CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2026-05-05 10:58:05 +02:00
Code Issues Packages Projects Releases Wiki Activity

Modify base ECS mappings to include .security where possible, as well as custom analyzer definition

Browse Source
This commit is contained in:
Wes Lambert
2022-03-02 14:19:36 +00:00
parent 93386f4620
commit 2d2ec45029
61 changed files with 25351 additions and 3396 deletions
Download Patch File Download Diff File Expand all files Collapse all files
salt/elasticsearch/templates/component/ecs/cloud.json
+118 -12
View File
@@ -4,6 +4,46 @@
"ecs_version": "1.12.2"
},
"template": {
"settings": {
"analysis": {
"analyzer": {
"es_security_analyzer": {
"type": "custom",
"char_filter": [
"whitespace_no_way"
],
"filter": [
"lowercase",
"trim"
],
"tokenizer": "keyword"
}
},
"char_filter": {
"whitespace_no_way": {
"type": "pattern_replace",
"pattern": "(\\s)+",
"replacement": "$1"
}
},
"filter": {
"path_hierarchy_pattern_filter": {
"type": "pattern_capture",
"preserve_original": true,
"patterns": [
"((?:[^\\\\]*\\\\)*)(.*)",
"((?:[^/]*/)*)(.*)"
]
}
},
"tokenizer": {
"path_tokenizer": {
"type": "path_hierarchy",
"delimiter": "\\"
}
}
}
},
"mappings": {
"properties": {
"cloud": {
@@ -12,27 +52,57 @@
"properties": {
"id": {
"ignore_above": 1024,
"type": "keyword"
"type": "keyword",
"fields": {
"security": {
"type": "text",
"analyzer": "es_security_analyzer"
}
}
},
"name": {
"ignore_above": 1024,
"type": "keyword"
"type": "keyword",
"fields": {
"security": {
"type": "text",
"analyzer": "es_security_analyzer"
}
}
}
}
},
"availability_zone": {
"ignore_above": 1024,
"type": "keyword"
"type": "keyword",
"fields": {
"security": {
"type": "text",
"analyzer": "es_security_analyzer"
}
}
},
"instance": {
"properties": {
"id": {
"ignore_above": 1024,
"type": "keyword"
"type": "keyword",
"fields": {
"security": {
"type": "text",
"analyzer": "es_security_analyzer"
}
}
},
"name": {
"ignore_above": 1024,
"type": "keyword"
"type": "keyword",
"fields": {
"security": {
"type": "text",
"analyzer": "es_security_analyzer"
}
}
}
}
},
@@ -40,7 +110,13 @@
"properties": {
"type": {
"ignore_above": 1024,
"type": "keyword"
"type": "keyword",
"fields": {
"security": {
"type": "text",
"analyzer": "es_security_analyzer"
}
}
}
}
},
@@ -48,27 +124,57 @@
"properties": {
"id": {
"ignore_above": 1024,
"type": "keyword"
"type": "keyword",
"fields": {
"security": {
"type": "text",
"analyzer": "es_security_analyzer"
}
}
},
"name": {
"ignore_above": 1024,
"type": "keyword"
"type": "keyword",
"fields": {
"security": {
"type": "text",
"analyzer": "es_security_analyzer"
}
}
}
}
},
"provider": {
"ignore_above": 1024,
"type": "keyword"
"type": "keyword",
"fields": {
"security": {
"type": "text",
"analyzer": "es_security_analyzer"
}
}
},
"region": {
"ignore_above": 1024,
"type": "keyword"
"type": "keyword",
"fields": {
"security": {
"type": "text",
"analyzer": "es_security_analyzer"
}
}
},
"service": {
"properties": {
"name": {
"ignore_above": 1024,
"type": "keyword"
"type": "keyword",
"fields": {
"security": {
"type": "text",
"analyzer": "es_security_analyzer"
}
}
}
}
}
@@ -77,4 +183,4 @@
}
}
}
}
}