Merge pull request #9893 from Security-Onion-Solutions/2.4/enable-zeek-vlan

2.4/enable zeek vlan

salt/elasticsearch/files/ingest/suricata.common

@@ -2,12 +2,13 @@
   "description" : "suricata.common",
   "processors" : [
     { "json":	{ "field": "message",			"target_field": "message2",		"ignore_failure": true  } },
-    { "rename":{ "field": "message2.proto",		"target_field": "network.transport",		"ignore_failure": true 	} },
+    { "rename":	{ "field": "message2.proto",		"target_field": "network.transport",	"ignore_failure": true 	} },
-    { "rename":{ "field": "message2.flow_id",		"target_field": "log.id.uid",		"ignore_failure": true 	} },
+    { "rename":	{ "field": "message2.flow_id",		"target_field": "log.id.uid",		"ignore_failure": true 	} },
-    { "rename":{ "field": "message2.src_ip",       "target_field": "source.ip",  "ignore_failure": true  } },
+    { "rename":	{ "field": "message2.src_ip",		"target_field": "source.ip",		"ignore_failure": true  } },
-    { "rename":{ "field": "message2.src_port",       "target_field": "source.port",  "ignore_failure": true  } },
+    { "rename":	{ "field": "message2.src_port",		"target_field": "source.port",		"ignore_failure": true  } },
-    { "rename":{ "field": "message2.dest_ip",       "target_field": "destination.ip",  "ignore_failure": true  } },
+    { "rename":	{ "field": "message2.dest_ip",		"target_field": "destination.ip",	"ignore_failure": true  } },
-    { "rename":{ "field": "message2.dest_port",       "target_field": "destination.port",  "ignore_failure": true  } },
+    { "rename":	{ "field": "message2.dest_port",	"target_field": "destination.port",	"ignore_failure": true  } },
+    { "rename":	{ "field": "message2.vlan",		"target_field": "network.vlan.id",	"ignore_failure": true  } },
     { "rename":	{ "field": "message2.community_id",	"target_field": "network.community_id",	"ignore_missing": true  } },
     { "set":	{ "field": "event.dataset",		"value": "{{ message2.event_type }}"  				} },
     { "set":	{ "field": "observer.name",		"value": "{{agent.name}}"  					} },

salt/elasticsearch/files/ingest/zeek.conn

@@ -20,9 +20,10 @@
     { "rename": 	{ "field": "message2.resp_ip_bytes", 	"target_field": "server.ip_bytes",		"ignore_missing": true 	} },
     { "rename": 	{ "field": "message2.orig_mac_oui", 	"target_field": "client.oui",			"ignore_missing": true 	} },
     { "rename": 	{ "field": "message2.tunnel_parents",	"target_field": "log.id.tunnel_parents",	"ignore_missing": true 	} },
-    { "rename": 	{ "field": "message2.orig_cc", 		"target_field": "client.country_code","ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.orig_cc", 		"target_field": "client.country_code",		"ignore_missing": true 	} },
     { "rename": 	{ "field": "message2.resp_cc", 		"target_field": "server.country_code",		"ignore_missing": true 	} },
     { "rename": 	{ "field": "message2.sensorname", 	"target_field": "observer.name",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.vlan", 		"target_field": "network.vlan.id",		"ignore_missing": true 	} },
     { "script":         { "lang": "painless", "source": "ctx.network.bytes = (ctx.client.bytes + ctx.server.bytes)", "ignore_failure": true } },
     { "set": { "if": "ctx.connection?.state == 'S0'",    "field": "connection.state_description", "value": "Connection attempt seen, no reply" } },
     { "set": { "if": "ctx.connection?.state == 'S1'",    "field": "connection.state_description", "value": "Connection established, not terminated" } },

salt/soc/defaults.yaml

@@ -1555,6 +1555,9 @@ soc:
           - name: Firewall
             description: Firewall logs
             query: 'event.dataset:firewall | groupby -sankey rule.action interface.name | groupby rule.action | groupby interface.name | groupby network.transport | groupby source.ip | groupby destination.ip | groupby destination.port'
+          - name: VLAN
+            description: VLAN (Virtual Local Area Network) tagged logs
+            query: '* AND _exists_:network.vlan.id | groupby network.vlan.id | groupby source.ip | groupby -sankey source.ip destination.ip | groupby destination.ip | groupby destination.port | groupby event.dataset | groupby event.module | groupby observer.name | groupby source.geo.country_name | groupby destination.geo.country_name'
       job:
       alerts:
         advanced: false

salt/zeek/defaults.yaml

@@ -37,6 +37,7 @@ zeek:
         - protocols/ftp/detect
         - protocols/conn/known-hosts
         - protocols/conn/known-services
+        - protocols/conn/vlan-logging
         - protocols/ssl/known-certs
         - protocols/ssl/validate-certs
         - protocols/ssl/log-hostcerts-only