificate_serial>(.*?))\t(?<certificate_subject>(.*?))\t(?<certificate_issuer>(.*?))\t(?<certificate_not_valid_before>(.*?))\t(?<certificate_not_valid_after>(.*?))\t(?<certificate_key_algorithm>(.*?))\t(?<certificate_signing_algorithm>(.*))\t(?<certificate_key_type>(.*))\t(?<certificate_key_length>(.*))\t(?<certificate_exponent>(.*))\t(?<certificate_curve>(.*))\t(?<san_dns>(.*))\t(?<san_uri>(.*))\t(?<san_email>(.*))\t(?<san_ip>(.*))\t(?<basic_constraints_ca>(.*))\t(?<basic_constraints_path_length>(.*))" ]
	    }
	}

    mutate {
      gsub => [ "certificate_issuer", "\\\\,", "|" ]
      gsub => [ "certificate_subject", "\\\\,", "|" ]
    }
	
    kv {
      include_keys => [ "CN", "C", "O", "OU", "ST", "SN", "L", "DC", "GN", "pseudonym", "serialNumber", "title", "initials" ]
      field_split => ","
      source => "certificate_issuer"
    }
    mutate {
      rename => { "CN" => "issuer_common_name"}
      rename => { "C" => "issuer_country_code"}
      rename => { "O" => "issuer_organization"}
      rename => { "OU" => "issuer_organization_unit"}
      rename => { "ST" => "issuer_state"}
      rename => { "SN" => "issuer_surname"}
      rename => { "L" => "issuer_locality"}
      rename => { "DC" => "issuer_distinguished_name"}
      rename => { "GN" => "issuer_given_name"}
      rename => { "pseudonym" => "issuer_pseudonym"}
      rename => { "serialNumber" => "issuer_serial_number"}
      rename => { "title" => "issuer_title"}
      rename => { "initials" => "issuer_initials"}
    }
    kv {
      include_keys => [ "CN", "C", "O", "OU", "ST", "SN", "L", "GN", "pseudonym", "serialNumber", "title", "initials" ]
      field_split => ","
      source => "certificate_subject"
    }
    mutate {
      rename => { "CN" => "certificate_common_name"}
      rename => { "C" => "certificate_country_code"}
      rename => { "O" => "certificate_organization"}
      rename => { "OU" => "certificate_organization_unit"}
      rename => { "ST" => "certificate_state"}
      rename => { "SN" => "certificate_surname"}
      rename => { "L" => "certificate_locality"}
      rename => { "GN" => "certificate_given_name"}
      rename => { "pseudonym" => "certificate_pseudonym"}
      rename => { "serialNumber" => "certificate_serial_number"}
      rename => { "title" => "certificate_title"}
      rename => { "initials" => "certificate_initials"}
      convert => [ "certificate_key_length", "integer" ]
      convert => [ "certificate_not_valid_after", "integer" ]
      convert => [ "certificate_not_valid_before", "integer" ]
    }
    if [query] == "-" {
      mutate {
        remove_field => [ "query" ]
      }
    }
    if [san_dns] == "-" {
      mutate {
        remove_field => [ "san_dns" ]
      }
    }
    if [san_email] == "-" {
      mutate {
        remove_field => [ "san_email" ]
      }
    }
    if [san_uri] == "-" {
      mutate {
        remove_field => [ "san_uri" ]
      }
    }
    if [san_ip] == "-" {
      mutate {
        remove_field => [ "san_ip" ]
      }
    }
    if [certificate_common_name] {
      ruby {
        code => "event.set('certificate_common_name_length', event.get('certificate_common_name').length)"
      }
    }
    if [issuer_common_name] {
      ruby {
        code => "event.set('issuer_common_name_length', event.get('issuer_common_name').length)"
      }
    }
    if [certificate_not_valid_after] == "-" {
      mutate {
        remove_field => [ "certificate_not_valid_after" ]
      }
    }
    if [certificate_not_valid_before] == "-" {
      mutate {
        remove_field => [ "certificate_not_valid_before" ]
      }
    }
    if [certificate_not_valid_after] and [certificate_not_valid_before] {
      ruby {
        code => "event.set('certificate_number_days_valid', ((event.get('certificate_not_valid_after') - event.get('certificate_not_valid_before')) / 86400).ceil)"
      }
      date {
        match => [ "certificate_not_valid_after", "UNIX" ]
        target => "certificate_not_valid_after"
      }
      date {
        match => [ "certificate_not_valid_before", "UNIX" ]
        target => "certificate_not_valid_before"
      }
    }
	mutate {
		#add_tag => [ "conf_file_1123"]
	}
  }
}
