From a91dbf0d1d1a959ec8b3dca51bdecb2d6676e621 Mon Sep 17 00:00:00 2001 From: Mike Reeves Date: Mon, 15 Jun 2020 15:10:16 -0400 Subject: [PATCH 1/2] Fix wording for Suricata meta data in whiptail --- setup/so-whiptail | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/setup/so-whiptail b/setup/so-whiptail index 693e53162..48e74e9b5 100755 --- a/setup/so-whiptail +++ b/setup/so-whiptail @@ -65,7 +65,7 @@ whiptail_bro_version() { [ -n "$TESTING" ] && return BROVERSION=$(whiptail --title "Security Onion Setup" --radiolist "What tool would you like to use to generate meta data?" 20 75 4 "ZEEK" "Install Zeek (aka Bro)" ON \ - "SURICATA" "SUPER EXPERIMENTAL" OFF 3>&1 1>&2 2>&3) + "SURICATA" "Use Suricata 5" OFF 3>&1 1>&2 2>&3) local exitstatus=$? whiptail_check_exitstatus $exitstatus From 3681f91c37c7dab63e5a0a18c5e879fdaa5bccb5 Mon Sep 17 00:00:00 2001 From: Mike Reeves Date: Mon, 15 Jun 2020 21:46:04 -0400 Subject: [PATCH 2/2] Suricata Conn --- salt/elasticsearch/files/ingest/suricata.flow | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/salt/elasticsearch/files/ingest/suricata.flow b/salt/elasticsearch/files/ingest/suricata.flow index c51961c05..47bec3a60 100644 --- a/salt/elasticsearch/files/ingest/suricata.flow +++ b/salt/elasticsearch/files/ingest/suricata.flow @@ -4,6 +4,11 @@ { "set": { "field": "dataset", "value": "conn" } }, { "rename": { "field": "message2.proto", "target_field": "network.transport", "ignore_missing": true } }, { "rename": { "field": "message2.app_proto", "target_field": "network.protocol", "ignore_missing": true } }, + { "rename": { "field": "message2.flow.state", "target_field": "connection.state", "ignore_missing": true } }, + { "rename": { "field": "message2.flow.bytes_toclient", "target_field": "server.ip_bytes", "ignore_missing": true } }, + { "rename": { "field": "message2.flow.bytes_toserver", "target_field": "client.ip_bytes", "ignore_missing": true } }, + { "rename": { "field": "message2.flow.start", "target_field": "connection.start", "ignore_missing": true } }, + { "rename": { "field": "message2.flow.end", "target_field": "connection.end", "ignore_missing": true } }, { "pipeline": { "name": "common" } } ] }