CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 17:22:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

Support Kratos user.name lookup

Browse Source
This commit is contained in:
Josh Brower
2025-04-15 11:40:43 -04:00
parent 7f5cde9a1c
commit 152fdaa7bb
1 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
salt/elasticfleet/files/integrations/grid-nodes_general/kratos-logs.json → salt/elasticfleet/files/integrations-dynamic/grid-nodes_general/kratos-logs.json
View File

@@ -1,3 +1,4 @@
{% set identities = salt['sqlite3.fetch']('/nsm/kratos/db/db.sqlite', 'SELECT id, json_extract(traits, "$.email") as email FROM identities;') %}
{ {
"package": { "package": {
"name": "log", "name": "log",
@@ -19,7 +20,7 @@
], ],
"data_stream.dataset": "kratos", "data_stream.dataset": "kratos",
"tags": ["so-kratos"], "tags": ["so-kratos"],
"processors": "- decode_json_fields:\n fields: [\"message\"]\n target: \"\"\n add_error_key: true \n- add_fields:\n target: event\n fields:\n category: iam\n module: kratos", "processors": "- decode_json_fields:\n fields: [\"message\"]\n target: \"\"\n add_error_key: true\n- add_fields:\n target: event\n fields:\n category: iam\n module: kratos\n- if:\n has_fields:\n - identity_id\n then:{% for id, email in identities %}\n - if:\n equals:\n identity_id: \"{{ id }}\"\n then:\n - add_fields:\n target: ''\n fields:\n user.name: \"{{ email }}\"{% endfor %}",
"custom": "pipeline: kratos" "custom": "pipeline: kratos"
} }
} }
@@ -28,3 +29,4 @@
}, },
"force": true "force": true
} }