CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 17:22:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #9501 from Security-Onion-Solutions/fix/elasticsearch_ingest_pipeline_rita_beacon

Browse Source 
Update RITA beacon parsing
This commit is contained in:
weslambert
2023-01-03 11:13:55 -05:00
committed by GitHub
parent 55c6fc422b bd114eb1c4
commit 20d6ce1ce9
1 changed files with 36 additions and 71 deletions
Download Patch File Download Diff File Expand all files Collapse all files

107
salt/elasticsearch/files/ingest/rita.beacon
View File

@@ -17,98 +17,63 @@
"destination.ip",
"network.connections",
"network.average_bytes",
"beacon.interval.range",
"beacon.size.range",
"beacon.interval.top",
"beacon.size.top",
"beacon.interval.top_count",
"beacon.size.top_count",
"beacon.interval.skew",
"beacon.size.skew",
"beacon.interval.dispersion",
"beacon.size.dispersion",
"network.bytes"
"network.bytes",
"beacon.ts_score",
"beacon.ds_score",
"beacon.duration_score",
"beacon.historical_score",
"beacon.interval.top"
]
}
},
{
"convert": {
"field": "beacon.ds_score",
"type": "float"
}
},
{
"convert": {
"field": "beacon.duration_score",
"type": "float"
}
},
{
"convert": {
"field": "beacon.historical_score",
"type": "float"
}
},
{
"convert": {
"field": "beacon.score",
"type": "float"
}
},
{
"convert": {
"field": "beacon.ts_score",
"type": "float"
}
},
{
"convert": {
"field": "network.average_bytes",
"type": "float"
}
},
{
"convert": {
"field": "network.connections",
"type": "integer"
}
},
{
"convert": {
"field": "network.average_bytes",
"type": "integer"
}
},
{
"convert": {
"field": "beacon.interval.range",
"type": "integer"
}
},
{
"convert": {
"field": "beacon.size.range",
"type": "integer"
}
},
{
"convert": {
"field": "beacon.interval.top",
"type": "integer"
}
},
{
"convert": {
"field": "beacon.size.top",
"type": "integer"
}
},
{
"convert": {
"field": "beacon.interval.top_count",
"type": "integer"
}
},
{
"convert": {
"field": "beacon.size.top_count",
"type": "integer"
}
},
{
"convert": {
"field": "beacon.interval.skew",
"type": "float"
}
},
{
"convert": {
"field": "beacon.size.skew",
"type": "float"
}
},
{
"convert": {
"field": "beacon.interval.dispersion",
"type": "integer"
}
},
{
"convert": {
"field": "beacon.size.dispersion",
"type": "integer"
}
},
{
"convert": {
"field": "network.bytes",