CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 17:22:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #8007 from Security-Onion-Solutions/fix/filestream-id

Browse Source 
Add filestream input ID for RITA logs
This commit is contained in:
weslambert
2022-05-25 10:11:36 -04:00
committed by GitHub
parent 99864f4787 44622350ea
commit 1a0ac4d253
1 changed files with 3 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
salt/filebeat/etc/filebeat.yml
View File

@@ -267,6 +267,7 @@ filebeat.inputs:
{%- if RITAENABLED %} {%- if RITAENABLED %}
- type: filestream - type: filestream
id: rita-beacon
paths: paths:
- /nsm/rita/beacons.csv - /nsm/rita/beacons.csv
exclude_lines: ['^Score', '^Source', '^Domain', '^No results'] exclude_lines: ['^Score', '^Source', '^Domain', '^No results']
@@ -282,6 +283,7 @@ filebeat.inputs:
index: "so-rita" index: "so-rita"
- type: filestream - type: filestream
id: rita-connection
paths: paths:
- /nsm/rita/long-connections.csv - /nsm/rita/long-connections.csv
- /nsm/rita/open-connections.csv - /nsm/rita/open-connections.csv
@@ -298,6 +300,7 @@ filebeat.inputs:
index: "so-rita" index: "so-rita"
- type: filestream - type: filestream
id: rita-dns
paths: paths:
- /nsm/rita/exploded-dns.csv - /nsm/rita/exploded-dns.csv
exclude_lines: ['^Domain', '^No results'] exclude_lines: ['^Domain', '^No results']