CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2026-04-26 22:47:49 +02:00
Code Issues Packages Projects Releases Wiki Activity

Modify base ECS mappings to include .security where possible, as well as custom analyzer definition

Browse Source
This commit is contained in:
Wes Lambert
2022-03-02 14:19:36 +00:00
parent 93386f4620
commit 2d2ec45029
61 changed files with 25351 additions and 3396 deletions
Download Patch File Download Diff File Expand all files Collapse all files
salt/elasticsearch/templates/component/ecs/source.json
+218 -31
View File
@@ -4,13 +4,59 @@
"ecs_version": "1.12.2"
},
"template": {
"settings": {
"analysis": {
"analyzer": {
"es_security_analyzer": {
"type": "custom",
"char_filter": [
"whitespace_no_way"
],
"filter": [
"lowercase",
"trim"
],
"tokenizer": "keyword"
}
},
"char_filter": {
"whitespace_no_way": {
"type": "pattern_replace",
"pattern": "(\\s)+",
"replacement": "$1"
}
},
"filter": {
"path_hierarchy_pattern_filter": {
"type": "pattern_capture",
"preserve_original": true,
"patterns": [
"((?:[^\\\\]*\\\\)*)(.*)",
"((?:[^/]*/)*)(.*)"
]
}
},
"tokenizer": {
"path_tokenizer": {
"type": "path_hierarchy",
"delimiter": "\\"
}
}
}
},
"mappings": {
"properties": {
"source": {
"properties": {
"address": {
"ignore_above": 1024,
"type": "keyword"
"type": "keyword",
"fields": {
"security": {
"type": "text",
"analyzer": "es_security_analyzer"
}
}
},
"as": {
"properties": {
@@ -21,8 +67,9 @@
"properties": {
"name": {
"fields": {
"text": {
"type": "match_only_text"
"security": {
"type": "text",
"analyzer": "es_security_analyzer"
}
},
"ignore_above": 1024,
@@ -37,52 +84,118 @@
},
"domain": {
"ignore_above": 1024,
"type": "keyword"
"type": "keyword",
"fields": {
"security": {
"type": "text",
"analyzer": "es_security_analyzer"
}
}
},
"geo": {
"properties": {
"city_name": {
"ignore_above": 1024,
"type": "keyword"
"type": "keyword",
"fields": {
"security": {
"type": "text",
"analyzer": "es_security_analyzer"
}
}
},
"continent_code": {
"ignore_above": 1024,
"type": "keyword"
"type": "keyword",
"fields": {
"security": {
"type": "text",
"analyzer": "es_security_analyzer"
}
}
},
"continent_name": {
"ignore_above": 1024,
"type": "keyword"
"type": "keyword",
"fields": {
"security": {
"type": "text",
"analyzer": "es_security_analyzer"
}
}
},
"country_iso_code": {
"ignore_above": 1024,
"type": "keyword"
"type": "keyword",
"fields": {
"security": {
"type": "text",
"analyzer": "es_security_analyzer"
}
}
},
"country_name": {
"ignore_above": 1024,
"type": "keyword"
"type": "keyword",
"fields": {
"security": {
"type": "text",
"analyzer": "es_security_analyzer"
}
}
},
"location": {
"type": "geo_point"
},
"name": {
"ignore_above": 1024,
"type": "keyword"
"type": "keyword",
"fields": {
"security": {
"type": "text",
"analyzer": "es_security_analyzer"
}
}
},
"postal_code": {
"ignore_above": 1024,
"type": "keyword"
"type": "keyword",
"fields": {
"security": {
"type": "text",
"analyzer": "es_security_analyzer"
}
}
},
"region_iso_code": {
"ignore_above": 1024,
"type": "keyword"
"type": "keyword",
"fields": {
"security": {
"type": "text",
"analyzer": "es_security_analyzer"
}
}
},
"region_name": {
"ignore_above": 1024,
"type": "keyword"
"type": "keyword",
"fields": {
"security": {
"type": "text",
"analyzer": "es_security_analyzer"
}
}
},
"timezone": {
"ignore_above": 1024,
"type": "keyword"
"type": "keyword",
"fields": {
"security": {
"type": "text",
"analyzer": "es_security_analyzer"
}
}
}
}
},
@@ -91,7 +204,13 @@
},
"mac": {
"ignore_above": 1024,
"type": "keyword"
"type": "keyword",
"fields": {
"security": {
"type": "text",
"analyzer": "es_security_analyzer"
}
}
},
"nat": {
"properties": {
@@ -111,30 +230,61 @@
},
"registered_domain": {
"ignore_above": 1024,
"type": "keyword"
"type": "keyword",
"fields": {
"security": {
"type": "text",
"analyzer": "es_security_analyzer"
}
}
},
"subdomain": {
"ignore_above": 1024,
"type": "keyword"
"type": "keyword",
"fields": {
"security": {
"type": "text",
"analyzer": "es_security_analyzer"
}
}
},
"top_level_domain": {
"ignore_above": 1024,
"type": "keyword"
"type": "keyword",
"fields": {
"security": {
"type": "text",
"analyzer": "es_security_analyzer"
}
}
},
"user": {
"properties": {
"domain": {
"ignore_above": 1024,
"type": "keyword"
"type": "keyword",
"fields": {
"security": {
"type": "text",
"analyzer": "es_security_analyzer"
}
}
},
"email": {
"ignore_above": 1024,
"type": "keyword"
"type": "keyword",
"fields": {
"security": {
"type": "text",
"analyzer": "es_security_analyzer"
}
}
},
"full_name": {
"fields": {
"text": {
"type": "match_only_text"
"security": {
"type": "text",
"analyzer": "es_security_analyzer"
}
},
"ignore_above": 1024,
@@ -144,30 +294,61 @@
"properties": {
"domain": {
"ignore_above": 1024,
"type": "keyword"
"type": "keyword",
"fields": {
"security": {
"type": "text",
"analyzer": "es_security_analyzer"
}
}
},
"id": {
"ignore_above": 1024,
"type": "keyword"
"type": "keyword",
"fields": {
"security": {
"type": "text",
"analyzer": "es_security_analyzer"
}
}
},
"name": {
"ignore_above": 1024,
"type": "keyword"
"type": "keyword",
"fields": {
"security": {
"type": "text",
"analyzer": "es_security_analyzer"
}
}
}
}
},
"hash": {
"ignore_above": 1024,
"type": "keyword"
"type": "keyword",
"fields": {
"security": {
"type": "text",
"analyzer": "es_security_analyzer"
}
}
},
"id": {
"ignore_above": 1024,
"type": "keyword"
"type": "keyword",
"fields": {
"security": {
"type": "text",
"analyzer": "es_security_analyzer"
}
}
},
"name": {
"fields": {
"text": {
"type": "match_only_text"
"security": {
"type": "text",
"analyzer": "es_security_analyzer"
}
},
"ignore_above": 1024,
@@ -175,7 +356,13 @@
},
"roles": {
"ignore_above": 1024,
"type": "keyword"
"type": "keyword",
"fields": {
"security": {
"type": "text",
"analyzer": "es_security_analyzer"
}
}
}
}
}
@@ -184,4 +371,4 @@
}
}
}
}
}