CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-07 09:42:46 +01:00
Code Issues Packages Projects Releases Wiki Activity

update zeek s7comm parsers

Browse Source
This commit is contained in:
doug
2022-11-29 07:50:21 -05:00
parent 4251331bd4
commit 1bb76bb251
3 changed files with 19 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
salt/elasticsearch/files/ingest/zeek.s7comm
View File

@@ -1,15 +1,15 @@
{
"description" : "zeek.s7comm",
"processors" : [
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true} },
{ "rename": { "field": "message2.rosctr_code", "target_field": "s7.ros.control.code", "ignore_missing": true } },
{ "rename": { "field": "message2.rosctr_name", "target_field": "s7.ros.control.name", "ignore_missing": true } },
{ "rename": { "field": "message2.pdu_reference", "target_field": "s7.pdu_reference", "ignore_missing": true } },
{ "rename": { "field": "message2.function_code", "target_field": "s7.function.code", "ignore_missing": true } },
{ "rename": { "field": "message2.function_name", "target_field": "s7.function.name", "ignore_missing": true } },
{ "rename": { "field": "message2.error_class", "target_field": "s7.error.class", "ignore_missing": true } },
{ "rename": { "field": "message2.error_code", "target_field": "s7.error.code", "ignore_missing": true } },
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
{ "rename": { "field": "message2.rosctr_code", "target_field": "s7.ros.control.code", "ignore_missing": true } },
{ "rename": { "field": "message2.rosctr_name", "target_field": "s7.ros.control.name", "ignore_missing": true } },
{ "rename": { "field": "message2.pdu_reference", "target_field": "s7.pdu_reference", "ignore_missing": true } },
{ "rename": { "field": "message2.function_code", "target_field": "s7.function.code", "ignore_missing": true } },
{ "rename": { "field": "message2.function_name", "target_field": "s7.function.name", "ignore_missing": true } },
{ "rename": { "field": "message2.error_class", "target_field": "s7.error.class", "ignore_missing": true } },
{ "rename": { "field": "message2.error_code", "target_field": "s7.error.code", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}

10
salt/elasticsearch/files/ingest/zeek.s7comm_plus
View File

@@ -1,11 +1,11 @@
{
"description" : "zeek.s7comm_plus",
"processors" : [
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true} },
{ "rename": { "field": "message2.version", "target_field": "s7.version", "ignore_missing": true } },
{ "rename": { "field": "message2.opcode", "target_field": "s7.opcode.value", "ignore_missing": true } },
{ "rename": { "field": "message2.opcode_name", "target_field": "s7.opcode.name", "ignore_missing": true } },
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
{ "rename": { "field": "message2.version", "target_field": "s7.version", "ignore_missing": true } },
{ "rename": { "field": "message2.opcode", "target_field": "s7.opcode.value", "ignore_missing": true } },
{ "rename": { "field": "message2.opcode_name", "target_field": "s7.opcode.name", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}

10
salt/elasticsearch/files/ingest/zeek.wireguard
View File

@@ -1,11 +1,11 @@
{
"description" : "zeek.wireguard",
"processors" : [
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true} },
{ "rename": { "field": "message2.established", "target_field": "wireguard.established", "ignore_missing": true } },
{ "rename": { "field": "message2.initiations", "target_field": "wireguard.initiations", "ignore_missing": true } },
{ "rename": { "field": "message2.responses", "target_field": "wireguard.responses", "ignore_missing": true } },
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
{ "rename": { "field": "message2.established", "target_field": "wireguard.established", "ignore_missing": true } },
{ "rename": { "field": "message2.initiations", "target_field": "wireguard.initiations", "ignore_missing": true } },
{ "rename": { "field": "message2.responses", "target_field": "wireguard.responses", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}