From 33712a340953dc3f019f938efcc35752a478496f Mon Sep 17 00:00:00 2001 From: Mike Reeves Date: Thu, 4 Jun 2020 16:19:22 -0400 Subject: [PATCH] Suricata HTTP parser --- salt/elasticsearch/files/ingest/suricata.http | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/salt/elasticsearch/files/ingest/suricata.http b/salt/elasticsearch/files/ingest/suricata.http index 53eb7b2af..32dd1f1c1 100644 --- a/salt/elasticsearch/files/ingest/suricata.http +++ b/salt/elasticsearch/files/ingest/suricata.http @@ -2,7 +2,15 @@ "description" : "suricata.http", "processors" : [ { "rename": { "field": "message2.proto", "target_field": "network.transport", "ignore_missing": true } }, - { "rename": { "field": "message2.app_proto", "target_field": "network.protocol", "ignore_missing": true } }, + { "rename": { "field": "message2.http.hostname", "target_field": "http.virtual_host", "ignore_missing": true } }, + { "rename": { "field": "message2.http.http_user_agent", "target_field": "http.useragent", "ignore_missing": true } }, + { "rename": { "field": "message2.http.url", "target_field": "http.uri", "ignore_missing": true } }, + { "rename": { "field": "message2.http.http_content_type", "target_field": "file.resp_mime_types", "ignore_missing": true } }, + { "rename": { "field": "message2.http.http_refer", "target_field": "http.referrer", "ignore_missing": true } }, + { "rename": { "field": "message2.http.http_method", "target_field": "http.method", "ignore_missing": true } }, + { "rename": { "field": "message2.http.protocol", "target_field": "http.version", "ignore_missing": true } }, + { "rename": { "field": "message2.http.status", "target_field": "http.status_code", "ignore_missing": true } }, + { "rename": { "field": "message2.http.length", "target_field": "http.request.body.length", "ignore_missing": true } }, { "pipeline": { "name": "common" } } ] -} +} \ No newline at end of file