CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 17:22:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #1860 from Security-Onion-Solutions/strelka-parsing

Browse Source 
Pull out additional fields from Exif info
This commit is contained in:
weslambert
2020-11-09 11:54:55 -05:00
committed by GitHub
parent 12125deecb 7e578d2ce0
commit 059c4e03e1
1 changed files with 21 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
salt/elasticsearch/files/ingest/strelka.file
View File

@@ -12,7 +12,7 @@
{ {
"if": "ctx.exiftool?.keys !=null", "if": "ctx.exiftool?.keys !=null",
"field": "exiftool.keys", "field": "exiftool.keys",
"processor":{ "processor": {
"append": { "append": {
"field": "scan.exiftool", "field": "scan.exiftool",
"value": "{{_ingest._value.key}}={{_ingest._value.value}}" "value": "{{_ingest._value.key}}={{_ingest._value.value}}"
@@ -20,6 +20,18 @@
} }
} }
}, },
{ "foreach":
{
"if": "ctx.exiftool?.keys !=null",
"field": "exiftool.keys",
"processor": {
"set": {
"field": "exiftool.{{_ingest._value.key}}",
"value": "{{_ingest._value.value}}"
}
}
}
},
{ "foreach": { "foreach":
{ {
"if": "ctx.scan?.yara?.meta !=null", "if": "ctx.scan?.yara?.meta !=null",
@@ -32,6 +44,14 @@
} }
} }
}, },
{ "set": { "if": "ctx.exiftool?.SourceFile != null", "field": "file.source", "value": "{{exiftool.SourceFile}}", "ignore_failure": true }},
{ "set": { "if": "ctx.exiftool?.FilePermissions != null", "field": "file.permissions", "value": "{{exiftool.FilePermissions}}", "ignore_failure": true }},
{ "set": { "if": "ctx.exiftool?.FileName != null", "field": "file.name", "value": "{{exiftool.FileName}}", "ignore_failure": true }},
{ "set": { "if": "ctx.exiftool?.FileModifyDate != null", "field": "file.mtime", "value": "{{exiftool.FileModifyDate}}", "ignore_failure": true }},
{ "set": { "if": "ctx.exiftool?.FileAccessDate != null", "field": "file.accessed", "value": "{{exiftool.FileAccessDate}}", "ignore_failure": true }},
{ "set": { "if": "ctx.exiftool?.FileInodeChangeDate != null", "field": "file.ctime", "value": "{{exiftool.FileInodeChangeDate}}", "ignore_failure": true }},
{ "set": { "if": "ctx.exiftool?.FileDirectory != null", "field": "file.directory", "value": "{{exiftool.FileDirectory}}", "ignore_failure": true }},
{ "set": { "if": "ctx.exiftool?.Subsystem != null", "field": "host.subsystem", "value": "{{exiftool.Subsystem}}", "ignore_failure": true }},
{ "set": { "if": "ctx.scan?.yara?.matches != null", "field": "rule.name", "value": "{{scan.yara.matches.0}}" }}, { "set": { "if": "ctx.scan?.yara?.matches != null", "field": "rule.name", "value": "{{scan.yara.matches.0}}" }},
{ "set": { "if": "ctx.scan?.yara?.matches != null", "field": "dataset", "value": "alert", "override": true }}, { "set": { "if": "ctx.scan?.yara?.matches != null", "field": "dataset", "value": "alert", "override": true }},
{ "rename": { "field": "file.flavors.mime", "target_field": "file.mime_type", "ignore_missing": true }}, { "rename": { "field": "file.flavors.mime", "target_field": "file.mime_type", "ignore_missing": true }},