From e77a60bcbf03a50892926f917f22653270a13e03 Mon Sep 17 00:00:00 2001 From: Wes Date: Tue, 22 Nov 2022 20:44:48 +0000 Subject: [PATCH 1/2] Add missing OPCUA 'activate_session' pipelines --- .../zeek.opcua_activate_session_client_software_cert | 11 +++++++++++ .../zeek.opcua_activate_session_diagnostic_info | 10 ++++++++++ .../ingest/zeek.opcua_activate_session_locale_id | 10 ++++++++++ 3 files changed, 31 insertions(+) create mode 100644 salt/elasticsearch/files/ingest/zeek.opcua_activate_session_client_software_cert create mode 100644 salt/elasticsearch/files/ingest/zeek.opcua_activate_session_diagnostic_info create mode 100644 salt/elasticsearch/files/ingest/zeek.opcua_activate_session_locale_id diff --git a/salt/elasticsearch/files/ingest/zeek.opcua_activate_session_client_software_cert b/salt/elasticsearch/files/ingest/zeek.opcua_activate_session_client_software_cert new file mode 100644 index 000000000..2f2bb1196 --- /dev/null +++ b/salt/elasticsearch/files/ingest/zeek.opcua_activate_session_client_software_cert @@ -0,0 +1,11 @@ +{ + "description" : "zeek.opcua.activate_session_client_software_cert", + "processors" : [ + { "remove": { "field": ["host"], "ignore_failure": true } }, + { "json": { "field": "message", "target_field": "message2", "ignore_failure": true} }, + { "rename": { "field": "message2.client_software_cert_link_id", "target_field": "opcua.client_software_cert.link_id", "ignore_missing": true } }, + { "rename": { "field": "message2.cert_data", "target_field": "opcua.certificate.data", "ignore_missing": true } }, + { "rename": { "field": "message2.cert_signature", "target_field": "opcua.certificate.signature", "ignore_missing": true } }, + { "pipeline": { "name": "zeek.common" } } + ] +} diff --git a/salt/elasticsearch/files/ingest/zeek.opcua_activate_session_diagnostic_info b/salt/elasticsearch/files/ingest/zeek.opcua_activate_session_diagnostic_info new file mode 100644 index 000000000..6b77ce8ef --- /dev/null +++ b/salt/elasticsearch/files/ingest/zeek.opcua_activate_session_diagnostic_info @@ -0,0 +1,10 @@ +{ + "description" : " zeek.opcua.activate_session_diagnostic_info", + "processors" : [ + { "remove": { "field": ["host"], "ignore_failure": true } }, + { "json": { "field": "message", "target_field": "message2", "ignore_failure": true} }, + { "rename": { "field": "message2.activate_session_diag_info_link_id", "target_field": "opcua.activate_session_diag_info.link_id", "ignore_missing": true } }, + { "rename": { "field": "message2.diag_info_link_id", "target_field": "opcua.diag_info.link_id", "ignore_missing": true } }, + { "pipeline": { "name": "zeek.common" } } + ] +} diff --git a/salt/elasticsearch/files/ingest/zeek.opcua_activate_session_locale_id b/salt/elasticsearch/files/ingest/zeek.opcua_activate_session_locale_id new file mode 100644 index 000000000..42674c864 --- /dev/null +++ b/salt/elasticsearch/files/ingest/zeek.opcua_activate_session_locale_id @@ -0,0 +1,10 @@ +{ + "description" : "zeek.opcua.activate_session_locale_id", + "processors" : [ + { "remove": { "field": ["host"], "ignore_failure": true } }, + { "json": { "field": "message", "target_field": "message2", "ignore_failure": true} }, + { "rename": { "field": "message2.opcua_locale_link_id", "target_field": "opcua.locale.link_id", "ignore_missing": true } }, + { "rename": { "field": "message2.local_id", "target_field": "opcua.local_id", "ignore_missing": true } }, + { "pipeline": { "name": "zeek.common" } } + ] +} From 3a643628872c927d4cc4ddf0248da8b323e24082 Mon Sep 17 00:00:00 2001 From: weslambert Date: Tue, 22 Nov 2022 15:47:16 -0500 Subject: [PATCH 2/2] Remove extra space used during testing --- .../files/ingest/zeek.opcua_activate_session_diagnostic_info | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/salt/elasticsearch/files/ingest/zeek.opcua_activate_session_diagnostic_info b/salt/elasticsearch/files/ingest/zeek.opcua_activate_session_diagnostic_info index 6b77ce8ef..86c4b5eb7 100644 --- a/salt/elasticsearch/files/ingest/zeek.opcua_activate_session_diagnostic_info +++ b/salt/elasticsearch/files/ingest/zeek.opcua_activate_session_diagnostic_info @@ -1,5 +1,5 @@ { - "description" : " zeek.opcua.activate_session_diagnostic_info", + "description" : "zeek.opcua.activate_session_diagnostic_info", "processors" : [ { "remove": { "field": ["host"], "ignore_failure": true } }, { "json": { "field": "message", "target_field": "message2", "ignore_failure": true} },