mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2026-11-09 14:09:58 +01:00
merge in dev
This commit is contained in:
102 files changed
+18699
-5104
No files matched your search
@@ -0,0 +1,23 @@
|
||||
#!/bin/bash
|
||||
#
|
||||
# Copyright 2014-2022 Security Onion Solutions, LLC
|
||||
#
|
||||
# This program is free software: you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation, either version 3 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
{%- set NODEIP = salt['pillar.get']('elasticsearch:mainip', '') -%}
|
||||
. /usr/sbin/so-common
|
||||
if [ "$1" == "" ]; then
|
||||
{{ ELASTICCURL }} -s -k -L https://{{ NODEIP }}:9200/_component_template | jq '.component_templates[] |.name'| sort
|
||||
else
|
||||
{{ ELASTICCURL }} -s -k -L https://{{ NODEIP }}:9200/_component_template/$1 | jq
|
||||
fi
|
||||
@@ -0,0 +1,23 @@
|
||||
#!/bin/bash
|
||||
#
|
||||
# Copyright 2014-2022 Security Onion Solutions, LLC
|
||||
#
|
||||
# This program is free software: you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation, either version 3 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
{%- set NODEIP = salt['pillar.get']('elasticsearch:mainip', '') -%}
|
||||
. /usr/sbin/so-common
|
||||
if [ "$1" == "" ]; then
|
||||
{{ ELASTICCURL }} -s -k -L https://{{ NODEIP }}:9200/_index_template | jq '.index_templates[] |.name'| sort
|
||||
else
|
||||
{{ ELASTICCURL }} -s -k -L https://{{ NODEIP }}:9200/_index_template/$1 | jq
|
||||
fi
|
||||
@@ -53,7 +53,9 @@ if [ "$CONTINUE" == "y" ]; then
|
||||
docker exec -i so-mysql mysql --user=root --password=$(lookup_pillar_secret 'mysql') -e "GRANT ALL PRIVILEGES ON *.* TO 'root'@'$NEW_IP' IDENTIFIED BY '$(lookup_pillar_secret 'mysql')' WITH GRANT OPTION;" &> /dev/null
|
||||
echo "Removing MySQL root user from $OLD_IP"
|
||||
docker exec -i so-mysql mysql --user=root --password=$(lookup_pillar_secret 'mysql') -e "DROP USER 'root'@'$OLD_IP';" &> /dev/null
|
||||
|
||||
echo "Updating Kibana dashboards"
|
||||
salt-call state.apply kibana.so_savedobjects_defaults -l info queue=True
|
||||
|
||||
echo "The IP has been changed from $OLD_IP to $NEW_IP."
|
||||
|
||||
echo
|
||||
|
||||
@@ -15,10 +15,6 @@
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
if ! [ "$(id -u)" = 0 ]; then
|
||||
echo "This command must be run as root"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
display_help() {
|
||||
cat <<HELP_USAGE
|
||||
@@ -100,10 +96,15 @@ create_expected_container_list() {
|
||||
|
||||
}
|
||||
|
||||
# {% raw %}
|
||||
populate_container_lists() {
|
||||
# TODO: check exit code directly, not with $?
|
||||
systemctl is-active --quiet docker
|
||||
|
||||
if [[ $? = 0 ]]; then
|
||||
# TODO: look into using docker templates instead of curl and jq
|
||||
# Ex docker ps --format "{{.Names}}\t{{.State}}"
|
||||
# TODO: convert the output to an associtive array
|
||||
mapfile -t docker_raw_list < <(curl -s --unix-socket /var/run/docker.sock http:/v1.40/containers/json?all=1 \
|
||||
| jq -c '.[] | { Name: .Names[0], State: .State }' \
|
||||
| tr -d '/{"}')
|
||||
@@ -167,60 +168,55 @@ parse_status() {
|
||||
fi
|
||||
}
|
||||
|
||||
# {% raw %}
|
||||
|
||||
print_line() {
|
||||
local service_name=${1}
|
||||
local service_state="$( parse_status ${1} ${2} )"
|
||||
local columns=$(tput cols)
|
||||
local state_color="\e[0m"
|
||||
local service_name="${1}"
|
||||
local service_state="" ; service_state="$( parse_status "${1}" "${2}" )"
|
||||
# XXX: What will we do if tput isn't avalable?
|
||||
local line=""
|
||||
local PADDING_CONSTANT=""
|
||||
local columns=35 # value used if not printing to a tty
|
||||
|
||||
local PADDING_CONSTANT=15
|
||||
if (( __tty == 1 )); then
|
||||
local reset_attr; reset_attr="$(tput sgr0)" # reset all attributes
|
||||
local bold; bold="$(tput bold)"
|
||||
local red; red="$(tput setaf 1)"
|
||||
local green; green="$(tput setaf 2)"
|
||||
local yellow; yellow="$(tput setaf 3)"
|
||||
PADDING_CONSTANT=15 # whitespace + brackets + 1
|
||||
|
||||
if [[ $service_state = "$ERROR_STRING" ]] || [[ $service_state = "$MISSING_STRING" ]]; then
|
||||
state_color="\e[1;31m"
|
||||
if [[ "$EXITCODE" -eq 0 ]]; then
|
||||
EXITCODE=1
|
||||
fi
|
||||
columns=$(tput cols)
|
||||
fi
|
||||
|
||||
# construct a line of '------' so that the names and states are all aligned
|
||||
linewidth=$(( columns - PADDING_CONSTANT - ${#service_name} - ${#service_state} ))
|
||||
for i in $(seq 0 "${linewidth}"); do
|
||||
line="${line}-"
|
||||
done
|
||||
|
||||
if [[ $service_state = "$ERROR_STRING" ]] \
|
||||
|| [[ $service_state = "$MISSING_STRING" ]]; then
|
||||
state_color="${red:-}"
|
||||
if [[ "$EXITCODE" -eq 0 ]]; then
|
||||
EXITCODE=1
|
||||
fi
|
||||
elif [[ $service_state = "$SUCCESS_STRING" ]]; then
|
||||
state_color="\e[1;32m"
|
||||
elif [[ $service_state = "$PENDING_STRING" ]] || [[ $service_state = "$DISABLED_STRING" ]] || [[ $service_state = "$STARTING_STRING" ]] || [[ $service_state = "$WAIT_START_STRING" ]]; then
|
||||
state_color="\e[1;33m"
|
||||
EXITCODE=2
|
||||
state_color="${green:-}"
|
||||
elif [[ $service_state = "$PENDING_STRING" ]] \
|
||||
|| [[ $service_state = "$DISABLED_STRING" ]] \
|
||||
|| [[ $service_state = "$STARTING_STRING" ]] \
|
||||
|| [[ $service_state = "$WAIT_START_STRING" ]]; then
|
||||
state_color="${yellow:-}"
|
||||
EXITCODE=2
|
||||
fi
|
||||
|
||||
printf " $service_name "
|
||||
for i in $(seq 0 $(( $columns - $PADDING_CONSTANT - ${#service_name} - ${#service_state} ))); do
|
||||
printf "${state_color}%b\e[0m" "-"
|
||||
done
|
||||
printf " [ "
|
||||
printf "${state_color}%b\e[0m" "$service_state"
|
||||
printf "%s \n" " ]"
|
||||
}
|
||||
|
||||
non_term_print_line() {
|
||||
local service_name=${1}
|
||||
local service_state="$( parse_status ${1} ${2} )"
|
||||
|
||||
if [[ $service_state = "$ERROR_STRING" ]] || [[ $service_state = "$MISSING_STRING" ]]; then
|
||||
if [[ "$EXITCODE" -eq 0 ]]; then
|
||||
EXITCODE=1
|
||||
fi
|
||||
elif [[ $service_state = "$PENDING_STRING" ]] || [[ $service_state = "$DISABLED_STRING" ]] || [[ $service_state = "$STARTING_STRING" ]] || [[ $service_state = "$WAIT_START_STRING" ]]; then
|
||||
EXITCODE=2
|
||||
fi
|
||||
|
||||
printf " $service_name "
|
||||
for i in $(seq 0 $(( 35 - ${#service_name} - ${#service_state} ))); do
|
||||
printf "-"
|
||||
done
|
||||
printf " [ "
|
||||
printf "$service_state"
|
||||
printf "%s \n" " ]"
|
||||
service_state="${bold:-}${state_color:-}${service_state}${reset_attr:-}"
|
||||
line="${bold:-}${state_color:-}${line:-}${reset_attr:-}"
|
||||
printf " %s %s [ %s ] \n" "${service_name}" "${line:-}" "${service_state}"
|
||||
}
|
||||
|
||||
main() {
|
||||
|
||||
is_tty
|
||||
# if running from salt
|
||||
if [ "$CALLER" == 'salt-call' ] || [ "$CALLER" == 'salt-minion' ]; then
|
||||
printf "\n"
|
||||
@@ -228,20 +224,19 @@ main() {
|
||||
|
||||
systemctl is-active --quiet docker
|
||||
if [[ $? = 0 ]]; then
|
||||
non_term_print_line "Docker" "running"
|
||||
print_line "Docker" "running"
|
||||
else
|
||||
non_term_print_line "Docker" "exited"
|
||||
print_line "Docker" "exited"
|
||||
fi
|
||||
|
||||
populate_container_lists
|
||||
|
||||
printf "\n"
|
||||
printf "Checking container statuses\n\n"
|
||||
printf "\nChecking container statuses\n\n"
|
||||
|
||||
local num_containers=${#container_name_list[@]}
|
||||
|
||||
for i in $(seq 0 $(($num_containers - 1 ))); do
|
||||
non_term_print_line ${container_name_list[$i]} ${container_state_list[$i]}
|
||||
print_line ${container_name_list[$i]} ${container_state_list[$i]}
|
||||
done
|
||||
|
||||
printf "\n"
|
||||
@@ -257,9 +252,12 @@ main() {
|
||||
else
|
||||
print_or_parse="print_line"
|
||||
|
||||
local focus_color="\e[1;34m"
|
||||
printf "\n"
|
||||
printf "${focus_color}%b\e[0m" "Checking Docker status\n\n"
|
||||
if (( __tty == 1 )) ; then
|
||||
local bold; bold="$(tput bold)"
|
||||
local focus_color; focus_color="$(tput setaf 4)"
|
||||
local reset_attr; reset_attr="$(tput sgr0)" # reset all attributes
|
||||
fi
|
||||
printf "\n${bold}${focus_color:-}%s${reset_attr:-}\n\n" "Checking Docker status"
|
||||
fi
|
||||
|
||||
systemctl is-active --quiet docker
|
||||
@@ -272,8 +270,7 @@ main() {
|
||||
populate_container_lists
|
||||
|
||||
if [ "$QUIET" = false ]; then
|
||||
printf "\n"
|
||||
printf "${focus_color}%b\e[0m" "Checking container statuses\n\n"
|
||||
printf "\n${bold}${focus_color:-}%s${reset_attr:-}\n\n" "Checking container statuses"
|
||||
fi
|
||||
|
||||
local num_containers=${#container_name_list[@]}
|
||||
@@ -288,20 +285,30 @@ main() {
|
||||
fi
|
||||
}
|
||||
|
||||
is_tty() {
|
||||
__tty=0
|
||||
[ -t 1 ] && __tty=1
|
||||
# don't print colors if NO_COLOR is set to anything
|
||||
[ "${#NO_COLOR}" -ne 0 ] && __tty=0
|
||||
}
|
||||
|
||||
# {% endraw %}
|
||||
|
||||
if ! [ "$(id -u)" = 0 ]; then
|
||||
echo "${0}: This command must be run as root"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
while getopts ':hq' OPTION; do
|
||||
case "$OPTION" in
|
||||
h)
|
||||
display_help
|
||||
exit 0
|
||||
;;
|
||||
q)
|
||||
QUIET=true
|
||||
;;
|
||||
q) QUIET=true ;;
|
||||
\?)
|
||||
display_help
|
||||
exit 0
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
done
|
||||
|
||||
@@ -29,7 +29,7 @@ if [[ $# -lt 1 || $# -gt 3 ]]; then
|
||||
echo " add: Adds a new user to the identity system; requires 'email' parameter, while 'role' parameter is optional and defaults to $DEFAULT_ROLE"
|
||||
echo " addrole: Grants a role to an existing user; requires 'email' and 'role' parameters"
|
||||
echo " delrole: Removes a role from an existing user; requires 'email' and 'role' parameters"
|
||||
echo " update: Updates a user's password; requires 'email' parameter"
|
||||
echo " update: Updates a user's password and disables MFA; requires 'email' parameter"
|
||||
echo " enable: Enables a user; requires 'email' parameter"
|
||||
echo " disable: Disables a user; requires 'email' parameter"
|
||||
echo " validate: Validates that the given email address and password are acceptable; requires 'email' parameter"
|
||||
@@ -98,7 +98,7 @@ function validatePassword() {
|
||||
password=$1
|
||||
|
||||
len=$(expr length "$password")
|
||||
if [[ $len -lt 6 ]]; then
|
||||
if [[ $len -lt 8 ]]; then
|
||||
fail "Password does not meet the minimum requirements"
|
||||
fi
|
||||
if [[ $len -gt 72 ]]; then
|
||||
@@ -147,7 +147,10 @@ function updatePassword() {
|
||||
# Generate password hash
|
||||
passwordHash=$(hashPassword "$password")
|
||||
# Update DB with new hash
|
||||
echo "update identity_credentials set config=CAST('{\"hashed_password\":\"$passwordHash\"}' as BLOB), updated_at=datetime('now') where identity_id='${identityId}';" | sqlite3 "$databasePath"
|
||||
echo "update identity_credentials set config=CAST('{\"hashed_password\":\"$passwordHash\"}' as BLOB), updated_at=datetime('now') where identity_id='${identityId}' and identity_credential_type_id=(select id from identity_credential_types where name='password');" | sqlite3 "$databasePath"
|
||||
# Deactivate MFA
|
||||
echo "delete from identity_credential_identifiers where identity_credential_id=(select id from identity_credentials where identity_id='${identityId}' and identity_credential_type_id=(select id from identity_credential_types where name='totp'));" | sqlite3 "$databasePath"
|
||||
echo "delete from identity_credentials where identity_id='${identityId}' and identity_credential_type_id=(select id from identity_credential_types where name='totp');" | sqlite3 "$databasePath"
|
||||
[[ $? != 0 ]] && fail "Unable to update password"
|
||||
fi
|
||||
}
|
||||
@@ -244,10 +247,12 @@ function syncElastic() {
|
||||
if [[ -f "$databasePath" && -f "$socRolesFile" ]]; then
|
||||
# Append the SOC users
|
||||
echo "select '{\"user\":\"' || ici.identifier || '\", \"data\":' || ic.config || '}'" \
|
||||
"from identity_credential_identifiers ici, identity_credentials ic, identities i " \
|
||||
"from identity_credential_identifiers ici, identity_credentials ic, identities i, identity_credential_types ict " \
|
||||
"where " \
|
||||
" ici.identity_credential_id=ic.id " \
|
||||
" and ic.identity_id=i.id " \
|
||||
" and ict.id=ic.identity_credential_type_id " \
|
||||
" and ict.name='password' " \
|
||||
" and instr(ic.config, 'hashed_password') " \
|
||||
" and i.state == 'active' " \
|
||||
"order by ici.identifier;" | \
|
||||
@@ -261,8 +266,11 @@ function syncElastic() {
|
||||
userId=$(echo "$rolePair" | cut -d: -f2)
|
||||
role=$(echo "$rolePair" | cut -d: -f1)
|
||||
echo "select '$role:' || ici.identifier " \
|
||||
"from identity_credential_identifiers ici, identity_credentials ic " \
|
||||
"where ici.identity_credential_id=ic.id and ic.identity_id = '$userId';" | \
|
||||
"from identity_credential_identifiers ici, identity_credentials ic, identity_credential_types ict " \
|
||||
"where ici.identity_credential_id=ic.id " \
|
||||
" and ict.id=ic.identity_credential_type_id " \
|
||||
" and ict.name='password' " \
|
||||
" and ic.identity_id = '$userId';" | \
|
||||
sqlite3 "$databasePath" >> "$rolesTmpFile"
|
||||
done < "$socRolesFile"
|
||||
|
||||
|
||||
@@ -403,6 +403,7 @@ preupgrade_changes() {
|
||||
[[ "$INSTALLEDVERSION" == 2.3.50 || "$INSTALLEDVERSION" == 2.3.51 || "$INSTALLEDVERSION" == 2.3.52 || "$INSTALLEDVERSION" == 2.3.60 || "$INSTALLEDVERSION" == 2.3.61 || "$INSTALLEDVERSION" == 2.3.70 ]] && up_to_2.3.80
|
||||
[[ "$INSTALLEDVERSION" == 2.3.80 ]] && up_to_2.3.90
|
||||
[[ "$INSTALLEDVERSION" == 2.3.90 || "$INSTALLEDVERSION" == 2.3.91 ]] && up_to_2.3.100
|
||||
[[ "$INSTALLEDVERSION" == 2.3.100 ]] && up_to_2.3.110
|
||||
true
|
||||
}
|
||||
|
||||
@@ -704,7 +705,6 @@ up_to_2.3.90() {
|
||||
}
|
||||
|
||||
up_to_2.3.100() {
|
||||
echo "Updating to Security Onion 2.3.100"
|
||||
fix_wazuh
|
||||
|
||||
echo "Removing /opt/so/state files for patched Salt InfluxDB module and state. This is due to Salt being upgraded and needing to patch the files again."
|
||||
@@ -721,6 +721,12 @@ up_to_2.3.100() {
|
||||
grep -qxF " receiver:" /opt/so/saltstack/local/salt/firewall/assigned_hostgroups.local.map.yaml || sed -i -e '$a\ receiver:' /opt/so/saltstack/local/salt/firewall/assigned_hostgroups.local.map.yaml
|
||||
}
|
||||
|
||||
up_to_2.3.110() {
|
||||
echo "Updating to Security Onion 2.3.110"
|
||||
echo "Updating shard settings for Elasticsearch index templates"
|
||||
sed -i 's|shards|index_template:\n template:\n settings:\n index:\n number_of_shards|g' /opt/so/saltstack/local/pillar/global.sls
|
||||
}
|
||||
|
||||
verify_upgradespace() {
|
||||
CURRENTSPACE=$(df -BG / | grep -v Avail | awk '{print $4}' | sed 's/.$//')
|
||||
if [ "$CURRENTSPACE" -lt "10" ]; then
|
||||
|
||||
@@ -18,6 +18,10 @@ actions:
|
||||
- filtertype: pattern
|
||||
kind: regex
|
||||
value: '^(logstash-.*|so-.*)$'
|
||||
- filtertype: pattern
|
||||
kind: regex
|
||||
value: '^(so-case.*)$'
|
||||
exclude: True
|
||||
- filtertype: space
|
||||
source: creation_date
|
||||
use_age: True
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
{% set DIGITS = "1234567890" %}
|
||||
{% set LOWERCASE = "qwertyuiopasdfghjklzxcvbnm" %}
|
||||
{% set UPPERCASE = "QWERTYUIOPASDFGHJKLZXCVBNM" %}
|
||||
{% set SYMBOLS = "~!@#$^&*()-_=+[]|;:,.<>?" %}
|
||||
{% set SYMBOLS = "~!@#^&*()-_=+[]|;:,.<>?" %}
|
||||
{% set CHARS = DIGITS~LOWERCASE~UPPERCASE~SYMBOLS %}
|
||||
{% set so_elastic_user_pass = salt['pillar.get']('elasticsearch:auth:users:so_elastic_user:pass', salt['random.get_str'](72, chars=CHARS)) %}
|
||||
{% set so_kibana_user_pass = salt['pillar.get']('elasticsearch:auth:users:so_kibana_user:pass', salt['random.get_str'](72, chars=CHARS)) %}
|
||||
|
||||
@@ -0,0 +1 @@
|
||||
{{ TEMPLATE_CONFIG | tojson(true) }}
|
||||
@@ -10,7 +10,7 @@
|
||||
{% if salt['pillar.get']('nodestab', {}) %}
|
||||
{% do ESCONFIG.elasticsearch.config.node.update({'roles': ['master', 'data', 'remote_cluster_client']}) %}
|
||||
{% if HIGHLANDER %}
|
||||
{% do ESCONFIG.elasticsearch.config.node.roles.append('ml', 'transform') %}
|
||||
{% do ESCONFIG.elasticsearch.config.node.roles.extend(['ml', 'transform']) %}
|
||||
{% endif %}
|
||||
{% do ESCONFIG.elasticsearch.config.update({'discovery': {'seed_hosts': [grains.master]}}) %}
|
||||
{% for SN, SNDATA in salt['pillar.get']('nodestab', {}).items() %}
|
||||
|
||||
File diff suppressed because it is too large.
Load diff
+22
-13
@@ -41,7 +41,7 @@ include:
|
||||
{% set ROLES = salt['pillar.get']('elasticsearch:roles', {}) %}
|
||||
{% from 'elasticsearch/auth.map.jinja' import ELASTICAUTH with context %}
|
||||
{% from 'elasticsearch/config.map.jinja' import ESCONFIG with context %}
|
||||
|
||||
{% from 'elasticsearch/template.map.jinja' import ES_INDEX_SETTINGS without context %}
|
||||
|
||||
vm.max_map_count:
|
||||
sysctl.present:
|
||||
@@ -152,8 +152,6 @@ estemplatedir:
|
||||
- group: 939
|
||||
- makedirs: True
|
||||
|
||||
|
||||
|
||||
esrolesdir:
|
||||
file.directory:
|
||||
- name: /opt/so/conf/elasticsearch/roles
|
||||
@@ -198,7 +196,26 @@ esyml:
|
||||
ESCONFIG: {{ ESCONFIG }}
|
||||
- template: jinja
|
||||
|
||||
#sync templates to /opt/so/conf/elasticsearch/templates
|
||||
escomponenttemplates:
|
||||
file.recurse:
|
||||
- name: /opt/so/conf/elasticsearch/templates/component
|
||||
- source: salt://elasticsearch/templates/component
|
||||
- user: 930
|
||||
- group: 939
|
||||
|
||||
# Auto-generate templates from defaults file
|
||||
{% for index, settings in ES_INDEX_SETTINGS.items() %}
|
||||
es_index_template_{{index}}:
|
||||
file.managed:
|
||||
- name: /opt/so/conf/elasticsearch/templates/index/{{ index }}-template.json
|
||||
- source: salt://elasticsearch/base-template.json.jinja
|
||||
- defaults:
|
||||
TEMPLATE_CONFIG: {{ settings.index_template }}
|
||||
- template: jinja
|
||||
{% endfor %}
|
||||
|
||||
{% if TEMPLATES %}
|
||||
# Sync custom templates to /opt/so/conf/elasticsearch/templates
|
||||
{% for TEMPLATE in TEMPLATES %}
|
||||
es_template_{{TEMPLATE.split('.')[0] | replace("/","_") }}:
|
||||
file.managed:
|
||||
@@ -212,13 +229,7 @@ es_template_{{TEMPLATE.split('.')[0] | replace("/","_") }}:
|
||||
- user: 930
|
||||
- group: 939
|
||||
{% endfor %}
|
||||
|
||||
escomponenttemplates:
|
||||
file.recurse:
|
||||
- name: /opt/so/conf/elasticsearch/templates/component
|
||||
- source: salt://elasticsearch/templates/component
|
||||
- user: 930
|
||||
- group: 939
|
||||
{% endif %}
|
||||
|
||||
esroles:
|
||||
file.recurse:
|
||||
@@ -380,7 +391,6 @@ so-elasticsearch-pipelines:
|
||||
- docker_container: so-elasticsearch
|
||||
- file: so-elasticsearch-pipelines-script
|
||||
|
||||
{% if TEMPLATES %}
|
||||
so-elasticsearch-templates:
|
||||
cmd.run:
|
||||
- name: /usr/sbin/so-elasticsearch-templates-load
|
||||
@@ -389,7 +399,6 @@ so-elasticsearch-templates:
|
||||
- require:
|
||||
- docker_container: so-elasticsearch
|
||||
- file: es_sync_scripts
|
||||
{% endif %}
|
||||
|
||||
so-elasticsearch-roles-load:
|
||||
cmd.run:
|
||||
|
||||
@@ -0,0 +1,7 @@
|
||||
{% import_yaml 'elasticsearch/defaults.yaml' as ESCONFIG with context %}
|
||||
{%- set ES_INDEX_SETTINGS = salt['pillar.get']('elasticsearch:index_settings', default=ESCONFIG.elasticsearch.index_settings, merge=True) %}
|
||||
{% for index, settings in ES_INDEX_SETTINGS.items() %}
|
||||
{% if settings.index_sorting, False %}
|
||||
{% do settings.index_template.template.settings.index.pop('sort') %}
|
||||
{% endif %}
|
||||
{% endfor %}
|
||||
@@ -0,0 +1,570 @@
|
||||
{
|
||||
"_meta": {
|
||||
"documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-base.html",
|
||||
"ecs_version": "1.12.2"
|
||||
},
|
||||
"template": {
|
||||
"mappings": {
|
||||
"properties": {
|
||||
"aws": {
|
||||
"properties": {
|
||||
"cloudtrail": {
|
||||
"properties": {
|
||||
"additional_eventdata": {
|
||||
"fields": {
|
||||
"text": {
|
||||
"norms": false,
|
||||
"type": "text"
|
||||
}
|
||||
},
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"api_version": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"console_login": {
|
||||
"properties": {
|
||||
"additional_eventdata": {
|
||||
"properties": {
|
||||
"login_to": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"mfa_used": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"mobile_version": {
|
||||
"type": "boolean"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"digest": {
|
||||
"properties": {
|
||||
"end_time": {
|
||||
"type": "date"
|
||||
},
|
||||
"log_files": {
|
||||
"type": "nested"
|
||||
},
|
||||
"newest_event_time": {
|
||||
"type": "date"
|
||||
},
|
||||
"oldest_event_time": {
|
||||
"type": "date"
|
||||
},
|
||||
"previous_hash_algorithm": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"previous_s3_bucket": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"public_key_fingerprint": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"s3_bucket": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"s3_object": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"signature_algorithm": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"start_time": {
|
||||
"type": "date"
|
||||
}
|
||||
}
|
||||
},
|
||||
"error_code": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"error_message": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"event_category": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"event_type": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"event_version": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"flattened": {
|
||||
"properties": {
|
||||
"additional_eventdata": {
|
||||
"type": "flattened"
|
||||
},
|
||||
"request_parameters": {
|
||||
"type": "flattened"
|
||||
},
|
||||
"response_elements": {
|
||||
"type": "flattened"
|
||||
},
|
||||
"service_event_details": {
|
||||
"type": "flattened"
|
||||
}
|
||||
}
|
||||
},
|
||||
"insight_details": {
|
||||
"type": "flattened"
|
||||
},
|
||||
"management_event": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"read_only": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"recipient_account_id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"request_id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"request_parameters": {
|
||||
"fields": {
|
||||
"text": {
|
||||
"norms": false,
|
||||
"type": "text"
|
||||
}
|
||||
},
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"resources": {
|
||||
"properties": {
|
||||
"account_id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"arn": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"type": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"response_elements": {
|
||||
"fields": {
|
||||
"text": {
|
||||
"norms": false,
|
||||
"type": "text"
|
||||
}
|
||||
},
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"service_event_details": {
|
||||
"fields": {
|
||||
"text": {
|
||||
"norms": false,
|
||||
"type": "text"
|
||||
}
|
||||
},
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"shared_event_id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"user_identity": {
|
||||
"properties": {
|
||||
"access_key_id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"arn": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"invoked_by": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"session_context": {
|
||||
"properties": {
|
||||
"creation_date": {
|
||||
"type": "date"
|
||||
},
|
||||
"mfa_authenticated": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"session_issuer": {
|
||||
"properties": {
|
||||
"account_id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"arn": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"principal_id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"type": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"type": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"vpc_endpoint_id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"cloudwatch": {
|
||||
"properties": {
|
||||
"message": {
|
||||
"norms": false,
|
||||
"type": "text"
|
||||
}
|
||||
}
|
||||
},
|
||||
"ec2": {
|
||||
"properties": {
|
||||
"ip_address": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"elb": {
|
||||
"properties": {
|
||||
"action_executed": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"backend": {
|
||||
"properties": {
|
||||
"http": {
|
||||
"properties": {
|
||||
"response": {
|
||||
"properties": {
|
||||
"status_code": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"ip": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"port": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"backend_processing_time": {
|
||||
"properties": {
|
||||
"sec": {
|
||||
"type": "float"
|
||||
}
|
||||
}
|
||||
},
|
||||
"chosen_cert": {
|
||||
"properties": {
|
||||
"arn": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"serial": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"classification": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"classification_reason": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"connection_time": {
|
||||
"properties": {
|
||||
"ms": {
|
||||
"type": "long"
|
||||
}
|
||||
}
|
||||
},
|
||||
"error": {
|
||||
"properties": {
|
||||
"reason": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"incoming_tls_alert": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"listener": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"matched_rule_priority": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"protocol": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"redirect_url": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"request_processing_time": {
|
||||
"properties": {
|
||||
"sec": {
|
||||
"type": "float"
|
||||
}
|
||||
}
|
||||
},
|
||||
"response_processing_time": {
|
||||
"properties": {
|
||||
"sec": {
|
||||
"type": "float"
|
||||
}
|
||||
}
|
||||
},
|
||||
"ssl_cipher": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"ssl_protocol": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"target_group": {
|
||||
"properties": {
|
||||
"arn": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"target_port": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"target_status_code": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"tls_handshake_time": {
|
||||
"properties": {
|
||||
"ms": {
|
||||
"type": "long"
|
||||
}
|
||||
}
|
||||
},
|
||||
"tls_named_group": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"trace_id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"type": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"s3access": {
|
||||
"properties": {
|
||||
"authentication_type": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"bucket": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"bucket_owner": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"bytes_sent": {
|
||||
"type": "long"
|
||||
},
|
||||
"cipher_suite": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"error_code": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"host_header": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"host_id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"http_status": {
|
||||
"type": "long"
|
||||
},
|
||||
"key": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"object_size": {
|
||||
"type": "long"
|
||||
},
|
||||
"operation": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"referrer": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"remote_ip": {
|
||||
"type": "ip"
|
||||
},
|
||||
"request_id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"request_uri": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"requester": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"signature_version": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"tls_version": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"total_time": {
|
||||
"type": "long"
|
||||
},
|
||||
"turn_around_time": {
|
||||
"type": "long"
|
||||
},
|
||||
"user_agent": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"version_id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"vpcflow": {
|
||||
"properties": {
|
||||
"account_id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"action": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"instance_id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"interface_id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"log_status": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"pkt_dstaddr": {
|
||||
"type": "ip"
|
||||
},
|
||||
"pkt_srcaddr": {
|
||||
"type": "ip"
|
||||
},
|
||||
"subnet_id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"tcp_flags": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"tcp_flags_array": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"type": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"version": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"vpc_id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,604 @@
|
||||
{
|
||||
"_meta": {
|
||||
"documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-base.html",
|
||||
"ecs_version": "1.12.2"
|
||||
},
|
||||
"template": {
|
||||
"mappings": {
|
||||
"properties": {
|
||||
"azure": {
|
||||
"properties": {
|
||||
"activitylogs": {
|
||||
"properties": {
|
||||
"category": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"event_category": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"identity": {
|
||||
"properties": {
|
||||
"authorization": {
|
||||
"properties": {
|
||||
"action": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"evidence": {
|
||||
"properties": {
|
||||
"principal_id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"principal_type": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"role": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"role_assignment_id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"role_assignment_scope": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"role_definition_id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"scope": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"claims": {
|
||||
"properties": {
|
||||
"*": {
|
||||
"type": "object"
|
||||
}
|
||||
}
|
||||
},
|
||||
"claims_initiated_by_user": {
|
||||
"properties": {
|
||||
"fullname": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"givenname": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"schema": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"surname": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"operation_name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"properties": {
|
||||
"type": "flattened"
|
||||
},
|
||||
"result_signature": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"result_type": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"auditlogs": {
|
||||
"properties": {
|
||||
"category": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"identity": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"operation_name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"operation_version": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"properties": {
|
||||
"properties": {
|
||||
"activity_datetime": {
|
||||
"type": "date"
|
||||
},
|
||||
"activity_display_name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"category": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"correlation_id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"initiated_by": {
|
||||
"properties": {
|
||||
"app": {
|
||||
"properties": {
|
||||
"appId": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"displayName": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"servicePrincipalId": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"servicePrincipalName": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"user": {
|
||||
"properties": {
|
||||
"displayName": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"ipAddress": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"userPrincipalName": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"logged_by_service": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"operation_type": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"result": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"result_reason": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"target_resources": {
|
||||
"properties": {
|
||||
"*": {
|
||||
"properties": {
|
||||
"display_name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"ip_address": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"modified_properties": {
|
||||
"properties": {
|
||||
"*": {
|
||||
"properties": {
|
||||
"display_name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"new_value": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"old_value": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"type": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"user_principal_name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"result_signature": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"tenant_id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"consumer_group": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"correlation_id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"enqueued_time": {
|
||||
"type": "date"
|
||||
},
|
||||
"eventhub": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"offset": {
|
||||
"type": "long"
|
||||
},
|
||||
"partition_id": {
|
||||
"type": "long"
|
||||
},
|
||||
"platformlogs": {
|
||||
"properties": {
|
||||
"ActivityId": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"Caller": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"Cloud": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"Environment": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"EventTimeString": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"ScaleUnit": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"category": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"ccpNamespace": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"event_category": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"operation_name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"properties": {
|
||||
"type": "flattened"
|
||||
},
|
||||
"result_signature": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"result_type": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"status": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"resource": {
|
||||
"properties": {
|
||||
"authorization_rule": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"group": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"namespace": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"provider": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"sequence_number": {
|
||||
"type": "long"
|
||||
},
|
||||
"signinlogs": {
|
||||
"properties": {
|
||||
"category": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"identity": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"operation_name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"operation_version": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"properties": {
|
||||
"properties": {
|
||||
"app_display_name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"app_id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"authentication_processing_details": {
|
||||
"type": "flattened"
|
||||
},
|
||||
"authentication_requirement": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"authentication_requirement_policies": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"autonomous_system_number": {
|
||||
"type": "long"
|
||||
},
|
||||
"client_app_used": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"conditional_access_status": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"correlation_id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"created_at": {
|
||||
"type": "date"
|
||||
},
|
||||
"cross_tenant_access_type": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"device_detail": {
|
||||
"properties": {
|
||||
"browser": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"device_id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"display_name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"operating_system": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"trust_type": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"flagged_for_review": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"home_tenant_id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"is_interactive": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"is_tenant_restricted": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"original_request_id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"processing_time_ms": {
|
||||
"type": "float"
|
||||
},
|
||||
"resource_display_name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"resource_id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"resource_tenant_id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"risk_detail": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"risk_event_types": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"risk_event_types_v2": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"risk_level_aggregated": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"risk_level_during_signin": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"risk_state": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"service_principal_id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"service_principal_name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"sso_extension_version": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"status": {
|
||||
"properties": {
|
||||
"error_code": {
|
||||
"type": "long"
|
||||
}
|
||||
}
|
||||
},
|
||||
"token_issuer_name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"token_issuer_type": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"user_display_name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"user_id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"user_principal_name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"user_type": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"result_description": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"result_signature": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"result_type": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"tenant_id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"subscription_id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"tenant_id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,772 @@
|
||||
{
|
||||
"_meta": {
|
||||
"documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-base.html",
|
||||
"ecs_version": "1.12.2"
|
||||
},
|
||||
"template": {
|
||||
"mappings": {
|
||||
"properties": {
|
||||
"cef": {
|
||||
"properties": {
|
||||
"device": {
|
||||
"properties": {
|
||||
"event_class_id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"product": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"vendor": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"version": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"extensions": {
|
||||
"properties": {
|
||||
"Reason": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"agentAddress": {
|
||||
"type": "ip"
|
||||
},
|
||||
"agentDnsDomain": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"agentHostName": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"agentId": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"agentMacAddress": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"agentNtDomain": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"agentReceiptTime": {
|
||||
"type": "date"
|
||||
},
|
||||
"agentTimeZone": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"agentTranslatedAddress": {
|
||||
"type": "ip"
|
||||
},
|
||||
"agentTranslatedZoneExternalID": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"agentTranslatedZoneURI": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"agentType": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"agentVersion": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"agentZoneExternalID": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"agentZoneURI": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"applicationProtocol": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"baseEventCount": {
|
||||
"type": "long"
|
||||
},
|
||||
"bytesIn": {
|
||||
"type": "long"
|
||||
},
|
||||
"bytesOut": {
|
||||
"type": "long"
|
||||
},
|
||||
"categoryBehavior": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"categoryDeviceGroup": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"categoryDeviceType": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"categoryObject": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"categoryOutcome": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"categorySignificance": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"categoryTechnique": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"cp_app_risk": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"cp_severity": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"customerExternalID": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"customerURI": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"destinationAddress": {
|
||||
"type": "ip"
|
||||
},
|
||||
"destinationDnsDomain": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"destinationGeoLatitude": {
|
||||
"type": "double"
|
||||
},
|
||||
"destinationGeoLongitude": {
|
||||
"type": "double"
|
||||
},
|
||||
"destinationHostName": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"destinationMacAddress": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"destinationNtDomain": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"destinationPort": {
|
||||
"type": "long"
|
||||
},
|
||||
"destinationProcessId": {
|
||||
"type": "long"
|
||||
},
|
||||
"destinationProcessName": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"destinationServiceName": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"destinationTranslatedAddress": {
|
||||
"type": "ip"
|
||||
},
|
||||
"destinationTranslatedPort": {
|
||||
"type": "long"
|
||||
},
|
||||
"destinationTranslatedZoneExternalID": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"destinationTranslatedZoneURI": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"destinationUserId": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"destinationUserName": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"destinationUserPrivileges": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"destinationZoneExternalID": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"destinationZoneURI": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"deviceAction": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"deviceAddress": {
|
||||
"type": "ip"
|
||||
},
|
||||
"deviceCustomDate1": {
|
||||
"type": "date"
|
||||
},
|
||||
"deviceCustomDate1Label": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"deviceCustomDate2": {
|
||||
"type": "date"
|
||||
},
|
||||
"deviceCustomDate2Label": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"deviceCustomFloatingPoint1": {
|
||||
"type": "double"
|
||||
},
|
||||
"deviceCustomFloatingPoint1Label": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"deviceCustomFloatingPoint2": {
|
||||
"type": "double"
|
||||
},
|
||||
"deviceCustomFloatingPoint2Label": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"deviceCustomFloatingPoint3": {
|
||||
"type": "double"
|
||||
},
|
||||
"deviceCustomFloatingPoint3Label": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"deviceCustomFloatingPoint4": {
|
||||
"type": "double"
|
||||
},
|
||||
"deviceCustomFloatingPoint4Label": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"deviceCustomIPv6Address1": {
|
||||
"type": "ip"
|
||||
},
|
||||
"deviceCustomIPv6Address1Label": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"deviceCustomIPv6Address2": {
|
||||
"type": "ip"
|
||||
},
|
||||
"deviceCustomIPv6Address2Label": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"deviceCustomIPv6Address3": {
|
||||
"type": "ip"
|
||||
},
|
||||
"deviceCustomIPv6Address3Label": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"deviceCustomIPv6Address4": {
|
||||
"type": "ip"
|
||||
},
|
||||
"deviceCustomIPv6Address4Label": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"deviceCustomNumber1": {
|
||||
"type": "long"
|
||||
},
|
||||
"deviceCustomNumber1Label": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"deviceCustomNumber2": {
|
||||
"type": "long"
|
||||
},
|
||||
"deviceCustomNumber2Label": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"deviceCustomNumber3": {
|
||||
"type": "long"
|
||||
},
|
||||
"deviceCustomNumber3Label": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"deviceCustomString1": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"deviceCustomString1Label": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"deviceCustomString2": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"deviceCustomString2Label": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"deviceCustomString3": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"deviceCustomString3Label": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"deviceCustomString4": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"deviceCustomString4Label": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"deviceCustomString5": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"deviceCustomString5Label": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"deviceCustomString6": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"deviceCustomString6Label": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"deviceDirection": {
|
||||
"type": "long"
|
||||
},
|
||||
"deviceDnsDomain": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"deviceEventCategory": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"deviceExternalId": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"deviceFacility": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"deviceFlexNumber1": {
|
||||
"type": "long"
|
||||
},
|
||||
"deviceFlexNumber1Label": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"deviceFlexNumber2": {
|
||||
"type": "long"
|
||||
},
|
||||
"deviceFlexNumber2Label": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"deviceHostName": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"deviceInboundInterface": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"deviceMacAddress": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"deviceNtDomain": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"deviceOutboundInterface": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"devicePayloadId": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"deviceProcessId": {
|
||||
"type": "long"
|
||||
},
|
||||
"deviceProcessName": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"deviceReceiptTime": {
|
||||
"type": "date"
|
||||
},
|
||||
"deviceTimeZone": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"deviceTranslatedAddress": {
|
||||
"type": "ip"
|
||||
},
|
||||
"deviceTranslatedZoneExternalID": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"deviceTranslatedZoneURI": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"deviceZoneExternalID": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"deviceZoneURI": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"endTime": {
|
||||
"type": "date"
|
||||
},
|
||||
"eventId": {
|
||||
"type": "long"
|
||||
},
|
||||
"eventOutcome": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"externalId": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"fileCreateTime": {
|
||||
"type": "date"
|
||||
},
|
||||
"fileHash": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"fileId": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"fileModificationTime": {
|
||||
"type": "date"
|
||||
},
|
||||
"filePath": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"filePermission": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"fileSize": {
|
||||
"type": "long"
|
||||
},
|
||||
"fileType": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"filename": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"flexDate1": {
|
||||
"type": "date"
|
||||
},
|
||||
"flexDate1Label": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"flexString1": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"flexString1Label": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"flexString2": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"flexString2Label": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"ifname": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"inzone": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"layer_name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"layer_uuid": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"logid": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"loguid": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"managerReceiptTime": {
|
||||
"type": "date"
|
||||
},
|
||||
"match_id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"message": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"nat_addtnl_rulenum": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"nat_rulenum": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"oldFileCreateTime": {
|
||||
"type": "date"
|
||||
},
|
||||
"oldFileHash": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"oldFileId": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"oldFileModificationTime": {
|
||||
"type": "date"
|
||||
},
|
||||
"oldFileName": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"oldFilePath": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"oldFilePermission": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"oldFileSize": {
|
||||
"type": "long"
|
||||
},
|
||||
"oldFileType": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"origin": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"originsicname": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"outzone": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"parent_rule": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"product": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"rawEvent": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"requestClientApplication": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"requestContext": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"requestCookies": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"requestMethod": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"requestUrl": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"rule_action": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"rule_uid": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"sequencenum": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"service_id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"sourceAddress": {
|
||||
"type": "ip"
|
||||
},
|
||||
"sourceDnsDomain": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"sourceGeoLatitude": {
|
||||
"type": "double"
|
||||
},
|
||||
"sourceGeoLongitude": {
|
||||
"type": "double"
|
||||
},
|
||||
"sourceHostName": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"sourceMacAddress": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"sourceNtDomain": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"sourcePort": {
|
||||
"type": "long"
|
||||
},
|
||||
"sourceProcessId": {
|
||||
"type": "long"
|
||||
},
|
||||
"sourceProcessName": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"sourceServiceName": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"sourceTranslatedAddress": {
|
||||
"type": "ip"
|
||||
},
|
||||
"sourceTranslatedPort": {
|
||||
"type": "long"
|
||||
},
|
||||
"sourceTranslatedZoneExternalID": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"sourceTranslatedZoneURI": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"sourceUserId": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"sourceUserName": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"sourceUserPrivileges": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"sourceZoneExternalID": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"sourceZoneURI": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"startTime": {
|
||||
"type": "date"
|
||||
},
|
||||
"transportProtocol": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"type": {
|
||||
"type": "long"
|
||||
},
|
||||
"version": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"severity": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"version": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
File diff suppressed because it is too large.
Load diff
@@ -0,0 +1,620 @@
|
||||
{
|
||||
"_meta": {
|
||||
"documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-base.html",
|
||||
"ecs_version": "1.12.2"
|
||||
},
|
||||
"template": {
|
||||
"mappings": {
|
||||
"properties": {
|
||||
"cisco": {
|
||||
"properties": {
|
||||
"amp": {
|
||||
"properties": {
|
||||
"bp_data": {
|
||||
"type": "flattened"
|
||||
},
|
||||
"cloud_ioc": {
|
||||
"properties": {
|
||||
"description": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"short_description": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"command_line": {
|
||||
"properties": {
|
||||
"arguments": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"computer": {
|
||||
"properties": {
|
||||
"active": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"connector_guid": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"external_ip": {
|
||||
"type": "ip"
|
||||
},
|
||||
"network_addresses": {
|
||||
"type": "flattened"
|
||||
}
|
||||
}
|
||||
},
|
||||
"connector_guid": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"detection": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"detection_id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"error": {
|
||||
"properties": {
|
||||
"description": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"error_code": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"event_type_id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"file": {
|
||||
"properties": {
|
||||
"archived_file": {
|
||||
"properties": {
|
||||
"disposition": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"identity": {
|
||||
"properties": {
|
||||
"md5": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"sha1": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"sha256": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"attack_details": {
|
||||
"properties": {
|
||||
"application": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"attacked_module": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"base_address": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"indicators": {
|
||||
"type": "flattened"
|
||||
},
|
||||
"suspicious_files": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"disposition": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"parent": {
|
||||
"properties": {
|
||||
"disposition": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"group_guids": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"mitre_tactics": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"mitre_techniques": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"network_info": {
|
||||
"properties": {
|
||||
"disposition": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"nfm": {
|
||||
"properties": {
|
||||
"direction": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"parent": {
|
||||
"properties": {
|
||||
"disposition": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"identify": {
|
||||
"properties": {
|
||||
"sha256": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"identity": {
|
||||
"properties": {
|
||||
"md5": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"sha1": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"related": {
|
||||
"properties": {
|
||||
"cve": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"mac": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"scan": {
|
||||
"properties": {
|
||||
"clean": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"description": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"malicious_detections": {
|
||||
"type": "long"
|
||||
},
|
||||
"scanned_files": {
|
||||
"type": "long"
|
||||
},
|
||||
"scanned_paths": {
|
||||
"type": "long"
|
||||
},
|
||||
"scanned_processes": {
|
||||
"type": "long"
|
||||
}
|
||||
}
|
||||
},
|
||||
"tactics": {
|
||||
"type": "flattened"
|
||||
},
|
||||
"techniques": {
|
||||
"type": "flattened"
|
||||
},
|
||||
"threat_hunting": {
|
||||
"properties": {
|
||||
"incident_end_time": {
|
||||
"type": "date"
|
||||
},
|
||||
"incident_hunt_guid": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"incident_id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"incident_remediation": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"incident_report_guid": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"incident_start_time": {
|
||||
"type": "date"
|
||||
},
|
||||
"incident_summary": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"incident_title": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"severity": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"tactics": {
|
||||
"type": "flattened"
|
||||
},
|
||||
"techniques": {
|
||||
"type": "flattened"
|
||||
}
|
||||
}
|
||||
},
|
||||
"timestamp_nanoseconds": {
|
||||
"type": "date"
|
||||
},
|
||||
"vulnerabilities": {
|
||||
"type": "flattened"
|
||||
}
|
||||
}
|
||||
},
|
||||
"asa": {
|
||||
"properties": {
|
||||
"assigned_ip": {
|
||||
"type": "ip"
|
||||
},
|
||||
"burst": {
|
||||
"properties": {
|
||||
"avg_rate": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"configured_avg_rate": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"configured_rate": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"cumulative_count": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"current_rate": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"object": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"command_line_arguments": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"connection_id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"connection_type": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"dap_records": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"destination_interface": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"destination_username": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"icmp_code": {
|
||||
"type": "short"
|
||||
},
|
||||
"icmp_type": {
|
||||
"type": "short"
|
||||
},
|
||||
"mapped_destination_host": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"mapped_destination_ip": {
|
||||
"type": "ip"
|
||||
},
|
||||
"mapped_destination_port": {
|
||||
"type": "long"
|
||||
},
|
||||
"mapped_source_host": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"mapped_source_ip": {
|
||||
"type": "ip"
|
||||
},
|
||||
"mapped_source_port": {
|
||||
"type": "long"
|
||||
},
|
||||
"message_id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"privilege": {
|
||||
"properties": {
|
||||
"new": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"old": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"rule_name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"session_type": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"source_interface": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"source_username": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"suffix": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"termination_initiator": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"termination_user": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"threat_category": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"threat_level": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"tunnel_type": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"webvpn": {
|
||||
"properties": {
|
||||
"group_name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"ftd": {
|
||||
"properties": {
|
||||
"connection_id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"connection_type": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"dap_records": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"destination_interface": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"destination_username": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"icmp_code": {
|
||||
"type": "short"
|
||||
},
|
||||
"icmp_type": {
|
||||
"type": "short"
|
||||
},
|
||||
"mapped_destination_host": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"mapped_destination_ip": {
|
||||
"type": "ip"
|
||||
},
|
||||
"mapped_destination_port": {
|
||||
"type": "long"
|
||||
},
|
||||
"mapped_source_host": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"mapped_source_ip": {
|
||||
"type": "ip"
|
||||
},
|
||||
"mapped_source_port": {
|
||||
"type": "long"
|
||||
},
|
||||
"message_id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"rule_name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"security": {
|
||||
"type": "object"
|
||||
},
|
||||
"source_interface": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"source_username": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"suffix": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"termination_initiator": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"termination_user": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"threat_category": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"threat_level": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"webvpn": {
|
||||
"properties": {
|
||||
"group_name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"ios": {
|
||||
"properties": {
|
||||
"access_list": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"facility": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"umbrella": {
|
||||
"properties": {
|
||||
"amp_disposition": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"amp_malware_name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"amp_score": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"av_detections": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"blocked_categories": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"categories": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"content_type": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"datacenter": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"identities": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"identity_types": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"origin_id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"policy_identity_type": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"puas": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"sha_sha256": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,305 @@
|
||||
{
|
||||
"_meta": {
|
||||
"documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-base.html",
|
||||
"ecs_version": "1.12.2"
|
||||
},
|
||||
"template": {
|
||||
"mappings": {
|
||||
"properties": {
|
||||
"cyberarkpas": {
|
||||
"properties": {
|
||||
"audit": {
|
||||
"properties": {
|
||||
"action": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"ca_properties": {
|
||||
"properties": {
|
||||
"address": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"cpm_disabled": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"cpm_error_details": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"cpm_status": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"creation_method": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"customer": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"database": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"device_type": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"dual_account_status": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"group_name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"in_process": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"index": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"last_fail_date": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"last_success_change": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"last_success_reconciliation": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"last_success_verification": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"last_task": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"logon_domain": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"other": {
|
||||
"type": "flattened"
|
||||
},
|
||||
"policy_id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"port": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"privcloud": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"reset_immediately": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"retries_count": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"sequence_id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"tags": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"user_dn": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"user_name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"virtual_username": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"category": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"desc": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"extra_details": {
|
||||
"properties": {
|
||||
"ad_process_id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"ad_process_name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"application_type": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"command": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"connection_component_id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"dst_host": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"logon_account": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"managed_account": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"other": {
|
||||
"type": "flattened"
|
||||
},
|
||||
"process_id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"process_name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"protocol": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"psmid": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"session_duration": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"session_id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"src_host": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"username": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"file": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"gateway_station": {
|
||||
"type": "ip"
|
||||
},
|
||||
"hostname": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"iso_timestamp": {
|
||||
"type": "date"
|
||||
},
|
||||
"issuer": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"location": {
|
||||
"doc_values": false,
|
||||
"ignore_above": 4096,
|
||||
"index": false,
|
||||
"type": "keyword"
|
||||
},
|
||||
"message": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"message_id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"product": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"pvwa_details": {
|
||||
"type": "flattened"
|
||||
},
|
||||
"raw": {
|
||||
"doc_values": false,
|
||||
"ignore_above": 4096,
|
||||
"index": false,
|
||||
"type": "keyword"
|
||||
},
|
||||
"reason": {
|
||||
"norms": false,
|
||||
"type": "text"
|
||||
},
|
||||
"rfc5424": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"safe": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"severity": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"source_user": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"station": {
|
||||
"type": "ip"
|
||||
},
|
||||
"target_user": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"timestamp": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"vendor": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"version": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,25 @@
|
||||
{
|
||||
"_meta": {
|
||||
"documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-base.html",
|
||||
"ecs_version": "1.12.2"
|
||||
},
|
||||
"template": {
|
||||
"mappings": {
|
||||
"properties": {
|
||||
"@timestamp": {
|
||||
"type": "date"
|
||||
},
|
||||
"labels": {
|
||||
"type": "object"
|
||||
},
|
||||
"message": {
|
||||
"type": "match_only_text"
|
||||
},
|
||||
"tags": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
File diff suppressed because it is too large.
Load diff
@@ -0,0 +1,267 @@
|
||||
{
|
||||
"_meta": {
|
||||
"documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-base.html",
|
||||
"ecs_version": "1.12.2"
|
||||
},
|
||||
"template": {
|
||||
"mappings": {
|
||||
"properties": {
|
||||
"gcp": {
|
||||
"properties": {
|
||||
"audit": {
|
||||
"properties": {
|
||||
"authentication_info": {
|
||||
"properties": {
|
||||
"authority_selector": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"principal_email": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"method_name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"num_response_items": {
|
||||
"type": "long"
|
||||
},
|
||||
"request": {
|
||||
"properties": {
|
||||
"filter": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"proto_name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"resource_name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"request_metadata": {
|
||||
"properties": {
|
||||
"caller_ip": {
|
||||
"type": "ip"
|
||||
},
|
||||
"caller_supplied_user_agent": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"resource_location": {
|
||||
"properties": {
|
||||
"current_locations": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"resource_name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"response": {
|
||||
"properties": {
|
||||
"details": {
|
||||
"properties": {
|
||||
"group": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"kind": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"uid": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"proto_name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"status": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"service_name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"status": {
|
||||
"properties": {
|
||||
"code": {
|
||||
"type": "long"
|
||||
},
|
||||
"message": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"type": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"destination": {
|
||||
"properties": {
|
||||
"instance": {
|
||||
"properties": {
|
||||
"project_id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"region": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"zone": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"vpc": {
|
||||
"properties": {
|
||||
"project_id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"subnetwork_name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"vpc_name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"firewall": {
|
||||
"properties": {
|
||||
"rule_details": {
|
||||
"properties": {
|
||||
"action": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"destination_range": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"direction": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"priority": {
|
||||
"type": "long"
|
||||
},
|
||||
"reference": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"source_range": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"source_service_account": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"source_tag": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"target_service_account": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"target_tag": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"source": {
|
||||
"properties": {
|
||||
"instance": {
|
||||
"properties": {
|
||||
"project_id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"region": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"zone": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"vpc": {
|
||||
"properties": {
|
||||
"project_id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"subnetwork_name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"vpc_name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"vpcflow": {
|
||||
"properties": {
|
||||
"reporter": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"rtt": {
|
||||
"properties": {
|
||||
"ms": {
|
||||
"type": "long"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,750 @@
|
||||
{
|
||||
"_meta": {
|
||||
"documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-base.html",
|
||||
"ecs_version": "1.12.2"
|
||||
},
|
||||
"template": {
|
||||
"mappings": {
|
||||
"properties": {
|
||||
"google_workspace": {
|
||||
"properties": {
|
||||
"actor": {
|
||||
"properties": {
|
||||
"key": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"type": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"admin": {
|
||||
"properties": {
|
||||
"alert": {
|
||||
"properties": {
|
||||
"name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"api": {
|
||||
"properties": {
|
||||
"client": {
|
||||
"properties": {
|
||||
"name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"scopes": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"application": {
|
||||
"properties": {
|
||||
"asp_id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"edition": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"enabled": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"licences_order_number": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"licences_purchased": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"package_id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"bulk_upload": {
|
||||
"properties": {
|
||||
"failed": {
|
||||
"type": "long"
|
||||
},
|
||||
"total": {
|
||||
"type": "long"
|
||||
}
|
||||
}
|
||||
},
|
||||
"chrome_licenses": {
|
||||
"properties": {
|
||||
"allowed": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"enabled": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"chrome_os": {
|
||||
"properties": {
|
||||
"session_type": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"device": {
|
||||
"properties": {
|
||||
"command_details": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"serial_number": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"type": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"distribution": {
|
||||
"properties": {
|
||||
"entity": {
|
||||
"properties": {
|
||||
"name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"type": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"domain": {
|
||||
"properties": {
|
||||
"alias": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"secondary_name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"email": {
|
||||
"properties": {
|
||||
"log_search_filter": {
|
||||
"properties": {
|
||||
"end_date": {
|
||||
"type": "date"
|
||||
},
|
||||
"message_id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"recipient": {
|
||||
"properties": {
|
||||
"ip": {
|
||||
"type": "ip"
|
||||
},
|
||||
"value": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"sender": {
|
||||
"properties": {
|
||||
"ip": {
|
||||
"type": "ip"
|
||||
},
|
||||
"value": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"start_date": {
|
||||
"type": "date"
|
||||
}
|
||||
}
|
||||
},
|
||||
"quarantine_name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"email_dump": {
|
||||
"properties": {
|
||||
"include_deleted": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"package_content": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"query": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"email_monitor": {
|
||||
"properties": {
|
||||
"dest_email": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"level": {
|
||||
"properties": {
|
||||
"chat": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"draft": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"incoming": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"outgoing": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"field": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"gateway": {
|
||||
"properties": {
|
||||
"name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"group": {
|
||||
"properties": {
|
||||
"allowed_list": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"email": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"priorities": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"info_type": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"managed_configuration": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"mdm": {
|
||||
"properties": {
|
||||
"token": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"vendor": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"mobile": {
|
||||
"properties": {
|
||||
"action": {
|
||||
"properties": {
|
||||
"id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"type": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"certificate": {
|
||||
"properties": {
|
||||
"name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"company_owned_devices": {
|
||||
"type": "long"
|
||||
}
|
||||
}
|
||||
},
|
||||
"new_value": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"non_featured_services_selection": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"oauth2": {
|
||||
"properties": {
|
||||
"application": {
|
||||
"properties": {
|
||||
"id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"type": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"service": {
|
||||
"properties": {
|
||||
"name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"old_value": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"org_unit": {
|
||||
"properties": {
|
||||
"full": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"print_server": {
|
||||
"properties": {
|
||||
"name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"printer": {
|
||||
"properties": {
|
||||
"name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"privilege": {
|
||||
"properties": {
|
||||
"name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"product": {
|
||||
"properties": {
|
||||
"name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"sku": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"request": {
|
||||
"properties": {
|
||||
"id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"resource": {
|
||||
"properties": {
|
||||
"id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"role": {
|
||||
"properties": {
|
||||
"id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"rule": {
|
||||
"properties": {
|
||||
"name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"service": {
|
||||
"properties": {
|
||||
"name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"setting": {
|
||||
"properties": {
|
||||
"description": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"url": {
|
||||
"properties": {
|
||||
"name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"user": {
|
||||
"properties": {
|
||||
"birthdate": {
|
||||
"type": "date"
|
||||
},
|
||||
"email": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"nickname": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"user_defined_setting": {
|
||||
"properties": {
|
||||
"name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"verification_method": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"drive": {
|
||||
"properties": {
|
||||
"added_role": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"billable": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"destination_folder_id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"destination_folder_title": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"file": {
|
||||
"properties": {
|
||||
"id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"owner": {
|
||||
"properties": {
|
||||
"email": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"is_shared_drive": {
|
||||
"type": "boolean"
|
||||
}
|
||||
}
|
||||
},
|
||||
"type": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"membership_change_type": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"new_value": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"old_value": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"old_visibility": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"originating_app_id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"primary_event": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"removed_role": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"shared_drive_id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"shared_drive_settings_change_type": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"sheets_import_range_recipient_doc": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"source_folder_id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"source_folder_title": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"target": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"target_domain": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"visibility": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"visibility_change": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"event": {
|
||||
"properties": {
|
||||
"type": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"groups": {
|
||||
"properties": {
|
||||
"acl_permission": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"email": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"member": {
|
||||
"properties": {
|
||||
"email": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"role": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"message": {
|
||||
"properties": {
|
||||
"id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"moderation_action": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"new_value": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"old_value": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"setting": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"status": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"value": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"kind": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"login": {
|
||||
"properties": {
|
||||
"affected_email_address": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"challenge_method": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"failure_type": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"is_second_factor": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"is_suspicious": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"type": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"organization": {
|
||||
"properties": {
|
||||
"domain": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"saml": {
|
||||
"properties": {
|
||||
"application_name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"failure_type": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"initiated_by": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"orgunit_path": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"second_level_status_code": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"status_code": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,378 @@
|
||||
{
|
||||
"_meta": {
|
||||
"documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-base.html",
|
||||
"ecs_version": "1.12.2"
|
||||
},
|
||||
"template": {
|
||||
"mappings": {
|
||||
"properties": {
|
||||
"juniper": {
|
||||
"properties": {
|
||||
"srx": {
|
||||
"properties": {
|
||||
"action": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"action_detail": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"alert": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"apbr_rule_type": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"application": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"application_category": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"application_characteristics": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"application_name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"application_sub_category": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"attack_name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"category": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"client_ip": {
|
||||
"type": "ip"
|
||||
},
|
||||
"connection_hit_rate": {
|
||||
"type": "long"
|
||||
},
|
||||
"connection_tag": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"context_hit_rate": {
|
||||
"type": "long"
|
||||
},
|
||||
"context_name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"context_value": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"context_value_hit_rate": {
|
||||
"type": "long"
|
||||
},
|
||||
"ddos_application_name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"dscp_value": {
|
||||
"type": "long"
|
||||
},
|
||||
"dst_nat_rule_name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"dst_nat_rule_type": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"dst_vrf_grp": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"elapsed_time": {
|
||||
"type": "date"
|
||||
},
|
||||
"encrypted": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"epoch_time": {
|
||||
"type": "date"
|
||||
},
|
||||
"error_code": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"error_message": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"export_id": {
|
||||
"type": "long"
|
||||
},
|
||||
"feed_name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"file_category": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"file_hash_lookup": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"file_name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"filename": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"hostname": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"icmp_type": {
|
||||
"type": "long"
|
||||
},
|
||||
"inbound_bytes": {
|
||||
"type": "long"
|
||||
},
|
||||
"inbound_packets": {
|
||||
"type": "long"
|
||||
},
|
||||
"index": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"logical_system_name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"malware_info": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"message": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"message_type": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"nat_connection_tag": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"nested_application": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"obj": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"occur_count": {
|
||||
"type": "long"
|
||||
},
|
||||
"outbound_bytes": {
|
||||
"type": "long"
|
||||
},
|
||||
"outbound_packets": {
|
||||
"type": "long"
|
||||
},
|
||||
"packet_log_id": {
|
||||
"type": "long"
|
||||
},
|
||||
"peer_destination_address": {
|
||||
"type": "ip"
|
||||
},
|
||||
"peer_destination_port": {
|
||||
"type": "long"
|
||||
},
|
||||
"peer_session_id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"peer_source_address": {
|
||||
"type": "ip"
|
||||
},
|
||||
"peer_source_port": {
|
||||
"type": "long"
|
||||
},
|
||||
"policy_name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"process": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"profile": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"profile_name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"protocol": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"protocol_id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"protocol_name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"reason": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"repeat_count": {
|
||||
"type": "long"
|
||||
},
|
||||
"roles": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"routing_instance": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"rule_name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"ruleebase_name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"sample_sha256": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"secure_web_proxy_session_type": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"service_name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"session_id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"session_id_32": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"src_nat_rule_name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"src_nat_rule_type": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"src_vrf_grp": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"state": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"status": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"sub_category": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"tag": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"temporary_filename": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"tenant_id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"th": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"threat_severity": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"time_count": {
|
||||
"type": "long"
|
||||
},
|
||||
"time_period": {
|
||||
"type": "long"
|
||||
},
|
||||
"time_scope": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"timestamp": {
|
||||
"type": "date"
|
||||
},
|
||||
"type": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"uplink_rx_bytes": {
|
||||
"type": "long"
|
||||
},
|
||||
"uplink_tx_bytes": {
|
||||
"type": "long"
|
||||
},
|
||||
"url": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"username": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"verdict_number": {
|
||||
"type": "long"
|
||||
},
|
||||
"verdict_source": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,75 @@
|
||||
{
|
||||
"_meta": {
|
||||
"documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-base.html",
|
||||
"ecs_version": "1.12.2"
|
||||
},
|
||||
"template": {
|
||||
"mappings": {
|
||||
"properties": {
|
||||
"kibana": {
|
||||
"properties": {
|
||||
"add_to_spaces": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"authentication_provider": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"authentication_realm": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"authentication_type": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"delete_from_spaces": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"log": {
|
||||
"properties": {
|
||||
"meta": {
|
||||
"type": "object"
|
||||
},
|
||||
"state": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"tags": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"lookup_realm": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"saved_object": {
|
||||
"properties": {
|
||||
"id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"type": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"session_id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"space_id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,99 @@
|
||||
{
|
||||
"_meta": {
|
||||
"documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-base.html",
|
||||
"ecs_version": "1.12.2"
|
||||
},
|
||||
"template": {
|
||||
"mappings": {
|
||||
"properties": {
|
||||
"logstash": {
|
||||
"properties": {
|
||||
"log": {
|
||||
"properties": {
|
||||
"log_event": {
|
||||
"properties": {
|
||||
"action": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"module": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"pipeline_id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"thread": {
|
||||
"fields": {
|
||||
"text": {
|
||||
"norms": false,
|
||||
"type": "text"
|
||||
}
|
||||
},
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"slowlog": {
|
||||
"properties": {
|
||||
"event": {
|
||||
"fields": {
|
||||
"text": {
|
||||
"norms": false,
|
||||
"type": "text"
|
||||
}
|
||||
},
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"module": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"plugin_name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"plugin_params": {
|
||||
"fields": {
|
||||
"text": {
|
||||
"norms": false,
|
||||
"type": "text"
|
||||
}
|
||||
},
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"plugin_params_object": {
|
||||
"type": "object"
|
||||
},
|
||||
"plugin_type": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"thread": {
|
||||
"fields": {
|
||||
"text": {
|
||||
"norms": false,
|
||||
"type": "text"
|
||||
}
|
||||
},
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"took_in_millis": {
|
||||
"type": "long"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,265 @@
|
||||
{
|
||||
"_meta": {
|
||||
"documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-base.html",
|
||||
"ecs_version": "1.12.2"
|
||||
},
|
||||
"template": {
|
||||
"mappings": {
|
||||
"properties": {
|
||||
"microsoft": {
|
||||
"properties": {
|
||||
"defender_atp": {
|
||||
"properties": {
|
||||
"assignedTo": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"classification": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"determination": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"evidence": {
|
||||
"properties": {
|
||||
"aadUserId": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"accountName": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"domainName": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"entityType": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"ipAddress": {
|
||||
"type": "ip"
|
||||
},
|
||||
"userPrincipalName": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"incidentId": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"investigationId": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"investigationState": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"lastUpdateTime": {
|
||||
"type": "date"
|
||||
},
|
||||
"rbacGroupName": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"resolvedTime": {
|
||||
"type": "date"
|
||||
},
|
||||
"status": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"threatFamilyName": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"m365_defender": {
|
||||
"properties": {
|
||||
"alerts": {
|
||||
"properties": {
|
||||
"actorName": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"assignedTo": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"classification": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"creationTime": {
|
||||
"type": "date"
|
||||
},
|
||||
"detectionSource": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"determination": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"devices": {
|
||||
"type": "flattened"
|
||||
},
|
||||
"entities": {
|
||||
"properties": {
|
||||
"accountName": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"clusterBy": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"deliveryAction": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"deviceId": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"entityType": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"ipAddress": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"mailboxAddress": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"mailboxDisplayName": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"recipient": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"registryHive": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"registryKey": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"registryValueType": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"securityGroupId": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"securityGroupName": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"sender": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"subject": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"incidentId": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"investigationId": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"investigationState": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"lastUpdatedTime": {
|
||||
"type": "date"
|
||||
},
|
||||
"mitreTechniques": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"resolvedTime": {
|
||||
"type": "date"
|
||||
},
|
||||
"severity": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"status": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"threatFamilyName": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"userSid": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"assignedTo": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"classification": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"determination": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"incidentId": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"incidentName": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"investigationState": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"redirectIncidentId": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"status": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"tags": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,425 @@
|
||||
{
|
||||
"_meta": {
|
||||
"documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-base.html",
|
||||
"ecs_version": "1.12.2"
|
||||
},
|
||||
"template": {
|
||||
"mappings": {
|
||||
"properties": {
|
||||
"misp": {
|
||||
"properties": {
|
||||
"attack_pattern": {
|
||||
"properties": {
|
||||
"description": {
|
||||
"norms": false,
|
||||
"type": "text"
|
||||
},
|
||||
"id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"kill_chain_phases": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"campaign": {
|
||||
"properties": {
|
||||
"aliases": {
|
||||
"norms": false,
|
||||
"type": "text"
|
||||
},
|
||||
"description": {
|
||||
"norms": false,
|
||||
"type": "text"
|
||||
},
|
||||
"first_seen": {
|
||||
"type": "date"
|
||||
},
|
||||
"id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"last_seen": {
|
||||
"type": "date"
|
||||
},
|
||||
"name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"objective": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"course_of_action": {
|
||||
"properties": {
|
||||
"description": {
|
||||
"norms": false,
|
||||
"type": "text"
|
||||
},
|
||||
"id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"identity": {
|
||||
"properties": {
|
||||
"contact_information": {
|
||||
"norms": false,
|
||||
"type": "text"
|
||||
},
|
||||
"description": {
|
||||
"norms": false,
|
||||
"type": "text"
|
||||
},
|
||||
"id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"identity_class": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"labels": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"sectors": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"intrusion_set": {
|
||||
"properties": {
|
||||
"aliases": {
|
||||
"norms": false,
|
||||
"type": "text"
|
||||
},
|
||||
"description": {
|
||||
"norms": false,
|
||||
"type": "text"
|
||||
},
|
||||
"first_seen": {
|
||||
"type": "date"
|
||||
},
|
||||
"goals": {
|
||||
"norms": false,
|
||||
"type": "text"
|
||||
},
|
||||
"id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"last_seen": {
|
||||
"type": "date"
|
||||
},
|
||||
"name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"primary_motivation": {
|
||||
"norms": false,
|
||||
"type": "text"
|
||||
},
|
||||
"resource_level": {
|
||||
"norms": false,
|
||||
"type": "text"
|
||||
},
|
||||
"secondary_motivations": {
|
||||
"norms": false,
|
||||
"type": "text"
|
||||
}
|
||||
}
|
||||
},
|
||||
"malware": {
|
||||
"properties": {
|
||||
"description": {
|
||||
"norms": false,
|
||||
"type": "text"
|
||||
},
|
||||
"id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"kill_chain_phases": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"labels": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"note": {
|
||||
"properties": {
|
||||
"authors": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"description": {
|
||||
"norms": false,
|
||||
"type": "text"
|
||||
},
|
||||
"id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"object_refs": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"summary": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"observed_data": {
|
||||
"properties": {
|
||||
"first_observed": {
|
||||
"type": "date"
|
||||
},
|
||||
"id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"last_observed": {
|
||||
"type": "date"
|
||||
},
|
||||
"number_observed": {
|
||||
"type": "long"
|
||||
},
|
||||
"objects": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"report": {
|
||||
"properties": {
|
||||
"description": {
|
||||
"norms": false,
|
||||
"type": "text"
|
||||
},
|
||||
"id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"labels": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"object_refs": {
|
||||
"norms": false,
|
||||
"type": "text"
|
||||
},
|
||||
"published": {
|
||||
"type": "date"
|
||||
}
|
||||
}
|
||||
},
|
||||
"threat_actor": {
|
||||
"properties": {
|
||||
"aliases": {
|
||||
"norms": false,
|
||||
"type": "text"
|
||||
},
|
||||
"description": {
|
||||
"norms": false,
|
||||
"type": "text"
|
||||
},
|
||||
"goals": {
|
||||
"norms": false,
|
||||
"type": "text"
|
||||
},
|
||||
"id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"labels": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"personal_motivations": {
|
||||
"norms": false,
|
||||
"type": "text"
|
||||
},
|
||||
"primary_motivation": {
|
||||
"norms": false,
|
||||
"type": "text"
|
||||
},
|
||||
"resource_level": {
|
||||
"norms": false,
|
||||
"type": "text"
|
||||
},
|
||||
"roles": {
|
||||
"norms": false,
|
||||
"type": "text"
|
||||
},
|
||||
"secondary_motivations": {
|
||||
"norms": false,
|
||||
"type": "text"
|
||||
},
|
||||
"sophistication": {
|
||||
"norms": false,
|
||||
"type": "text"
|
||||
}
|
||||
}
|
||||
},
|
||||
"threat_indicator": {
|
||||
"properties": {
|
||||
"attack_pattern": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"attack_pattern_kql": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"campaign": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"confidence": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"description": {
|
||||
"norms": false,
|
||||
"type": "text"
|
||||
},
|
||||
"feed": {
|
||||
"norms": false,
|
||||
"type": "text"
|
||||
},
|
||||
"id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"intrusion_set": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"kill_chain_phases": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"labels": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"mitre_tactic": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"mitre_technique": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"negate": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"severity": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"threat_actor": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"type": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"valid_from": {
|
||||
"type": "date"
|
||||
},
|
||||
"valid_until": {
|
||||
"type": "date"
|
||||
},
|
||||
"version": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"tool": {
|
||||
"properties": {
|
||||
"description": {
|
||||
"norms": false,
|
||||
"type": "text"
|
||||
},
|
||||
"id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"kill_chain_phases": {
|
||||
"norms": false,
|
||||
"type": "text"
|
||||
},
|
||||
"labels": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"tool_version": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"vulnerability": {
|
||||
"properties": {
|
||||
"description": {
|
||||
"norms": false,
|
||||
"type": "text"
|
||||
},
|
||||
"id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
File diff suppressed because it is too large.
Load diff
@@ -0,0 +1,445 @@
|
||||
{
|
||||
"_meta": {
|
||||
"documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-base.html",
|
||||
"ecs_version": "1.12.2"
|
||||
},
|
||||
"template": {
|
||||
"mappings": {
|
||||
"properties": {
|
||||
"o365": {
|
||||
"properties": {
|
||||
"audit": {
|
||||
"properties": {
|
||||
"AADGroupId": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"ActorContextId": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"ActorIpAddress": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"ActorUserId": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"ActorYammerUserId": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"AlertEntityId": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"AlertId": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"AlertType": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"AppId": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"ApplicationDisplayName": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"ApplicationId": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"AzureActiveDirectoryEventType": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"Category": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"ClientAppId": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"ClientIP": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"ClientIPAddress": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"ClientInfoString": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"Comments": {
|
||||
"norms": false,
|
||||
"type": "text"
|
||||
},
|
||||
"CommunicationType": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"CorrelationId": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"CreationTime": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"CustomUniqueId": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"Data": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"DataType": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"DoNotDistributeEvent": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"EntityType": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"ErrorNumber": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"EventData": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"EventSource": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"ExceptionInfo": {
|
||||
"properties": {
|
||||
"*": {
|
||||
"type": "object"
|
||||
}
|
||||
}
|
||||
},
|
||||
"ExchangeMetaData": {
|
||||
"properties": {
|
||||
"*": {
|
||||
"type": "object"
|
||||
}
|
||||
}
|
||||
},
|
||||
"ExtendedProperties": {
|
||||
"properties": {
|
||||
"*": {
|
||||
"type": "object"
|
||||
}
|
||||
}
|
||||
},
|
||||
"ExternalAccess": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"FromApp": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"GroupName": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"Id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"ImplicitShare": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"IncidentId": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"InterSystemsId": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"InternalLogonType": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"IntraSystemId": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"IsDocLib": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"Item": {
|
||||
"properties": {
|
||||
"*": {
|
||||
"properties": {
|
||||
"*": {
|
||||
"type": "object"
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
}
|
||||
},
|
||||
"ItemCount": {
|
||||
"type": "long"
|
||||
},
|
||||
"ItemName": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"ItemType": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"ListBaseTemplateType": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"ListBaseType": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"ListColor": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"ListIcon": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"ListId": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"ListItemUniqueId": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"ListTitle": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"LogonError": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"LogonType": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"LogonUserSid": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"MailboxGuid": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"MailboxOwnerMasterAccountSid": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"MailboxOwnerSid": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"MailboxOwnerUPN": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"Members": {
|
||||
"properties": {
|
||||
"*": {
|
||||
"type": "object"
|
||||
}
|
||||
}
|
||||
},
|
||||
"ModifiedProperties": {
|
||||
"properties": {
|
||||
"*": {
|
||||
"properties": {
|
||||
"*": {
|
||||
"type": "object"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"Name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"ObjectId": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"Operation": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"OrganizationId": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"OrganizationName": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"OriginatingServer": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"Parameters": {
|
||||
"properties": {
|
||||
"*": {
|
||||
"type": "object"
|
||||
}
|
||||
}
|
||||
},
|
||||
"PolicyId": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"RecordType": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"ResultStatus": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"SensitiveInfoDetectionIsIncluded": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"SessionId": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"Severity": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"SharePointMetaData": {
|
||||
"properties": {
|
||||
"*": {
|
||||
"type": "object"
|
||||
}
|
||||
}
|
||||
},
|
||||
"Site": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"SiteUrl": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"Source": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"SourceFileExtension": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"SourceFileName": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"SourceRelativeUrl": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"Status": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"SupportTicketId": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"TargetContextId": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"TargetUserOrGroupName": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"TargetUserOrGroupType": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"TeamGuid": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"TeamName": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"TemplateTypeId": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"UniqueSharingId": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"UserAgent": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"UserId": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"UserKey": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"UserType": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"Version": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"WebId": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"Workload": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"YammerNetworkId": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,293 @@
|
||||
{
|
||||
"_meta": {
|
||||
"documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-base.html",
|
||||
"ecs_version": "1.12.2"
|
||||
},
|
||||
"template": {
|
||||
"mappings": {
|
||||
"properties": {
|
||||
"okta": {
|
||||
"properties": {
|
||||
"actor": {
|
||||
"properties": {
|
||||
"alternate_id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"display_name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"type": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"authentication_context": {
|
||||
"properties": {
|
||||
"authentication_provider": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"authentication_step": {
|
||||
"type": "long"
|
||||
},
|
||||
"credential_provider": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"credential_type": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"external_session_id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"interface": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"client": {
|
||||
"properties": {
|
||||
"device": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"ip": {
|
||||
"type": "ip"
|
||||
},
|
||||
"user_agent": {
|
||||
"properties": {
|
||||
"browser": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"os": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"raw_user_agent": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"zone": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"debug_context": {
|
||||
"properties": {
|
||||
"debug_data": {
|
||||
"properties": {
|
||||
"device_fingerprint": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"request_id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"request_uri": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"suspicious_activity": {
|
||||
"properties": {
|
||||
"browser": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"event_city": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"event_country": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"event_id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"event_ip": {
|
||||
"type": "ip"
|
||||
},
|
||||
"event_latitude": {
|
||||
"type": "float"
|
||||
},
|
||||
"event_longitude": {
|
||||
"type": "float"
|
||||
},
|
||||
"event_state": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"event_transaction_id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"event_type": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"os": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"timestamp": {
|
||||
"type": "date"
|
||||
}
|
||||
}
|
||||
},
|
||||
"threat_suspected": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"url": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"display_message": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"event_type": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"outcome": {
|
||||
"properties": {
|
||||
"reason": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"result": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"request": {
|
||||
"properties": {
|
||||
"ip_chain": {
|
||||
"properties": {
|
||||
"geographical_context": {
|
||||
"properties": {
|
||||
"city": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"country": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"geolocation": {
|
||||
"type": "geo_point"
|
||||
},
|
||||
"postal_code": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"state": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"ip": {
|
||||
"type": "ip"
|
||||
},
|
||||
"source": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"version": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"security_context": {
|
||||
"properties": {
|
||||
"as": {
|
||||
"properties": {
|
||||
"number": {
|
||||
"type": "long"
|
||||
},
|
||||
"organization": {
|
||||
"properties": {
|
||||
"name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"domain": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"is_proxy": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"isp": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"severity": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"target": {
|
||||
"type": "flattened"
|
||||
},
|
||||
"transaction": {
|
||||
"properties": {
|
||||
"id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"type": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"uuid": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"version": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,50 @@
|
||||
{
|
||||
"_meta": {
|
||||
"documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-base.html",
|
||||
"ecs_version": "1.12.2"
|
||||
},
|
||||
"template": {
|
||||
"mappings": {
|
||||
"properties": {
|
||||
"redis": {
|
||||
"properties": {
|
||||
"log": {
|
||||
"properties": {
|
||||
"role": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"slowlog": {
|
||||
"properties": {
|
||||
"args": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"cmd": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"duration": {
|
||||
"properties": {
|
||||
"us": {
|
||||
"type": "long"
|
||||
}
|
||||
}
|
||||
},
|
||||
"id": {
|
||||
"type": "long"
|
||||
},
|
||||
"key": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,149 @@
|
||||
{
|
||||
"_meta": {
|
||||
"documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-base.html",
|
||||
"ecs_version": "1.12.2"
|
||||
},
|
||||
"template": {
|
||||
"mappings": {
|
||||
"properties": {
|
||||
"snyk": {
|
||||
"properties": {
|
||||
"audit": {
|
||||
"properties": {
|
||||
"content": {
|
||||
"type": "flattened"
|
||||
},
|
||||
"org_id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"project_id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"projects": {
|
||||
"type": "flattened"
|
||||
},
|
||||
"related": {
|
||||
"properties": {
|
||||
"projects": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"vulnerabilities": {
|
||||
"properties": {
|
||||
"credit": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"cvss3": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"disclosure_time": {
|
||||
"type": "date"
|
||||
},
|
||||
"exploit_maturity": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"identifiers": {
|
||||
"properties": {
|
||||
"alternative": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"cwe": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"introduced_date": {
|
||||
"type": "date"
|
||||
},
|
||||
"is_fixed": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"is_ignored": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"is_patchable": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"is_patched": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"is_pinnable": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"is_upgradable": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"jira_issue_url": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"language": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"original_severity": {
|
||||
"type": "long"
|
||||
},
|
||||
"package": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"package_manager": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"patches": {
|
||||
"type": "flattened"
|
||||
},
|
||||
"priority_score": {
|
||||
"type": "long"
|
||||
},
|
||||
"publication_time": {
|
||||
"type": "date"
|
||||
},
|
||||
"reachability": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"semver": {
|
||||
"type": "flattened"
|
||||
},
|
||||
"title": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"type": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"unique_severities_list": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"version": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,722 @@
|
||||
{
|
||||
"_meta": {
|
||||
"documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-base.html",
|
||||
"ecs_version": "1.12.2"
|
||||
},
|
||||
"template": {
|
||||
"mappings": {
|
||||
"properties": {
|
||||
"sophos": {
|
||||
"properties": {
|
||||
"xg": {
|
||||
"properties": {
|
||||
"Configuration": {
|
||||
"type": "float"
|
||||
},
|
||||
"Mode": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"PHPSESSID": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"Reports": {
|
||||
"type": "float"
|
||||
},
|
||||
"Signature": {
|
||||
"type": "float"
|
||||
},
|
||||
"SysLog_SERVER_NAME": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"Temp": {
|
||||
"type": "float"
|
||||
},
|
||||
"action": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"activityname": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"ap": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"app_is_cloud": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"appfilter_policy_id": {
|
||||
"type": "long"
|
||||
},
|
||||
"application": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"application_category": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"application_filter_policy": {
|
||||
"type": "long"
|
||||
},
|
||||
"application_name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"application_risk": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"application_technology": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"appresolvedby": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"auth_client": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"auth_mechanism": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"av_policy_name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"backup_mode": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"branch_name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"category": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"category_type": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"classification": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"client_host_name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"client_physical_address": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"clients_conn_ssid": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"collisions": {
|
||||
"type": "long"
|
||||
},
|
||||
"con_id": {
|
||||
"type": "long"
|
||||
},
|
||||
"conn_id": {
|
||||
"type": "long"
|
||||
},
|
||||
"connectionname": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"connectiontype": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"connevent": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"connid": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"contenttype": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"context_match": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"context_prefix": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"context_suffix": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"cookie": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"date": {
|
||||
"type": "date"
|
||||
},
|
||||
"destinationip": {
|
||||
"type": "ip"
|
||||
},
|
||||
"device": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"device_id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"device_name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"dictionary_name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"dir_disp": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"direction": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"domainname": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"download_file_name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"download_file_type": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"dst_country_code": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"dst_domainname": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"dst_ip": {
|
||||
"type": "ip"
|
||||
},
|
||||
"dst_port": {
|
||||
"type": "long"
|
||||
},
|
||||
"dstdomain": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"dstzone": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"dstzonetype": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"duration": {
|
||||
"type": "long"
|
||||
},
|
||||
"email_subject": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"ep_uuid": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"eventid": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"eventtime": {
|
||||
"type": "date"
|
||||
},
|
||||
"eventtype": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"exceptions": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"execution_path": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"extra": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"file_name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"file_path": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"file_size": {
|
||||
"type": "long"
|
||||
},
|
||||
"filename": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"filepath": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"filesize": {
|
||||
"type": "long"
|
||||
},
|
||||
"free": {
|
||||
"type": "long"
|
||||
},
|
||||
"from_email_address": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"ftp_direction": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"ftp_url": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"ftpcommand": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"fw_rule_id": {
|
||||
"type": "long"
|
||||
},
|
||||
"hb_health": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"host": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"httpresponsecode": {
|
||||
"type": "long"
|
||||
},
|
||||
"iap": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"icmp_code": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"icmp_type": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"idle_cpu": {
|
||||
"type": "float"
|
||||
},
|
||||
"idp_policy_id": {
|
||||
"type": "long"
|
||||
},
|
||||
"idp_policy_name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"in_interface": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"interface": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"ipaddress": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"ips_policy_id": {
|
||||
"type": "long"
|
||||
},
|
||||
"localgateway": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"localnetwork": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"log_component": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"log_id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"log_subtype": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"log_type": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"login_user": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"mailid": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"mailsize": {
|
||||
"type": "long"
|
||||
},
|
||||
"message": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"message_id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"newversion": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"oldversion": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"out_interface": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"override_authorizer": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"override_name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"override_token": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"platform": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"policy_type": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"priority": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"protocol": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"quarantine": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"quarantine_reason": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"querystring": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"raw_data": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"reason": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"received_pkts": {
|
||||
"type": "long"
|
||||
},
|
||||
"receiveddrops": {
|
||||
"type": "long"
|
||||
},
|
||||
"receivederrors": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"receivedkbits": {
|
||||
"type": "long"
|
||||
},
|
||||
"recv_bytes": {
|
||||
"type": "long"
|
||||
},
|
||||
"red_id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"referer": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"remote_ip": {
|
||||
"type": "ip"
|
||||
},
|
||||
"remotenetwork": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"responsetime": {
|
||||
"type": "long"
|
||||
},
|
||||
"rule_priority": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"sent_bytes": {
|
||||
"type": "long"
|
||||
},
|
||||
"sent_pkts": {
|
||||
"type": "long"
|
||||
},
|
||||
"server": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"sessionid": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"sha1sum": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"signature_id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"signature_msg": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"site_category": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"source": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"sourceip": {
|
||||
"type": "ip"
|
||||
},
|
||||
"spamaction": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"sqli": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"src_country_code": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"src_domainname": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"src_ip": {
|
||||
"type": "ip"
|
||||
},
|
||||
"src_mac": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"src_port": {
|
||||
"type": "long"
|
||||
},
|
||||
"srczone": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"srczonetype": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"ssid": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"start_time": {
|
||||
"type": "date"
|
||||
},
|
||||
"starttime": {
|
||||
"type": "date"
|
||||
},
|
||||
"status": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"status_code": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"subject": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"system_cpu": {
|
||||
"type": "float"
|
||||
},
|
||||
"target": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"threatname": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"timestamp": {
|
||||
"type": "date"
|
||||
},
|
||||
"timezone": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"to_email_address": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"total_memory": {
|
||||
"type": "long"
|
||||
},
|
||||
"trans_dst_ip": {
|
||||
"type": "ip"
|
||||
},
|
||||
"trans_dst_port": {
|
||||
"type": "long"
|
||||
},
|
||||
"trans_src_ip": {
|
||||
"type": "ip"
|
||||
},
|
||||
"trans_src_port": {
|
||||
"type": "long"
|
||||
},
|
||||
"transaction_id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"transactionid": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"transmitteddrops": {
|
||||
"type": "long"
|
||||
},
|
||||
"transmittederrors": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"transmittedkbits": {
|
||||
"type": "long"
|
||||
},
|
||||
"unit": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"updatedip": {
|
||||
"type": "ip"
|
||||
},
|
||||
"upload_file_name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"upload_file_type": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"url": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"used": {
|
||||
"type": "long"
|
||||
},
|
||||
"user": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"user_cpu": {
|
||||
"type": "float"
|
||||
},
|
||||
"user_gp": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"user_group": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"user_name": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"users": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"vconn_id": {
|
||||
"type": "long"
|
||||
},
|
||||
"virus": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"website": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"xss": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,850 @@
|
||||
{
|
||||
"_meta": {
|
||||
"documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-base.html",
|
||||
"ecs_version": "1.12.2"
|
||||
},
|
||||
"template": {
|
||||
"mappings": {
|
||||
"properties": {
|
||||
"suricata": {
|
||||
"properties": {
|
||||
"eve": {
|
||||
"properties": {
|
||||
"alert": {
|
||||
"properties": {
|
||||
"affected_product": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"attack_target": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"capec_id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"category": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"classtype": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"created_at": {
|
||||
"type": "date"
|
||||
},
|
||||
"cve": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"cvss_v2_base": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"cvss_v2_temporal": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"cvss_v3_base": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"cvss_v3_temporal": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"cwe_id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"deployment": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"former_category": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"gid": {
|
||||
"type": "long"
|
||||
},
|
||||
"hostile": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"infected": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"malware": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "flattened"
|
||||
},
|
||||
"mitre_tool_id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"performance_impact": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"priority": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"protocols": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"rev": {
|
||||
"type": "long"
|
||||
},
|
||||
"rule_source": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"sid": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"signature": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"signature_id": {
|
||||
"type": "long"
|
||||
},
|
||||
"signature_severity": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"tag": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"updated_at": {
|
||||
"type": "date"
|
||||
}
|
||||
}
|
||||
},
|
||||
"app_proto_expected": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"app_proto_orig": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"app_proto_tc": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"app_proto_ts": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"dns": {
|
||||
"properties": {
|
||||
"id": {
|
||||
"type": "long"
|
||||
},
|
||||
"rcode": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"rdata": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"rrname": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"rrtype": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"ttl": {
|
||||
"type": "long"
|
||||
},
|
||||
"tx_id": {
|
||||
"type": "long"
|
||||
},
|
||||
"type": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"email": {
|
||||
"properties": {
|
||||
"status": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"event_type": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"fileinfo": {
|
||||
"properties": {
|
||||
"gaps": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"md5": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"sha1": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"sha256": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"state": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"stored": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"tx_id": {
|
||||
"type": "long"
|
||||
}
|
||||
}
|
||||
},
|
||||
"flow": {
|
||||
"properties": {
|
||||
"age": {
|
||||
"type": "long"
|
||||
},
|
||||
"alerted": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"reason": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"state": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"flow_id": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"http": {
|
||||
"properties": {
|
||||
"http_content_type": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"protocol": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"redirect": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"icmp_code": {
|
||||
"type": "long"
|
||||
},
|
||||
"icmp_type": {
|
||||
"type": "long"
|
||||
},
|
||||
"in_iface": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"pcap_cnt": {
|
||||
"type": "long"
|
||||
},
|
||||
"smtp": {
|
||||
"properties": {
|
||||
"helo": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"mail_from": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"rcpt_to": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"ssh": {
|
||||
"properties": {
|
||||
"client": {
|
||||
"properties": {
|
||||
"proto_version": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"software_version": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"server": {
|
||||
"properties": {
|
||||
"proto_version": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"software_version": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"stats": {
|
||||
"properties": {
|
||||
"app_layer": {
|
||||
"properties": {
|
||||
"flow": {
|
||||
"properties": {
|
||||
"dcerpc_tcp": {
|
||||
"type": "long"
|
||||
},
|
||||
"dcerpc_udp": {
|
||||
"type": "long"
|
||||
},
|
||||
"dns_tcp": {
|
||||
"type": "long"
|
||||
},
|
||||
"dns_udp": {
|
||||
"type": "long"
|
||||
},
|
||||
"failed_tcp": {
|
||||
"type": "long"
|
||||
},
|
||||
"failed_udp": {
|
||||
"type": "long"
|
||||
},
|
||||
"ftp": {
|
||||
"type": "long"
|
||||
},
|
||||
"http": {
|
||||
"type": "long"
|
||||
},
|
||||
"imap": {
|
||||
"type": "long"
|
||||
},
|
||||
"msn": {
|
||||
"type": "long"
|
||||
},
|
||||
"smb": {
|
||||
"type": "long"
|
||||
},
|
||||
"smtp": {
|
||||
"type": "long"
|
||||
},
|
||||
"ssh": {
|
||||
"type": "long"
|
||||
},
|
||||
"tls": {
|
||||
"type": "long"
|
||||
}
|
||||
}
|
||||
},
|
||||
"tx": {
|
||||
"properties": {
|
||||
"dcerpc_tcp": {
|
||||
"type": "long"
|
||||
},
|
||||
"dcerpc_udp": {
|
||||
"type": "long"
|
||||
},
|
||||
"dns_tcp": {
|
||||
"type": "long"
|
||||
},
|
||||
"dns_udp": {
|
||||
"type": "long"
|
||||
},
|
||||
"ftp": {
|
||||
"type": "long"
|
||||
},
|
||||
"http": {
|
||||
"type": "long"
|
||||
},
|
||||
"smb": {
|
||||
"type": "long"
|
||||
},
|
||||
"smtp": {
|
||||
"type": "long"
|
||||
},
|
||||
"ssh": {
|
||||
"type": "long"
|
||||
},
|
||||
"tls": {
|
||||
"type": "long"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"capture": {
|
||||
"properties": {
|
||||
"kernel_drops": {
|
||||
"type": "long"
|
||||
},
|
||||
"kernel_ifdrops": {
|
||||
"type": "long"
|
||||
},
|
||||
"kernel_packets": {
|
||||
"type": "long"
|
||||
}
|
||||
}
|
||||
},
|
||||
"decoder": {
|
||||
"properties": {
|
||||
"avg_pkt_size": {
|
||||
"type": "long"
|
||||
},
|
||||
"bytes": {
|
||||
"type": "long"
|
||||
},
|
||||
"dce": {
|
||||
"properties": {
|
||||
"pkt_too_small": {
|
||||
"type": "long"
|
||||
}
|
||||
}
|
||||
},
|
||||
"erspan": {
|
||||
"type": "long"
|
||||
},
|
||||
"ethernet": {
|
||||
"type": "long"
|
||||
},
|
||||
"gre": {
|
||||
"type": "long"
|
||||
},
|
||||
"icmpv4": {
|
||||
"type": "long"
|
||||
},
|
||||
"icmpv6": {
|
||||
"type": "long"
|
||||
},
|
||||
"ieee8021ah": {
|
||||
"type": "long"
|
||||
},
|
||||
"invalid": {
|
||||
"type": "long"
|
||||
},
|
||||
"ipraw": {
|
||||
"properties": {
|
||||
"invalid_ip_version": {
|
||||
"type": "long"
|
||||
}
|
||||
}
|
||||
},
|
||||
"ipv4": {
|
||||
"type": "long"
|
||||
},
|
||||
"ipv4_in_ipv6": {
|
||||
"type": "long"
|
||||
},
|
||||
"ipv6": {
|
||||
"type": "long"
|
||||
},
|
||||
"ipv6_in_ipv6": {
|
||||
"type": "long"
|
||||
},
|
||||
"ltnull": {
|
||||
"properties": {
|
||||
"pkt_too_small": {
|
||||
"type": "long"
|
||||
},
|
||||
"unsupported_type": {
|
||||
"type": "long"
|
||||
}
|
||||
}
|
||||
},
|
||||
"max_pkt_size": {
|
||||
"type": "long"
|
||||
},
|
||||
"mpls": {
|
||||
"type": "long"
|
||||
},
|
||||
"null": {
|
||||
"type": "long"
|
||||
},
|
||||
"pkts": {
|
||||
"type": "long"
|
||||
},
|
||||
"ppp": {
|
||||
"type": "long"
|
||||
},
|
||||
"pppoe": {
|
||||
"type": "long"
|
||||
},
|
||||
"raw": {
|
||||
"type": "long"
|
||||
},
|
||||
"sctp": {
|
||||
"type": "long"
|
||||
},
|
||||
"sll": {
|
||||
"type": "long"
|
||||
},
|
||||
"tcp": {
|
||||
"type": "long"
|
||||
},
|
||||
"teredo": {
|
||||
"type": "long"
|
||||
},
|
||||
"udp": {
|
||||
"type": "long"
|
||||
},
|
||||
"vlan": {
|
||||
"type": "long"
|
||||
},
|
||||
"vlan_qinq": {
|
||||
"type": "long"
|
||||
}
|
||||
}
|
||||
},
|
||||
"defrag": {
|
||||
"properties": {
|
||||
"ipv4": {
|
||||
"properties": {
|
||||
"fragments": {
|
||||
"type": "long"
|
||||
},
|
||||
"reassembled": {
|
||||
"type": "long"
|
||||
},
|
||||
"timeouts": {
|
||||
"type": "long"
|
||||
}
|
||||
}
|
||||
},
|
||||
"ipv6": {
|
||||
"properties": {
|
||||
"fragments": {
|
||||
"type": "long"
|
||||
},
|
||||
"reassembled": {
|
||||
"type": "long"
|
||||
},
|
||||
"timeouts": {
|
||||
"type": "long"
|
||||
}
|
||||
}
|
||||
},
|
||||
"max_frag_hits": {
|
||||
"type": "long"
|
||||
}
|
||||
}
|
||||
},
|
||||
"detect": {
|
||||
"properties": {
|
||||
"alert": {
|
||||
"type": "long"
|
||||
}
|
||||
}
|
||||
},
|
||||
"dns": {
|
||||
"properties": {
|
||||
"memcap_global": {
|
||||
"type": "long"
|
||||
},
|
||||
"memcap_state": {
|
||||
"type": "long"
|
||||
},
|
||||
"memuse": {
|
||||
"type": "long"
|
||||
}
|
||||
}
|
||||
},
|
||||
"file_store": {
|
||||
"properties": {
|
||||
"open_files": {
|
||||
"type": "long"
|
||||
}
|
||||
}
|
||||
},
|
||||
"flow": {
|
||||
"properties": {
|
||||
"emerg_mode_entered": {
|
||||
"type": "long"
|
||||
},
|
||||
"emerg_mode_over": {
|
||||
"type": "long"
|
||||
},
|
||||
"icmpv4": {
|
||||
"type": "long"
|
||||
},
|
||||
"icmpv6": {
|
||||
"type": "long"
|
||||
},
|
||||
"memcap": {
|
||||
"type": "long"
|
||||
},
|
||||
"memuse": {
|
||||
"type": "long"
|
||||
},
|
||||
"spare": {
|
||||
"type": "long"
|
||||
},
|
||||
"tcp": {
|
||||
"type": "long"
|
||||
},
|
||||
"tcp_reuse": {
|
||||
"type": "long"
|
||||
},
|
||||
"udp": {
|
||||
"type": "long"
|
||||
}
|
||||
}
|
||||
},
|
||||
"flow_mgr": {
|
||||
"properties": {
|
||||
"bypassed_pruned": {
|
||||
"type": "long"
|
||||
},
|
||||
"closed_pruned": {
|
||||
"type": "long"
|
||||
},
|
||||
"est_pruned": {
|
||||
"type": "long"
|
||||
},
|
||||
"flows_checked": {
|
||||
"type": "long"
|
||||
},
|
||||
"flows_notimeout": {
|
||||
"type": "long"
|
||||
},
|
||||
"flows_removed": {
|
||||
"type": "long"
|
||||
},
|
||||
"flows_timeout": {
|
||||
"type": "long"
|
||||
},
|
||||
"flows_timeout_inuse": {
|
||||
"type": "long"
|
||||
},
|
||||
"new_pruned": {
|
||||
"type": "long"
|
||||
},
|
||||
"rows_busy": {
|
||||
"type": "long"
|
||||
},
|
||||
"rows_checked": {
|
||||
"type": "long"
|
||||
},
|
||||
"rows_empty": {
|
||||
"type": "long"
|
||||
},
|
||||
"rows_maxlen": {
|
||||
"type": "long"
|
||||
},
|
||||
"rows_skipped": {
|
||||
"type": "long"
|
||||
}
|
||||
}
|
||||
},
|
||||
"http": {
|
||||
"properties": {
|
||||
"memcap": {
|
||||
"type": "long"
|
||||
},
|
||||
"memuse": {
|
||||
"type": "long"
|
||||
}
|
||||
}
|
||||
},
|
||||
"tcp": {
|
||||
"properties": {
|
||||
"insert_data_normal_fail": {
|
||||
"type": "long"
|
||||
},
|
||||
"insert_data_overlap_fail": {
|
||||
"type": "long"
|
||||
},
|
||||
"insert_list_fail": {
|
||||
"type": "long"
|
||||
},
|
||||
"invalid_checksum": {
|
||||
"type": "long"
|
||||
},
|
||||
"memuse": {
|
||||
"type": "long"
|
||||
},
|
||||
"no_flow": {
|
||||
"type": "long"
|
||||
},
|
||||
"overlap": {
|
||||
"type": "long"
|
||||
},
|
||||
"overlap_diff_data": {
|
||||
"type": "long"
|
||||
},
|
||||
"pseudo": {
|
||||
"type": "long"
|
||||
},
|
||||
"pseudo_failed": {
|
||||
"type": "long"
|
||||
},
|
||||
"reassembly_gap": {
|
||||
"type": "long"
|
||||
},
|
||||
"reassembly_memuse": {
|
||||
"type": "long"
|
||||
},
|
||||
"rst": {
|
||||
"type": "long"
|
||||
},
|
||||
"segment_memcap_drop": {
|
||||
"type": "long"
|
||||
},
|
||||
"sessions": {
|
||||
"type": "long"
|
||||
},
|
||||
"ssn_memcap_drop": {
|
||||
"type": "long"
|
||||
},
|
||||
"stream_depth_reached": {
|
||||
"type": "long"
|
||||
},
|
||||
"syn": {
|
||||
"type": "long"
|
||||
},
|
||||
"synack": {
|
||||
"type": "long"
|
||||
}
|
||||
}
|
||||
},
|
||||
"uptime": {
|
||||
"type": "long"
|
||||
}
|
||||
}
|
||||
},
|
||||
"tcp": {
|
||||
"properties": {
|
||||
"ack": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"fin": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"psh": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"rst": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"state": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"syn": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"tcp_flags": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"tcp_flags_tc": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"tcp_flags_ts": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"tls": {
|
||||
"properties": {
|
||||
"fingerprint": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"issuerdn": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"ja3": {
|
||||
"properties": {
|
||||
"hash": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"string": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"ja3s": {
|
||||
"properties": {
|
||||
"hash": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"string": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"notafter": {
|
||||
"type": "date"
|
||||
},
|
||||
"notbefore": {
|
||||
"type": "date"
|
||||
},
|
||||
"serial": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"session_resumed": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"sni": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"subject": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"version": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"tx_id": {
|
||||
"type": "long"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,30 @@
|
||||
{
|
||||
"_meta": {
|
||||
"documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-base.html",
|
||||
"ecs_version": "1.12.2"
|
||||
},
|
||||
"template": {
|
||||
"mappings": {
|
||||
"properties": {
|
||||
"syslog": {
|
||||
"properties": {
|
||||
"facility": {
|
||||
"type": "long"
|
||||
},
|
||||
"facility_label": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"priority": {
|
||||
"type": "long"
|
||||
},
|
||||
"severity_label": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
File diff suppressed because it is too large.
Load diff
@@ -30,7 +30,12 @@
|
||||
"type": "keyword"
|
||||
},
|
||||
"created": {
|
||||
"type": "date"
|
||||
"type": "date",
|
||||
"fields": {
|
||||
"keyword": {
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"dataset": {
|
||||
"ignore_above": 1024,
|
||||
@@ -56,7 +61,12 @@
|
||||
"type": "keyword"
|
||||
},
|
||||
"ingested": {
|
||||
"type": "date"
|
||||
"type": "date",
|
||||
"fields": {
|
||||
"keyword": {
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"kind": {
|
||||
"ignore_above": 1024,
|
||||
|
||||
@@ -1,104 +0,0 @@
|
||||
{%- set INDEX_SORTING = salt['pillar.get']('elasticsearch:index_sorting', False) %}
|
||||
{%- set REPLICAS = salt['pillar.get']('elasticsearch:replicas', 0) %}
|
||||
{%- set SHARDS = salt['pillar.get']('elasticsearch:index_settings:so-aws:shards', 1) %}
|
||||
{%- set REFRESH = salt['pillar.get']('elasticsearch:index_settings:so-aws:refresh', '30s') %}
|
||||
{%- set PRIORITY = salt['pillar.get']('elasticsearch:index_settings:so-aws:priority', 500) %}
|
||||
{%- set FIELD_LIMIT = salt['pillar.get']('elasticsearch:index_settings:so-aws:field_limit', 3000) %}
|
||||
{
|
||||
"index_patterns": [
|
||||
"so-aws*"
|
||||
],
|
||||
"template": {
|
||||
"mappings": {
|
||||
"dynamic_templates": [
|
||||
{
|
||||
"strings_as_keyword": {
|
||||
"mapping": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"match_mapping_type": "string"
|
||||
}
|
||||
}
|
||||
],
|
||||
"date_detection": false
|
||||
},
|
||||
"settings": {
|
||||
"index": {
|
||||
"mapping": {
|
||||
"total_fields": {
|
||||
"limit": {{ FIELD_LIMIT }}
|
||||
}
|
||||
},
|
||||
{%- if INDEX_SORTING is sameas true %}
|
||||
"index.sort.field": "@timestamp",
|
||||
"index.sort.order": "desc",
|
||||
{%- endif %}
|
||||
"refresh_interval": "{{ REFRESH }}",
|
||||
"number_of_shards": {{ SHARDS }},
|
||||
"number_of_replicas": {{ REPLICAS }}
|
||||
}
|
||||
}
|
||||
},
|
||||
"composed_of": [
|
||||
"agent-mappings",
|
||||
"dtc-agent-mappings",
|
||||
"base-mappings",
|
||||
"dtc-base-mappings",
|
||||
"client-mappings",
|
||||
"cloud-mappings",
|
||||
"container-mappings",
|
||||
"data_stream-mappings",
|
||||
"destination-mappings",
|
||||
"dll-mappings",
|
||||
"dns-mappings",
|
||||
"dtc-dns-mappings",
|
||||
"ecs-mappings",
|
||||
"dtc-ecs-mappings",
|
||||
"error-mappings",
|
||||
"event-mappings",
|
||||
"dtc-event-mappings",
|
||||
"file-mappings",
|
||||
"dtc-file-mappings",
|
||||
"group-mappings",
|
||||
"host-mappings",
|
||||
"dtc-host-mappings",
|
||||
"http-mappings",
|
||||
"dtc-http-mappings",
|
||||
"log-mappings",
|
||||
"network-mappings",
|
||||
"dtc-network-mappings",
|
||||
"observer-mappings",
|
||||
"dtc-observer-mappings",
|
||||
"orchestrator-mappings",
|
||||
"organization-mappings",
|
||||
"package-mappings",
|
||||
"process-mappings",
|
||||
"dtc-process-mappings",
|
||||
"registry-mappings",
|
||||
"related-mappings",
|
||||
"rule-mappings",
|
||||
"dtc-rule-mappings",
|
||||
"server-mappings",
|
||||
"service-mappings",
|
||||
"dtc-service-mappings",
|
||||
"source-mappings",
|
||||
"threat-mappings",
|
||||
"tls-mappings",
|
||||
"tracing-mappings",
|
||||
"url-mappings",
|
||||
"user_agent-mappings",
|
||||
"dtc-user_agent-mappings",
|
||||
"user-mappings",
|
||||
"dtc-user-mappings",
|
||||
"vulnerability-mappings",
|
||||
"common-settings",
|
||||
"common-dynamic-mappings"
|
||||
],
|
||||
"priority": {{ PRIORITY }},
|
||||
"_meta": {
|
||||
"description": "Composable template that includes SO base fields",
|
||||
"ecs_version": "1.12"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,104 +0,0 @@
|
||||
{%- set INDEX_SORTING = salt['pillar.get']('elasticsearch:index_sorting', False) %}
|
||||
{%- set REPLICAS = salt['pillar.get']('elasticsearch:replicas', 0) %}
|
||||
{%- set SHARDS = salt['pillar.get']('elasticsearch:index_settings:so-azure:shards', 1) %}
|
||||
{%- set REFRESH = salt['pillar.get']('elasticsearch:index_settings:so-azure:refresh', '30s') %}
|
||||
{%- set PRIORITY = salt['pillar.get']('elasticsearch:index_settings:so-azure:priority', 500) %}
|
||||
{%- set FIELD_LIMIT = salt['pillar.get']('elasticsearch:index_settings:so-azure:field_limit', 3000) %}
|
||||
{
|
||||
"index_patterns": [
|
||||
"so-azure*"
|
||||
],
|
||||
"template": {
|
||||
"mappings": {
|
||||
"dynamic_templates": [
|
||||
{
|
||||
"strings_as_keyword": {
|
||||
"mapping": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"match_mapping_type": "string"
|
||||
}
|
||||
}
|
||||
],
|
||||
"date_detection": false
|
||||
},
|
||||
"settings": {
|
||||
"index": {
|
||||
"mapping": {
|
||||
"total_fields": {
|
||||
"limit": {{ FIELD_LIMIT }}
|
||||
}
|
||||
},
|
||||
{%- if INDEX_SORTING is sameas true %}
|
||||
"index.sort.field": "@timestamp",
|
||||
"index.sort.order": "desc",
|
||||
{%- endif %}
|
||||
"refresh_interval": "{{ REFRESH }}",
|
||||
"number_of_shards": {{ SHARDS }},
|
||||
"number_of_replicas": {{ REPLICAS }}
|
||||
}
|
||||
}
|
||||
},
|
||||
"composed_of": [
|
||||
"agent-mappings",
|
||||
"dtc-agent-mappings",
|
||||
"base-mappings",
|
||||
"dtc-base-mappings",
|
||||
"client-mappings",
|
||||
"cloud-mappings",
|
||||
"container-mappings",
|
||||
"data_stream-mappings",
|
||||
"destination-mappings",
|
||||
"dll-mappings",
|
||||
"dns-mappings",
|
||||
"dtc-dns-mappings",
|
||||
"ecs-mappings",
|
||||
"dtc-ecs-mappings",
|
||||
"error-mappings",
|
||||
"event-mappings",
|
||||
"dtc-event-mappings",
|
||||
"file-mappings",
|
||||
"dtc-file-mappings",
|
||||
"group-mappings",
|
||||
"host-mappings",
|
||||
"dtc-host-mappings",
|
||||
"http-mappings",
|
||||
"dtc-http-mappings",
|
||||
"log-mappings",
|
||||
"network-mappings",
|
||||
"dtc-network-mappings",
|
||||
"observer-mappings",
|
||||
"dtc-observer-mappings",
|
||||
"orchestrator-mappings",
|
||||
"organization-mappings",
|
||||
"package-mappings",
|
||||
"process-mappings",
|
||||
"dtc-process-mappings",
|
||||
"registry-mappings",
|
||||
"related-mappings",
|
||||
"rule-mappings",
|
||||
"dtc-rule-mappings",
|
||||
"server-mappings",
|
||||
"service-mappings",
|
||||
"dtc-service-mappings",
|
||||
"source-mappings",
|
||||
"threat-mappings",
|
||||
"tls-mappings",
|
||||
"tracing-mappings",
|
||||
"url-mappings",
|
||||
"user_agent-mappings",
|
||||
"dtc-user_agent-mappings",
|
||||
"user-mappings",
|
||||
"dtc-user-mappings",
|
||||
"vulnerability-mappings",
|
||||
"common-settings",
|
||||
"common-dynamic-mappings"
|
||||
],
|
||||
"priority": {{ PRIORITY }},
|
||||
"_meta": {
|
||||
"description": "Composable template that includes SO base fields",
|
||||
"ecs_version": "1.12"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,104 +0,0 @@
|
||||
{%- set INDEX_SORTING = salt['pillar.get']('elasticsearch:index_sorting', False) %}
|
||||
{%- set REPLICAS = salt['pillar.get']('elasticsearch:replicas', 0) %}
|
||||
{%- set SHARDS = salt['pillar.get']('elasticsearch:index_settings:so-barracuda:shards', 1) %}
|
||||
{%- set REFRESH = salt['pillar.get']('elasticsearch:index_settings:so-barracuda:refresh', '30s') %}
|
||||
{%- set PRIORITY = salt['pillar.get']('elasticsearch:index_settings:so-barracuda:priority', 500) %}
|
||||
{%- set FIELD_LIMIT = salt['pillar.get']('elasticsearch:index_settings:so-barracuda:field_limit', 3000) %}
|
||||
{
|
||||
"index_patterns": [
|
||||
"so-barracuda*"
|
||||
],
|
||||
"template": {
|
||||
"mappings": {
|
||||
"dynamic_templates": [
|
||||
{
|
||||
"strings_as_keyword": {
|
||||
"mapping": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"match_mapping_type": "string"
|
||||
}
|
||||
}
|
||||
],
|
||||
"date_detection": false
|
||||
},
|
||||
"settings": {
|
||||
"index": {
|
||||
"mapping": {
|
||||
"total_fields": {
|
||||
"limit": {{ FIELD_LIMIT }}
|
||||
}
|
||||
},
|
||||
{%- if INDEX_SORTING is sameas true %}
|
||||
"index.sort.field": "@timestamp",
|
||||
"index.sort.order": "desc",
|
||||
{%- endif %}
|
||||
"refresh_interval": "{{ REFRESH }}",
|
||||
"number_of_shards": {{ SHARDS }},
|
||||
"number_of_replicas": {{ REPLICAS }}
|
||||
}
|
||||
}
|
||||
},
|
||||
"composed_of": [
|
||||
"agent-mappings",
|
||||
"dtc-agent-mappings",
|
||||
"base-mappings",
|
||||
"dtc-base-mappings",
|
||||
"client-mappings",
|
||||
"cloud-mappings",
|
||||
"container-mappings",
|
||||
"data_stream-mappings",
|
||||
"destination-mappings",
|
||||
"dll-mappings",
|
||||
"dns-mappings",
|
||||
"dtc-dns-mappings",
|
||||
"ecs-mappings",
|
||||
"dtc-ecs-mappings",
|
||||
"error-mappings",
|
||||
"event-mappings",
|
||||
"dtc-event-mappings",
|
||||
"file-mappings",
|
||||
"dtc-file-mappings",
|
||||
"group-mappings",
|
||||
"host-mappings",
|
||||
"dtc-host-mappings",
|
||||
"http-mappings",
|
||||
"dtc-http-mappings",
|
||||
"log-mappings",
|
||||
"network-mappings",
|
||||
"dtc-network-mappings",
|
||||
"observer-mappings",
|
||||
"dtc-observer-mappings",
|
||||
"orchestrator-mappings",
|
||||
"organization-mappings",
|
||||
"package-mappings",
|
||||
"process-mappings",
|
||||
"dtc-process-mappings",
|
||||
"registry-mappings",
|
||||
"related-mappings",
|
||||
"rule-mappings",
|
||||
"dtc-rule-mappings",
|
||||
"server-mappings",
|
||||
"service-mappings",
|
||||
"dtc-service-mappings",
|
||||
"source-mappings",
|
||||
"threat-mappings",
|
||||
"tls-mappings",
|
||||
"tracing-mappings",
|
||||
"url-mappings",
|
||||
"user_agent-mappings",
|
||||
"dtc-user_agent-mappings",
|
||||
"user-mappings",
|
||||
"dtc-user-mappings",
|
||||
"vulnerability-mappings",
|
||||
"common-settings",
|
||||
"common-dynamic-mappings"
|
||||
],
|
||||
"priority": {{ PRIORITY }},
|
||||
"_meta": {
|
||||
"description": "Composable template that includes SO base fields",
|
||||
"ecs_version": "1.12"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,105 +0,0 @@
|
||||
{%- set INDEX_SORTING = salt['pillar.get']('elasticsearch:index_sorting', False) %}
|
||||
{%- set REPLICAS = salt['pillar.get']('elasticsearch:replicas', 0) %}
|
||||
{%- set SHARDS = salt['pillar.get']('elasticsearch:index_settings:so-beats:shards', 1) %}
|
||||
{%- set REFRESH = salt['pillar.get']('elasticsearch:index_settings:so-beats:refresh', '30s') %}
|
||||
{%- set PRIORITY = salt['pillar.get']('elasticsearch:index_settings:so-beats:priority', 500) %}
|
||||
{%- set FIELD_LIMIT = salt['pillar.get']('elasticsearch:index_settings:so-beats:field_limit', 3000) %}
|
||||
{
|
||||
"index_patterns": [
|
||||
"so-beats*"
|
||||
],
|
||||
"template": {
|
||||
"mappings": {
|
||||
"dynamic_templates": [
|
||||
{
|
||||
"strings_as_keyword": {
|
||||
"mapping": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"match_mapping_type": "string"
|
||||
}
|
||||
}
|
||||
],
|
||||
"date_detection": false
|
||||
},
|
||||
"settings": {
|
||||
"index": {
|
||||
"mapping": {
|
||||
"total_fields": {
|
||||
"limit": {{ FIELD_LIMIT }}
|
||||
}
|
||||
},
|
||||
{%- if INDEX_SORTING is sameas true %}
|
||||
"index.sort.field": "@timestamp",
|
||||
"index.sort.order": "desc",
|
||||
{%- endif %}
|
||||
"refresh_interval": "{{ REFRESH }}",
|
||||
"number_of_shards": {{ SHARDS }},
|
||||
"number_of_replicas": {{ REPLICAS }}
|
||||
}
|
||||
}
|
||||
},
|
||||
"composed_of": [
|
||||
"agent-mappings",
|
||||
"dtc-agent-mappings",
|
||||
"base-mappings",
|
||||
"dtc-base-mappings",
|
||||
"client-mappings",
|
||||
"cloud-mappings",
|
||||
"container-mappings",
|
||||
"data_stream-mappings",
|
||||
"destination-mappings",
|
||||
"dll-mappings",
|
||||
"dns-mappings",
|
||||
"dtc-dns-mappings",
|
||||
"ecs-mappings",
|
||||
"dtc-ecs-mappings",
|
||||
"error-mappings",
|
||||
"event-mappings",
|
||||
"dtc-event-mappings",
|
||||
"file-mappings",
|
||||
"dtc-file-mappings",
|
||||
"group-mappings",
|
||||
"host-mappings",
|
||||
"dtc-host-mappings",
|
||||
"http-mappings",
|
||||
"dtc-http-mappings",
|
||||
"log-mappings",
|
||||
"network-mappings",
|
||||
"dtc-network-mappings",
|
||||
"observer-mappings",
|
||||
"dtc-observer-mappings",
|
||||
"orchestrator-mappings",
|
||||
"organization-mappings",
|
||||
"package-mappings",
|
||||
"process-mappings",
|
||||
"dtc-process-mappings",
|
||||
"registry-mappings",
|
||||
"related-mappings",
|
||||
"rule-mappings",
|
||||
"dtc-rule-mappings",
|
||||
"server-mappings",
|
||||
"service-mappings",
|
||||
"dtc-service-mappings",
|
||||
"source-mappings",
|
||||
"threat-mappings",
|
||||
"tls-mappings",
|
||||
"tracing-mappings",
|
||||
"url-mappings",
|
||||
"user_agent-mappings",
|
||||
"dtc-user_agent-mappings",
|
||||
"user-mappings",
|
||||
"dtc-user-mappings",
|
||||
"vulnerability-mappings",
|
||||
"common-settings",
|
||||
"common-dynamic-mappings",
|
||||
"winlog-mappings"
|
||||
],
|
||||
"priority": {{ PRIORITY }},
|
||||
"_meta": {
|
||||
"description": "Composable template that includes SO base fields",
|
||||
"ecs_version": "1.12"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,104 +0,0 @@
|
||||
{%- set INDEX_SORTING = salt['pillar.get']('elasticsearch:index_sorting', False) %}
|
||||
{%- set REPLICAS = salt['pillar.get']('elasticsearch:replicas', 0) %}
|
||||
{%- set SHARDS = salt['pillar.get']('elasticsearch:index_settings:so-bluecoat:shards', 1) %}
|
||||
{%- set REFRESH = salt['pillar.get']('elasticsearch:index_settings:so-bluecoat:refresh', '30s') %}
|
||||
{%- set PRIORITY = salt['pillar.get']('elasticsearch:index_settings:so-bluecoat:priority', 500) %}
|
||||
{%- set FIELD_LIMIT = salt['pillar.get']('elasticsearch:index_settings:so-bluecoat:field_limit', 3000) %}
|
||||
{
|
||||
"index_patterns": [
|
||||
"so-bluecoat*"
|
||||
],
|
||||
"template": {
|
||||
"mappings": {
|
||||
"dynamic_templates": [
|
||||
{
|
||||
"strings_as_keyword": {
|
||||
"mapping": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"match_mapping_type": "string"
|
||||
}
|
||||
}
|
||||
],
|
||||
"date_detection": false
|
||||
},
|
||||
"settings": {
|
||||
"index": {
|
||||
"mapping": {
|
||||
"total_fields": {
|
||||
"limit": {{ FIELD_LIMIT }}
|
||||
}
|
||||
},
|
||||
{%- if INDEX_SORTING is sameas true %}
|
||||
"index.sort.field": "@timestamp",
|
||||
"index.sort.order": "desc",
|
||||
{%- endif %}
|
||||
"refresh_interval": "{{ REFRESH }}",
|
||||
"number_of_shards": {{ SHARDS }},
|
||||
"number_of_replicas": {{ REPLICAS }}
|
||||
}
|
||||
}
|
||||
},
|
||||
"composed_of": [
|
||||
"agent-mappings",
|
||||
"dtc-agent-mappings",
|
||||
"base-mappings",
|
||||
"dtc-base-mappings",
|
||||
"client-mappings",
|
||||
"cloud-mappings",
|
||||
"container-mappings",
|
||||
"data_stream-mappings",
|
||||
"destination-mappings",
|
||||
"dll-mappings",
|
||||
"dns-mappings",
|
||||
"dtc-dns-mappings",
|
||||
"ecs-mappings",
|
||||
"dtc-ecs-mappings",
|
||||
"error-mappings",
|
||||
"event-mappings",
|
||||
"dtc-event-mappings",
|
||||
"file-mappings",
|
||||
"dtc-file-mappings",
|
||||
"group-mappings",
|
||||
"host-mappings",
|
||||
"dtc-host-mappings",
|
||||
"http-mappings",
|
||||
"dtc-http-mappings",
|
||||
"log-mappings",
|
||||
"network-mappings",
|
||||
"dtc-network-mappings",
|
||||
"observer-mappings",
|
||||
"dtc-observer-mappings",
|
||||
"orchestrator-mappings",
|
||||
"organization-mappings",
|
||||
"package-mappings",
|
||||
"process-mappings",
|
||||
"dtc-process-mappings",
|
||||
"registry-mappings",
|
||||
"related-mappings",
|
||||
"rule-mappings",
|
||||
"dtc-rule-mappings",
|
||||
"server-mappings",
|
||||
"service-mappings",
|
||||
"dtc-service-mappings",
|
||||
"source-mappings",
|
||||
"threat-mappings",
|
||||
"tls-mappings",
|
||||
"tracing-mappings",
|
||||
"url-mappings",
|
||||
"user_agent-mappings",
|
||||
"dtc-user_agent-mappings",
|
||||
"user-mappings",
|
||||
"dtc-user-mappings",
|
||||
"vulnerability-mappings",
|
||||
"common-settings",
|
||||
"common-dynamic-mappings"
|
||||
],
|
||||
"priority": {{ PRIORITY }},
|
||||
"_meta": {
|
||||
"description": "Composable template that includes SO base fields",
|
||||
"ecs_version": "1.12"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,53 +0,0 @@
|
||||
{%- set INDEX_SORTING = salt['pillar.get']('elasticsearch:index_sorting', False) %}
|
||||
{%- set REPLICAS = salt['pillar.get']('elasticsearch:replicas', 0) %}
|
||||
{%- set SHARDS = salt['pillar.get']('elasticsearch:index_settings:so-case:shards', 1) %}
|
||||
{%- set REFRESH = salt['pillar.get']('elasticsearch:index_settings:so-case:refresh', '30s') %}
|
||||
{%- set PRIORITY = salt['pillar.get']('elasticsearch:index_settings:so-case:priority', 500) %}
|
||||
{%- set FIELD_LIMIT = salt['pillar.get']('elasticsearch:index_settings:so-case:field_limit', 2000) %}
|
||||
{
|
||||
"index_patterns": [
|
||||
"so-case*"
|
||||
],
|
||||
"template": {
|
||||
"mappings": {
|
||||
"dynamic_templates": [
|
||||
{
|
||||
"strings_as_keyword": {
|
||||
"mapping": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"match_mapping_type": "string"
|
||||
}
|
||||
}
|
||||
],
|
||||
"date_detection": false
|
||||
},
|
||||
"settings": {
|
||||
"index": {
|
||||
"mapping": {
|
||||
"total_fields": {
|
||||
"limit": {{ FIELD_LIMIT }}
|
||||
}
|
||||
},
|
||||
{%- if INDEX_SORTING is sameas true %}
|
||||
"index.sort.field": "@timestamp",
|
||||
"index.sort.order": "desc",
|
||||
{%- endif %}
|
||||
"refresh_interval": "{{ REFRESH }}",
|
||||
"number_of_shards": {{ SHARDS }},
|
||||
"number_of_replicas": {{ REPLICAS }}
|
||||
}
|
||||
}
|
||||
},
|
||||
"composed_of": [
|
||||
"case-mappings",
|
||||
"case-settings"
|
||||
],
|
||||
"priority": {{ PRIORITY }},
|
||||
"_meta": {
|
||||
"description": "Composable template that includes Cases fields",
|
||||
"ecs_version": "1.12"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,104 +0,0 @@
|
||||
{%- set INDEX_SORTING = salt['pillar.get']('elasticsearch:index_sorting', False) %}
|
||||
{%- set REPLICAS = salt['pillar.get']('elasticsearch:replicas', 0) %}
|
||||
{%- set SHARDS = salt['pillar.get']('elasticsearch:index_settings:so-cef:shards', 1) %}
|
||||
{%- set REFRESH = salt['pillar.get']('elasticsearch:index_settings:so-cef:refresh', '30s') %}
|
||||
{%- set PRIORITY = salt['pillar.get']('elasticsearch:index_settings:so-cef:priority', 500) %}
|
||||
{%- set FIELD_LIMIT = salt['pillar.get']('elasticsearch:index_settings:so-cef:field_limit', 3000) %}
|
||||
{
|
||||
"index_patterns": [
|
||||
"so-cef*"
|
||||
],
|
||||
"template": {
|
||||
"mappings": {
|
||||
"dynamic_templates": [
|
||||
{
|
||||
"strings_as_keyword": {
|
||||
"mapping": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"match_mapping_type": "string"
|
||||
}
|
||||
}
|
||||
],
|
||||
"date_detection": false
|
||||
},
|
||||
"settings": {
|
||||
"index": {
|
||||
"mapping": {
|
||||
"total_fields": {
|
||||
"limit": {{ FIELD_LIMIT }}
|
||||
}
|
||||
},
|
||||
{%- if INDEX_SORTING is sameas true %}
|
||||
"index.sort.field": "@timestamp",
|
||||
"index.sort.order": "desc",
|
||||
{%- endif %}
|
||||
"refresh_interval": "{{ REFRESH }}",
|
||||
"number_of_shards": {{ SHARDS }},
|
||||
"number_of_replicas": {{ REPLICAS }}
|
||||
}
|
||||
}
|
||||
},
|
||||
"composed_of": [
|
||||
"agent-mappings",
|
||||
"dtc-agent-mappings",
|
||||
"base-mappings",
|
||||
"dtc-base-mappings",
|
||||
"client-mappings",
|
||||
"cloud-mappings",
|
||||
"container-mappings",
|
||||
"data_stream-mappings",
|
||||
"destination-mappings",
|
||||
"dll-mappings",
|
||||
"dns-mappings",
|
||||
"dtc-dns-mappings",
|
||||
"ecs-mappings",
|
||||
"dtc-ecs-mappings",
|
||||
"error-mappings",
|
||||
"event-mappings",
|
||||
"dtc-event-mappings",
|
||||
"file-mappings",
|
||||
"dtc-file-mappings",
|
||||
"group-mappings",
|
||||
"host-mappings",
|
||||
"dtc-host-mappings",
|
||||
"http-mappings",
|
||||
"dtc-http-mappings",
|
||||
"log-mappings",
|
||||
"network-mappings",
|
||||
"dtc-network-mappings",
|
||||
"observer-mappings",
|
||||
"dtc-observer-mappings",
|
||||
"orchestrator-mappings",
|
||||
"organization-mappings",
|
||||
"package-mappings",
|
||||
"process-mappings",
|
||||
"dtc-process-mappings",
|
||||
"registry-mappings",
|
||||
"related-mappings",
|
||||
"rule-mappings",
|
||||
"dtc-rule-mappings",
|
||||
"server-mappings",
|
||||
"service-mappings",
|
||||
"dtc-service-mappings",
|
||||
"source-mappings",
|
||||
"threat-mappings",
|
||||
"tls-mappings",
|
||||
"tracing-mappings",
|
||||
"url-mappings",
|
||||
"user_agent-mappings",
|
||||
"dtc-user_agent-mappings",
|
||||
"user-mappings",
|
||||
"dtc-user-mappings",
|
||||
"vulnerability-mappings",
|
||||
"common-settings",
|
||||
"common-dynamic-mappings"
|
||||
],
|
||||
"priority": {{ PRIORITY }},
|
||||
"_meta": {
|
||||
"description": "Composable template that includes SO base fields",
|
||||
"ecs_version": "1.12"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,104 +0,0 @@
|
||||
{%- set INDEX_SORTING = salt['pillar.get']('elasticsearch:index_sorting', False) %}
|
||||
{%- set REPLICAS = salt['pillar.get']('elasticsearch:replicas', 0) %}
|
||||
{%- set SHARDS = salt['pillar.get']('elasticsearch:index_settings:so-checkpoint:shards', 1) %}
|
||||
{%- set REFRESH = salt['pillar.get']('elasticsearch:index_settings:so-checkpoint:refresh', '30s') %}
|
||||
{%- set PRIORITY = salt['pillar.get']('elasticsearch:index_settings:so-checkpoint:priority', 500) %}
|
||||
{%- set FIELD_LIMIT = salt['pillar.get']('elasticsearch:index_settings:so-checkpoint:field_limit', 3000) %}
|
||||
{
|
||||
"index_patterns": [
|
||||
"so-checkpoint*"
|
||||
],
|
||||
"template": {
|
||||
"mappings": {
|
||||
"dynamic_templates": [
|
||||
{
|
||||
"strings_as_keyword": {
|
||||
"mapping": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"match_mapping_type": "string"
|
||||
}
|
||||
}
|
||||
],
|
||||
"date_detection": false
|
||||
},
|
||||
"settings": {
|
||||
"index": {
|
||||
"mapping": {
|
||||
"total_fields": {
|
||||
"limit": {{ FIELD_LIMIT }}
|
||||
}
|
||||
},
|
||||
{%- if INDEX_SORTING is sameas true %}
|
||||
"index.sort.field": "@timestamp",
|
||||
"index.sort.order": "desc",
|
||||
{%- endif %}
|
||||
"refresh_interval": "{{ REFRESH }}",
|
||||
"number_of_shards": {{ SHARDS }},
|
||||
"number_of_replicas": {{ REPLICAS }}
|
||||
}
|
||||
}
|
||||
},
|
||||
"composed_of": [
|
||||
"agent-mappings",
|
||||
"dtc-agent-mappings",
|
||||
"base-mappings",
|
||||
"dtc-base-mappings",
|
||||
"client-mappings",
|
||||
"cloud-mappings",
|
||||
"container-mappings",
|
||||
"data_stream-mappings",
|
||||
"destination-mappings",
|
||||
"dll-mappings",
|
||||
"dns-mappings",
|
||||
"dtc-dns-mappings",
|
||||
"ecs-mappings",
|
||||
"dtc-ecs-mappings",
|
||||
"error-mappings",
|
||||
"event-mappings",
|
||||
"dtc-event-mappings",
|
||||
"file-mappings",
|
||||
"dtc-file-mappings",
|
||||
"group-mappings",
|
||||
"host-mappings",
|
||||
"dtc-host-mappings",
|
||||
"http-mappings",
|
||||
"dtc-http-mappings",
|
||||
"log-mappings",
|
||||
"network-mappings",
|
||||
"dtc-network-mappings",
|
||||
"observer-mappings",
|
||||
"dtc-observer-mappings",
|
||||
"orchestrator-mappings",
|
||||
"organization-mappings",
|
||||
"package-mappings",
|
||||
"process-mappings",
|
||||
"dtc-process-mappings",
|
||||
"registry-mappings",
|
||||
"related-mappings",
|
||||
"rule-mappings",
|
||||
"dtc-rule-mappings",
|
||||
"server-mappings",
|
||||
"service-mappings",
|
||||
"dtc-service-mappings",
|
||||
"source-mappings",
|
||||
"threat-mappings",
|
||||
"tls-mappings",
|
||||
"tracing-mappings",
|
||||
"url-mappings",
|
||||
"user_agent-mappings",
|
||||
"dtc-user_agent-mappings",
|
||||
"user-mappings",
|
||||
"dtc-user-mappings",
|
||||
"vulnerability-mappings",
|
||||
"common-settings",
|
||||
"common-dynamic-mappings"
|
||||
],
|
||||
"priority": {{ PRIORITY }},
|
||||
"_meta": {
|
||||
"description": "Composable template that includes SO base fields",
|
||||
"ecs_version": "1.12"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,105 +0,0 @@
|
||||
{%- set INDEX_SORTING = salt['pillar.get']('elasticsearch:index_sorting', False) %}
|
||||
{%- set REPLICAS = salt['pillar.get']('elasticsearch:replicas', 0) %}
|
||||
{%- set SHARDS = salt['pillar.get']('elasticsearch:index_settings:so-cisco:shards', 1) %}
|
||||
{%- set REFRESH = salt['pillar.get']('elasticsearch:index_settings:so-cisco:refresh', '30s') %}
|
||||
{%- set PRIORITY = salt['pillar.get']('elasticsearch:index_settings:so-cisco:priority', 500) %}
|
||||
{%- set FIELD_LIMIT = salt['pillar.get']('elasticsearch:index_settings:so-cisco:field_limit', 3000) %}
|
||||
{
|
||||
"index_templates": [
|
||||
{
|
||||
"so-cisco*"
|
||||
],
|
||||
"template": {
|
||||
"mappings": {
|
||||
"dynamic_templates": [
|
||||
{
|
||||
"strings_as_keyword": {
|
||||
"mapping": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"match_mapping_type": "string"
|
||||
}
|
||||
}
|
||||
],
|
||||
"date_detection": false
|
||||
},
|
||||
"settings": {
|
||||
"index": {
|
||||
"mapping": {
|
||||
"total_fields": {
|
||||
"limit": {{ FIELD_LIMIT }}
|
||||
}
|
||||
},
|
||||
{%- if INDEX_SORTING is sameas true %}
|
||||
"index.sort.field": "@timestamp",
|
||||
"index.sort.order": "desc",
|
||||
{%- endif %}
|
||||
"refresh_interval": "{{ REFRESH }}",
|
||||
"number_of_shards": {{ SHARDS }},
|
||||
"number_of_replicas": {{ REPLICAS }}
|
||||
}
|
||||
}
|
||||
},
|
||||
"composed_of": [
|
||||
"agent-mappings",
|
||||
"dtc-agent-mappings",
|
||||
"base-mappings",
|
||||
"dtc-base-mappings",
|
||||
"client-mappings",
|
||||
"cloud-mappings",
|
||||
"container-mappings",
|
||||
"data_stream-mappings",
|
||||
"destination-mappings",
|
||||
"dll-mappings",
|
||||
"dns-mappings",
|
||||
"dtc-dns-mappings",
|
||||
"ecs-mappings",
|
||||
"dtc-ecs-mappings",
|
||||
"error-mappings",
|
||||
"event-mappings",
|
||||
"dtc-event-mappings",
|
||||
"file-mappings",
|
||||
"dtc-file-mappings",
|
||||
"group-mappings",
|
||||
"host-mappings",
|
||||
"dtc-host-mappings",
|
||||
"http-mappings",
|
||||
"dtc-http-mappings",
|
||||
"log-mappings",
|
||||
"network-mappings",
|
||||
"dtc-network-mappings",
|
||||
"observer-mappings",
|
||||
"dtc-observer-mappings",
|
||||
"orchestrator-mappings",
|
||||
"organization-mappings",
|
||||
"package-mappings",
|
||||
"process-mappings",
|
||||
"dtc-process-mappings",
|
||||
"registry-mappings",
|
||||
"related-mappings",
|
||||
"rule-mappings",
|
||||
"dtc-rule-mappings",
|
||||
"server-mappings",
|
||||
"service-mappings",
|
||||
"dtc-service-mappings",
|
||||
"source-mappings",
|
||||
"threat-mappings",
|
||||
"tls-mappings",
|
||||
"tracing-mappings",
|
||||
"url-mappings",
|
||||
"user_agent-mappings",
|
||||
"dtc-user_agent-mappings",
|
||||
"user-mappings",
|
||||
"dtc-user-mappings",
|
||||
"vulnerability-mappings",
|
||||
"common-settings",
|
||||
"common-dynamic-mappings"
|
||||
],
|
||||
"priority": {{ PRIORITY }},
|
||||
"_meta": {
|
||||
"description": "Composable template that includes SO base fields",
|
||||
"ecs_version": "1.12"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,105 +0,0 @@
|
||||
{%- set INDEX_SORTING = salt['pillar.get']('elasticsearch:index_sorting', False) %}
|
||||
{%- set REPLICAS = salt['pillar.get']('elasticsearch:replicas', 0) %}
|
||||
{%- set SHARDS = salt['pillar.get']('elasticsearch:index_settings:so-common:shards', 1) %}
|
||||
{%- set REFRESH = salt['pillar.get']('elasticsearch:index_settings:so-common:refresh', '30s') %}
|
||||
{%- set PRIORITY = salt['pillar.get']('elasticsearch:index_settings:so-common:priority', 1) %}
|
||||
{%- set FIELD_LIMIT = salt['pillar.get']('elasticsearch:index_settings:so-common:field_limit', 3000) %}
|
||||
{
|
||||
"index_patterns": [
|
||||
"so-*"
|
||||
],
|
||||
"template": {
|
||||
"mappings": {
|
||||
"dynamic_templates": [
|
||||
{
|
||||
"strings_as_keyword": {
|
||||
"mapping": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"match_mapping_type": "string"
|
||||
}
|
||||
}
|
||||
],
|
||||
"date_detection": false
|
||||
},
|
||||
"settings": {
|
||||
"index": {
|
||||
"mapping": {
|
||||
"total_fields": {
|
||||
"limit": {{ FIELD_LIMIT }}
|
||||
}
|
||||
},
|
||||
{%- if INDEX_SORTING is sameas true %}
|
||||
"sort.field": "@timestamp",
|
||||
"sort.order": "desc",
|
||||
{%- endif %}
|
||||
"refresh_interval": "{{ REFRESH }}",
|
||||
"number_of_shards": {{ SHARDS }},
|
||||
"number_of_replicas": {{ REPLICAS }}
|
||||
}
|
||||
}
|
||||
},
|
||||
"composed_of": [
|
||||
"agent-mappings",
|
||||
"dtc-agent-mappings",
|
||||
"base-mappings",
|
||||
"dtc-base-mappings",
|
||||
"client-mappings",
|
||||
"cloud-mappings",
|
||||
"container-mappings",
|
||||
"data_stream-mappings",
|
||||
"destination-mappings",
|
||||
"dll-mappings",
|
||||
"dns-mappings",
|
||||
"dtc-dns-mappings",
|
||||
"ecs-mappings",
|
||||
"dtc-ecs-mappings",
|
||||
"error-mappings",
|
||||
"event-mappings",
|
||||
"dtc-event-mappings",
|
||||
"file-mappings",
|
||||
"dtc-file-mappings",
|
||||
"so-file-mappings",
|
||||
"group-mappings",
|
||||
"host-mappings",
|
||||
"dtc-host-mappings",
|
||||
"http-mappings",
|
||||
"dtc-http-mappings",
|
||||
"log-mappings",
|
||||
"network-mappings",
|
||||
"dtc-network-mappings",
|
||||
"observer-mappings",
|
||||
"dtc-observer-mappings",
|
||||
"orchestrator-mappings",
|
||||
"organization-mappings",
|
||||
"package-mappings",
|
||||
"process-mappings",
|
||||
"dtc-process-mappings",
|
||||
"registry-mappings",
|
||||
"related-mappings",
|
||||
"rule-mappings",
|
||||
"dtc-rule-mappings",
|
||||
"server-mappings",
|
||||
"service-mappings",
|
||||
"dtc-service-mappings",
|
||||
"source-mappings",
|
||||
"threat-mappings",
|
||||
"tls-mappings",
|
||||
"tracing-mappings",
|
||||
"url-mappings",
|
||||
"user_agent-mappings",
|
||||
"dtc-user_agent-mappings",
|
||||
"user-mappings",
|
||||
"dtc-user-mappings",
|
||||
"vulnerability-mappings",
|
||||
"common-settings",
|
||||
"common-dynamic-mappings"
|
||||
],
|
||||
"priority": {{ PRIORITY }},
|
||||
"_meta": {
|
||||
"description": "Composable template that includes SO base fields",
|
||||
"ecs_version": "1.12"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,104 +0,0 @@
|
||||
{%- set INDEX_SORTING = salt['pillar.get']('elasticsearch:index_sorting', False) %}
|
||||
{%- set REPLICAS = salt['pillar.get']('elasticsearch:replicas', 0) %}
|
||||
{%- set SHARDS = salt['pillar.get']('elasticsearch:index_settings:so-cyberark:shards', 1) %}
|
||||
{%- set REFRESH = salt['pillar.get']('elasticsearch:index_settings:so-cyberark:refresh', '30s') %}
|
||||
{%- set PRIORITY = salt['pillar.get']('elasticsearch:index_settings:so-cyberark:priority', 500) %}
|
||||
{%- set FIELD_LIMIT = salt['pillar.get']('elasticsearch:index_settings:so-cyberark:field_limit', 3000) %}
|
||||
{
|
||||
"index_patterns": [
|
||||
"so-cyberark*"
|
||||
],
|
||||
"template": {
|
||||
"mappings": {
|
||||
"dynamic_templates": [
|
||||
{
|
||||
"strings_as_keyword": {
|
||||
"mapping": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"match_mapping_type": "string"
|
||||
}
|
||||
}
|
||||
],
|
||||
"date_detection": false
|
||||
},
|
||||
"settings": {
|
||||
"index": {
|
||||
"mapping": {
|
||||
"total_fields": {
|
||||
"limit": {{ FIELD_LIMIT }}
|
||||
}
|
||||
},
|
||||
{%- if INDEX_SORTING is sameas true %}
|
||||
"index.sort.field": "@timestamp",
|
||||
"index.sort.order": "desc",
|
||||
{%- endif %}
|
||||
"refresh_interval": "{{ REFRESH }}",
|
||||
"number_of_shards": {{ SHARDS }},
|
||||
"number_of_replicas": {{ REPLICAS }}
|
||||
}
|
||||
}
|
||||
},
|
||||
"composed_of": [
|
||||
"agent-mappings",
|
||||
"dtc-agent-mappings",
|
||||
"base-mappings",
|
||||
"dtc-base-mappings",
|
||||
"client-mappings",
|
||||
"cloud-mappings",
|
||||
"container-mappings",
|
||||
"data_stream-mappings",
|
||||
"destination-mappings",
|
||||
"dll-mappings",
|
||||
"dns-mappings",
|
||||
"dtc-dns-mappings",
|
||||
"ecs-mappings",
|
||||
"dtc-ecs-mappings",
|
||||
"error-mappings",
|
||||
"event-mappings",
|
||||
"dtc-event-mappings",
|
||||
"file-mappings",
|
||||
"dtc-file-mappings",
|
||||
"group-mappings",
|
||||
"host-mappings",
|
||||
"dtc-host-mappings",
|
||||
"http-mappings",
|
||||
"dtc-http-mappings",
|
||||
"log-mappings",
|
||||
"network-mappings",
|
||||
"dtc-network-mappings",
|
||||
"observer-mappings",
|
||||
"dtc-observer-mappings",
|
||||
"orchestrator-mappings",
|
||||
"organization-mappings",
|
||||
"package-mappings",
|
||||
"process-mappings",
|
||||
"dtc-process-mappings",
|
||||
"registry-mappings",
|
||||
"related-mappings",
|
||||
"rule-mappings",
|
||||
"dtc-rule-mappings",
|
||||
"server-mappings",
|
||||
"service-mappings",
|
||||
"dtc-service-mappings",
|
||||
"source-mappings",
|
||||
"threat-mappings",
|
||||
"tls-mappings",
|
||||
"tracing-mappings",
|
||||
"url-mappings",
|
||||
"user_agent-mappings",
|
||||
"dtc-user_agent-mappings",
|
||||
"user-mappings",
|
||||
"dtc-user-mappings",
|
||||
"vulnerability-mappings",
|
||||
"common-settings",
|
||||
"common-dynamic-mappings"
|
||||
],
|
||||
"priority": {{ PRIORITY }},
|
||||
"_meta": {
|
||||
"description": "Composable template that includes SO base fields",
|
||||
"ecs_version": "1.12"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,104 +0,0 @@
|
||||
{%- set INDEX_SORTING = salt['pillar.get']('elasticsearch:index_sorting', False) %}
|
||||
{%- set REPLICAS = salt['pillar.get']('elasticsearch:replicas', 0) %}
|
||||
{%- set SHARDS = salt['pillar.get']('elasticsearch:index_settings:so-cylance:shards', 1) %}
|
||||
{%- set REFRESH = salt['pillar.get']('elasticsearch:index_settings:so-cylance:refresh', '30s') %}
|
||||
{%- set PRIORITY = salt['pillar.get']('elasticsearch:index_settings:so-cylance:priority', 500) %}
|
||||
{%- set FIELD_LIMIT = salt['pillar.get']('elasticsearch:index_settings:so-cylance:field_limit', 3000) %}
|
||||
{
|
||||
"index_patterns": [
|
||||
"so-cylance*"
|
||||
],
|
||||
"template": {
|
||||
"mappings": {
|
||||
"dynamic_templates": [
|
||||
{
|
||||
"strings_as_keyword": {
|
||||
"mapping": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"match_mapping_type": "string"
|
||||
}
|
||||
}
|
||||
],
|
||||
"date_detection": false
|
||||
},
|
||||
"settings": {
|
||||
"index": {
|
||||
"mapping": {
|
||||
"total_fields": {
|
||||
"limit": {{ FIELD_LIMIT }}
|
||||
}
|
||||
},
|
||||
{%- if INDEX_SORTING is sameas true %}
|
||||
"index.sort.field": "@timestamp",
|
||||
"index.sort.order": "desc",
|
||||
{%- endif %}
|
||||
"refresh_interval": "{{ REFRESH }}",
|
||||
"number_of_shards": {{ SHARDS }},
|
||||
"number_of_replicas": {{ REPLICAS }}
|
||||
}
|
||||
}
|
||||
},
|
||||
"composed_of": [
|
||||
"agent-mappings",
|
||||
"dtc-agent-mappings",
|
||||
"base-mappings",
|
||||
"dtc-base-mappings",
|
||||
"client-mappings",
|
||||
"cloud-mappings",
|
||||
"container-mappings",
|
||||
"data_stream-mappings",
|
||||
"destination-mappings",
|
||||
"dll-mappings",
|
||||
"dns-mappings",
|
||||
"dtc-dns-mappings",
|
||||
"ecs-mappings",
|
||||
"dtc-ecs-mappings",
|
||||
"error-mappings",
|
||||
"event-mappings",
|
||||
"dtc-event-mappings",
|
||||
"file-mappings",
|
||||
"dtc-file-mappings",
|
||||
"group-mappings",
|
||||
"host-mappings",
|
||||
"dtc-host-mappings",
|
||||
"http-mappings",
|
||||
"dtc-http-mappings",
|
||||
"log-mappings",
|
||||
"network-mappings",
|
||||
"dtc-network-mappings",
|
||||
"observer-mappings",
|
||||
"dtc-observer-mappings",
|
||||
"orchestrator-mappings",
|
||||
"organization-mappings",
|
||||
"package-mappings",
|
||||
"process-mappings",
|
||||
"dtc-process-mappings",
|
||||
"registry-mappings",
|
||||
"related-mappings",
|
||||
"rule-mappings",
|
||||
"dtc-rule-mappings",
|
||||
"server-mappings",
|
||||
"service-mappings",
|
||||
"dtc-service-mappings",
|
||||
"source-mappings",
|
||||
"threat-mappings",
|
||||
"tls-mappings",
|
||||
"tracing-mappings",
|
||||
"url-mappings",
|
||||
"user_agent-mappings",
|
||||
"dtc-user_agent-mappings",
|
||||
"user-mappings",
|
||||
"dtc-user-mappings",
|
||||
"vulnerability-mappings",
|
||||
"common-settings",
|
||||
"common-dynamic-mappings"
|
||||
],
|
||||
"priority": {{ PRIORITY }},
|
||||
"_meta": {
|
||||
"description": "Composable template that includes SO base fields",
|
||||
"ecs_version": "1.12"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,104 +0,0 @@
|
||||
{%- set INDEX_SORTING = salt['pillar.get']('elasticsearch:index_sorting', False) %}
|
||||
{%- set REPLICAS = salt['pillar.get']('elasticsearch:replicas', 0) %}
|
||||
{%- set SHARDS = salt['pillar.get']('elasticsearch:index_settings:so-elasticsearch:shards', 1) %}
|
||||
{%- set REFRESH = salt['pillar.get']('elasticsearch:index_settings:so-elasticsearch:refresh', '30s') %}
|
||||
{%- set PRIORITY = salt['pillar.get']('elasticsearch:index_settings:so-elasticsearch:priority', 500) %}
|
||||
{%- set FIELD_LIMIT = salt['pillar.get']('elasticsearch:index_settings:so-elasticsearch:field_limit', 3000) %}
|
||||
{
|
||||
"index_patterns": [
|
||||
"so-elasticsearch*"
|
||||
],
|
||||
"template": {
|
||||
"mappings": {
|
||||
"dynamic_templates": [
|
||||
{
|
||||
"strings_as_keyword": {
|
||||
"mapping": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"match_mapping_type": "string"
|
||||
}
|
||||
}
|
||||
],
|
||||
"date_detection": false
|
||||
},
|
||||
"settings": {
|
||||
"index": {
|
||||
"mapping": {
|
||||
"total_fields": {
|
||||
"limit": {{ FIELD_LIMIT }}
|
||||
}
|
||||
},
|
||||
{%- if INDEX_SORTING is sameas true %}
|
||||
"index.sort.field": "@timestamp",
|
||||
"index.sort.order": "desc",
|
||||
{%- endif %}
|
||||
"refresh_interval": "{{ REFRESH }}",
|
||||
"number_of_shards": {{ SHARDS }},
|
||||
"number_of_replicas": {{ REPLICAS }}
|
||||
}
|
||||
}
|
||||
},
|
||||
"composed_of": [
|
||||
"agent-mappings",
|
||||
"dtc-agent-mappings",
|
||||
"base-mappings",
|
||||
"dtc-base-mappings",
|
||||
"client-mappings",
|
||||
"cloud-mappings",
|
||||
"container-mappings",
|
||||
"data_stream-mappings",
|
||||
"destination-mappings",
|
||||
"dll-mappings",
|
||||
"dns-mappings",
|
||||
"dtc-dns-mappings",
|
||||
"ecs-mappings",
|
||||
"dtc-ecs-mappings",
|
||||
"error-mappings",
|
||||
"event-mappings",
|
||||
"dtc-event-mappings",
|
||||
"file-mappings",
|
||||
"dtc-file-mappings",
|
||||
"group-mappings",
|
||||
"host-mappings",
|
||||
"dtc-host-mappings",
|
||||
"http-mappings",
|
||||
"dtc-http-mappings",
|
||||
"log-mappings",
|
||||
"network-mappings",
|
||||
"dtc-network-mappings",
|
||||
"observer-mappings",
|
||||
"dtc-observer-mappings",
|
||||
"orchestrator-mappings",
|
||||
"organization-mappings",
|
||||
"package-mappings",
|
||||
"process-mappings",
|
||||
"dtc-process-mappings",
|
||||
"registry-mappings",
|
||||
"related-mappings",
|
||||
"rule-mappings",
|
||||
"dtc-rule-mappings",
|
||||
"server-mappings",
|
||||
"service-mappings",
|
||||
"dtc-service-mappings",
|
||||
"source-mappings",
|
||||
"threat-mappings",
|
||||
"tls-mappings",
|
||||
"tracing-mappings",
|
||||
"url-mappings",
|
||||
"user_agent-mappings",
|
||||
"dtc-user_agent-mappings",
|
||||
"user-mappings",
|
||||
"dtc-user-mappings",
|
||||
"vulnerability-mappings",
|
||||
"common-settings",
|
||||
"common-dynamic-mappings"
|
||||
],
|
||||
"priority": {{ PRIORITY }},
|
||||
"_meta": {
|
||||
"description": "Composable template that includes SO base fields",
|
||||
"ecs_version": "1.12"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,105 +0,0 @@
|
||||
{%- set INDEX_SORTING = salt['pillar.get']('elasticsearch:index_sorting', False) %}
|
||||
{%- set REPLICAS = salt['pillar.get']('elasticsearch:replicas', 0) %}
|
||||
{%- set SHARDS = salt['pillar.get']('elasticsearch:index_settings:so-endgame:shards', 1) %}
|
||||
{%- set REFRESH = salt['pillar.get']('elasticsearch:index_settings:so-endgame:refresh', '30s') %}
|
||||
{%- set PRIORITY = salt['pillar.get']('elasticsearch:index_settings:so-endgame:priority', 500) %}
|
||||
{%- set FIELD_LIMIT = salt['pillar.get']('elasticsearch:index_settings:so-endgame:field_limit', 3000) %}
|
||||
{
|
||||
"index_patterns": [
|
||||
"endgame*"
|
||||
],
|
||||
"template": {
|
||||
"mappings": {
|
||||
"dynamic_templates": [
|
||||
{
|
||||
"strings_as_keyword": {
|
||||
"mapping": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"match_mapping_type": "string"
|
||||
}
|
||||
}
|
||||
],
|
||||
"date_detection": false
|
||||
},
|
||||
"settings": {
|
||||
"index": {
|
||||
"mapping": {
|
||||
"total_fields": {
|
||||
"limit": {{ FIELD_LIMIT }}
|
||||
}
|
||||
},
|
||||
{%- if INDEX_SORTING is sameas true %}
|
||||
"index.sort.field": "@timestamp",
|
||||
"index.sort.order": "desc",
|
||||
{%- endif %}
|
||||
"refresh_interval": "{{ REFRESH }}",
|
||||
"number_of_shards": {{ SHARDS }},
|
||||
"number_of_replicas": {{ REPLICAS }}
|
||||
}
|
||||
}
|
||||
},
|
||||
"composed_of": [
|
||||
"agent-mappings",
|
||||
"dtc-agent-mappings",
|
||||
"base-mappings",
|
||||
"dtc-base-mappings",
|
||||
"client-mappings",
|
||||
"cloud-mappings",
|
||||
"container-mappings",
|
||||
"data_stream-mappings",
|
||||
"destination-mappings",
|
||||
"dll-mappings",
|
||||
"dns-mappings",
|
||||
"dtc-dns-mappings",
|
||||
"ecs-mappings",
|
||||
"dtc-ecs-mappings",
|
||||
"endgame-mappings",
|
||||
"error-mappings",
|
||||
"event-mappings",
|
||||
"dtc-event-mappings",
|
||||
"file-mappings",
|
||||
"dtc-file-mappings",
|
||||
"group-mappings",
|
||||
"host-mappings",
|
||||
"dtc-host-mappings",
|
||||
"http-mappings",
|
||||
"dtc-http-mappings",
|
||||
"log-mappings",
|
||||
"network-mappings",
|
||||
"dtc-network-mappings",
|
||||
"observer-mappings",
|
||||
"dtc-observer-mappings",
|
||||
"orchestrator-mappings",
|
||||
"organization-mappings",
|
||||
"package-mappings",
|
||||
"process-mappings",
|
||||
"dtc-process-mappings",
|
||||
"registry-mappings",
|
||||
"related-mappings",
|
||||
"rule-mappings",
|
||||
"dtc-rule-mappings",
|
||||
"server-mappings",
|
||||
"service-mappings",
|
||||
"dtc-service-mappings",
|
||||
"source-mappings",
|
||||
"threat-mappings",
|
||||
"tls-mappings",
|
||||
"tracing-mappings",
|
||||
"url-mappings",
|
||||
"user_agent-mappings",
|
||||
"dtc-user_agent-mappings",
|
||||
"user-mappings",
|
||||
"dtc-user-mappings",
|
||||
"vulnerability-mappings",
|
||||
"common-settings",
|
||||
"common-dynamic-mappings"
|
||||
],
|
||||
"priority": {{ PRIORITY }},
|
||||
"_meta": {
|
||||
"description": "Composable template that includes SO base fields",
|
||||
"ecs_version": "1.12"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,104 +0,0 @@
|
||||
{%- set INDEX_SORTING = salt['pillar.get']('elasticsearch:index_sorting', False) %}
|
||||
{%- set REPLICAS = salt['pillar.get']('elasticsearch:replicas', 0) %}
|
||||
{%- set SHARDS = salt['pillar.get']('elasticsearch:index_settings:so-f5:shards', 1) %}
|
||||
{%- set REFRESH = salt['pillar.get']('elasticsearch:index_settings:so-f5:refresh', '30s') %}
|
||||
{%- set PRIORITY = salt['pillar.get']('elasticsearch:index_settings:so-f5:priority', 500) %}
|
||||
{%- set FIELD_LIMIT = salt['pillar.get']('elasticsearch:index_settings:so-f5:field_limit', 3000) %}
|
||||
{
|
||||
"index_patterns": [
|
||||
"so-f5*"
|
||||
],
|
||||
"template": {
|
||||
"mappings": {
|
||||
"dynamic_templates": [
|
||||
{
|
||||
"strings_as_keyword": {
|
||||
"mapping": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"match_mapping_type": "string"
|
||||
}
|
||||
}
|
||||
],
|
||||
"date_detection": false
|
||||
},
|
||||
"settings": {
|
||||
"index": {
|
||||
"mapping": {
|
||||
"total_fields": {
|
||||
"limit": {{ FIELD_LIMIT }}
|
||||
}
|
||||
},
|
||||
{%- if INDEX_SORTING is sameas true %}
|
||||
"index.sort.field": "@timestamp",
|
||||
"index.sort.order": "desc",
|
||||
{%- endif %}
|
||||
"refresh_interval": "{{ REFRESH }}",
|
||||
"number_of_shards": {{ SHARDS }},
|
||||
"number_of_replicas": {{ REPLICAS }}
|
||||
}
|
||||
}
|
||||
},
|
||||
"composed_of": [
|
||||
"agent-mappings",
|
||||
"dtc-agent-mappings",
|
||||
"base-mappings",
|
||||
"dtc-base-mappings",
|
||||
"client-mappings",
|
||||
"cloud-mappings",
|
||||
"container-mappings",
|
||||
"data_stream-mappings",
|
||||
"destination-mappings",
|
||||
"dll-mappings",
|
||||
"dns-mappings",
|
||||
"dtc-dns-mappings",
|
||||
"ecs-mappings",
|
||||
"dtc-ecs-mappings",
|
||||
"error-mappings",
|
||||
"event-mappings",
|
||||
"dtc-event-mappings",
|
||||
"file-mappings",
|
||||
"dtc-file-mappings",
|
||||
"group-mappings",
|
||||
"host-mappings",
|
||||
"dtc-host-mappings",
|
||||
"http-mappings",
|
||||
"dtc-http-mappings",
|
||||
"log-mappings",
|
||||
"network-mappings",
|
||||
"dtc-network-mappings",
|
||||
"observer-mappings",
|
||||
"dtc-observer-mappings",
|
||||
"orchestrator-mappings",
|
||||
"organization-mappings",
|
||||
"package-mappings",
|
||||
"process-mappings",
|
||||
"dtc-process-mappings",
|
||||
"registry-mappings",
|
||||
"related-mappings",
|
||||
"rule-mappings",
|
||||
"dtc-rule-mappings",
|
||||
"server-mappings",
|
||||
"service-mappings",
|
||||
"dtc-service-mappings",
|
||||
"source-mappings",
|
||||
"threat-mappings",
|
||||
"tls-mappings",
|
||||
"tracing-mappings",
|
||||
"url-mappings",
|
||||
"user_agent-mappings",
|
||||
"dtc-user_agent-mappings",
|
||||
"user-mappings",
|
||||
"dtc-user-mappings",
|
||||
"vulnerability-mappings",
|
||||
"common-settings",
|
||||
"common-dynamic-mappings"
|
||||
],
|
||||
"priority": {{ PRIORITY }},
|
||||
"_meta": {
|
||||
"description": "Composable template that includes SO base fields",
|
||||
"ecs_version": "1.12"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,104 +0,0 @@
|
||||
{%- set INDEX_SORTING = salt['pillar.get']('elasticsearch:index_sorting', False) %}
|
||||
{%- set REPLICAS = salt['pillar.get']('elasticsearch:replicas', 0) %}
|
||||
{%- set SHARDS = salt['pillar.get']('elasticsearch:index_settings:so-firewall:shards', 1) %}
|
||||
{%- set REFRESH = salt['pillar.get']('elasticsearch:index_settings:so-firewall:refresh', '30s') %}
|
||||
{%- set PRIORITY = salt['pillar.get']('elasticsearch:index_settings:so-firewall:priority', 500) %}
|
||||
{%- set FIELD_LIMIT = salt['pillar.get']('elasticsearch:index_settings:so-firewall:field_limit', 3000) %}
|
||||
{
|
||||
"index_patterns": [
|
||||
"so-firewall*"
|
||||
],
|
||||
"template": {
|
||||
"mappings": {
|
||||
"dynamic_templates": [
|
||||
{
|
||||
"strings_as_keyword": {
|
||||
"mapping": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"match_mapping_type": "string"
|
||||
}
|
||||
}
|
||||
],
|
||||
"date_detection": false
|
||||
},
|
||||
"settings": {
|
||||
"index": {
|
||||
"mapping": {
|
||||
"total_fields": {
|
||||
"limit": {{ FIELD_LIMIT }}
|
||||
}
|
||||
},
|
||||
{%- if INDEX_SORTING is sameas true %}
|
||||
"index.sort.field": "@timestamp",
|
||||
"index.sort.order": "desc",
|
||||
{%- endif %}
|
||||
"refresh_interval": "{{ REFRESH }}",
|
||||
"number_of_shards": {{ SHARDS }},
|
||||
"number_of_replicas": {{ REPLICAS }}
|
||||
}
|
||||
}
|
||||
},
|
||||
"composed_of": [
|
||||
"agent-mappings",
|
||||
"dtc-agent-mappings",
|
||||
"base-mappings",
|
||||
"dtc-base-mappings",
|
||||
"client-mappings",
|
||||
"cloud-mappings",
|
||||
"container-mappings",
|
||||
"data_stream-mappings",
|
||||
"destination-mappings",
|
||||
"dll-mappings",
|
||||
"dns-mappings",
|
||||
"dtc-dns-mappings",
|
||||
"ecs-mappings",
|
||||
"dtc-ecs-mappings",
|
||||
"error-mappings",
|
||||
"event-mappings",
|
||||
"dtc-event-mappings",
|
||||
"file-mappings",
|
||||
"dtc-file-mappings",
|
||||
"group-mappings",
|
||||
"host-mappings",
|
||||
"dtc-host-mappings",
|
||||
"http-mappings",
|
||||
"dtc-http-mappings",
|
||||
"log-mappings",
|
||||
"network-mappings",
|
||||
"dtc-network-mappings",
|
||||
"observer-mappings",
|
||||
"dtc-observer-mappings",
|
||||
"orchestrator-mappings",
|
||||
"organization-mappings",
|
||||
"package-mappings",
|
||||
"process-mappings",
|
||||
"dtc-process-mappings",
|
||||
"registry-mappings",
|
||||
"related-mappings",
|
||||
"rule-mappings",
|
||||
"dtc-rule-mappings",
|
||||
"server-mappings",
|
||||
"service-mappings",
|
||||
"dtc-service-mappings",
|
||||
"source-mappings",
|
||||
"threat-mappings",
|
||||
"tls-mappings",
|
||||
"tracing-mappings",
|
||||
"url-mappings",
|
||||
"user_agent-mappings",
|
||||
"dtc-user_agent-mappings",
|
||||
"user-mappings",
|
||||
"dtc-user-mappings",
|
||||
"vulnerability-mappings",
|
||||
"common-settings",
|
||||
"common-dynamic-mappings"
|
||||
],
|
||||
"priority": {{ PRIORITY }},
|
||||
"_meta": {
|
||||
"description": "Composable template that includes SO base fields",
|
||||
"ecs_version": "1.12"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,104 +0,0 @@
|
||||
{%- set INDEX_SORTING = salt['pillar.get']('elasticsearch:index_sorting', False) %}
|
||||
{%- set REPLICAS = salt['pillar.get']('elasticsearch:replicas', 0) %}
|
||||
{%- set SHARDS = salt['pillar.get']('elasticsearch:index_settings:so-flow:shards', 1) %}
|
||||
{%- set REFRESH = salt['pillar.get']('elasticsearch:index_settings:so-flow:refresh', '30s') %}
|
||||
{%- set PRIORITY = salt['pillar.get']('elasticsearch:index_settings:so-flow:priority', 500) %}
|
||||
{%- set FIELD_LIMIT = salt['pillar.get']('elasticsearch:index_settings:so-flow:field_limit', 3000) %}
|
||||
{
|
||||
"index_patterns": [
|
||||
"so-flow*"
|
||||
],
|
||||
"template": {
|
||||
"mappings": {
|
||||
"dynamic_templates": [
|
||||
{
|
||||
"strings_as_keyword": {
|
||||
"mapping": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"match_mapping_type": "string"
|
||||
}
|
||||
}
|
||||
],
|
||||
"date_detection": false
|
||||
},
|
||||
"settings": {
|
||||
"index": {
|
||||
"mapping": {
|
||||
"total_fields": {
|
||||
"limit": {{ FIELD_LIMIT }}
|
||||
}
|
||||
},
|
||||
{%- if INDEX_SORTING is sameas true %}
|
||||
"index.sort.field": "@timestamp",
|
||||
"index.sort.order": "desc",
|
||||
{%- endif %}
|
||||
"refresh_interval": "{{ REFRESH }}",
|
||||
"number_of_shards": {{ SHARDS }},
|
||||
"number_of_replicas": {{ REPLICAS }}
|
||||
}
|
||||
}
|
||||
},
|
||||
"composed_of": [
|
||||
"agent-mappings",
|
||||
"dtc-agent-mappings",
|
||||
"base-mappings",
|
||||
"dtc-base-mappings",
|
||||
"client-mappings",
|
||||
"cloud-mappings",
|
||||
"container-mappings",
|
||||
"data_stream-mappings",
|
||||
"destination-mappings",
|
||||
"dll-mappings",
|
||||
"dns-mappings",
|
||||
"dtc-dns-mappings",
|
||||
"ecs-mappings",
|
||||
"dtc-ecs-mappings",
|
||||
"error-mappings",
|
||||
"event-mappings",
|
||||
"dtc-event-mappings",
|
||||
"file-mappings",
|
||||
"dtc-file-mappings",
|
||||
"group-mappings",
|
||||
"host-mappings",
|
||||
"dtc-host-mappings",
|
||||
"http-mappings",
|
||||
"dtc-http-mappings",
|
||||
"log-mappings",
|
||||
"network-mappings",
|
||||
"dtc-network-mappings",
|
||||
"observer-mappings",
|
||||
"dtc-observer-mappings",
|
||||
"orchestrator-mappings",
|
||||
"organization-mappings",
|
||||
"package-mappings",
|
||||
"process-mappings",
|
||||
"dtc-process-mappings",
|
||||
"registry-mappings",
|
||||
"related-mappings",
|
||||
"rule-mappings",
|
||||
"dtc-rule-mappings",
|
||||
"server-mappings",
|
||||
"service-mappings",
|
||||
"dtc-service-mappings",
|
||||
"source-mappings",
|
||||
"threat-mappings",
|
||||
"tls-mappings",
|
||||
"tracing-mappings",
|
||||
"url-mappings",
|
||||
"user_agent-mappings",
|
||||
"dtc-user_agent-mappings",
|
||||
"user-mappings",
|
||||
"dtc-user-mappings",
|
||||
"vulnerability-mappings",
|
||||
"common-settings",
|
||||
"common-dynamic-mappings"
|
||||
],
|
||||
"priority": {{ PRIORITY }},
|
||||
"_meta": {
|
||||
"description": "Composable template that includes SO base fields",
|
||||
"ecs_version": "1.12"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,104 +0,0 @@
|
||||
{%- set INDEX_SORTING = salt['pillar.get']('elasticsearch:index_sorting', False) %}
|
||||
{%- set REPLICAS = salt['pillar.get']('elasticsearch:replicas', 0) %}
|
||||
{%- set SHARDS = salt['pillar.get']('elasticsearch:index_settings:so-fortinet:shards', 1) %}
|
||||
{%- set REFRESH = salt['pillar.get']('elasticsearch:index_settings:so-fortinet:refresh', '30s') %}
|
||||
{%- set PRIORITY = salt['pillar.get']('elasticsearch:index_settings:so-fortinet:priority', 500) %}
|
||||
{%- set FIELD_LIMIT = salt['pillar.get']('elasticsearch:index_settings:so-fortinet:field_limit', 3000) %}
|
||||
{
|
||||
"index_patterns": [
|
||||
"so-fortinet*"
|
||||
],
|
||||
"template": {
|
||||
"mappings": {
|
||||
"dynamic_templates": [
|
||||
{
|
||||
"strings_as_keyword": {
|
||||
"mapping": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"match_mapping_type": "string"
|
||||
}
|
||||
}
|
||||
],
|
||||
"date_detection": false
|
||||
},
|
||||
"settings": {
|
||||
"index": {
|
||||
"mapping": {
|
||||
"total_fields": {
|
||||
"limit": {{ FIELD_LIMIT }}
|
||||
}
|
||||
},
|
||||
{%- if INDEX_SORTING is sameas true %}
|
||||
"index.sort.field": "@timestamp",
|
||||
"index.sort.order": "desc",
|
||||
{%- endif %}
|
||||
"refresh_interval": "{{ REFRESH }}",
|
||||
"number_of_shards": {{ SHARDS }},
|
||||
"number_of_replicas": {{ REPLICAS }}
|
||||
}
|
||||
}
|
||||
},
|
||||
"composed_of": [
|
||||
"agent-mappings",
|
||||
"dtc-agent-mappings",
|
||||
"base-mappings",
|
||||
"dtc-base-mappings",
|
||||
"client-mappings",
|
||||
"cloud-mappings",
|
||||
"container-mappings",
|
||||
"data_stream-mappings",
|
||||
"destination-mappings",
|
||||
"dll-mappings",
|
||||
"dns-mappings",
|
||||
"dtc-dns-mappings",
|
||||
"ecs-mappings",
|
||||
"dtc-ecs-mappings",
|
||||
"error-mappings",
|
||||
"event-mappings",
|
||||
"dtc-event-mappings",
|
||||
"file-mappings",
|
||||
"dtc-file-mappings",
|
||||
"group-mappings",
|
||||
"host-mappings",
|
||||
"dtc-host-mappings",
|
||||
"http-mappings",
|
||||
"dtc-http-mappings",
|
||||
"log-mappings",
|
||||
"network-mappings",
|
||||
"dtc-network-mappings",
|
||||
"observer-mappings",
|
||||
"dtc-observer-mappings",
|
||||
"orchestrator-mappings",
|
||||
"organization-mappings",
|
||||
"package-mappings",
|
||||
"process-mappings",
|
||||
"dtc-process-mappings",
|
||||
"registry-mappings",
|
||||
"related-mappings",
|
||||
"rule-mappings",
|
||||
"dtc-rule-mappings",
|
||||
"server-mappings",
|
||||
"service-mappings",
|
||||
"dtc-service-mappings",
|
||||
"source-mappings",
|
||||
"threat-mappings",
|
||||
"tls-mappings",
|
||||
"tracing-mappings",
|
||||
"url-mappings",
|
||||
"user_agent-mappings",
|
||||
"dtc-user_agent-mappings",
|
||||
"user-mappings",
|
||||
"dtc-user-mappings",
|
||||
"vulnerability-mappings",
|
||||
"common-settings",
|
||||
"common-dynamic-mappings"
|
||||
],
|
||||
"priority": {{ PRIORITY }},
|
||||
"_meta": {
|
||||
"description": "Composable template that includes SO base fields",
|
||||
"ecs_version": "1.12"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,104 +0,0 @@
|
||||
{%- set INDEX_SORTING = salt['pillar.get']('elasticsearch:index_sorting', False) %}
|
||||
{%- set REPLICAS = salt['pillar.get']('elasticsearch:replicas', 0) %}
|
||||
{%- set SHARDS = salt['pillar.get']('elasticsearch:index_settings:so-gcp:shards', 1) %}
|
||||
{%- set REFRESH = salt['pillar.get']('elasticsearch:index_settings:so-gcp:refresh', '30s') %}
|
||||
{%- set PRIORITY = salt['pillar.get']('elasticsearch:index_settings:so-gcp:priority', 500) %}
|
||||
{%- set FIELD_LIMIT = salt['pillar.get']('elasticsearch:index_settings:so-gcp:field_limit', 3000) %}
|
||||
{
|
||||
"index_patterns": [
|
||||
"so-gcp*"
|
||||
],
|
||||
"template": {
|
||||
"mappings": {
|
||||
"dynamic_templates": [
|
||||
{
|
||||
"strings_as_keyword": {
|
||||
"mapping": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"match_mapping_type": "string"
|
||||
}
|
||||
}
|
||||
],
|
||||
"date_detection": false
|
||||
},
|
||||
"settings": {
|
||||
"index": {
|
||||
"mapping": {
|
||||
"total_fields": {
|
||||
"limit": {{ FIELD_LIMIT }}
|
||||
}
|
||||
},
|
||||
{%- if INDEX_SORTING is sameas true %}
|
||||
"index.sort.field": "@timestamp",
|
||||
"index.sort.order": "desc",
|
||||
{%- endif %}
|
||||
"refresh_interval": "{{ REFRESH }}",
|
||||
"number_of_shards": {{ SHARDS }},
|
||||
"number_of_replicas": {{ REPLICAS }}
|
||||
}
|
||||
}
|
||||
},
|
||||
"composed_of": [
|
||||
"agent-mappings",
|
||||
"dtc-agent-mappings",
|
||||
"base-mappings",
|
||||
"dtc-base-mappings",
|
||||
"client-mappings",
|
||||
"cloud-mappings",
|
||||
"container-mappings",
|
||||
"data_stream-mappings",
|
||||
"destination-mappings",
|
||||
"dll-mappings",
|
||||
"dns-mappings",
|
||||
"dtc-dns-mappings",
|
||||
"ecs-mappings",
|
||||
"dtc-ecs-mappings",
|
||||
"error-mappings",
|
||||
"event-mappings",
|
||||
"dtc-event-mappings",
|
||||
"file-mappings",
|
||||
"dtc-file-mappings",
|
||||
"group-mappings",
|
||||
"host-mappings",
|
||||
"dtc-host-mappings",
|
||||
"http-mappings",
|
||||
"dtc-http-mappings",
|
||||
"log-mappings",
|
||||
"network-mappings",
|
||||
"dtc-network-mappings",
|
||||
"observer-mappings",
|
||||
"dtc-observer-mappings",
|
||||
"orchestrator-mappings",
|
||||
"organization-mappings",
|
||||
"package-mappings",
|
||||
"process-mappings",
|
||||
"dtc-process-mappings",
|
||||
"registry-mappings",
|
||||
"related-mappings",
|
||||
"rule-mappings",
|
||||
"dtc-rule-mappings",
|
||||
"server-mappings",
|
||||
"service-mappings",
|
||||
"dtc-service-mappings",
|
||||
"source-mappings",
|
||||
"threat-mappings",
|
||||
"tls-mappings",
|
||||
"tracing-mappings",
|
||||
"url-mappings",
|
||||
"user_agent-mappings",
|
||||
"dtc-user_agent-mappings",
|
||||
"user-mappings",
|
||||
"dtc-user-mappings",
|
||||
"vulnerability-mappings",
|
||||
"common-settings",
|
||||
"common-dynamic-mappings"
|
||||
],
|
||||
"priority": {{ PRIORITY }},
|
||||
"_meta": {
|
||||
"description": "Composable template that includes SO base fields",
|
||||
"ecs_version": "1.12"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,104 +0,0 @@
|
||||
{%- set INDEX_SORTING = salt['pillar.get']('elasticsearch:index_sorting', False) %}
|
||||
{%- set REPLICAS = salt['pillar.get']('elasticsearch:replicas', 0) %}
|
||||
{%- set SHARDS = salt['pillar.get']('elasticsearch:index_settings:so-google_workspace:shards', 1) %}
|
||||
{%- set REFRESH = salt['pillar.get']('elasticsearch:index_settings:so-google_workspace:refresh', '30s') %}
|
||||
{%- set PRIORITY = salt['pillar.get']('elasticsearch:index_settings:so-google_workspace:priority', 500) %}
|
||||
{%- set FIELD_LIMIT = salt['pillar.get']('elasticsearch:index_settings:so-google_workspace:field_limit', 3000) %}
|
||||
{
|
||||
"index_patterns": [
|
||||
"so-google_workspace*"
|
||||
],
|
||||
"template": {
|
||||
"mappings": {
|
||||
"dynamic_templates": [
|
||||
{
|
||||
"strings_as_keyword": {
|
||||
"mapping": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"match_mapping_type": "string"
|
||||
}
|
||||
}
|
||||
],
|
||||
"date_detection": false
|
||||
},
|
||||
"settings": {
|
||||
"index": {
|
||||
"mapping": {
|
||||
"total_fields": {
|
||||
"limit": {{ FIELD_LIMIT }}
|
||||
}
|
||||
},
|
||||
{%- if INDEX_SORTING is sameas true %}
|
||||
"index.sort.field": "@timestamp",
|
||||
"index.sort.order": "desc",
|
||||
{%- endif %}
|
||||
"refresh_interval": "{{ REFRESH }}",
|
||||
"number_of_shards": {{ SHARDS }},
|
||||
"number_of_replicas": {{ REPLICAS }}
|
||||
}
|
||||
}
|
||||
},
|
||||
"composed_of": [
|
||||
"agent-mappings",
|
||||
"dtc-agent-mappings",
|
||||
"base-mappings",
|
||||
"dtc-base-mappings",
|
||||
"client-mappings",
|
||||
"cloud-mappings",
|
||||
"container-mappings",
|
||||
"data_stream-mappings",
|
||||
"destination-mappings",
|
||||
"dll-mappings",
|
||||
"dns-mappings",
|
||||
"dtc-dns-mappings",
|
||||
"ecs-mappings",
|
||||
"dtc-ecs-mappings",
|
||||
"error-mappings",
|
||||
"event-mappings",
|
||||
"dtc-event-mappings",
|
||||
"file-mappings",
|
||||
"dtc-file-mappings",
|
||||
"group-mappings",
|
||||
"host-mappings",
|
||||
"dtc-host-mappings",
|
||||
"http-mappings",
|
||||
"dtc-http-mappings",
|
||||
"log-mappings",
|
||||
"network-mappings",
|
||||
"dtc-network-mappings",
|
||||
"observer-mappings",
|
||||
"dtc-observer-mappings",
|
||||
"orchestrator-mappings",
|
||||
"organization-mappings",
|
||||
"package-mappings",
|
||||
"process-mappings",
|
||||
"dtc-process-mappings",
|
||||
"registry-mappings",
|
||||
"related-mappings",
|
||||
"rule-mappings",
|
||||
"dtc-rule-mappings",
|
||||
"server-mappings",
|
||||
"service-mappings",
|
||||
"dtc-service-mappings",
|
||||
"source-mappings",
|
||||
"threat-mappings",
|
||||
"tls-mappings",
|
||||
"tracing-mappings",
|
||||
"url-mappings",
|
||||
"user_agent-mappings",
|
||||
"dtc-user_agent-mappings",
|
||||
"user-mappings",
|
||||
"dtc-user-mappings",
|
||||
"vulnerability-mappings",
|
||||
"common-settings",
|
||||
"common-dynamic-mappings"
|
||||
],
|
||||
"priority": {{ PRIORITY }},
|
||||
"_meta": {
|
||||
"description": "Composable template that includes SO base fields",
|
||||
"ecs_version": "1.12"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,104 +0,0 @@
|
||||
{%- set INDEX_SORTING = salt['pillar.get']('elasticsearch:index_sorting', False) %}
|
||||
{%- set REPLICAS = salt['pillar.get']('elasticsearch:replicas', 0) %}
|
||||
{%- set SHARDS = salt['pillar.get']('elasticsearch:index_settings:so-ids:shards', 1) %}
|
||||
{%- set REFRESH = salt['pillar.get']('elasticsearch:index_settings:so-ids:refresh', '30s') %}
|
||||
{%- set PRIORITY = salt['pillar.get']('elasticsearch:index_settings:so-ids:priority', 500) %}
|
||||
{%- set FIELD_LIMIT = salt['pillar.get']('elasticsearch:index_settings:so-ids:field_limit', 3000) %}
|
||||
{
|
||||
"index_patterns": [
|
||||
"so-ids*"
|
||||
],
|
||||
"template": {
|
||||
"mappings": {
|
||||
"dynamic_templates": [
|
||||
{
|
||||
"strings_as_keyword": {
|
||||
"mapping": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"match_mapping_type": "string"
|
||||
}
|
||||
}
|
||||
],
|
||||
"date_detection": false
|
||||
},
|
||||
"settings": {
|
||||
"index": {
|
||||
"mapping": {
|
||||
"total_fields": {
|
||||
"limit": {{ FIELD_LIMIT }}
|
||||
}
|
||||
},
|
||||
{%- if INDEX_SORTING is sameas true %}
|
||||
"index.sort.field": "@timestamp",
|
||||
"index.sort.order": "desc",
|
||||
{%- endif %}
|
||||
"refresh_interval": "{{ REFRESH }}",
|
||||
"number_of_shards": {{ SHARDS }},
|
||||
"number_of_replicas": {{ REPLICAS }}
|
||||
}
|
||||
}
|
||||
},
|
||||
"composed_of": [
|
||||
"agent-mappings",
|
||||
"dtc-agent-mappings",
|
||||
"base-mappings",
|
||||
"dtc-base-mappings",
|
||||
"client-mappings",
|
||||
"cloud-mappings",
|
||||
"container-mappings",
|
||||
"data_stream-mappings",
|
||||
"destination-mappings",
|
||||
"dll-mappings",
|
||||
"dns-mappings",
|
||||
"dtc-dns-mappings",
|
||||
"ecs-mappings",
|
||||
"dtc-ecs-mappings",
|
||||
"error-mappings",
|
||||
"event-mappings",
|
||||
"dtc-event-mappings",
|
||||
"file-mappings",
|
||||
"dtc-file-mappings",
|
||||
"group-mappings",
|
||||
"host-mappings",
|
||||
"dtc-host-mappings",
|
||||
"http-mappings",
|
||||
"dtc-http-mappings",
|
||||
"log-mappings",
|
||||
"network-mappings",
|
||||
"dtc-network-mappings",
|
||||
"observer-mappings",
|
||||
"dtc-observer-mappings",
|
||||
"orchestrator-mappings",
|
||||
"organization-mappings",
|
||||
"package-mappings",
|
||||
"process-mappings",
|
||||
"dtc-process-mappings",
|
||||
"registry-mappings",
|
||||
"related-mappings",
|
||||
"rule-mappings",
|
||||
"dtc-rule-mappings",
|
||||
"server-mappings",
|
||||
"service-mappings",
|
||||
"dtc-service-mappings",
|
||||
"source-mappings",
|
||||
"threat-mappings",
|
||||
"tls-mappings",
|
||||
"tracing-mappings",
|
||||
"url-mappings",
|
||||
"user_agent-mappings",
|
||||
"dtc-user_agent-mappings",
|
||||
"user-mappings",
|
||||
"dtc-user-mappings",
|
||||
"vulnerability-mappings",
|
||||
"common-settings",
|
||||
"common-dynamic-mappings"
|
||||
],
|
||||
"priority": {{ PRIORITY }},
|
||||
"_meta": {
|
||||
"description": "Composable template that includes SO base fields",
|
||||
"ecs_version": "1.12"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,104 +0,0 @@
|
||||
{%- set INDEX_SORTING = salt['pillar.get']('elasticsearch:index_sorting', False) %}
|
||||
{%- set REPLICAS = salt['pillar.get']('elasticsearch:replicas', 0) %}
|
||||
{%- set SHARDS = salt['pillar.get']('elasticsearch:index_settings:so-imperva:shards', 1) %}
|
||||
{%- set REFRESH = salt['pillar.get']('elasticsearch:index_settings:so-imperva:refresh', '30s') %}
|
||||
{%- set PRIORITY = salt['pillar.get']('elasticsearch:index_settings:so-imperva:priority', 500) %}
|
||||
{%- set FIELD_LIMIT = salt['pillar.get']('elasticsearch:index_settings:so-imperva:field_limit', 3000) %}
|
||||
{
|
||||
"index_patterns": [
|
||||
"so-imperva*"
|
||||
],
|
||||
"template": {
|
||||
"mappings": {
|
||||
"dynamic_templates": [
|
||||
{
|
||||
"strings_as_keyword": {
|
||||
"mapping": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"match_mapping_type": "string"
|
||||
}
|
||||
}
|
||||
],
|
||||
"date_detection": false
|
||||
},
|
||||
"settings": {
|
||||
"index": {
|
||||
"mapping": {
|
||||
"total_fields": {
|
||||
"limit": {{ FIELD_LIMIT }}
|
||||
}
|
||||
},
|
||||
{%- if INDEX_SORTING is sameas true %}
|
||||
"index.sort.field": "@timestamp",
|
||||
"index.sort.order": "desc",
|
||||
{%- endif %}
|
||||
"refresh_interval": "{{ REFRESH }}",
|
||||
"number_of_shards": {{ SHARDS }},
|
||||
"number_of_replicas": {{ REPLICAS }}
|
||||
}
|
||||
}
|
||||
},
|
||||
"composed_of": [
|
||||
"agent-mappings",
|
||||
"dtc-agent-mappings",
|
||||
"base-mappings",
|
||||
"dtc-base-mappings",
|
||||
"client-mappings",
|
||||
"cloud-mappings",
|
||||
"container-mappings",
|
||||
"data_stream-mappings",
|
||||
"destination-mappings",
|
||||
"dll-mappings",
|
||||
"dns-mappings",
|
||||
"dtc-dns-mappings",
|
||||
"ecs-mappings",
|
||||
"dtc-ecs-mappings",
|
||||
"error-mappings",
|
||||
"event-mappings",
|
||||
"dtc-event-mappings",
|
||||
"file-mappings",
|
||||
"dtc-file-mappings",
|
||||
"group-mappings",
|
||||
"host-mappings",
|
||||
"dtc-host-mappings",
|
||||
"http-mappings",
|
||||
"dtc-http-mappings",
|
||||
"log-mappings",
|
||||
"network-mappings",
|
||||
"dtc-network-mappings",
|
||||
"observer-mappings",
|
||||
"dtc-observer-mappings",
|
||||
"orchestrator-mappings",
|
||||
"organization-mappings",
|
||||
"package-mappings",
|
||||
"process-mappings",
|
||||
"dtc-process-mappings",
|
||||
"registry-mappings",
|
||||
"related-mappings",
|
||||
"rule-mappings",
|
||||
"dtc-rule-mappings",
|
||||
"server-mappings",
|
||||
"service-mappings",
|
||||
"dtc-service-mappings",
|
||||
"source-mappings",
|
||||
"threat-mappings",
|
||||
"tls-mappings",
|
||||
"tracing-mappings",
|
||||
"url-mappings",
|
||||
"user_agent-mappings",
|
||||
"dtc-user_agent-mappings",
|
||||
"user-mappings",
|
||||
"dtc-user-mappings",
|
||||
"vulnerability-mappings",
|
||||
"common-settings",
|
||||
"common-dynamic-mappings"
|
||||
],
|
||||
"priority": {{ PRIORITY }},
|
||||
"_meta": {
|
||||
"description": "Composable template that includes SO base fields",
|
||||
"ecs_version": "1.12"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,104 +0,0 @@
|
||||
{%- set INDEX_SORTING = salt['pillar.get']('elasticsearch:index_sorting', False) %}
|
||||
{%- set REPLICAS = salt['pillar.get']('elasticsearch:replicas', 0) %}
|
||||
{%- set SHARDS = salt['pillar.get']('elasticsearch:index_settings:so-import:shards', 1) %}
|
||||
{%- set REFRESH = salt['pillar.get']('elasticsearch:index_settings:so-import:refresh', '30s') %}
|
||||
{%- set PRIORITY = salt['pillar.get']('elasticsearch:index_settings:so-import:priority', 500) %}
|
||||
{%- set FIELD_LIMIT = salt['pillar.get']('elasticsearch:index_settings:so-import:field_limit', 3000) %}
|
||||
{
|
||||
"index_patterns": [
|
||||
"so-import*"
|
||||
],
|
||||
"template": {
|
||||
"mappings": {
|
||||
"dynamic_templates": [
|
||||
{
|
||||
"strings_as_keyword": {
|
||||
"mapping": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"match_mapping_type": "string"
|
||||
}
|
||||
}
|
||||
],
|
||||
"date_detection": false
|
||||
},
|
||||
"settings": {
|
||||
"index": {
|
||||
"mapping": {
|
||||
"total_fields": {
|
||||
"limit": {{ FIELD_LIMIT }}
|
||||
}
|
||||
},
|
||||
{%- if INDEX_SORTING is sameas true %}
|
||||
"index.sort.field": "@timestamp",
|
||||
"index.sort.order": "desc",
|
||||
{%- endif %}
|
||||
"refresh_interval": "{{ REFRESH }}",
|
||||
"number_of_shards": {{ SHARDS }},
|
||||
"number_of_replicas": {{ REPLICAS }}
|
||||
}
|
||||
}
|
||||
},
|
||||
"composed_of": [
|
||||
"agent-mappings",
|
||||
"dtc-agent-mappings",
|
||||
"base-mappings",
|
||||
"dtc-base-mappings",
|
||||
"client-mappings",
|
||||
"cloud-mappings",
|
||||
"container-mappings",
|
||||
"data_stream-mappings",
|
||||
"destination-mappings",
|
||||
"dll-mappings",
|
||||
"dns-mappings",
|
||||
"dtc-dns-mappings",
|
||||
"ecs-mappings",
|
||||
"dtc-ecs-mappings",
|
||||
"error-mappings",
|
||||
"event-mappings",
|
||||
"dtc-event-mappings",
|
||||
"file-mappings",
|
||||
"dtc-file-mappings",
|
||||
"group-mappings",
|
||||
"host-mappings",
|
||||
"dtc-host-mappings",
|
||||
"http-mappings",
|
||||
"dtc-http-mappings",
|
||||
"log-mappings",
|
||||
"network-mappings",
|
||||
"dtc-network-mappings",
|
||||
"observer-mappings",
|
||||
"dtc-observer-mappings",
|
||||
"orchestrator-mappings",
|
||||
"organization-mappings",
|
||||
"package-mappings",
|
||||
"process-mappings",
|
||||
"dtc-process-mappings",
|
||||
"registry-mappings",
|
||||
"related-mappings",
|
||||
"rule-mappings",
|
||||
"dtc-rule-mappings",
|
||||
"server-mappings",
|
||||
"service-mappings",
|
||||
"dtc-service-mappings",
|
||||
"source-mappings",
|
||||
"threat-mappings",
|
||||
"tls-mappings",
|
||||
"tracing-mappings",
|
||||
"url-mappings",
|
||||
"user_agent-mappings",
|
||||
"dtc-user_agent-mappings",
|
||||
"user-mappings",
|
||||
"dtc-user-mappings",
|
||||
"vulnerability-mappings",
|
||||
"common-settings",
|
||||
"common-dynamic-mappings"
|
||||
],
|
||||
"priority": {{ PRIORITY }},
|
||||
"_meta": {
|
||||
"description": "Composable template that includes SO base fields",
|
||||
"ecs_version": "1.12"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,104 +0,0 @@
|
||||
{%- set INDEX_SORTING = salt['pillar.get']('elasticsearch:index_sorting', False) %}
|
||||
{%- set REPLICAS = salt['pillar.get']('elasticsearch:replicas', 0) %}
|
||||
{%- set SHARDS = salt['pillar.get']('elasticsearch:index_settings:so-infoblox:shards', 1) %}
|
||||
{%- set REFRESH = salt['pillar.get']('elasticsearch:index_settings:so-infoblox:refresh', '30s') %}
|
||||
{%- set PRIORITY = salt['pillar.get']('elasticsearch:index_settings:so-infoblox:priority', 500) %}
|
||||
{%- set FIELD_LIMIT = salt['pillar.get']('elasticsearch:index_settings:so-infoblox:field_limit', 3000) %}
|
||||
{
|
||||
"index_patterns": [
|
||||
"so-infoblox*"
|
||||
],
|
||||
"template": {
|
||||
"mappings": {
|
||||
"dynamic_templates": [
|
||||
{
|
||||
"strings_as_keyword": {
|
||||
"mapping": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"match_mapping_type": "string"
|
||||
}
|
||||
}
|
||||
],
|
||||
"date_detection": false
|
||||
},
|
||||
"settings": {
|
||||
"index": {
|
||||
"mapping": {
|
||||
"total_fields": {
|
||||
"limit": {{ FIELD_LIMIT }}
|
||||
}
|
||||
},
|
||||
{%- if INDEX_SORTING is sameas true %}
|
||||
"index.sort.field": "@timestamp",
|
||||
"index.sort.order": "desc",
|
||||
{%- endif %}
|
||||
"refresh_interval": "{{ REFRESH }}",
|
||||
"number_of_shards": {{ SHARDS }},
|
||||
"number_of_replicas": {{ REPLICAS }}
|
||||
}
|
||||
}
|
||||
},
|
||||
"composed_of": [
|
||||
"agent-mappings",
|
||||
"dtc-agent-mappings",
|
||||
"base-mappings",
|
||||
"dtc-base-mappings",
|
||||
"client-mappings",
|
||||
"cloud-mappings",
|
||||
"container-mappings",
|
||||
"data_stream-mappings",
|
||||
"destination-mappings",
|
||||
"dll-mappings",
|
||||
"dns-mappings",
|
||||
"dtc-dns-mappings",
|
||||
"ecs-mappings",
|
||||
"dtc-ecs-mappings",
|
||||
"error-mappings",
|
||||
"event-mappings",
|
||||
"dtc-event-mappings",
|
||||
"file-mappings",
|
||||
"dtc-file-mappings",
|
||||
"group-mappings",
|
||||
"host-mappings",
|
||||
"dtc-host-mappings",
|
||||
"http-mappings",
|
||||
"dtc-http-mappings",
|
||||
"log-mappings",
|
||||
"network-mappings",
|
||||
"dtc-network-mappings",
|
||||
"observer-mappings",
|
||||
"dtc-observer-mappings",
|
||||
"orchestrator-mappings",
|
||||
"organization-mappings",
|
||||
"package-mappings",
|
||||
"process-mappings",
|
||||
"dtc-process-mappings",
|
||||
"registry-mappings",
|
||||
"related-mappings",
|
||||
"rule-mappings",
|
||||
"dtc-rule-mappings",
|
||||
"server-mappings",
|
||||
"service-mappings",
|
||||
"dtc-service-mappings",
|
||||
"source-mappings",
|
||||
"threat-mappings",
|
||||
"tls-mappings",
|
||||
"tracing-mappings",
|
||||
"url-mappings",
|
||||
"user_agent-mappings",
|
||||
"dtc-user_agent-mappings",
|
||||
"user-mappings",
|
||||
"dtc-user-mappings",
|
||||
"vulnerability-mappings",
|
||||
"common-settings",
|
||||
"common-dynamic-mappings"
|
||||
],
|
||||
"priority": {{ PRIORITY }},
|
||||
"_meta": {
|
||||
"description": "Composable template that includes SO base fields",
|
||||
"ecs_version": "1.12"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,104 +0,0 @@
|
||||
{%- set INDEX_SORTING = salt['pillar.get']('elasticsearch:index_sorting', False) %}
|
||||
{%- set REPLICAS = salt['pillar.get']('elasticsearch:replicas', 0) %}
|
||||
{%- set SHARDS = salt['pillar.get']('elasticsearch:index_settings:so-juniper:shards', 1) %}
|
||||
{%- set REFRESH = salt['pillar.get']('elasticsearch:index_settings:so-juniper:refresh', '30s') %}
|
||||
{%- set PRIORITY = salt['pillar.get']('elasticsearch:index_settings:so-juniper:priority', 500) %}
|
||||
{%- set FIELD_LIMIT = salt['pillar.get']('elasticsearch:index_settings:so-juniper:field_limit', 3000) %}
|
||||
{
|
||||
"index_patterns": [
|
||||
"so-juniper*"
|
||||
],
|
||||
"template": {
|
||||
"mappings": {
|
||||
"dynamic_templates": [
|
||||
{
|
||||
"strings_as_keyword": {
|
||||
"mapping": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"match_mapping_type": "string"
|
||||
}
|
||||
}
|
||||
],
|
||||
"date_detection": false
|
||||
},
|
||||
"settings": {
|
||||
"index": {
|
||||
"mapping": {
|
||||
"total_fields": {
|
||||
"limit": {{ FIELD_LIMIT }}
|
||||
}
|
||||
},
|
||||
{%- if INDEX_SORTING is sameas true %}
|
||||
"index.sort.field": "@timestamp",
|
||||
"index.sort.order": "desc",
|
||||
{%- endif %}
|
||||
"refresh_interval": "{{ REFRESH }}",
|
||||
"number_of_shards": {{ SHARDS }},
|
||||
"number_of_replicas": {{ REPLICAS }}
|
||||
}
|
||||
}
|
||||
},
|
||||
"composed_of": [
|
||||
"agent-mappings",
|
||||
"dtc-agent-mappings",
|
||||
"base-mappings",
|
||||
"dtc-base-mappings",
|
||||
"client-mappings",
|
||||
"cloud-mappings",
|
||||
"container-mappings",
|
||||
"data_stream-mappings",
|
||||
"destination-mappings",
|
||||
"dll-mappings",
|
||||
"dns-mappings",
|
||||
"dtc-dns-mappings",
|
||||
"ecs-mappings",
|
||||
"dtc-ecs-mappings",
|
||||
"error-mappings",
|
||||
"event-mappings",
|
||||
"dtc-event-mappings",
|
||||
"file-mappings",
|
||||
"dtc-file-mappings",
|
||||
"group-mappings",
|
||||
"host-mappings",
|
||||
"dtc-host-mappings",
|
||||
"http-mappings",
|
||||
"dtc-http-mappings",
|
||||
"log-mappings",
|
||||
"network-mappings",
|
||||
"dtc-network-mappings",
|
||||
"observer-mappings",
|
||||
"dtc-observer-mappings",
|
||||
"orchestrator-mappings",
|
||||
"organization-mappings",
|
||||
"package-mappings",
|
||||
"process-mappings",
|
||||
"dtc-process-mappings",
|
||||
"registry-mappings",
|
||||
"related-mappings",
|
||||
"rule-mappings",
|
||||
"dtc-rule-mappings",
|
||||
"server-mappings",
|
||||
"service-mappings",
|
||||
"dtc-service-mappings",
|
||||
"source-mappings",
|
||||
"threat-mappings",
|
||||
"tls-mappings",
|
||||
"tracing-mappings",
|
||||
"url-mappings",
|
||||
"user_agent-mappings",
|
||||
"dtc-user_agent-mappings",
|
||||
"user-mappings",
|
||||
"dtc-user-mappings",
|
||||
"vulnerability-mappings",
|
||||
"common-settings",
|
||||
"common-dynamic-mappings"
|
||||
],
|
||||
"priority": {{ PRIORITY }},
|
||||
"_meta": {
|
||||
"description": "Composable template that includes SO base fields",
|
||||
"ecs_version": "1.12"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,104 +0,0 @@
|
||||
{%- set INDEX_SORTING = salt['pillar.get']('elasticsearch:index_sorting', False) %}
|
||||
{%- set REPLICAS = salt['pillar.get']('elasticsearch:replicas', 0) %}
|
||||
{%- set SHARDS = salt['pillar.get']('elasticsearch:index_settings:so-kibana:shards', 1) %}
|
||||
{%- set REFRESH = salt['pillar.get']('elasticsearch:index_settings:so-kibana:refresh', '30s') %}
|
||||
{%- set PRIORITY = salt['pillar.get']('elasticsearch:index_settings:so-kibana:priority', 500) %}
|
||||
{%- set FIELD_LIMIT = salt['pillar.get']('elasticsearch:index_settings:so-kibana:field_limit', 3000) %}
|
||||
{
|
||||
"index_patterns": [
|
||||
"so-kibana*"
|
||||
],
|
||||
"template": {
|
||||
"mappings": {
|
||||
"dynamic_templates": [
|
||||
{
|
||||
"strings_as_keyword": {
|
||||
"mapping": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"match_mapping_type": "string"
|
||||
}
|
||||
}
|
||||
],
|
||||
"date_detection": false
|
||||
},
|
||||
"settings": {
|
||||
"index": {
|
||||
"mapping": {
|
||||
"total_fields": {
|
||||
"limit": {{ FIELD_LIMIT }}
|
||||
}
|
||||
},
|
||||
{%- if INDEX_SORTING is sameas true %}
|
||||
"index.sort.field": "@timestamp",
|
||||
"index.sort.order": "desc",
|
||||
{%- endif %}
|
||||
"refresh_interval": "{{ REFRESH }}",
|
||||
"number_of_shards": {{ SHARDS }},
|
||||
"number_of_replicas": {{ REPLICAS }}
|
||||
}
|
||||
}
|
||||
},
|
||||
"composed_of": [
|
||||
"agent-mappings",
|
||||
"dtc-agent-mappings",
|
||||
"base-mappings",
|
||||
"dtc-base-mappings",
|
||||
"client-mappings",
|
||||
"cloud-mappings",
|
||||
"container-mappings",
|
||||
"data_stream-mappings",
|
||||
"destination-mappings",
|
||||
"dll-mappings",
|
||||
"dns-mappings",
|
||||
"dtc-dns-mappings",
|
||||
"ecs-mappings",
|
||||
"dtc-ecs-mappings",
|
||||
"error-mappings",
|
||||
"event-mappings",
|
||||
"dtc-event-mappings",
|
||||
"file-mappings",
|
||||
"dtc-file-mappings",
|
||||
"group-mappings",
|
||||
"host-mappings",
|
||||
"dtc-host-mappings",
|
||||
"http-mappings",
|
||||
"dtc-http-mappings",
|
||||
"log-mappings",
|
||||
"network-mappings",
|
||||
"dtc-network-mappings",
|
||||
"observer-mappings",
|
||||
"dtc-observer-mappings",
|
||||
"orchestrator-mappings",
|
||||
"organization-mappings",
|
||||
"package-mappings",
|
||||
"process-mappings",
|
||||
"dtc-process-mappings",
|
||||
"registry-mappings",
|
||||
"related-mappings",
|
||||
"rule-mappings",
|
||||
"dtc-rule-mappings",
|
||||
"server-mappings",
|
||||
"service-mappings",
|
||||
"dtc-service-mappings",
|
||||
"source-mappings",
|
||||
"threat-mappings",
|
||||
"tls-mappings",
|
||||
"tracing-mappings",
|
||||
"url-mappings",
|
||||
"user_agent-mappings",
|
||||
"dtc-user_agent-mappings",
|
||||
"user-mappings",
|
||||
"dtc-user-mappings",
|
||||
"vulnerability-mappings",
|
||||
"common-settings",
|
||||
"common-dynamic-mappings"
|
||||
],
|
||||
"priority": {{ PRIORITY }},
|
||||
"_meta": {
|
||||
"description": "Composable template that includes SO base fields",
|
||||
"ecs_version": "1.12"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,104 +0,0 @@
|
||||
{%- set INDEX_SORTING = salt['pillar.get']('elasticsearch:index_sorting', False) %}
|
||||
{%- set REPLICAS = salt['pillar.get']('elasticsearch:replicas', 0) %}
|
||||
{%- set SHARDS = salt['pillar.get']('elasticsearch:index_settings:so-logstash:shards', 1) %}
|
||||
{%- set REFRESH = salt['pillar.get']('elasticsearch:index_settings:so-logstash:refresh', '30s') %}
|
||||
{%- set PRIORITY = salt['pillar.get']('elasticsearch:index_settings:so-logstash:priority', 500) %}
|
||||
{%- set FIELD_LIMIT = salt['pillar.get']('elasticsearch:index_settings:so-logstash:field_limit', 3000) %}
|
||||
{
|
||||
"index_patterns": [
|
||||
"so-logstash*"
|
||||
],
|
||||
"template": {
|
||||
"mappings": {
|
||||
"dynamic_templates": [
|
||||
{
|
||||
"strings_as_keyword": {
|
||||
"mapping": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"match_mapping_type": "string"
|
||||
}
|
||||
}
|
||||
],
|
||||
"date_detection": false
|
||||
},
|
||||
"settings": {
|
||||
"index": {
|
||||
"mapping": {
|
||||
"total_fields": {
|
||||
"limit": {{ FIELD_LIMIT }}
|
||||
}
|
||||
},
|
||||
{%- if INDEX_SORTING is sameas true %}
|
||||
"index.sort.field": "@timestamp",
|
||||
"index.sort.order": "desc",
|
||||
{%- endif %}
|
||||
"refresh_interval": "{{ REFRESH }}",
|
||||
"number_of_shards": {{ SHARDS }},
|
||||
"number_of_replicas": {{ REPLICAS }}
|
||||
}
|
||||
}
|
||||
},
|
||||
"composed_of": [
|
||||
"agent-mappings",
|
||||
"dtc-agent-mappings",
|
||||
"base-mappings",
|
||||
"dtc-base-mappings",
|
||||
"client-mappings",
|
||||
"cloud-mappings",
|
||||
"container-mappings",
|
||||
"data_stream-mappings",
|
||||
"destination-mappings",
|
||||
"dll-mappings",
|
||||
"dns-mappings",
|
||||
"dtc-dns-mappings",
|
||||
"ecs-mappings",
|
||||
"dtc-ecs-mappings",
|
||||
"error-mappings",
|
||||
"event-mappings",
|
||||
"dtc-event-mappings",
|
||||
"file-mappings",
|
||||
"dtc-file-mappings",
|
||||
"group-mappings",
|
||||
"host-mappings",
|
||||
"dtc-host-mappings",
|
||||
"http-mappings",
|
||||
"dtc-http-mappings",
|
||||
"log-mappings",
|
||||
"network-mappings",
|
||||
"dtc-network-mappings",
|
||||
"observer-mappings",
|
||||
"dtc-observer-mappings",
|
||||
"orchestrator-mappings",
|
||||
"organization-mappings",
|
||||
"package-mappings",
|
||||
"process-mappings",
|
||||
"dtc-process-mappings",
|
||||
"registry-mappings",
|
||||
"related-mappings",
|
||||
"rule-mappings",
|
||||
"dtc-rule-mappings",
|
||||
"server-mappings",
|
||||
"service-mappings",
|
||||
"dtc-service-mappings",
|
||||
"source-mappings",
|
||||
"threat-mappings",
|
||||
"tls-mappings",
|
||||
"tracing-mappings",
|
||||
"url-mappings",
|
||||
"user_agent-mappings",
|
||||
"dtc-user_agent-mappings",
|
||||
"user-mappings",
|
||||
"dtc-user-mappings",
|
||||
"vulnerability-mappings",
|
||||
"common-settings",
|
||||
"common-dynamic-mappings"
|
||||
],
|
||||
"priority": {{ PRIORITY }},
|
||||
"_meta": {
|
||||
"description": "Composable template that includes SO base fields",
|
||||
"ecs_version": "1.12"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,104 +0,0 @@
|
||||
{%- set INDEX_SORTING = salt['pillar.get']('elasticsearch:index_sorting', False) %}
|
||||
{%- set REPLICAS = salt['pillar.get']('elasticsearch:replicas', 0) %}
|
||||
{%- set SHARDS = salt['pillar.get']('elasticsearch:index_settings:so-microsoft:shards', 1) %}
|
||||
{%- set REFRESH = salt['pillar.get']('elasticsearch:index_settings:so-microsoft:refresh', '30s') %}
|
||||
{%- set PRIORITY = salt['pillar.get']('elasticsearch:index_settings:so-microsoft:priority', 500) %}
|
||||
{%- set FIELD_LIMIT = salt['pillar.get']('elasticsearch:index_settings:so-microsoft:field_limit', 3000) %}
|
||||
{
|
||||
"index_patterns": [
|
||||
"so-microsoft*"
|
||||
],
|
||||
"template": {
|
||||
"mappings": {
|
||||
"dynamic_templates": [
|
||||
{
|
||||
"strings_as_keyword": {
|
||||
"mapping": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"match_mapping_type": "string"
|
||||
}
|
||||
}
|
||||
],
|
||||
"date_detection": false
|
||||
},
|
||||
"settings": {
|
||||
"index": {
|
||||
"mapping": {
|
||||
"total_fields": {
|
||||
"limit": {{ FIELD_LIMIT }}
|
||||
}
|
||||
},
|
||||
{%- if INDEX_SORTING is sameas true %}
|
||||
"index.sort.field": "@timestamp",
|
||||
"index.sort.order": "desc",
|
||||
{%- endif %}
|
||||
"refresh_interval": "{{ REFRESH }}",
|
||||
"number_of_shards": {{ SHARDS }},
|
||||
"number_of_replicas": {{ REPLICAS }}
|
||||
}
|
||||
}
|
||||
},
|
||||
"composed_of": [
|
||||
"agent-mappings",
|
||||
"dtc-agent-mappings",
|
||||
"base-mappings",
|
||||
"dtc-base-mappings",
|
||||
"client-mappings",
|
||||
"cloud-mappings",
|
||||
"container-mappings",
|
||||
"data_stream-mappings",
|
||||
"destination-mappings",
|
||||
"dll-mappings",
|
||||
"dns-mappings",
|
||||
"dtc-dns-mappings",
|
||||
"ecs-mappings",
|
||||
"dtc-ecs-mappings",
|
||||
"error-mappings",
|
||||
"event-mappings",
|
||||
"dtc-event-mappings",
|
||||
"file-mappings",
|
||||
"dtc-file-mappings",
|
||||
"group-mappings",
|
||||
"host-mappings",
|
||||
"dtc-host-mappings",
|
||||
"http-mappings",
|
||||
"dtc-http-mappings",
|
||||
"log-mappings",
|
||||
"network-mappings",
|
||||
"dtc-network-mappings",
|
||||
"observer-mappings",
|
||||
"dtc-observer-mappings",
|
||||
"orchestrator-mappings",
|
||||
"organization-mappings",
|
||||
"package-mappings",
|
||||
"process-mappings",
|
||||
"dtc-process-mappings",
|
||||
"registry-mappings",
|
||||
"related-mappings",
|
||||
"rule-mappings",
|
||||
"dtc-rule-mappings",
|
||||
"server-mappings",
|
||||
"service-mappings",
|
||||
"dtc-service-mappings",
|
||||
"source-mappings",
|
||||
"threat-mappings",
|
||||
"tls-mappings",
|
||||
"tracing-mappings",
|
||||
"url-mappings",
|
||||
"user_agent-mappings",
|
||||
"dtc-user_agent-mappings",
|
||||
"user-mappings",
|
||||
"dtc-user-mappings",
|
||||
"vulnerability-mappings",
|
||||
"common-settings",
|
||||
"common-dynamic-mappings"
|
||||
],
|
||||
"priority": {{ PRIORITY }},
|
||||
"_meta": {
|
||||
"description": "Composable template that includes SO base fields",
|
||||
"ecs_version": "1.12"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,104 +0,0 @@
|
||||
{%- set INDEX_SORTING = salt['pillar.get']('elasticsearch:index_sorting', False) %}
|
||||
{%- set REPLICAS = salt['pillar.get']('elasticsearch:replicas', 0) %}
|
||||
{%- set SHARDS = salt['pillar.get']('elasticsearch:index_settings:so-misp:shards', 1) %}
|
||||
{%- set REFRESH = salt['pillar.get']('elasticsearch:index_settings:so-misp:refresh', '30s') %}
|
||||
{%- set PRIORITY = salt['pillar.get']('elasticsearch:index_settings:so-misp:priority', 500) %}
|
||||
{%- set FIELD_LIMIT = salt['pillar.get']('elasticsearch:index_settings:so-misp:field_limit', 3000) %}
|
||||
{
|
||||
"index_patterns": [
|
||||
"so-misp*"
|
||||
],
|
||||
"template": {
|
||||
"mappings": {
|
||||
"dynamic_templates": [
|
||||
{
|
||||
"strings_as_keyword": {
|
||||
"mapping": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"match_mapping_type": "string"
|
||||
}
|
||||
}
|
||||
],
|
||||
"date_detection": false
|
||||
},
|
||||
"settings": {
|
||||
"index": {
|
||||
"mapping": {
|
||||
"total_fields": {
|
||||
"limit": {{ FIELD_LIMIT }}
|
||||
}
|
||||
},
|
||||
{%- if INDEX_SORTING is sameas true %}
|
||||
"index.sort.field": "@timestamp",
|
||||
"index.sort.order": "desc",
|
||||
{%- endif %}
|
||||
"refresh_interval": "{{ REFRESH }}",
|
||||
"number_of_shards": {{ SHARDS }},
|
||||
"number_of_replicas": {{ REPLICAS }}
|
||||
}
|
||||
}
|
||||
},
|
||||
"composed_of": [
|
||||
"agent-mappings",
|
||||
"dtc-agent-mappings",
|
||||
"base-mappings",
|
||||
"dtc-base-mappings",
|
||||
"client-mappings",
|
||||
"cloud-mappings",
|
||||
"container-mappings",
|
||||
"data_stream-mappings",
|
||||
"destination-mappings",
|
||||
"dll-mappings",
|
||||
"dns-mappings",
|
||||
"dtc-dns-mappings",
|
||||
"ecs-mappings",
|
||||
"dtc-ecs-mappings",
|
||||
"error-mappings",
|
||||
"event-mappings",
|
||||
"dtc-event-mappings",
|
||||
"file-mappings",
|
||||
"dtc-file-mappings",
|
||||
"group-mappings",
|
||||
"host-mappings",
|
||||
"dtc-host-mappings",
|
||||
"http-mappings",
|
||||
"dtc-http-mappings",
|
||||
"log-mappings",
|
||||
"network-mappings",
|
||||
"dtc-network-mappings",
|
||||
"observer-mappings",
|
||||
"dtc-observer-mappings",
|
||||
"orchestrator-mappings",
|
||||
"organization-mappings",
|
||||
"package-mappings",
|
||||
"process-mappings",
|
||||
"dtc-process-mappings",
|
||||
"registry-mappings",
|
||||
"related-mappings",
|
||||
"rule-mappings",
|
||||
"dtc-rule-mappings",
|
||||
"server-mappings",
|
||||
"service-mappings",
|
||||
"dtc-service-mappings",
|
||||
"source-mappings",
|
||||
"threat-mappings",
|
||||
"tls-mappings",
|
||||
"tracing-mappings",
|
||||
"url-mappings",
|
||||
"user_agent-mappings",
|
||||
"dtc-user_agent-mappings",
|
||||
"user-mappings",
|
||||
"dtc-user-mappings",
|
||||
"vulnerability-mappings",
|
||||
"common-settings",
|
||||
"common-dynamic-mappings"
|
||||
],
|
||||
"priority": {{ PRIORITY }},
|
||||
"_meta": {
|
||||
"description": "Composable template that includes SO base fields",
|
||||
"ecs_version": "1.12"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,104 +0,0 @@
|
||||
{%- set INDEX_SORTING = salt['pillar.get']('elasticsearch:index_sorting', False) %}
|
||||
{%- set REPLICAS = salt['pillar.get']('elasticsearch:replicas', 0) %}
|
||||
{%- set SHARDS = salt['pillar.get']('elasticsearch:index_settings:so-netflow:shards', 1) %}
|
||||
{%- set REFRESH = salt['pillar.get']('elasticsearch:index_settings:so-netflow:refresh', '30s') %}
|
||||
{%- set PRIORITY = salt['pillar.get']('elasticsearch:index_settings:so-netflow:priority', 500) %}
|
||||
{%- set FIELD_LIMIT = salt['pillar.get']('elasticsearch:index_settings:so-netflow:field_limit', 3000) %}
|
||||
{
|
||||
"index_patterns": [
|
||||
"so-netflow*"
|
||||
],
|
||||
"template": {
|
||||
"mappings": {
|
||||
"dynamic_templates": [
|
||||
{
|
||||
"strings_as_keyword": {
|
||||
"mapping": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"match_mapping_type": "string"
|
||||
}
|
||||
}
|
||||
],
|
||||
"date_detection": false
|
||||
},
|
||||
"settings": {
|
||||
"index": {
|
||||
"mapping": {
|
||||
"total_fields": {
|
||||
"limit": {{ FIELD_LIMIT }}
|
||||
}
|
||||
},
|
||||
{%- if INDEX_SORTING is sameas true %}
|
||||
"index.sort.field": "@timestamp",
|
||||
"index.sort.order": "desc",
|
||||
{%- endif %}
|
||||
"refresh_interval": "{{ REFRESH }}",
|
||||
"number_of_shards": {{ SHARDS }},
|
||||
"number_of_replicas": {{ REPLICAS }}
|
||||
}
|
||||
}
|
||||
},
|
||||
"composed_of": [
|
||||
"agent-mappings",
|
||||
"dtc-agent-mappings",
|
||||
"base-mappings",
|
||||
"dtc-base-mappings",
|
||||
"client-mappings",
|
||||
"cloud-mappings",
|
||||
"container-mappings",
|
||||
"data_stream-mappings",
|
||||
"destination-mappings",
|
||||
"dll-mappings",
|
||||
"dns-mappings",
|
||||
"dtc-dns-mappings",
|
||||
"ecs-mappings",
|
||||
"dtc-ecs-mappings",
|
||||
"error-mappings",
|
||||
"event-mappings",
|
||||
"dtc-event-mappings",
|
||||
"file-mappings",
|
||||
"dtc-file-mappings",
|
||||
"group-mappings",
|
||||
"host-mappings",
|
||||
"dtc-host-mappings",
|
||||
"http-mappings",
|
||||
"dtc-http-mappings",
|
||||
"log-mappings",
|
||||
"network-mappings",
|
||||
"dtc-network-mappings",
|
||||
"observer-mappings",
|
||||
"dtc-observer-mappings",
|
||||
"orchestrator-mappings",
|
||||
"organization-mappings",
|
||||
"package-mappings",
|
||||
"process-mappings",
|
||||
"dtc-process-mappings",
|
||||
"registry-mappings",
|
||||
"related-mappings",
|
||||
"rule-mappings",
|
||||
"dtc-rule-mappings",
|
||||
"server-mappings",
|
||||
"service-mappings",
|
||||
"dtc-service-mappings",
|
||||
"source-mappings",
|
||||
"threat-mappings",
|
||||
"tls-mappings",
|
||||
"tracing-mappings",
|
||||
"url-mappings",
|
||||
"user_agent-mappings",
|
||||
"dtc-user_agent-mappings",
|
||||
"user-mappings",
|
||||
"dtc-user-mappings",
|
||||
"vulnerability-mappings",
|
||||
"common-settings",
|
||||
"common-dynamic-mappings"
|
||||
],
|
||||
"priority": {{ PRIORITY }},
|
||||
"_meta": {
|
||||
"description": "Composable template that includes SO base fields",
|
||||
"ecs_version": "1.12"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,104 +0,0 @@
|
||||
{%- set INDEX_SORTING = salt['pillar.get']('elasticsearch:index_sorting', False) %}
|
||||
{%- set REPLICAS = salt['pillar.get']('elasticsearch:replicas', 0) %}
|
||||
{%- set SHARDS = salt['pillar.get']('elasticsearch:index_settings:so-netscout:shards', 1) %}
|
||||
{%- set REFRESH = salt['pillar.get']('elasticsearch:index_settings:so-netscout:refresh', '30s') %}
|
||||
{%- set PRIORITY = salt['pillar.get']('elasticsearch:index_settings:so-netscout:priority', 500) %}
|
||||
{%- set FIELD_LIMIT = salt['pillar.get']('elasticsearch:index_settings:so-netscout:field_limit', 3000) %}
|
||||
{
|
||||
"index_patterns": [
|
||||
"so-netscout*"
|
||||
],
|
||||
"template": {
|
||||
"mappings": {
|
||||
"dynamic_templates": [
|
||||
{
|
||||
"strings_as_keyword": {
|
||||
"mapping": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"match_mapping_type": "string"
|
||||
}
|
||||
}
|
||||
],
|
||||
"date_detection": false
|
||||
},
|
||||
"settings": {
|
||||
"index": {
|
||||
"mapping": {
|
||||
"total_fields": {
|
||||
"limit": {{ FIELD_LIMIT }}
|
||||
}
|
||||
},
|
||||
{%- if INDEX_SORTING is sameas true %}
|
||||
"index.sort.field": "@timestamp",
|
||||
"index.sort.order": "desc",
|
||||
{%- endif %}
|
||||
"refresh_interval": "{{ REFRESH }}",
|
||||
"number_of_shards": {{ SHARDS }},
|
||||
"number_of_replicas": {{ REPLICAS }}
|
||||
}
|
||||
}
|
||||
},
|
||||
"composed_of": [
|
||||
"agent-mappings",
|
||||
"dtc-agent-mappings",
|
||||
"base-mappings",
|
||||
"dtc-base-mappings",
|
||||
"client-mappings",
|
||||
"cloud-mappings",
|
||||
"container-mappings",
|
||||
"data_stream-mappings",
|
||||
"destination-mappings",
|
||||
"dll-mappings",
|
||||
"dns-mappings",
|
||||
"dtc-dns-mappings",
|
||||
"ecs-mappings",
|
||||
"dtc-ecs-mappings",
|
||||
"error-mappings",
|
||||
"event-mappings",
|
||||
"dtc-event-mappings",
|
||||
"file-mappings",
|
||||
"dtc-file-mappings",
|
||||
"group-mappings",
|
||||
"host-mappings",
|
||||
"dtc-host-mappings",
|
||||
"http-mappings",
|
||||
"dtc-http-mappings",
|
||||
"log-mappings",
|
||||
"network-mappings",
|
||||
"dtc-network-mappings",
|
||||
"observer-mappings",
|
||||
"dtc-observer-mappings",
|
||||
"orchestrator-mappings",
|
||||
"organization-mappings",
|
||||
"package-mappings",
|
||||
"process-mappings",
|
||||
"dtc-process-mappings",
|
||||
"registry-mappings",
|
||||
"related-mappings",
|
||||
"rule-mappings",
|
||||
"dtc-rule-mappings",
|
||||
"server-mappings",
|
||||
"service-mappings",
|
||||
"dtc-service-mappings",
|
||||
"source-mappings",
|
||||
"threat-mappings",
|
||||
"tls-mappings",
|
||||
"tracing-mappings",
|
||||
"url-mappings",
|
||||
"user_agent-mappings",
|
||||
"dtc-user_agent-mappings",
|
||||
"user-mappings",
|
||||
"dtc-user-mappings",
|
||||
"vulnerability-mappings",
|
||||
"common-settings",
|
||||
"common-dynamic-mappings"
|
||||
],
|
||||
"priority": {{ PRIORITY }},
|
||||
"_meta": {
|
||||
"description": "Composable template that includes SO base fields",
|
||||
"ecs_version": "1.12"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,104 +0,0 @@
|
||||
{%- set INDEX_SORTING = salt['pillar.get']('elasticsearch:index_sorting', False) %}
|
||||
{%- set REPLICAS = salt['pillar.get']('elasticsearch:replicas', 0) %}
|
||||
{%- set SHARDS = salt['pillar.get']('elasticsearch:index_settings:so-o365:shards', 1) %}
|
||||
{%- set REFRESH = salt['pillar.get']('elasticsearch:index_settings:so-o365:refresh', '30s') %}
|
||||
{%- set PRIORITY = salt['pillar.get']('elasticsearch:index_settings:so-o365:priority', 500) %}
|
||||
{%- set FIELD_LIMIT = salt['pillar.get']('elasticsearch:index_settings:so-o365:field_limit', 3000) %}
|
||||
{
|
||||
"index_patterns": [
|
||||
"so-o365*"
|
||||
],
|
||||
"template": {
|
||||
"mappings": {
|
||||
"dynamic_templates": [
|
||||
{
|
||||
"strings_as_keyword": {
|
||||
"mapping": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"match_mapping_type": "string"
|
||||
}
|
||||
}
|
||||
],
|
||||
"date_detection": false
|
||||
},
|
||||
"settings": {
|
||||
"index": {
|
||||
"mapping": {
|
||||
"total_fields": {
|
||||
"limit": {{ FIELD_LIMIT }}
|
||||
}
|
||||
},
|
||||
{%- if INDEX_SORTING is sameas true %}
|
||||
"index.sort.field": "@timestamp",
|
||||
"index.sort.order": "desc",
|
||||
{%- endif %}
|
||||
"refresh_interval": "{{ REFRESH }}",
|
||||
"number_of_shards": {{ SHARDS }},
|
||||
"number_of_replicas": {{ REPLICAS }}
|
||||
}
|
||||
}
|
||||
},
|
||||
"composed_of": [
|
||||
"agent-mappings",
|
||||
"dtc-agent-mappings",
|
||||
"base-mappings",
|
||||
"dtc-base-mappings",
|
||||
"client-mappings",
|
||||
"cloud-mappings",
|
||||
"container-mappings",
|
||||
"data_stream-mappings",
|
||||
"destination-mappings",
|
||||
"dll-mappings",
|
||||
"dns-mappings",
|
||||
"dtc-dns-mappings",
|
||||
"ecs-mappings",
|
||||
"dtc-ecs-mappings",
|
||||
"error-mappings",
|
||||
"event-mappings",
|
||||
"dtc-event-mappings",
|
||||
"file-mappings",
|
||||
"dtc-file-mappings",
|
||||
"group-mappings",
|
||||
"host-mappings",
|
||||
"dtc-host-mappings",
|
||||
"http-mappings",
|
||||
"dtc-http-mappings",
|
||||
"log-mappings",
|
||||
"network-mappings",
|
||||
"dtc-network-mappings",
|
||||
"observer-mappings",
|
||||
"dtc-observer-mappings",
|
||||
"orchestrator-mappings",
|
||||
"organization-mappings",
|
||||
"package-mappings",
|
||||
"process-mappings",
|
||||
"dtc-process-mappings",
|
||||
"registry-mappings",
|
||||
"related-mappings",
|
||||
"rule-mappings",
|
||||
"dtc-rule-mappings",
|
||||
"server-mappings",
|
||||
"service-mappings",
|
||||
"dtc-service-mappings",
|
||||
"source-mappings",
|
||||
"threat-mappings",
|
||||
"tls-mappings",
|
||||
"tracing-mappings",
|
||||
"url-mappings",
|
||||
"user_agent-mappings",
|
||||
"dtc-user_agent-mappings",
|
||||
"user-mappings",
|
||||
"dtc-user-mappings",
|
||||
"vulnerability-mappings",
|
||||
"common-settings",
|
||||
"common-dynamic-mappings"
|
||||
],
|
||||
"priority": {{ PRIORITY }},
|
||||
"_meta": {
|
||||
"description": "Composable template that includes SO base fields",
|
||||
"ecs_version": "1.12"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,104 +0,0 @@
|
||||
{%- set INDEX_SORTING = salt['pillar.get']('elasticsearch:index_sorting', False) %}
|
||||
{%- set REPLICAS = salt['pillar.get']('elasticsearch:replicas', 0) %}
|
||||
{%- set SHARDS = salt['pillar.get']('elasticsearch:index_settings:so-okta:shards', 1) %}
|
||||
{%- set REFRESH = salt['pillar.get']('elasticsearch:index_settings:so-okta:refresh', '30s') %}
|
||||
{%- set PRIORITY = salt['pillar.get']('elasticsearch:index_settings:so-okta:priority', 500) %}
|
||||
{%- set FIELD_LIMIT = salt['pillar.get']('elasticsearch:index_settings:so-okta:field_limit', 3000) %}
|
||||
{
|
||||
"index_patterns": [
|
||||
"so-okta*"
|
||||
],
|
||||
"template": {
|
||||
"mappings": {
|
||||
"dynamic_templates": [
|
||||
{
|
||||
"strings_as_keyword": {
|
||||
"mapping": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"match_mapping_type": "string"
|
||||
}
|
||||
}
|
||||
],
|
||||
"date_detection": false
|
||||
},
|
||||
"settings": {
|
||||
"index": {
|
||||
"mapping": {
|
||||
"total_fields": {
|
||||
"limit": {{ FIELD_LIMIT }}
|
||||
}
|
||||
},
|
||||
{%- if INDEX_SORTING is sameas true %}
|
||||
"index.sort.field": "@timestamp",
|
||||
"index.sort.order": "desc",
|
||||
{%- endif %}
|
||||
"refresh_interval": "{{ REFRESH }}",
|
||||
"number_of_shards": {{ SHARDS }},
|
||||
"number_of_replicas": {{ REPLICAS }}
|
||||
}
|
||||
}
|
||||
},
|
||||
"composed_of": [
|
||||
"agent-mappings",
|
||||
"dtc-agent-mappings",
|
||||
"base-mappings",
|
||||
"dtc-base-mappings",
|
||||
"client-mappings",
|
||||
"cloud-mappings",
|
||||
"container-mappings",
|
||||
"data_stream-mappings",
|
||||
"destination-mappings",
|
||||
"dll-mappings",
|
||||
"dns-mappings",
|
||||
"dtc-dns-mappings",
|
||||
"ecs-mappings",
|
||||
"dtc-ecs-mappings",
|
||||
"error-mappings",
|
||||
"event-mappings",
|
||||
"dtc-event-mappings",
|
||||
"file-mappings",
|
||||
"dtc-file-mappings",
|
||||
"group-mappings",
|
||||
"host-mappings",
|
||||
"dtc-host-mappings",
|
||||
"http-mappings",
|
||||
"dtc-http-mappings",
|
||||
"log-mappings",
|
||||
"network-mappings",
|
||||
"dtc-network-mappings",
|
||||
"observer-mappings",
|
||||
"dtc-observer-mappings",
|
||||
"orchestrator-mappings",
|
||||
"organization-mappings",
|
||||
"package-mappings",
|
||||
"process-mappings",
|
||||
"dtc-process-mappings",
|
||||
"registry-mappings",
|
||||
"related-mappings",
|
||||
"rule-mappings",
|
||||
"dtc-rule-mappings",
|
||||
"server-mappings",
|
||||
"service-mappings",
|
||||
"dtc-service-mappings",
|
||||
"source-mappings",
|
||||
"threat-mappings",
|
||||
"tls-mappings",
|
||||
"tracing-mappings",
|
||||
"url-mappings",
|
||||
"user_agent-mappings",
|
||||
"dtc-user_agent-mappings",
|
||||
"user-mappings",
|
||||
"dtc-user-mappings",
|
||||
"vulnerability-mappings",
|
||||
"common-settings",
|
||||
"common-dynamic-mappings"
|
||||
],
|
||||
"priority": {{ PRIORITY }},
|
||||
"_meta": {
|
||||
"description": "Composable template that includes SO base fields",
|
||||
"ecs_version": "1.12"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,105 +0,0 @@
|
||||
{%- set INDEX_SORTING = salt['pillar.get']('elasticsearch:index_sorting', False) %}
|
||||
{%- set REPLICAS = salt['pillar.get']('elasticsearch:replicas', 0) %}
|
||||
{%- set SHARDS = salt['pillar.get']('elasticsearch:index_settings:so-osquery:shards', 1) %}
|
||||
{%- set REFRESH = salt['pillar.get']('elasticsearch:index_settings:so-osquery:refresh', '30s') %}
|
||||
{%- set PRIORITY = salt['pillar.get']('elasticsearch:index_settings:so-osquery:priority', 500) %}
|
||||
{%- set FIELD_LIMIT = salt['pillar.get']('elasticsearch:index_settings:so-osquery:field_limit', 3000) %}
|
||||
{
|
||||
"index_patterns": [
|
||||
"so-osquery*"
|
||||
],
|
||||
"template": {
|
||||
"mappings": {
|
||||
"dynamic_templates": [
|
||||
{
|
||||
"strings_as_keyword": {
|
||||
"mapping": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"match_mapping_type": "string"
|
||||
}
|
||||
}
|
||||
],
|
||||
"date_detection": false
|
||||
},
|
||||
"settings": {
|
||||
"index": {
|
||||
"mapping": {
|
||||
"total_fields": {
|
||||
"limit": {{ FIELD_LIMIT }}
|
||||
}
|
||||
},
|
||||
{%- if INDEX_SORTING is sameas true %}
|
||||
"index.sort.field": "@timestamp",
|
||||
"index.sort.order": "desc",
|
||||
{%- endif %}
|
||||
"refresh_interval": "{{ REFRESH }}",
|
||||
"number_of_shards": {{ SHARDS }},
|
||||
"number_of_replicas": {{ REPLICAS }}
|
||||
}
|
||||
}
|
||||
},
|
||||
"composed_of": [
|
||||
"agent-mappings",
|
||||
"dtc-agent-mappings",
|
||||
"base-mappings",
|
||||
"dtc-base-mappings",
|
||||
"client-mappings",
|
||||
"cloud-mappings",
|
||||
"container-mappings",
|
||||
"data_stream-mappings",
|
||||
"destination-mappings",
|
||||
"dll-mappings",
|
||||
"dns-mappings",
|
||||
"dtc-dns-mappings",
|
||||
"ecs-mappings",
|
||||
"dtc-ecs-mappings",
|
||||
"error-mappings",
|
||||
"event-mappings",
|
||||
"dtc-event-mappings",
|
||||
"file-mappings",
|
||||
"dtc-file-mappings",
|
||||
"group-mappings",
|
||||
"host-mappings",
|
||||
"dtc-host-mappings",
|
||||
"http-mappings",
|
||||
"dtc-http-mappings",
|
||||
"log-mappings",
|
||||
"network-mappings",
|
||||
"dtc-network-mappings",
|
||||
"observer-mappings",
|
||||
"dtc-observer-mappings",
|
||||
"orchestrator-mappings",
|
||||
"organization-mappings",
|
||||
"package-mappings",
|
||||
"process-mappings",
|
||||
"dtc-process-mappings",
|
||||
"registry-mappings",
|
||||
"related-mappings",
|
||||
"rule-mappings",
|
||||
"dtc-rule-mappings",
|
||||
"server-mappings",
|
||||
"service-mappings",
|
||||
"dtc-service-mappings",
|
||||
"source-mappings",
|
||||
"threat-mappings",
|
||||
"tls-mappings",
|
||||
"tracing-mappings",
|
||||
"url-mappings",
|
||||
"user_agent-mappings",
|
||||
"dtc-user_agent-mappings",
|
||||
"user-mappings",
|
||||
"dtc-user-mappings",
|
||||
"vulnerability-mappings",
|
||||
"common-settings",
|
||||
"common-dynamic-mappings",
|
||||
"winlog-mappings"
|
||||
],
|
||||
"priority": {{ PRIORITY }},
|
||||
"_meta": {
|
||||
"description": "Composable template that includes SO base fields",
|
||||
"ecs_version": "1.12"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,105 +0,0 @@
|
||||
{%- set INDEX_SORTING = salt['pillar.get']('elasticsearch:index_sorting', False) %}
|
||||
{%- set REPLICAS = salt['pillar.get']('elasticsearch:replicas', 0) %}
|
||||
{%- set SHARDS = salt['pillar.get']('elasticsearch:index_settings:so-ossec:shards', 1) %}
|
||||
{%- set REFRESH = salt['pillar.get']('elasticsearch:index_settings:so-ossec:refresh', '30s') %}
|
||||
{%- set PRIORITY = salt['pillar.get']('elasticsearch:index_settings:so-ossec:priority', 500) %}
|
||||
{%- set FIELD_LIMIT = salt['pillar.get']('elasticsearch:index_settings:so-ossec:field_limit', 3000) %}
|
||||
{
|
||||
"index_patterns": [
|
||||
"so-ossec*"
|
||||
],
|
||||
"template": {
|
||||
"mappings": {
|
||||
"dynamic_templates": [
|
||||
{
|
||||
"strings_as_keyword": {
|
||||
"mapping": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"match_mapping_type": "string"
|
||||
}
|
||||
}
|
||||
],
|
||||
"date_detection": false
|
||||
},
|
||||
"settings": {
|
||||
"index": {
|
||||
"mapping": {
|
||||
"total_fields": {
|
||||
"limit": {{ FIELD_LIMIT }}
|
||||
}
|
||||
},
|
||||
{%- if INDEX_SORTING is sameas true %}
|
||||
"index.sort.field": "@timestamp",
|
||||
"index.sort.order": "desc",
|
||||
{%- endif %}
|
||||
"refresh_interval": "{{ REFRESH }}",
|
||||
"number_of_shards": {{ SHARDS }},
|
||||
"number_of_replicas": {{ REPLICAS }}
|
||||
}
|
||||
}
|
||||
},
|
||||
"composed_of": [
|
||||
"agent-mappings",
|
||||
"dtc-agent-mappings",
|
||||
"base-mappings",
|
||||
"dtc-base-mappings",
|
||||
"client-mappings",
|
||||
"cloud-mappings",
|
||||
"container-mappings",
|
||||
"data_stream-mappings",
|
||||
"destination-mappings",
|
||||
"dll-mappings",
|
||||
"dns-mappings",
|
||||
"dtc-dns-mappings",
|
||||
"ecs-mappings",
|
||||
"dtc-ecs-mappings",
|
||||
"error-mappings",
|
||||
"event-mappings",
|
||||
"dtc-event-mappings",
|
||||
"file-mappings",
|
||||
"dtc-file-mappings",
|
||||
"group-mappings",
|
||||
"host-mappings",
|
||||
"dtc-host-mappings",
|
||||
"http-mappings",
|
||||
"dtc-http-mappings",
|
||||
"log-mappings",
|
||||
"network-mappings",
|
||||
"dtc-network-mappings",
|
||||
"observer-mappings",
|
||||
"dtc-observer-mappings",
|
||||
"orchestrator-mappings",
|
||||
"organization-mappings",
|
||||
"package-mappings",
|
||||
"process-mappings",
|
||||
"dtc-process-mappings",
|
||||
"registry-mappings",
|
||||
"related-mappings",
|
||||
"rule-mappings",
|
||||
"dtc-rule-mappings",
|
||||
"server-mappings",
|
||||
"service-mappings",
|
||||
"dtc-service-mappings",
|
||||
"source-mappings",
|
||||
"threat-mappings",
|
||||
"tls-mappings",
|
||||
"tracing-mappings",
|
||||
"url-mappings",
|
||||
"user_agent-mappings",
|
||||
"dtc-user_agent-mappings",
|
||||
"user-mappings",
|
||||
"dtc-user-mappings",
|
||||
"vulnerability-mappings",
|
||||
"common-settings",
|
||||
"common-dynamic-mappings",
|
||||
"winlog-mappings"
|
||||
],
|
||||
"priority": {{ PRIORITY }},
|
||||
"_meta": {
|
||||
"description": "Composable template that includes SO base fields",
|
||||
"ecs_version": "1.12"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,104 +0,0 @@
|
||||
{%- set INDEX_SORTING = salt['pillar.get']('elasticsearch:index_sorting', False) %}
|
||||
{%- set REPLICAS = salt['pillar.get']('elasticsearch:replicas', 0) %}
|
||||
{%- set SHARDS = salt['pillar.get']('elasticsearch:index_settings:so-proofpoint:shards', 1) %}
|
||||
{%- set REFRESH = salt['pillar.get']('elasticsearch:index_settings:so-proofpoint:refresh', '30s') %}
|
||||
{%- set PRIORITY = salt['pillar.get']('elasticsearch:index_settings:so-proofpoint:priority', 500) %}
|
||||
{%- set FIELD_LIMIT = salt['pillar.get']('elasticsearch:index_settings:so-proofpoint:field_limit', 3000) %}
|
||||
{
|
||||
"index_patterns": [
|
||||
"so-proofpoint*"
|
||||
],
|
||||
"template": {
|
||||
"mappings": {
|
||||
"dynamic_templates": [
|
||||
{
|
||||
"strings_as_keyword": {
|
||||
"mapping": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"match_mapping_type": "string"
|
||||
}
|
||||
}
|
||||
],
|
||||
"date_detection": false
|
||||
},
|
||||
"settings": {
|
||||
"index": {
|
||||
"mapping": {
|
||||
"total_fields": {
|
||||
"limit": {{ FIELD_LIMIT }}
|
||||
}
|
||||
},
|
||||
{%- if INDEX_SORTING is sameas true %}
|
||||
"index.sort.field": "@timestamp",
|
||||
"index.sort.order": "desc",
|
||||
{%- endif %}
|
||||
"refresh_interval": "{{ REFRESH }}",
|
||||
"number_of_shards": {{ SHARDS }},
|
||||
"number_of_replicas": {{ REPLICAS }}
|
||||
}
|
||||
}
|
||||
},
|
||||
"composed_of": [
|
||||
"agent-mappings",
|
||||
"dtc-agent-mappings",
|
||||
"base-mappings",
|
||||
"dtc-base-mappings",
|
||||
"client-mappings",
|
||||
"cloud-mappings",
|
||||
"container-mappings",
|
||||
"data_stream-mappings",
|
||||
"destination-mappings",
|
||||
"dll-mappings",
|
||||
"dns-mappings",
|
||||
"dtc-dns-mappings",
|
||||
"ecs-mappings",
|
||||
"dtc-ecs-mappings",
|
||||
"error-mappings",
|
||||
"event-mappings",
|
||||
"dtc-event-mappings",
|
||||
"file-mappings",
|
||||
"dtc-file-mappings",
|
||||
"group-mappings",
|
||||
"host-mappings",
|
||||
"dtc-host-mappings",
|
||||
"http-mappings",
|
||||
"dtc-http-mappings",
|
||||
"log-mappings",
|
||||
"network-mappings",
|
||||
"dtc-network-mappings",
|
||||
"observer-mappings",
|
||||
"dtc-observer-mappings",
|
||||
"orchestrator-mappings",
|
||||
"organization-mappings",
|
||||
"package-mappings",
|
||||
"process-mappings",
|
||||
"dtc-process-mappings",
|
||||
"registry-mappings",
|
||||
"related-mappings",
|
||||
"rule-mappings",
|
||||
"dtc-rule-mappings",
|
||||
"server-mappings",
|
||||
"service-mappings",
|
||||
"dtc-service-mappings",
|
||||
"source-mappings",
|
||||
"threat-mappings",
|
||||
"tls-mappings",
|
||||
"tracing-mappings",
|
||||
"url-mappings",
|
||||
"user_agent-mappings",
|
||||
"dtc-user_agent-mappings",
|
||||
"user-mappings",
|
||||
"dtc-user-mappings",
|
||||
"vulnerability-mappings",
|
||||
"common-settings",
|
||||
"common-dynamic-mappings"
|
||||
],
|
||||
"priority": {{ PRIORITY }},
|
||||
"_meta": {
|
||||
"description": "Composable template that includes SO base fields",
|
||||
"ecs_version": "1.12"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,104 +0,0 @@
|
||||
{%- set INDEX_SORTING = salt['pillar.get']('elasticsearch:index_sorting', False) %}
|
||||
{%- set REPLICAS = salt['pillar.get']('elasticsearch:replicas', 0) %}
|
||||
{%- set SHARDS = salt['pillar.get']('elasticsearch:index_settings:so-radware:shards', 1) %}
|
||||
{%- set REFRESH = salt['pillar.get']('elasticsearch:index_settings:so-radware:refresh', '30s') %}
|
||||
{%- set PRIORITY = salt['pillar.get']('elasticsearch:index_settings:so-radware:priority', 500) %}
|
||||
{%- set FIELD_LIMIT = salt['pillar.get']('elasticsearch:index_settings:so-radware:field_limit', 3000) %}
|
||||
{
|
||||
"index_patterns": [
|
||||
"so-radware*"
|
||||
],
|
||||
"template": {
|
||||
"mappings": {
|
||||
"dynamic_templates": [
|
||||
{
|
||||
"strings_as_keyword": {
|
||||
"mapping": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"match_mapping_type": "string"
|
||||
}
|
||||
}
|
||||
],
|
||||
"date_detection": false
|
||||
},
|
||||
"settings": {
|
||||
"index": {
|
||||
"mapping": {
|
||||
"total_fields": {
|
||||
"limit": {{ FIELD_LIMIT }}
|
||||
}
|
||||
},
|
||||
{%- if INDEX_SORTING is sameas true %}
|
||||
"index.sort.field": "@timestamp",
|
||||
"index.sort.order": "desc",
|
||||
{%- endif %}
|
||||
"refresh_interval": "{{ REFRESH }}",
|
||||
"number_of_shards": {{ SHARDS }},
|
||||
"number_of_replicas": {{ REPLICAS }}
|
||||
}
|
||||
}
|
||||
},
|
||||
"composed_of": [
|
||||
"agent-mappings",
|
||||
"dtc-agent-mappings",
|
||||
"base-mappings",
|
||||
"dtc-base-mappings",
|
||||
"client-mappings",
|
||||
"cloud-mappings",
|
||||
"container-mappings",
|
||||
"data_stream-mappings",
|
||||
"destination-mappings",
|
||||
"dll-mappings",
|
||||
"dns-mappings",
|
||||
"dtc-dns-mappings",
|
||||
"ecs-mappings",
|
||||
"dtc-ecs-mappings",
|
||||
"error-mappings",
|
||||
"event-mappings",
|
||||
"dtc-event-mappings",
|
||||
"file-mappings",
|
||||
"dtc-file-mappings",
|
||||
"group-mappings",
|
||||
"host-mappings",
|
||||
"dtc-host-mappings",
|
||||
"http-mappings",
|
||||
"dtc-http-mappings",
|
||||
"log-mappings",
|
||||
"network-mappings",
|
||||
"dtc-network-mappings",
|
||||
"observer-mappings",
|
||||
"dtc-observer-mappings",
|
||||
"orchestrator-mappings",
|
||||
"organization-mappings",
|
||||
"package-mappings",
|
||||
"process-mappings",
|
||||
"dtc-process-mappings",
|
||||
"registry-mappings",
|
||||
"related-mappings",
|
||||
"rule-mappings",
|
||||
"dtc-rule-mappings",
|
||||
"server-mappings",
|
||||
"service-mappings",
|
||||
"dtc-service-mappings",
|
||||
"source-mappings",
|
||||
"threat-mappings",
|
||||
"tls-mappings",
|
||||
"tracing-mappings",
|
||||
"url-mappings",
|
||||
"user_agent-mappings",
|
||||
"dtc-user_agent-mappings",
|
||||
"user-mappings",
|
||||
"dtc-user-mappings",
|
||||
"vulnerability-mappings",
|
||||
"common-settings",
|
||||
"common-dynamic-mappings"
|
||||
],
|
||||
"priority": {{ PRIORITY }},
|
||||
"_meta": {
|
||||
"description": "Composable template that includes SO base fields",
|
||||
"ecs_version": "1.12"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,104 +0,0 @@
|
||||
{%- set INDEX_SORTING = salt['pillar.get']('elasticsearch:index_sorting', False) %}
|
||||
{%- set REPLICAS = salt['pillar.get']('elasticsearch:replicas', 0) %}
|
||||
{%- set SHARDS = salt['pillar.get']('elasticsearch:index_settings:so-redis:shards', 1) %}
|
||||
{%- set REFRESH = salt['pillar.get']('elasticsearch:index_settings:so-redis:refresh', '30s') %}
|
||||
{%- set PRIORITY = salt['pillar.get']('elasticsearch:index_settings:so-redis:priority', 500) %}
|
||||
{%- set FIELD_LIMIT = salt['pillar.get']('elasticsearch:index_settings:so-redis:field_limit', 3000) %}
|
||||
{
|
||||
"index_patterns": [
|
||||
"so-redis*"
|
||||
],
|
||||
"template": {
|
||||
"mappings": {
|
||||
"dynamic_templates": [
|
||||
{
|
||||
"strings_as_keyword": {
|
||||
"mapping": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"match_mapping_type": "string"
|
||||
}
|
||||
}
|
||||
],
|
||||
"date_detection": false
|
||||
},
|
||||
"settings": {
|
||||
"index": {
|
||||
"mapping": {
|
||||
"total_fields": {
|
||||
"limit": {{ FIELD_LIMIT }}
|
||||
}
|
||||
},
|
||||
{%- if INDEX_SORTING is sameas true %}
|
||||
"index.sort.field": "@timestamp",
|
||||
"index.sort.order": "desc",
|
||||
{%- endif %}
|
||||
"refresh_interval": "{{ REFRESH }}",
|
||||
"number_of_shards": {{ SHARDS }},
|
||||
"number_of_replicas": {{ REPLICAS }}
|
||||
}
|
||||
}
|
||||
},
|
||||
"composed_of": [
|
||||
"agent-mappings",
|
||||
"dtc-agent-mappings",
|
||||
"base-mappings",
|
||||
"dtc-base-mappings",
|
||||
"client-mappings",
|
||||
"cloud-mappings",
|
||||
"container-mappings",
|
||||
"data_stream-mappings",
|
||||
"destination-mappings",
|
||||
"dll-mappings",
|
||||
"dns-mappings",
|
||||
"dtc-dns-mappings",
|
||||
"ecs-mappings",
|
||||
"dtc-ecs-mappings",
|
||||
"error-mappings",
|
||||
"event-mappings",
|
||||
"dtc-event-mappings",
|
||||
"file-mappings",
|
||||
"dtc-file-mappings",
|
||||
"group-mappings",
|
||||
"host-mappings",
|
||||
"dtc-host-mappings",
|
||||
"http-mappings",
|
||||
"dtc-http-mappings",
|
||||
"log-mappings",
|
||||
"network-mappings",
|
||||
"dtc-network-mappings",
|
||||
"observer-mappings",
|
||||
"dtc-observer-mappings",
|
||||
"orchestrator-mappings",
|
||||
"organization-mappings",
|
||||
"package-mappings",
|
||||
"process-mappings",
|
||||
"dtc-process-mappings",
|
||||
"registry-mappings",
|
||||
"related-mappings",
|
||||
"rule-mappings",
|
||||
"dtc-rule-mappings",
|
||||
"server-mappings",
|
||||
"service-mappings",
|
||||
"dtc-service-mappings",
|
||||
"source-mappings",
|
||||
"threat-mappings",
|
||||
"tls-mappings",
|
||||
"tracing-mappings",
|
||||
"url-mappings",
|
||||
"user_agent-mappings",
|
||||
"dtc-user_agent-mappings",
|
||||
"user-mappings",
|
||||
"dtc-user-mappings",
|
||||
"vulnerability-mappings",
|
||||
"common-settings",
|
||||
"common-dynamic-mappings"
|
||||
],
|
||||
"priority": {{ PRIORITY }},
|
||||
"_meta": {
|
||||
"description": "Composable template that includes SO base fields",
|
||||
"ecs_version": "1.12"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,104 +0,0 @@
|
||||
{%- set INDEX_SORTING = salt['pillar.get']('elasticsearch:index_sorting', False) %}
|
||||
{%- set REPLICAS = salt['pillar.get']('elasticsearch:replicas', 0) %}
|
||||
{%- set SHARDS = salt['pillar.get']('elasticsearch:index_settings:so-snort:shards', 1) %}
|
||||
{%- set REFRESH = salt['pillar.get']('elasticsearch:index_settings:so-snort:refresh', '30s') %}
|
||||
{%- set PRIORITY = salt['pillar.get']('elasticsearch:index_settings:so-snort:priority', 500) %}
|
||||
{%- set FIELD_LIMIT = salt['pillar.get']('elasticsearch:index_settings:so-snort:field_limit', 3000) %}
|
||||
{
|
||||
"index_patterns": [
|
||||
"so-snort*"
|
||||
],
|
||||
"template": {
|
||||
"mappings": {
|
||||
"dynamic_templates": [
|
||||
{
|
||||
"strings_as_keyword": {
|
||||
"mapping": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"match_mapping_type": "string"
|
||||
}
|
||||
}
|
||||
],
|
||||
"date_detection": false
|
||||
},
|
||||
"settings": {
|
||||
"index": {
|
||||
"mapping": {
|
||||
"total_fields": {
|
||||
"limit": {{ FIELD_LIMIT }}
|
||||
}
|
||||
},
|
||||
{%- if INDEX_SORTING is sameas true %}
|
||||
"index.sort.field": "@timestamp",
|
||||
"index.sort.order": "desc",
|
||||
{%- endif %}
|
||||
"refresh_interval": "{{ REFRESH }}",
|
||||
"number_of_shards": {{ SHARDS }},
|
||||
"number_of_replicas": {{ REPLICAS }}
|
||||
}
|
||||
}
|
||||
},
|
||||
"composed_of": [
|
||||
"agent-mappings",
|
||||
"dtc-agent-mappings",
|
||||
"base-mappings",
|
||||
"dtc-base-mappings",
|
||||
"client-mappings",
|
||||
"cloud-mappings",
|
||||
"container-mappings",
|
||||
"data_stream-mappings",
|
||||
"destination-mappings",
|
||||
"dll-mappings",
|
||||
"dns-mappings",
|
||||
"dtc-dns-mappings",
|
||||
"ecs-mappings",
|
||||
"dtc-ecs-mappings",
|
||||
"error-mappings",
|
||||
"event-mappings",
|
||||
"dtc-event-mappings",
|
||||
"file-mappings",
|
||||
"dtc-file-mappings",
|
||||
"group-mappings",
|
||||
"host-mappings",
|
||||
"dtc-host-mappings",
|
||||
"http-mappings",
|
||||
"dtc-http-mappings",
|
||||
"log-mappings",
|
||||
"network-mappings",
|
||||
"dtc-network-mappings",
|
||||
"observer-mappings",
|
||||
"dtc-observer-mappings",
|
||||
"orchestrator-mappings",
|
||||
"organization-mappings",
|
||||
"package-mappings",
|
||||
"process-mappings",
|
||||
"dtc-process-mappings",
|
||||
"registry-mappings",
|
||||
"related-mappings",
|
||||
"rule-mappings",
|
||||
"dtc-rule-mappings",
|
||||
"server-mappings",
|
||||
"service-mappings",
|
||||
"dtc-service-mappings",
|
||||
"source-mappings",
|
||||
"threat-mappings",
|
||||
"tls-mappings",
|
||||
"tracing-mappings",
|
||||
"url-mappings",
|
||||
"user_agent-mappings",
|
||||
"dtc-user_agent-mappings",
|
||||
"user-mappings",
|
||||
"dtc-user-mappings",
|
||||
"vulnerability-mappings",
|
||||
"common-settings",
|
||||
"common-dynamic-mappings"
|
||||
],
|
||||
"priority": {{ PRIORITY }},
|
||||
"_meta": {
|
||||
"description": "Composable template that includes SO base fields",
|
||||
"ecs_version": "1.12"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,104 +0,0 @@
|
||||
{%- set INDEX_SORTING = salt['pillar.get']('elasticsearch:index_sorting', False) %}
|
||||
{%- set REPLICAS = salt['pillar.get']('elasticsearch:replicas', 0) %}
|
||||
{%- set SHARDS = salt['pillar.get']('elasticsearch:index_settings:so-snyk:shards', 1) %}
|
||||
{%- set REFRESH = salt['pillar.get']('elasticsearch:index_settings:so-snyk:refresh', '30s') %}
|
||||
{%- set PRIORITY = salt['pillar.get']('elasticsearch:index_settings:so-snyk:priority', 500) %}
|
||||
{%- set FIELD_LIMIT = salt['pillar.get']('elasticsearch:index_settings:so-snyk:field_limit', 3000) %}
|
||||
{
|
||||
"index_patterns": [
|
||||
"so-snyk*"
|
||||
],
|
||||
"template": {
|
||||
"mappings": {
|
||||
"dynamic_templates": [
|
||||
{
|
||||
"strings_as_keyword": {
|
||||
"mapping": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"match_mapping_type": "string"
|
||||
}
|
||||
}
|
||||
],
|
||||
"date_detection": false
|
||||
},
|
||||
"settings": {
|
||||
"index": {
|
||||
"mapping": {
|
||||
"total_fields": {
|
||||
"limit": {{ FIELD_LIMIT }}
|
||||
}
|
||||
},
|
||||
{%- if INDEX_SORTING is sameas true %}
|
||||
"index.sort.field": "@timestamp",
|
||||
"index.sort.order": "desc",
|
||||
{%- endif %}
|
||||
"refresh_interval": "{{ REFRESH }}",
|
||||
"number_of_shards": {{ SHARDS }},
|
||||
"number_of_replicas": {{ REPLICAS }}
|
||||
}
|
||||
}
|
||||
},
|
||||
"composed_of": [
|
||||
"agent-mappings",
|
||||
"dtc-agent-mappings",
|
||||
"base-mappings",
|
||||
"dtc-base-mappings",
|
||||
"client-mappings",
|
||||
"cloud-mappings",
|
||||
"container-mappings",
|
||||
"data_stream-mappings",
|
||||
"destination-mappings",
|
||||
"dll-mappings",
|
||||
"dns-mappings",
|
||||
"dtc-dns-mappings",
|
||||
"ecs-mappings",
|
||||
"dtc-ecs-mappings",
|
||||
"error-mappings",
|
||||
"event-mappings",
|
||||
"dtc-event-mappings",
|
||||
"file-mappings",
|
||||
"dtc-file-mappings",
|
||||
"group-mappings",
|
||||
"host-mappings",
|
||||
"dtc-host-mappings",
|
||||
"http-mappings",
|
||||
"dtc-http-mappings",
|
||||
"log-mappings",
|
||||
"network-mappings",
|
||||
"dtc-network-mappings",
|
||||
"observer-mappings",
|
||||
"dtc-observer-mappings",
|
||||
"orchestrator-mappings",
|
||||
"organization-mappings",
|
||||
"package-mappings",
|
||||
"process-mappings",
|
||||
"dtc-process-mappings",
|
||||
"registry-mappings",
|
||||
"related-mappings",
|
||||
"rule-mappings",
|
||||
"dtc-rule-mappings",
|
||||
"server-mappings",
|
||||
"service-mappings",
|
||||
"dtc-service-mappings",
|
||||
"source-mappings",
|
||||
"threat-mappings",
|
||||
"tls-mappings",
|
||||
"tracing-mappings",
|
||||
"url-mappings",
|
||||
"user_agent-mappings",
|
||||
"dtc-user_agent-mappings",
|
||||
"user-mappings",
|
||||
"dtc-user-mappings",
|
||||
"vulnerability-mappings",
|
||||
"common-settings",
|
||||
"common-dynamic-mappings"
|
||||
],
|
||||
"priority": {{ PRIORITY }},
|
||||
"_meta": {
|
||||
"description": "Composable template that includes SO base fields",
|
||||
"ecs_version": "1.12"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,104 +0,0 @@
|
||||
i%- set INDEX_SORTING = salt['pillar.get']('elasticsearch:index_sorting', False) %}
|
||||
{%- set REPLICAS = salt['pillar.get']('elasticsearch:replicas', 0) %}
|
||||
{%- set SHARDS = salt['pillar.get']('elasticsearch:index_settings:so-sonicwall:shards', 1) %}
|
||||
{%- set REFRESH = salt['pillar.get']('elasticsearch:index_settings:so-sonicwall:refresh', '30s') %}
|
||||
{%- set PRIORITY = salt['pillar.get']('elasticsearch:index_settings:so-sonicwall:priority', 500) %}
|
||||
{%- set FIELD_LIMIT = salt['pillar.get']('elasticsearch:index_settings:so-sonicwall:field_limit', 3000) %}
|
||||
{
|
||||
"index_patterns": [
|
||||
"so-sonicwall*"
|
||||
],
|
||||
"template": {
|
||||
"mappings": {
|
||||
"dynamic_templates": [
|
||||
{
|
||||
"strings_as_keyword": {
|
||||
"mapping": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"match_mapping_type": "string"
|
||||
}
|
||||
}
|
||||
],
|
||||
"date_detection": false
|
||||
},
|
||||
"settings": {
|
||||
"index": {
|
||||
"mapping": {
|
||||
"total_fields": {
|
||||
"limit": {{ FIELD_LIMIT }}
|
||||
}
|
||||
},
|
||||
{%- if INDEX_SORTING is sameas true %}
|
||||
"index.sort.field": "@timestamp",
|
||||
"index.sort.order": "desc",
|
||||
{%- endif %}
|
||||
"refresh_interval": "{{ REFRESH }}",
|
||||
"number_of_shards": {{ SHARDS }},
|
||||
"number_of_replicas": {{ REPLICAS }}
|
||||
}
|
||||
}
|
||||
},
|
||||
"composed_of": [
|
||||
"agent-mappings",
|
||||
"dtc-agent-mappings",
|
||||
"base-mappings",
|
||||
"dtc-base-mappings",
|
||||
"client-mappings",
|
||||
"cloud-mappings",
|
||||
"container-mappings",
|
||||
"data_stream-mappings",
|
||||
"destination-mappings",
|
||||
"dll-mappings",
|
||||
"dns-mappings",
|
||||
"dtc-dns-mappings",
|
||||
"ecs-mappings",
|
||||
"dtc-ecs-mappings",
|
||||
"error-mappings",
|
||||
"event-mappings",
|
||||
"dtc-event-mappings",
|
||||
"file-mappings",
|
||||
"dtc-file-mappings",
|
||||
"group-mappings",
|
||||
"host-mappings",
|
||||
"dtc-host-mappings",
|
||||
"http-mappings",
|
||||
"dtc-http-mappings",
|
||||
"log-mappings",
|
||||
"network-mappings",
|
||||
"dtc-network-mappings",
|
||||
"observer-mappings",
|
||||
"dtc-observer-mappings",
|
||||
"orchestrator-mappings",
|
||||
"organization-mappings",
|
||||
"package-mappings",
|
||||
"process-mappings",
|
||||
"dtc-process-mappings",
|
||||
"registry-mappings",
|
||||
"related-mappings",
|
||||
"rule-mappings",
|
||||
"dtc-rule-mappings",
|
||||
"server-mappings",
|
||||
"service-mappings",
|
||||
"dtc-service-mappings",
|
||||
"source-mappings",
|
||||
"threat-mappings",
|
||||
"tls-mappings",
|
||||
"tracing-mappings",
|
||||
"url-mappings",
|
||||
"user_agent-mappings",
|
||||
"dtc-user_agent-mappings",
|
||||
"user-mappings",
|
||||
"dtc-user-mappings",
|
||||
"vulnerability-mappings",
|
||||
"common-settings",
|
||||
"common-dynamic-mappings"
|
||||
],
|
||||
"priority": {{ PRIORITY }},
|
||||
"_meta": {
|
||||
"description": "Composable template that includes SO base fields",
|
||||
"ecs_version": "1.12"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,104 +0,0 @@
|
||||
{%- set INDEX_SORTING = salt['pillar.get']('elasticsearch:index_sorting', False) %}
|
||||
{%- set REPLICAS = salt['pillar.get']('elasticsearch:replicas', 0) %}
|
||||
{%- set SHARDS = salt['pillar.get']('elasticsearch:index_settings:so-sophos:shards', 1) %}
|
||||
{%- set REFRESH = salt['pillar.get']('elasticsearch:index_settings:so-sophos:refresh', '30s') %}
|
||||
{%- set PRIORITY = salt['pillar.get']('elasticsearch:index_settings:so-sophos:priority', 500) %}
|
||||
{%- set FIELD_LIMIT = salt['pillar.get']('elasticsearch:index_settings:so-sophos:field_limit', 3000) %}
|
||||
{
|
||||
"index_patterns": [
|
||||
"so-sophos*"
|
||||
],
|
||||
"template": {
|
||||
"mappings": {
|
||||
"dynamic_templates": [
|
||||
{
|
||||
"strings_as_keyword": {
|
||||
"mapping": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"match_mapping_type": "string"
|
||||
}
|
||||
}
|
||||
],
|
||||
"date_detection": false
|
||||
},
|
||||
"settings": {
|
||||
"index": {
|
||||
"mapping": {
|
||||
"total_fields": {
|
||||
"limit": {{ FIELD_LIMIT }}
|
||||
}
|
||||
},
|
||||
{%- if INDEX_SORTING is sameas true %}
|
||||
"index.sort.field": "@timestamp",
|
||||
"index.sort.order": "desc",
|
||||
{%- endif %}
|
||||
"refresh_interval": "{{ REFRESH }}",
|
||||
"number_of_shards": {{ SHARDS }},
|
||||
"number_of_replicas": {{ REPLICAS }}
|
||||
}
|
||||
}
|
||||
},
|
||||
"composed_of": [
|
||||
"agent-mappings",
|
||||
"dtc-agent-mappings",
|
||||
"base-mappings",
|
||||
"dtc-base-mappings",
|
||||
"client-mappings",
|
||||
"cloud-mappings",
|
||||
"container-mappings",
|
||||
"data_stream-mappings",
|
||||
"destination-mappings",
|
||||
"dll-mappings",
|
||||
"dns-mappings",
|
||||
"dtc-dns-mappings",
|
||||
"ecs-mappings",
|
||||
"dtc-ecs-mappings",
|
||||
"error-mappings",
|
||||
"event-mappings",
|
||||
"dtc-event-mappings",
|
||||
"file-mappings",
|
||||
"dtc-file-mappings",
|
||||
"group-mappings",
|
||||
"host-mappings",
|
||||
"dtc-host-mappings",
|
||||
"http-mappings",
|
||||
"dtc-http-mappings",
|
||||
"log-mappings",
|
||||
"network-mappings",
|
||||
"dtc-network-mappings",
|
||||
"observer-mappings",
|
||||
"dtc-observer-mappings",
|
||||
"orchestrator-mappings",
|
||||
"organization-mappings",
|
||||
"package-mappings",
|
||||
"process-mappings",
|
||||
"dtc-process-mappings",
|
||||
"registry-mappings",
|
||||
"related-mappings",
|
||||
"rule-mappings",
|
||||
"dtc-rule-mappings",
|
||||
"server-mappings",
|
||||
"service-mappings",
|
||||
"dtc-service-mappings",
|
||||
"source-mappings",
|
||||
"threat-mappings",
|
||||
"tls-mappings",
|
||||
"tracing-mappings",
|
||||
"url-mappings",
|
||||
"user_agent-mappings",
|
||||
"dtc-user_agent-mappings",
|
||||
"user-mappings",
|
||||
"dtc-user-mappings",
|
||||
"vulnerability-mappings",
|
||||
"common-settings",
|
||||
"common-dynamic-mappings"
|
||||
],
|
||||
"priority": {{ PRIORITY }},
|
||||
"_meta": {
|
||||
"description": "Composable template that includes SO base fields",
|
||||
"ecs_version": "1.12"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,104 +0,0 @@
|
||||
{%- set INDEX_SORTING = salt['pillar.get']('elasticsearch:index_sorting', False) %}
|
||||
{%- set REPLICAS = salt['pillar.get']('elasticsearch:replicas', 0) %}
|
||||
{%- set SHARDS = salt['pillar.get']('elasticsearch:index_settings:so-squid:shards', 1) %}
|
||||
{%- set REFRESH = salt['pillar.get']('elasticsearch:index_settings:so-squid:refresh', '30s') %}
|
||||
{%- set PRIORITY = salt['pillar.get']('elasticsearch:index_settings:so-squid:priority', 500) %}
|
||||
{%- set FIELD_LIMIT = salt['pillar.get']('elasticsearch:index_settings:so-squid:field_limit', 3000) %}
|
||||
{
|
||||
"index_patterns": [
|
||||
"so-squid*"
|
||||
],
|
||||
"template": {
|
||||
"mappings": {
|
||||
"dynamic_templates": [
|
||||
{
|
||||
"strings_as_keyword": {
|
||||
"mapping": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"match_mapping_type": "string"
|
||||
}
|
||||
}
|
||||
],
|
||||
"date_detection": false
|
||||
},
|
||||
"settings": {
|
||||
"index": {
|
||||
"mapping": {
|
||||
"total_fields": {
|
||||
"limit": {{ FIELD_LIMIT }}
|
||||
}
|
||||
},
|
||||
{%- if INDEX_SORTING is sameas true %}
|
||||
"index.sort.field": "@timestamp",
|
||||
"index.sort.order": "desc",
|
||||
{%- endif %}
|
||||
"refresh_interval": "{{ REFRESH }}",
|
||||
"number_of_shards": {{ SHARDS }},
|
||||
"number_of_replicas": {{ REPLICAS }}
|
||||
}
|
||||
}
|
||||
},
|
||||
"composed_of": [
|
||||
"agent-mappings",
|
||||
"dtc-agent-mappings",
|
||||
"base-mappings",
|
||||
"dtc-base-mappings",
|
||||
"client-mappings",
|
||||
"cloud-mappings",
|
||||
"container-mappings",
|
||||
"data_stream-mappings",
|
||||
"destination-mappings",
|
||||
"dll-mappings",
|
||||
"dns-mappings",
|
||||
"dtc-dns-mappings",
|
||||
"ecs-mappings",
|
||||
"dtc-ecs-mappings",
|
||||
"error-mappings",
|
||||
"event-mappings",
|
||||
"dtc-event-mappings",
|
||||
"file-mappings",
|
||||
"dtc-file-mappings",
|
||||
"group-mappings",
|
||||
"host-mappings",
|
||||
"dtc-host-mappings",
|
||||
"http-mappings",
|
||||
"dtc-http-mappings",
|
||||
"log-mappings",
|
||||
"network-mappings",
|
||||
"dtc-network-mappings",
|
||||
"observer-mappings",
|
||||
"dtc-observer-mappings",
|
||||
"orchestrator-mappings",
|
||||
"organization-mappings",
|
||||
"package-mappings",
|
||||
"process-mappings",
|
||||
"dtc-process-mappings",
|
||||
"registry-mappings",
|
||||
"related-mappings",
|
||||
"rule-mappings",
|
||||
"dtc-rule-mappings",
|
||||
"server-mappings",
|
||||
"service-mappings",
|
||||
"dtc-service-mappings",
|
||||
"source-mappings",
|
||||
"threat-mappings",
|
||||
"tls-mappings",
|
||||
"tracing-mappings",
|
||||
"url-mappings",
|
||||
"user_agent-mappings",
|
||||
"dtc-user_agent-mappings",
|
||||
"user-mappings",
|
||||
"dtc-user-mappings",
|
||||
"vulnerability-mappings",
|
||||
"common-settings",
|
||||
"common-dynamic-mappings"
|
||||
],
|
||||
"priority": {{ PRIORITY }},
|
||||
"_meta": {
|
||||
"description": "Composable template that includes SO base fields",
|
||||
"ecs_version": "1.12"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,105 +0,0 @@
|
||||
{%- set INDEX_SORTING = salt['pillar.get']('elasticsearch:index_sorting', False) %}
|
||||
{%- set REPLICAS = salt['pillar.get']('elasticsearch:replicas', 0) %}
|
||||
{%- set SHARDS = salt['pillar.get']('elasticsearch:index_settings:so-strelka:shards', 1) %}
|
||||
{%- set REFRESH = salt['pillar.get']('elasticsearch:index_settings:so-strelka:refresh', '30s') %}
|
||||
{%- set PRIORITY = salt['pillar.get']('elasticsearch:index_settings:so-strelka:priority', 500) %}
|
||||
{%- set FIELD_LIMIT = salt['pillar.get']('elasticsearch:index_settings:so-strelka:field_limit', 3000) %}
|
||||
{
|
||||
"index_patterns": [
|
||||
"so-strelka*"
|
||||
],
|
||||
"template": {
|
||||
"mappings": {
|
||||
"dynamic_templates": [
|
||||
{
|
||||
"strings_as_keyword": {
|
||||
"mapping": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"match_mapping_type": "string"
|
||||
}
|
||||
}
|
||||
],
|
||||
"date_detection": false
|
||||
},
|
||||
"settings": {
|
||||
"index": {
|
||||
"mapping": {
|
||||
"total_fields": {
|
||||
"limit": {{ FIELD_LIMIT }}
|
||||
}
|
||||
},
|
||||
{%- if INDEX_SORTING is sameas true %}
|
||||
"index.sort.field": "@timestamp",
|
||||
"index.sort.order": "desc",
|
||||
{%- endif %}
|
||||
"refresh_interval": "{{ REFRESH }}",
|
||||
"number_of_shards": {{ SHARDS }},
|
||||
"number_of_replicas": {{ REPLICAS }}
|
||||
}
|
||||
}
|
||||
},
|
||||
"composed_of": [
|
||||
"agent-mappings",
|
||||
"dtc-agent-mappings",
|
||||
"base-mappings",
|
||||
"dtc-base-mappings",
|
||||
"client-mappings",
|
||||
"cloud-mappings",
|
||||
"container-mappings",
|
||||
"data_stream-mappings",
|
||||
"destination-mappings",
|
||||
"dll-mappings",
|
||||
"dns-mappings",
|
||||
"dtc-dns-mappings",
|
||||
"ecs-mappings",
|
||||
"dtc-ecs-mappings",
|
||||
"error-mappings",
|
||||
"event-mappings",
|
||||
"dtc-event-mappings",
|
||||
"file-mappings",
|
||||
"dtc-file-mappings",
|
||||
"so-file-mappings",
|
||||
"group-mappings",
|
||||
"host-mappings",
|
||||
"dtc-host-mappings",
|
||||
"http-mappings",
|
||||
"dtc-http-mappings",
|
||||
"log-mappings",
|
||||
"network-mappings",
|
||||
"dtc-network-mappings",
|
||||
"observer-mappings",
|
||||
"dtc-observer-mappings",
|
||||
"orchestrator-mappings",
|
||||
"organization-mappings",
|
||||
"package-mappings",
|
||||
"process-mappings",
|
||||
"dtc-process-mappings",
|
||||
"registry-mappings",
|
||||
"related-mappings",
|
||||
"rule-mappings",
|
||||
"dtc-rule-mappings",
|
||||
"server-mappings",
|
||||
"service-mappings",
|
||||
"dtc-service-mappings",
|
||||
"source-mappings",
|
||||
"threat-mappings",
|
||||
"tls-mappings",
|
||||
"tracing-mappings",
|
||||
"url-mappings",
|
||||
"user_agent-mappings",
|
||||
"dtc-user_agent-mappings",
|
||||
"user-mappings",
|
||||
"dtc-user-mappings",
|
||||
"vulnerability-mappings",
|
||||
"common-settings",
|
||||
"common-dynamic-mappings"
|
||||
],
|
||||
"priority": {{ PRIORITY }},
|
||||
"_meta": {
|
||||
"description": "Composable template that includes SO base fields",
|
||||
"ecs_version": "1.12"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,104 +0,0 @@
|
||||
{%- set INDEX_SORTING = salt['pillar.get']('elasticsearch:index_sorting', False) %}
|
||||
{%- set REPLICAS = salt['pillar.get']('elasticsearch:replicas', 0) %}
|
||||
{%- set SHARDS = salt['pillar.get']('elasticsearch:index_settings:so-syslog:shards', 1) %}
|
||||
{%- set REFRESH = salt['pillar.get']('elasticsearch:index_settings:so-syslog:refresh', '30s') %}
|
||||
{%- set PRIORITY = salt['pillar.get']('elasticsearch:index_settings:so-syslog:priority', 500) %}
|
||||
{%- set FIELD_LIMIT = salt['pillar.get']('elasticsearch:index_settings:so-syslog:field_limit', 3000) %}
|
||||
{
|
||||
"index_patterns": [
|
||||
"so-syslog*"
|
||||
],
|
||||
"template": {
|
||||
"mappings": {
|
||||
"dynamic_templates": [
|
||||
{
|
||||
"strings_as_keyword": {
|
||||
"mapping": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"match_mapping_type": "string"
|
||||
}
|
||||
}
|
||||
],
|
||||
"date_detection": false
|
||||
},
|
||||
"settings": {
|
||||
"index": {
|
||||
"mapping": {
|
||||
"total_fields": {
|
||||
"limit": {{ FIELD_LIMIT }}
|
||||
}
|
||||
},
|
||||
{%- if INDEX_SORTING is sameas true %}
|
||||
"index.sort.field": "@timestamp",
|
||||
"index.sort.order": "desc",
|
||||
{%- endif %}
|
||||
"refresh_interval": "{{ REFRESH }}",
|
||||
"number_of_shards": {{ SHARDS }},
|
||||
"number_of_replicas": {{ REPLICAS }}
|
||||
}
|
||||
}
|
||||
},
|
||||
"composed_of": [
|
||||
"agent-mappings",
|
||||
"dtc-agent-mappings",
|
||||
"base-mappings",
|
||||
"dtc-base-mappings",
|
||||
"client-mappings",
|
||||
"cloud-mappings",
|
||||
"container-mappings",
|
||||
"data_stream-mappings",
|
||||
"destination-mappings",
|
||||
"dll-mappings",
|
||||
"dns-mappings",
|
||||
"dtc-dns-mappings",
|
||||
"ecs-mappings",
|
||||
"dtc-ecs-mappings",
|
||||
"error-mappings",
|
||||
"event-mappings",
|
||||
"dtc-event-mappings",
|
||||
"file-mappings",
|
||||
"dtc-file-mappings",
|
||||
"group-mappings",
|
||||
"host-mappings",
|
||||
"dtc-host-mappings",
|
||||
"http-mappings",
|
||||
"dtc-http-mappings",
|
||||
"log-mappings",
|
||||
"network-mappings",
|
||||
"dtc-network-mappings",
|
||||
"observer-mappings",
|
||||
"dtc-observer-mappings",
|
||||
"orchestrator-mappings",
|
||||
"organization-mappings",
|
||||
"package-mappings",
|
||||
"process-mappings",
|
||||
"dtc-process-mappings",
|
||||
"registry-mappings",
|
||||
"related-mappings",
|
||||
"rule-mappings",
|
||||
"dtc-rule-mappings",
|
||||
"server-mappings",
|
||||
"service-mappings",
|
||||
"dtc-service-mappings",
|
||||
"source-mappings",
|
||||
"threat-mappings",
|
||||
"tls-mappings",
|
||||
"tracing-mappings",
|
||||
"url-mappings",
|
||||
"user_agent-mappings",
|
||||
"dtc-user_agent-mappings",
|
||||
"user-mappings",
|
||||
"dtc-user-mappings",
|
||||
"vulnerability-mappings",
|
||||
"common-settings",
|
||||
"common-dynamic-mappings"
|
||||
],
|
||||
"priority": {{ PRIORITY }},
|
||||
"_meta": {
|
||||
"description": "Composable template that includes SO base fields",
|
||||
"ecs_version": "1.12"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,104 +0,0 @@
|
||||
{%- set INDEX_SORTING = salt['pillar.get']('elasticsearch:index_sorting', False) %}
|
||||
{%- set REPLICAS = salt['pillar.get']('elasticsearch:replicas', 0) %}
|
||||
{%- set SHARDS = salt['pillar.get']('elasticsearch:index_settings:so-tomcat:shards', 1) %}
|
||||
{%- set REFRESH = salt['pillar.get']('elasticsearch:index_settings:so-tomcat:refresh', '30s') %}
|
||||
{%- set PRIORITY = salt['pillar.get']('elasticsearch:index_settings:so-tomcat:priority', 500) %}
|
||||
{%- set FIELD_LIMIT = salt['pillar.get']('elasticsearch:index_settings:so-tomcat:field_limit', 3000) %}
|
||||
{
|
||||
"index_patterns": [
|
||||
"so-tomcat*"
|
||||
],
|
||||
"template": {
|
||||
"mappings": {
|
||||
"dynamic_templates": [
|
||||
{
|
||||
"strings_as_keyword": {
|
||||
"mapping": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"match_mapping_type": "string"
|
||||
}
|
||||
}
|
||||
],
|
||||
"date_detection": false
|
||||
},
|
||||
"settings": {
|
||||
"index": {
|
||||
"mapping": {
|
||||
"total_fields": {
|
||||
"limit": {{ FIELD_LIMIT }}
|
||||
}
|
||||
},
|
||||
{%- if INDEX_SORTING is sameas true %}
|
||||
"index.sort.field": "@timestamp",
|
||||
"index.sort.order": "desc",
|
||||
{%- endif %}
|
||||
"refresh_interval": "{{ REFRESH }}",
|
||||
"number_of_shards": {{ SHARDS }},
|
||||
"number_of_replicas": {{ REPLICAS }}
|
||||
}
|
||||
}
|
||||
},
|
||||
"composed_of": [
|
||||
"agent-mappings",
|
||||
"dtc-agent-mappings",
|
||||
"base-mappings",
|
||||
"dtc-base-mappings",
|
||||
"client-mappings",
|
||||
"cloud-mappings",
|
||||
"container-mappings",
|
||||
"data_stream-mappings",
|
||||
"destination-mappings",
|
||||
"dll-mappings",
|
||||
"dns-mappings",
|
||||
"dtc-dns-mappings",
|
||||
"ecs-mappings",
|
||||
"dtc-ecs-mappings",
|
||||
"error-mappings",
|
||||
"event-mappings",
|
||||
"dtc-event-mappings",
|
||||
"file-mappings",
|
||||
"dtc-file-mappings",
|
||||
"group-mappings",
|
||||
"host-mappings",
|
||||
"dtc-host-mappings",
|
||||
"http-mappings",
|
||||
"dtc-http-mappings",
|
||||
"log-mappings",
|
||||
"network-mappings",
|
||||
"dtc-network-mappings",
|
||||
"observer-mappings",
|
||||
"dtc-observer-mappings",
|
||||
"orchestrator-mappings",
|
||||
"organization-mappings",
|
||||
"package-mappings",
|
||||
"process-mappings",
|
||||
"dtc-process-mappings",
|
||||
"registry-mappings",
|
||||
"related-mappings",
|
||||
"rule-mappings",
|
||||
"dtc-rule-mappings",
|
||||
"server-mappings",
|
||||
"service-mappings",
|
||||
"dtc-service-mappings",
|
||||
"source-mappings",
|
||||
"threat-mappings",
|
||||
"tls-mappings",
|
||||
"tracing-mappings",
|
||||
"url-mappings",
|
||||
"user_agent-mappings",
|
||||
"dtc-user_agent-mappings",
|
||||
"user-mappings",
|
||||
"dtc-user-mappings",
|
||||
"vulnerability-mappings",
|
||||
"common-settings",
|
||||
"common-dynamic-mappings"
|
||||
],
|
||||
"priority": {{ PRIORITY }},
|
||||
"_meta": {
|
||||
"description": "Composable template that includes SO base fields",
|
||||
"ecs_version": "1.12"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,104 +0,0 @@
|
||||
{%- set INDEX_SORTING = salt['pillar.get']('elasticsearch:index_sorting', False) %}
|
||||
{%- set REPLICAS = salt['pillar.get']('elasticsearch:replicas', 0) %}
|
||||
{%- set SHARDS = salt['pillar.get']('elasticsearch:index_settings:so-zeek:shards', 1) %}
|
||||
{%- set REFRESH = salt['pillar.get']('elasticsearch:index_settings:so-zeek:refresh', '30s') %}
|
||||
{%- set PRIORITY = salt['pillar.get']('elasticsearch:index_settings:so-zeek:priority', 500) %}
|
||||
{%- set FIELD_LIMIT = salt['pillar.get']('elasticsearch:index_settings:so-zeek:field_limit', 3000) %}
|
||||
{
|
||||
"index_patterns": [
|
||||
"so-zeek*"
|
||||
],
|
||||
"template": {
|
||||
"mappings": {
|
||||
"dynamic_templates": [
|
||||
{
|
||||
"strings_as_keyword": {
|
||||
"mapping": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"match_mapping_type": "string"
|
||||
}
|
||||
}
|
||||
],
|
||||
"date_detection": false
|
||||
},
|
||||
"settings": {
|
||||
"index": {
|
||||
"mapping": {
|
||||
"total_fields": {
|
||||
"limit": {{ FIELD_LIMIT }}
|
||||
}
|
||||
},
|
||||
{%- if INDEX_SORTING is sameas true %}
|
||||
"index.sort.field": "@timestamp",
|
||||
"index.sort.order": "desc",
|
||||
{%- endif %}
|
||||
"refresh_interval": "{{ REFRESH }}",
|
||||
"number_of_shards": {{ SHARDS }},
|
||||
"number_of_replicas": {{ REPLICAS }}
|
||||
}
|
||||
}
|
||||
},
|
||||
"composed_of": [
|
||||
"agent-mappings",
|
||||
"dtc-agent-mappings",
|
||||
"base-mappings",
|
||||
"dtc-base-mappings",
|
||||
"client-mappings",
|
||||
"cloud-mappings",
|
||||
"container-mappings",
|
||||
"data_stream-mappings",
|
||||
"destination-mappings",
|
||||
"dll-mappings",
|
||||
"dns-mappings",
|
||||
"dtc-dns-mappings",
|
||||
"ecs-mappings",
|
||||
"dtc-ecs-mappings",
|
||||
"error-mappings",
|
||||
"event-mappings",
|
||||
"dtc-event-mappings",
|
||||
"file-mappings",
|
||||
"dtc-file-mappings",
|
||||
"group-mappings",
|
||||
"host-mappings",
|
||||
"dtc-host-mappings",
|
||||
"http-mappings",
|
||||
"dtc-http-mappings",
|
||||
"log-mappings",
|
||||
"network-mappings",
|
||||
"dtc-network-mappings",
|
||||
"observer-mappings",
|
||||
"dtc-observer-mappings",
|
||||
"orchestrator-mappings",
|
||||
"organization-mappings",
|
||||
"package-mappings",
|
||||
"process-mappings",
|
||||
"dtc-process-mappings",
|
||||
"registry-mappings",
|
||||
"related-mappings",
|
||||
"rule-mappings",
|
||||
"dtc-rule-mappings",
|
||||
"server-mappings",
|
||||
"service-mappings",
|
||||
"dtc-service-mappings",
|
||||
"source-mappings",
|
||||
"threat-mappings",
|
||||
"tls-mappings",
|
||||
"tracing-mappings",
|
||||
"url-mappings",
|
||||
"user_agent-mappings",
|
||||
"dtc-user_agent-mappings",
|
||||
"user-mappings",
|
||||
"dtc-user-mappings",
|
||||
"vulnerability-mappings",
|
||||
"common-settings",
|
||||
"common-dynamic-mappings"
|
||||
],
|
||||
"priority": {{ PRIORITY }},
|
||||
"_meta": {
|
||||
"description": "Composable template that includes SO base fields",
|
||||
"ecs_version": "1.12"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,104 +0,0 @@
|
||||
{%- set INDEX_SORTING = salt['pillar.get']('elasticsearch:index_sorting', False) %}
|
||||
{%- set REPLICAS = salt['pillar.get']('elasticsearch:replicas', 0) %}
|
||||
{%- set SHARDS = salt['pillar.get']('elasticsearch:index_settings:so-zscaler:shards', 1) %}
|
||||
{%- set REFRESH = salt['pillar.get']('elasticsearch:index_settings:so-zscaler:refresh', '30s') %}
|
||||
{%- set PRIORITY = salt['pillar.get']('elasticsearch:index_settings:so-zscaler:priority', 500) %}
|
||||
{%- set FIELD_LIMIT = salt['pillar.get']('elasticsearch:index_settings:so-zscaler:field_limit', 3000) %}
|
||||
{
|
||||
"index_patterns": [
|
||||
"so-zscaler*"
|
||||
],
|
||||
"template": {
|
||||
"mappings": {
|
||||
"dynamic_templates": [
|
||||
{
|
||||
"strings_as_keyword": {
|
||||
"mapping": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
},
|
||||
"match_mapping_type": "string"
|
||||
}
|
||||
}
|
||||
],
|
||||
"date_detection": false
|
||||
},
|
||||
"settings": {
|
||||
"index": {
|
||||
"mapping": {
|
||||
"total_fields": {
|
||||
"limit": {{ FIELD_LIMIT }}
|
||||
}
|
||||
},
|
||||
{%- if INDEX_SORTING is sameas true %}
|
||||
"index.sort.field": "@timestamp",
|
||||
"index.sort.order": "desc",
|
||||
{%- endif %}
|
||||
"refresh_interval": "{{ REFRESH }}",
|
||||
"number_of_shards": {{ SHARDS }},
|
||||
"number_of_replicas": {{ REPLICAS }}
|
||||
}
|
||||
}
|
||||
},
|
||||
"composed_of": [
|
||||
"agent-mappings",
|
||||
"dtc-agent-mappings",
|
||||
"base-mappings",
|
||||
"dtc-base-mappings",
|
||||
"client-mappings",
|
||||
"cloud-mappings",
|
||||
"container-mappings",
|
||||
"data_stream-mappings",
|
||||
"destination-mappings",
|
||||
"dll-mappings",
|
||||
"dns-mappings",
|
||||
"dtc-dns-mappings",
|
||||
"ecs-mappings",
|
||||
"dtc-ecs-mappings",
|
||||
"error-mappings",
|
||||
"event-mappings",
|
||||
"dtc-event-mappings",
|
||||
"file-mappings",
|
||||
"dtc-file-mappings",
|
||||
"group-mappings",
|
||||
"host-mappings",
|
||||
"dtc-host-mappings",
|
||||
"http-mappings",
|
||||
"dtc-http-mappings",
|
||||
"log-mappings",
|
||||
"network-mappings",
|
||||
"dtc-network-mappings",
|
||||
"observer-mappings",
|
||||
"dtc-observer-mappings",
|
||||
"orchestrator-mappings",
|
||||
"organization-mappings",
|
||||
"package-mappings",
|
||||
"process-mappings",
|
||||
"dtc-process-mappings",
|
||||
"registry-mappings",
|
||||
"related-mappings",
|
||||
"rule-mappings",
|
||||
"dtc-rule-mappings",
|
||||
"server-mappings",
|
||||
"service-mappings",
|
||||
"dtc-service-mappings",
|
||||
"source-mappings",
|
||||
"threat-mappings",
|
||||
"tls-mappings",
|
||||
"tracing-mappings",
|
||||
"url-mappings",
|
||||
"user_agent-mappings",
|
||||
"dtc-user_agent-mappings",
|
||||
"user-mappings",
|
||||
"dtc-user-mappings",
|
||||
"vulnerability-mappings",
|
||||
"common-settings",
|
||||
"common-dynamic-mappings"
|
||||
],
|
||||
"priority": {{ PRIORITY }},
|
||||
"_meta": {
|
||||
"description": "Composable template that includes SO base fields",
|
||||
"ecs_version": "1.12"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -264,6 +264,32 @@ filebeat.inputs:
|
||||
|
||||
{%- endif %}
|
||||
|
||||
{%- if grains['role'] in ['so-eval', 'so-standalone', 'so-manager', 'so-managersearch', 'so-import'] %}
|
||||
- type: log
|
||||
paths:
|
||||
- /logs/kratos/kratos.log
|
||||
fields:
|
||||
module: kratos
|
||||
category: host
|
||||
tags: beat-ext
|
||||
processors:
|
||||
- rename:
|
||||
fields:
|
||||
- from: "audience"
|
||||
to: "event.dataset"
|
||||
ignore_missing: true
|
||||
- add_fields:
|
||||
when:
|
||||
not:
|
||||
has_fields: ['event.dataset']
|
||||
target: ''
|
||||
fields:
|
||||
event.dataset: access
|
||||
fields_under_root: true
|
||||
clean_removed: false
|
||||
close_removed: false
|
||||
{%- endif %}
|
||||
|
||||
{%- if grains.role == 'so-idh' %}
|
||||
- type: log
|
||||
paths:
|
||||
@@ -271,8 +297,6 @@ filebeat.inputs:
|
||||
fields:
|
||||
module: opencanary
|
||||
dataset: idh
|
||||
category: host
|
||||
tags: beat-ext
|
||||
processors:
|
||||
- decode_json_fields:
|
||||
fields: ["message"]
|
||||
@@ -301,9 +325,6 @@ filebeat.inputs:
|
||||
ignore_missing: true
|
||||
- drop_fields:
|
||||
fields: '["prospector", "input", "offset", "beat"]'
|
||||
fields_under_root: true
|
||||
clean_removed: false
|
||||
close_removed: false
|
||||
{%- endif %}
|
||||
|
||||
{%- if INPUTS %}
|
||||
|
||||
@@ -1 +1 @@
|
||||
{"attributes": {"buildNum": 39457,"defaultIndex": "2289a0c0-6970-11ea-a0cd-ffa0f6a1bc29","defaultRoute": "/app/dashboards#/view/a8411b30-6d03-11ea-b301-3d6c35840645","discover:sampleSize": 100,"theme:darkMode": true,"timepicker:timeDefaults": "{\n \"from\": \"now-24h\",\n \"to\": \"now\"\n}"},"coreMigrationVersion": "7.16.3","id": "7.16.3","migrationVersion": {"config": "7.13.0"},"references": [],"type": "config","updated_at": "2021-10-10T10:10:10.105Z","version": "WzI5NzUsMl0="}
|
||||
{"attributes": {"buildNum": 39457,"defaultIndex": "2289a0c0-6970-11ea-a0cd-ffa0f6a1bc29","defaultRoute": "/app/dashboards#/view/a8411b30-6d03-11ea-b301-3d6c35840645","discover:sampleSize": 100,"theme:darkMode": true,"timepicker:timeDefaults": "{\n \"from\": \"now-24h\",\n \"to\": \"now\"\n}"},"coreMigrationVersion": "7.17.0","id": "7.17.0","migrationVersion": {"config": "7.13.0"},"references": [],"type": "config","updated_at": "2021-10-10T10:10:10.105Z","version": "WzI5NzUsMl0="}
|
||||
@@ -1,7 +1,7 @@
|
||||
{"attributes":{"fieldFormatMap":"{\"match_body.source_ip\":{\"id\":\"url\",\"params\":{\"urlTemplate\":\"/kibana/app/dashboards#/view/68563ed0-34bf-11e7-9b32-bb903919ead9?_g=(refreshInterval:(display:Off,pause:!f,value:0),time:(from:now-24h,mode:quick,to:now))&_a=(columns:!(_source),index:'*:logstash-*',interval:auto,query:(query_string:(analyze_wildcard:!t,query:'\\\"{{value}}\\\"')),sort:!('@timestamp',desc))\",\"labelTemplate\":\"{{value}}\"}},\"match_body.destination_ip\":{\"id\":\"url\",\"params\":{\"urlTemplate\":\"/kibana/app/dashboards#/view/68563ed0-34bf-11e7-9b32-bb903919ead9?_g=(refreshInterval:(display:Off,pause:!f,value:0),time:(from:now-24h,mode:quick,to:now))&_a=(columns:!(_source),index:'*:logstash-*',interval:auto,query:(query_string:(analyze_wildcard:!t,query:'\\\"{{value}}\\\"')),sort:!('@timestamp',desc))\",\"labelTemplate\":\"{{value}}\"}}}","fields":"[{\"name\":\"@timestamp\",\"type\":\"date\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"_id\",\"type\":\"string\",\"count\":1,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"_index\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":false},{\"name\":\"_score\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":false,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"_source\",\"type\":\"_source\",\"count\":0,\"scripted\":false,\"searchable\":false,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"_type\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":false},{\"name\":\"alert_info.slack_username_override\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"alert_info.slack_username_override.keyword\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"alert_info.slack_webhook_url\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"alert_info.slack_webhook_url.keyword\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"alert_info.type\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"alert_info.type.keyword\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"alert_sent\",\"type\":\"boolean\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"alert_time\",\"type\":\"date\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"data.rule\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"data.rule.keyword\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"endtime\",\"type\":\"date\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"exponent\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"hits\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"match_body.@timestamp\",\"type\":\"date\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"match_body.@version\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"match_body.@version.keyword\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"match_body.signature_info\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"match_body.signature_info.keyword\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"match_body._id\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"match_body._id.keyword\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"match_body._index\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\Line truncated
|
||||
{"attributes":{"fieldFormatMap":"{\"_id\":{\"id\":\"url\",\"params\":{\"urlTemplate\":\"https://PLACEHOLDER/#/hunt?q=_id%3A{{value}}\",\"labelTemplate\":\"Hunt and optionally pivot to PCAP/Cases\"}},\"uid\":{\"id\":\"url\",\"params\":{\"urlTemplate\":\"/kibana/app/dashboards#/view/68563ed0-34bf-11e7-9b32-bb903919ead9?_g=(refreshInterval:(display:Off,pause:!f,value:0),time:(from:now-24h,mode:quick,to:now))&_a=(columns:!(_source),index:'*:logstash-*',interval:auto,query:(query_string:(analyze_wildcard:!t,query:{{value}})),sort:!('@timestamp',desc))\",\"labelTemplate\":\"{{value}}\"}},\"source_ip\":{\"id\":\"url\",\"params\":{\"urlTemplate\":\"/kibana/app/dashboards#/view/68563ed0-34bf-11e7-9b32-bb903919ead9?_g=(refreshInterval:(display:Off,pause:!f,value:0),time:(from:now-24h,mode:quick,to:now))&_a=(columns:!(_source),index:'*:logstash-*',interval:auto,query:(query_string:(analyze_wildcard:!t,query:'\\\"{{value}}\\\"')),sort:!('@timestamp',desc))\",\"labelTemplate\":\"{{value}}\"}},\"destination_ip\":{\"id\":\"url\",\"params\":{\"urlTemplate\":\"/kibana/app/dashboards#/view/68563ed0-34bf-11e7-9b32-bb903919ead9?_g=(refreshInterval:(display:Off,pause:!f,value:0),time:(from:now-24h,mode:quick,to:now))&_a=(columns:!(_source),index:'*:logstash-*',interval:auto,query:(query_string:(analyze_wildcard:!t,query:'\\\"{{value}}\\\"')),sort:!('@timestamp',desc))\",\"labelTemplate\":\"{{value}}\"}},\"source_port\":{\"id\":\"url\",\"params\":{\"urlTemplate\":\"/kibana/app/dashboards#/view/68563ed0-34bf-11e7-9b32-bb903919ead9?_g=(refreshInterval:(display:Off,pause:!f,value:0),time:(from:now-24h,mode:quick,to:now))&_a=(columns:!(_source),index:'*:logstash-*',interval:auto,query:(query_string:(analyze_wildcard:!t,query:'source_port:\\\"{{value}}\\\" OR destination_port:\\\"{{value}}\\\"')),sort:!('@timestamp',desc))\",\"labelTemplate\":\"{{value}}\"}},\"destination_port\":{\"id\":\"url\",\"params\":{\"urlTemplate\":\"/kibana/app/dashboards#/view/68563ed0-34bf-11e7-9b32-bb903919ead9?_g=(refreshInterval:(display:Off,pause:!f,value:0),time:(from:now-24h,mode:quick,to:now))&_a=(columns:!(_source),index:'*:logstash-*',interval:auto,query:(query_string:(analyze_wildcard:!t,query:'source_port:\\\"{{value}}\\\" OR destination_port:\\\"{{value}}\\\"')),sort:!('@timestamp',desc))\",\"labelTemplate\":\"{{value}}\"}},\"fuid\":{\"id\":\"url\",\"params\":{\"urlTemplate\":\"/kibana/app/dashboards#/view/68563ed0-34bf-11e7-9b32-bb903919ead9?_g=(refreshInterval:(display:Off,pause:!f,value:0),time:(from:now-24h,mode:quick,to:now))&_a=(columns:!(_source),index:'*:logstash-*',interval:auto,query:(query_string:(analyze_wildcard:!t,query:{{value}})),sort:!('@timestamp',desc))\",\"labelTemplate\":\"{{value}}\"}},\"resp_fuids\":{\"id\":\"url\",\"params\":{\"urlTemplate\":\"/kibana/app/dashboards#/view/68563ed0-34bf-11e7-9b32-bb903919ead9?_g=(refreshInterval:(display:Off,pause:!f,value:0),time:(from:now-24h,mode:quick,to:now))&_a=(columns:!(_source),index:'*:logstash-*',interval:auto,query:(query_string:(analyze_wildcard:!t,query:{{value}})),sort:!('@timestamp',desc))\",\"labelTemplate\":\"{{value}}\"}},\"orig_fuids\":{\"id\":\"url\",\"params\":{\"urlTemplate\":\"/kibana/app/dashboards#/view/68563ed0-34bf-11e7-9b32-bb903919ead9?_g=(refreshInterval:(display:Off,pause:!f,value:0),time:(from:now-24h,mode:quick,to:now))&_a=(columns:!(_source),index:'*:logstash-*',interval:auto,query:(query_string:(analyze_wildcard:!t,query:{{value}})),sort:!('@timestamp',desc))\",\"labelTemplate\":\"{{value}}\"}},\"sid\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"port\":{\"id\":\"number\",\"params\":{\"pattern\":\"0.[000]\"}},\"query\":{\"id\":\"url\",\"params\":{\"urlTemplate\":\"/kibana/app/dashboards#/view/68563ed0-34bf-11e7-9b32-bb903919ead9?_g=(refreshInterval:(display:Off,pause:!f,value:0),time:(from:now-24h,mode:quick,to:now))&_a=(columns:!(_source),index:'*:logstash-*',interval:auto,query:(query_string:(analyze_wildcard:!t,query:{{value}})),sort:!('@timestamp',desc))\",\"labelTemplate\":\"{{value}}\"}},\"query.keyword\":{\"id\":\"url\",\"params\":{\"urlTemplate\":\"/kibana/app/dashboards#/view/68563ed0-34bf-11e7-9b32-bb903919ead9?_g=(refreshInterval:(display:Off,pause:!f,value:0),time:(from:now-24h,mode:quick,to:now))&_a=(columns:!(_source),index:'*:logstash-*',interval:auto,query:(query_string:(analyze_wildcard:!t,query:{{value}})),sort:!('@timestamp',desc))\",\"labelTemplate\":\"{{value}}\"}},\"server_name\":{\"id\":\"url\",\"params\":{\"urlTemplate\":\"/kibana/app/dashboards#/view/68563ed0-34bf-11e7-9b32-bb903919ead9?_g=(refreshInterval:(display:Off,pause:!f,value:0),time:(from:now-24h,mode:quick,to:now))&_a=(columns:!(_source),index:'*:logstash-*',interval:auto,query:(query_string:(analyze_wildcard:!t,query:{{value}})),sort:!('@timestamp',desc))\",\"labelTemplate\":\"{{value}}\"}},\"server_name.keyword\":{\"id\":\"url\",\"params\":{\"urlTemplate\":\"/kibana/app/dashboards#/view/68563ed0-34bf-11e7-9b32-bb903919ead9?_g=(refreshInterval:(display:Off,pauLine truncated
|
||||
{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"title":"Security Onion - Network Data","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security Onion - Network Data\",\"type\":\"markdown\",\"aggs\":[],\"params\":{\"fontSize\":12,\"openLinksInNewTab\":false,\"markdown\":\"[Home](/kibana/app/dashboards#/view/a8411b30-6d03-11ea-b301-3d6c35840645) \\n \\n**Datasets** \\n[Connections](/kibana/app/dashboards#/view/0cc628b0-6e9f-11ea-9266-1fd14ca6af34) | [DCE/RPC](/kibana/app/dashboards#/view/9e882df0-72c5-11ea-8dd2-9d8795a1200b) |\\n[DHCP](/kibana/app/dashboards#/view/80625c10-96dd-11ea-814e-bb515e873c2c) \\n[DNP3](/kibana/app/dashboards#/view/b1f52180-755a-11ea-9565-7315f4ee5cac) | [DNS](/kibana/app/dashboards#/view/55ac6bf0-6ec4-11ea-9266-1fd14ca6af34) |\\n[FTP](/kibana/app/dashboards#/view/739bfad0-755a-11ea-9565-7315f4ee5cac) |\\n[HTTP](/kibana/app/dashboards#/view/44e9c820-6eb1-11ea-9266-1fd14ca6af34) | [Intel](/kibana/app/dashboards#/view/85b529a0-0e5a-11eb-a255-e1e8e85e3571) | [IRC](/kibana/app/dashboards#/view/38523560-75ba-11ea-9565-7315f4ee5cac) |\\n[Kerberos](/kibana/app/dashboards#/view/b207ab90-75bc-11ea-9565-7315f4ee5cac) \\n[Modbus](/kibana/app/dashboards#/view/886a7b90-75bd-11ea-9565-7315f4ee5cac) | \\n[MySQL](/kibana/app/dashboards#/view/c3ced6d0-75be-11ea-9565-7315f4ee5cac) | \\n[NTLM](/kibana/app/dashboards#/view/558292e0-75c1-11ea-9565-7315f4ee5cac) | \\n[PE](/kibana/app/dashboards#/view/94b55b90-c761-11ea-bebb-37c5ab5894ea) |\\n[RADIUS](/kibana/app/dashboards#/view/b9769e60-75c4-11ea-9565-7315f4ee5cac) | [RDP](/kibana/app/dashboards#/view/5b743150-75c5-11ea-9565-7315f4ee5cac) | \\n[RFB](/kibana/app/dashboards#/view/c8b3c360-75c6-11ea-9565-7315f4ee5cac) | [SIP](/kibana/app/dashboards#/view/dd98e260-75c6-11ea-9565-7315f4ee5cac) \\n[SMB](/kibana/app/dashboards#/view/f24d7b80-75c6-11ea-9565-7315f4ee5cac) | [SMTP](/kibana/app/dashboards#/view/00304500-75e7-11ea-9565-7315f4ee5cac) | [SNMP](/kibana/app/dashboards#/view/96522610-75e8-11ea-9565-7315f4ee5cac) | \\n[SSH](/kibana/app/dashboards#/view/9dfd77e0-75eb-11ea-9565-7315f4ee5cac) | [SSL](/kibana/app/dashboards#/view/efae8de0-75eb-11ea-9565-7315f4ee5cac) | [Syslog](/kibana/app/dashboards#/view/66499a20-75ed-11ea-9565-7315f4ee5cac) | [Tunnels](/kibana/app/dashboards#/view/c962dd60-75ed-11ea-9565-7315f4ee5cac) | [X.509](/kibana/app/dashboards#/view/2e0865f0-75ee-11ea-9565-7315f4ee5cac) \\n\"}}"},"coreMigrationVersion":"7.16.2","id":"7f822930-6ea4-11ea-9266-1fd14ca6af34","migrationVersion":{"visualization":"7.14.0"},"references":[],"sort":[1643385898421,11],"type":"visualization","updated_at":"2022-01-28T16:04:58.421Z","version":"WzEzNjY2LDE1XQ=="}
|
||||
{"attributes":{"fieldFormatMap":"{\"network.community_id\":{\"id\":\"url\",\"params\":{\"parsedUrl\":{\"origin\":\"https://PLACEHOLDER\",\"pathname\":\"/kibana/app/kibana\",\"basePath\":\"/kibana\"},\"urlTemplate\":\"kibana#/dashboard/30d0ac90-729f-11ea-8dd2-9d8795a1200b?_g=(filters:!(('$state':(store:globalState),meta:(alias:!n,disabled:!f,index:'2289a0c0-6970-11ea-a0cd-ffa0f6a1bc29',key:network.community_id,negate:!f,params:(query:'{{ value }}'),type:phrase),query:(match_phrase:(network.community_id:'{{ value }}')))),refreshInterval:(pause:!t,value:0),time:(from:now-24h,mode:quick,to:now))&_a=(description:'',filters:!(),fullScreenMode:!f,options:(hidePanelTitles:!f,useMargins:!t),panels:!((embeddableConfig:(),gridData:(h:8,i:c706b8e5-9d49-4700-a3ea-26e86ac3a4c4,w:10,x:0,y:0),id:'8cfec8c0-6ec2-11ea-9266-1fd14ca6af34',panelIndex:c706b8e5-9d49-4700-a3ea-26e86ac3a4c4,type:visualization,version:'7.6.1'),(embeddableConfig:(),gridData:(h:8,i:'77c5d557-83e4-40b9-9177-388db29d711d',w:15,x:10,y:0),id:d04b5130-6e99-11ea-9266-1fd14ca6af34,panelIndex:'77c5d557-83e4-40b9-9177-388db29d711d',type:visualization,version:'7.6.1'),(embeddableConfig:(),gridData:(h:8,i:f044ff9c-455a-4085-88c8-92e9ead2bba0,w:23,x:25,y:0),id:d9eb5b30-6ea9-11ea-9266-1fd14ca6af34,panelIndex:f044ff9c-455a-4085-88c8-92e9ead2bba0,type:visualization,version:'7.6.1'),(embeddableConfig:(),gridData:(h:20,i:'54873f75-4452-4938-840d-3a2f50547a88',w:9,x:0,y:8),id:ad398b70-6e9a-11ea-9266-1fd14ca6af34,panelIndex:'54873f75-4452-4938-840d-3a2f50547a88',type:visualization,version:'7.6.1'),(embeddableConfig:(),gridData:(h:20,i:'30749cb6-18ad-4069-b18d-5912086fff9c',w:13,x:9,y:8),id:'6b18be30-72a7-11ea-8dd2-9d8795a1200b',panelIndex:'30749cb6-18ad-4069-b18d-5912086fff9c',type:visualization,version:'7.6.1'),(embeddableConfig:(),gridData:(h:20,i:'2f69e716-e6e9-4595-801d-8f59b7d2c574',w:13,x:35,y:8),id:f4cfdeb0-72a7-11ea-8dd2-9d8795a1200b,panelIndex:'2f69e716-e6e9-4595-801d-8f59b7d2c574',type:visualization,version:'7.6.1'),(embeddableConfig:(),gridData:(h:20,i:'7c498d50-d009-493a-a8c9-c91303ad5556',w:13,x:22,y:8),id:b6a4f3f0-72a7-11ea-8dd2-9d8795a1200b,panelIndex:'7c498d50-d009-493a-a8c9-c91303ad5556',type:visualization,version:'7.6.1'),(embeddableConfig:(),gridData:(h:31,i:'6ddfd0a2-337e-47d1-8d4c-bc386a4210af',w:48,x:0,y:27),id:'8b6f3150-72a2-11ea-8dd2-9d8795a1200b',panelIndex:'6ddfd0a2-337e-47d1-8d4c-bc386a4210af',type:search,version:'7.6.1')),query:(language:kuery,query:'*'),timeRestore:!f,title:'Security%20Onion%20-%20Indicator',viewMode:view)\",\"labelTemplate\":\"{{ value }}\"}},\"source.ip\":{\"id\":\"url\",\"params\":{\"parsedUrl\":{\"origin\":\"https://PLACEHOLDER\",\"pathname\":\"/kibana/app/kibana\",\"basePath\":\"/kibana\"},\"urlTemplate\":\"kibana#/dashboard/30d0ac90-729f-11ea-8dd2-9d8795a1200b?_g=(filters:!(),refreshInterval:(pause:!t,value:0),time:(from:now-24h,mode:quick,to:now))&_a=(description:'',filters:!(('$state':(store:globalState),bool:(should:!((term:(source.ip:'{{ value }}')),(term:(destination.ip:'{{ value }}')))),meta:(alias:'source.ip:%20!'{{ value }}!'%20OR%20destination.ip:%20!'{{ value }}!'',disabled:!f,index:'2289a0c0-6970-11ea-a0cd-ffa0f6a1bc29',key:bool,negate:!f,type:custom,value:'%7B%22should%22:%5B%7B%22term%22:%7B%22source.ip%22:%2210.200.1.153%22%7D%7D,%7B%22term%22:%7B%22destination.ip%22:%2210.200.1.153%22%7D%7D%5D%7D'))),fullScreenMode:!f,options:(hidePanelTitles:!f,useMargins:!t),panels:!((embeddableConfig:(),gridData:(h:8,i:c706b8e5-9d49-4700-a3ea-26e86ac3a4c4,w:10,x:0,y:0),id:'8cfec8c0-6ec2-11ea-9266-1fd14ca6af34',panelIndex:c706b8e5-9d49-4700-a3ea-26e86ac3a4c4,type:visualization,version:'7.6.1'),(embeddableConfig:(),gridData:(h:8,i:'77c5d557-83e4-40b9-9177-388db29d711d',w:15,x:10,y:0),id:d04b5130-6e99-11ea-9266-1fd14ca6af34,panelIndex:'77c5d557-83e4-40b9-9177-388db29d711d',type:visualization,version:'7.6.1'),(embeddableConfig:(),gridData:(h:8,i:f044ff9c-455a-4085-88c8-92e9ead2bba0,w:23,x:25,y:0),id:d9eb5b30-6ea9-11ea-9266-1fd14ca6af34,panelIndex:f044ff9c-455a-4085-88c8-92e9ead2bba0,type:visualization,version:'7.6.1'),(embeddableConfig:(),gridData:(h:20,i:'54873f75-4452-4938-840d-3a2f50547a88',w:9,x:0,y:8),id:ad398b70-6e9a-11ea-9266-1fd14ca6af34,panelIndex:'54873f75-4452-4938-840d-3a2f50547a88',type:visualization,version:'7.6.1'),(embeddableConfig:(),gridData:(h:20,i:'30749cb6-18ad-4069-b18d-5912086fff9c',w:13,x:9,y:8),id:'6b18be30-72a7-11ea-8dd2-9d8795a1200b',panelIndex:'30749cb6-18ad-4069-b18d-5912086fff9c',type:visualization,version:'7.6.1'),(embeddableConfig:(),gridData:(h:20,i:'7c498d50-d009-493a-a8c9-c91303ad5556',w:13,x:22,y:8),id:b6a4f3f0-72a7-11ea-8dd2-9d8795a1200b,panelIndex:'7c498d50-d009-493a-a8c9-c91303ad5556',type:visualization,version:'7.6.1'),(embeddableConfig:(),gridData:(h:20,i:'2f69e716-e6e9-4595-801d-8f59b7d2c574',w:13,x:35,y:8),id:f4cfdeb0-72a7-11ea-8dd2-9d8795a1200b,panelIndex:'2f69e716-e6e9-4595-801d-8f59b7d2c574',type:visualization,version:'7.6.1'),(embeddableConfig:(),gridData:(h:31,i:'6ddfd0a2-33Line truncated
|
||||
{"attributes":{"fieldFormatMap":"{\"network.community_id\":{\"id\":\"url\",\"params\":{\"parsedUrl\":{\"origin\":\"https://PLACEHOLDER\",\"pathname\":\"/kibana/app/kibana\",\"basePath\":\"/kibana\"},\"urlTemplate\":\"kibana#/dashboard/30d0ac90-729f-11ea-8dd2-9d8795a1200b?_g=(filters:!(('$state':(store:globalState),meta:(alias:!n,disabled:!f,index:'2289a0c0-6970-11ea-a0cd-ffa0f6a1bc29',key:network.community_id,negate:!f,params:(query:'{{ value }}'),type:phrase),query:(match_phrase:(network.community_id:'{{ value }}')))),refreshInterval:(pause:!t,value:0),time:(from:now-24h,mode:quick,to:now))&_a=(description:'',filters:!(),fullScreenMode:!f,options:(hidePanelTitles:!f,useMargins:!t),panels:!((embeddableConfig:(),gridData:(h:8,i:c706b8e5-9d49-4700-a3ea-26e86ac3a4c4,w:10,x:0,y:0),id:'8cfec8c0-6ec2-11ea-9266-1fd14ca6af34',panelIndex:c706b8e5-9d49-4700-a3ea-26e86ac3a4c4,type:visualization,version:'7.6.1'),(embeddableConfig:(),gridData:(h:8,i:'77c5d557-83e4-40b9-9177-388db29d711d',w:15,x:10,y:0),id:d04b5130-6e99-11ea-9266-1fd14ca6af34,panelIndex:'77c5d557-83e4-40b9-9177-388db29d711d',type:visualization,version:'7.6.1'),(embeddableConfig:(),gridData:(h:8,i:f044ff9c-455a-4085-88c8-92e9ead2bba0,w:23,x:25,y:0),id:d9eb5b30-6ea9-11ea-9266-1fd14ca6af34,panelIndex:f044ff9c-455a-4085-88c8-92e9ead2bba0,type:visualization,version:'7.6.1'),(embeddableConfig:(),gridData:(h:20,i:'54873f75-4452-4938-840d-3a2f50547a88',w:9,x:0,y:8),id:ad398b70-6e9a-11ea-9266-1fd14ca6af34,panelIndex:'54873f75-4452-4938-840d-3a2f50547a88',type:visualization,version:'7.6.1'),(embeddableConfig:(),gridData:(h:20,i:'30749cb6-18ad-4069-b18d-5912086fff9c',w:13,x:9,y:8),id:'6b18be30-72a7-11ea-8dd2-9d8795a1200b',panelIndex:'30749cb6-18ad-4069-b18d-5912086fff9c',type:visualization,version:'7.6.1'),(embeddableConfig:(),gridData:(h:20,i:'2f69e716-e6e9-4595-801d-8f59b7d2c574',w:13,x:35,y:8),id:f4cfdeb0-72a7-11ea-8dd2-9d8795a1200b,panelIndex:'2f69e716-e6e9-4595-801d-8f59b7d2c574',type:visualization,version:'7.6.1'),(embeddableConfig:(),gridData:(h:20,i:'7c498d50-d009-493a-a8c9-c91303ad5556',w:13,x:22,y:8),id:b6a4f3f0-72a7-11ea-8dd2-9d8795a1200b,panelIndex:'7c498d50-d009-493a-a8c9-c91303ad5556',type:visualization,version:'7.6.1'),(embeddableConfig:(),gridData:(h:31,i:'6ddfd0a2-337e-47d1-8d4c-bc386a4210af',w:48,x:0,y:27),id:'8b6f3150-72a2-11ea-8dd2-9d8795a1200b',panelIndex:'6ddfd0a2-337e-47d1-8d4c-bc386a4210af',type:search,version:'7.6.1')),query:(language:kuery,query:'*'),timeRestore:!f,title:'Security%20Onion%20-%20Indicator',viewMode:view)\",\"labelTemplate\":\"{{ value }}\"}},\"source.ip\":{\"id\":\"url\",\"params\":{\"parsedUrl\":{\"origin\":\"https://PLACEHOLDER\",\"pathname\":\"/kibana/app/kibana\",\"basePath\":\"/kibana\"},\"urlTemplate\":\"kibana#/dashboard/30d0ac90-729f-11ea-8dd2-9d8795a1200b?_g=(filters:!(),refreshInterval:(pause:!t,value:0),time:(from:now-24h,mode:quick,to:now))&_a=(description:'',filters:!(('$state':(store:globalState),bool:(should:!((term:(source.ip:'{{ value }}')),(term:(destination.ip:'{{ value }}')))),meta:(alias:'source.ip:%20!'{{ value }}!'%20OR%20destination.ip:%20!'{{ value }}!'',disabled:!f,index:'2289a0c0-6970-11ea-a0cd-ffa0f6a1bc29',key:bool,negate:!f,type:custom,value:'%7B%22should%22:%5B%7B%22term%22:%7B%22source.ip%22:%2210.200.1.153%22%7D%7D,%7B%22term%22:%7B%22destination.ip%22:%2210.200.1.153%22%7D%7D%5D%7D'))),fullScreenMode:!f,options:(hidePanelTitles:!f,useMargins:!t),panels:!((embeddableConfig:(),gridData:(h:8,i:c706b8e5-9d49-4700-a3ea-26e86ac3a4c4,w:10,x:0,y:0),id:'8cfec8c0-6ec2-11ea-9266-1fd14ca6af34',panelIndex:c706b8e5-9d49-4700-a3ea-26e86ac3a4c4,type:visualization,version:'7.6.1'),(embeddableConfig:(),gridData:(h:8,i:'77c5d557-83e4-40b9-9177-388db29d711d',w:15,x:10,y:0),id:d04b5130-6e99-11ea-9266-1fd14ca6af34,panelIndex:'77c5d557-83e4-40b9-9177-388db29d711d',type:visualization,version:'7.6.1'),(embeddableConfig:(),gridData:(h:8,i:f044ff9c-455a-4085-88c8-92e9ead2bba0,w:23,x:25,y:0),id:d9eb5b30-6ea9-11ea-9266-1fd14ca6af34,panelIndex:f044ff9c-455a-4085-88c8-92e9ead2bba0,type:visualization,version:'7.6.1'),(embeddableConfig:(),gridData:(h:20,i:'54873f75-4452-4938-840d-3a2f50547a88',w:9,x:0,y:8),id:ad398b70-6e9a-11ea-9266-1fd14ca6af34,panelIndex:'54873f75-4452-4938-840d-3a2f50547a88',type:visualization,version:'7.6.1'),(embeddableConfig:(),gridData:(h:20,i:'30749cb6-18ad-4069-b18d-5912086fff9c',w:13,x:9,y:8),id:'6b18be30-72a7-11ea-8dd2-9d8795a1200b',panelIndex:'30749cb6-18ad-4069-b18d-5912086fff9c',type:visualization,version:'7.6.1'),(embeddableConfig:(),gridData:(h:20,i:'7c498d50-d009-493a-a8c9-c91303ad5556',w:13,x:22,y:8),id:b6a4f3f0-72a7-11ea-8dd2-9d8795a1200b,panelIndex:'7c498d50-d009-493a-a8c9-c91303ad5556',type:visualization,version:'7.6.1'),(embeddableConfig:(),gridData:(h:20,i:'2f69e716-e6e9-4595-801d-8f59b7d2c574',w:13,x:35,y:8),id:f4cfdeb0-72a7-11ea-8dd2-9d8795a1200b,panelIndex:'2f69e716-e6e9-4595-801d-8f59b7d2c574',type:visualization,version:'7.6.1'),(embeddableConfig:(),gridData:(h:31,i:'6ddfd0a2-33Line truncated
|
||||
{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"title":"Security Onion - All Logs","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security Onion - All Logs\",\"type\":\"metric\",\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":29}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}}]}"},"coreMigrationVersion":"7.16.2","id":"d04b5130-6e99-11ea-9266-1fd14ca6af34","migrationVersion":{"visualization":"7.14.0"},"references":[{"id":"2289a0c0-6970-11ea-a0cd-ffa0f6a1bc29","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"sort":[1643385898421,14],"type":"visualization","updated_at":"2022-01-28T16:04:58.421Z","version":"WzEzNjY4LDE1XQ=="}
|
||||
{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"title":"Security Onion - Logs Over Time","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security Onion - Logs Over Time\",\"type\":\"line\",\"params\":{\"type\":\"line\",\"grid\":{\"categoryLines\":false},\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"type\":\"category\",\"position\":\"bottom\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\"},\"labels\":{\"show\":true,\"filter\":true,\"truncate\":100},\"title\":{}}],\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"name\":\"LeftAxis-1\",\"type\":\"value\",\"position\":\"left\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\",\"mode\":\"normal\"},\"labels\":{\"show\":true,\"rotate\":0,\"filter\":false,\"truncate\":100},\"title\":{\"text\":\"Count\"}}],\"seriesParams\":[{\"show\":true,\"type\":\"line\",\"mode\":\"normal\",\"data\":{\"label\":\"Count\",\"id\":\"1\"},\"valueAxis\":\"ValueAxis-1\",\"drawLinesBetweenPoints\":true,\"lineWidth\":2,\"interpolate\":\"linear\",\"showCircles\":true,\"circlesRadius\":1}],\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"times\":[],\"addTimeMarker\":false,\"labels\":{},\"thresholdLine\":{\"show\":false,\"value\":10,\"width\":1,\"style\":\"full\",\"color\":\"#E7664C\"},\"dimensions\":{\"x\":null,\"y\":[{\"accessor\":0,\"format\":{\"id\":\"number\"},\"params\":{},\"label\":\"Count\",\"aggType\":\"count\"}]},\"palette\":{\"type\":\"palette\",\"name\":\"kibana_palette\"},\"isVislibVis\":true,\"detailedTooltip\":true,\"fittingFunction\":\"linear\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"date_histogram\",\"schema\":\"segment\",\"params\":{\"field\":\"@timestamp\",\"useNormalizedEsInterval\":true,\"scaleMetricValues\":false,\"interval\":\"auto\",\"drop_partials\":false,\"min_doc_count\":1,\"extended_bounds\":{}}}]}"},"coreMigrationVersion":"7.16.2","id":"23ed13a0-6e9a-11ea-9266-1fd14ca6af34","migrationVersion":{"visualization":"7.14.0"},"references":[{"id":"2289a0c0-6970-11ea-a0cd-ffa0f6a1bc29","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"sort":[1643385898421,16],"type":"visualization","updated_at":"2022-01-28T16:04:58.421Z","version":"WzEzNjY5LDE1XQ=="}
|
||||
{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"title":"Security Onion - Source IPs","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"title\":\"Security Onion - Source IPs\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"percentageCol\":\"\",\"dimensions\":{\"metrics\":[{\"accessor\":0,\"format\":{\"id\":\"number\"},\"params\":{},\"label\":\"Count\",\"aggType\":\"count\"}],\"buckets\":[]},\"showToolbar\":true},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"source.ip\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Source IP\"}}]}"},"coreMigrationVersion":"7.16.2","id":"6b18be30-72a7-11ea-8dd2-9d8795a1200b","migrationVersion":{"visualization":"7.14.0"},"references":[{"id":"2289a0c0-6970-11ea-a0cd-ffa0f6a1bc29","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"sort":[1643385898421,18],"type":"visualization","updated_at":"2022-01-28T16:04:58.421Z","version":"WzEzNjcwLDE1XQ=="}
|
||||
@@ -424,7 +424,7 @@
|
||||
{"attributes":{"description":"","hits":0,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":{\"query_string\":{\"analyze_wildcard\":true,\"query\":\"*\",\"default_field\":\"*\",\"time_zone\":\"America/New_York\"}},\"language\":\"lucene\"},\"filter\":[]}"},"optionsJSON":"{\"darkTheme\":true,\"useMargins\":true}","panelsJSON":"[{\"version\":\"7.9.0\",\"gridData\":{\"w\":8,\"h\":60,\"x\":0,\"y\":0,\"i\":\"1\"},\"panelIndex\":\"1\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_0\"},{\"version\":\"7.9.0\",\"gridData\":{\"w\":32,\"h\":8,\"x\":16,\"y\":0,\"i\":\"3\"},\"panelIndex\":\"3\",\"embeddableConfig\":{\"vis\":{\"legendOpen\":false},\"enhancements\":{}},\"panelRefName\":\"panel_1\"},{\"version\":\"7.9.0\",\"gridData\":{\"w\":20,\"h\":24,\"x\":8,\"y\":36,\"i\":\"4\"},\"panelIndex\":\"4\",\"embeddableConfig\":{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}},\"enhancements\":{}},\"panelRefName\":\"panel_2\"},{\"version\":\"7.9.0\",\"gridData\":{\"w\":20,\"h\":24,\"x\":28,\"y\":36,\"i\":\"5\"},\"panelIndex\":\"5\",\"embeddableConfig\":{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}},\"enhancements\":{}},\"panelRefName\":\"panel_3\"},{\"version\":\"7.9.0\",\"gridData\":{\"w\":24,\"h\":16,\"x\":8,\"y\":8,\"i\":\"7\"},\"panelIndex\":\"7\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_4\"},{\"version\":\"7.9.0\",\"gridData\":{\"w\":16,\"h\":16,\"x\":32,\"y\":8,\"i\":\"8\"},\"panelIndex\":\"8\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_5\"},{\"version\":\"7.9.0\",\"gridData\":{\"w\":40,\"h\":12,\"x\":8,\"y\":24,\"i\":\"9\"},\"panelIndex\":\"9\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_6\"},{\"version\":\"7.9.0\",\"gridData\":{\"w\":48,\"h\":24,\"x\":0,\"y\":60,\"i\":\"10\"},\"panelIndex\":\"10\",\"embeddableConfig\":{\"columns\":[\"action\",\"reason\",\"source_ip\",\"source_port\",\"destination_ip\",\"destination_port\",\"_id\"],\"sort\":[\"@timestamp\",\"desc\"],\"enhancements\":{}},\"panelRefName\":\"panel_7\"},{\"version\":\"7.9.0\",\"gridData\":{\"w\":8,\"h\":8,\"x\":8,\"y\":0,\"i\":\"11\"},\"panelIndex\":\"11\",\"embeddableConfig\":{\"vis\":{\"defaultColors\":{\"0 - 100\":\"rgb(0,104,55)\"}},\"enhancements\":{}},\"panelRefName\":\"panel_8\"}]","timeRestore":false,"title":"z16.04 - Firewall","version":1},"coreMigrationVersion":"7.16.2","id":"50173bd0-3582-11e7-98ef-19df58fe538b","migrationVersion":{"dashboard":"7.16.0"},"references":[{"id":"b3b449d0-3429-11e7-9d52-4f090484f59e","name":"panel_0","type":"visualization"},{"id":"e76d2eb0-6d6b-11e7-ad64-15aa071374a6","name":"panel_1","type":"visualization"},{"id":"c3a06740-6d75-11e7-b09b-f57b22df6524","name":"panel_2","type":"visualization"},{"id":"df06de60-6d75-11e7-b09b-f57b22df6524","name":"panel_3","type":"visualization"},{"id":"2a1eb100-6d82-11e7-bcd4-0d514e0e7da1","name":"panel_4","type":"visualization"},{"id":"fcf75bc0-6d75-11e7-b09b-f57b22df6524","name":"panel_5","type":"visualization"},{"id":"f8f0dbc0-6d82-11e7-912f-0950e6d5c322","name":"panel_6","type":"visualization"},{"id":"37c16940-6d6b-11e7-ad64-15aa071374a6","name":"panel_7","type":"search"},{"id":"AWDHH3kBxQT5EBNmq459","name":"panel_8","type":"visualization"}],"sort":[1643385898421,1305],"type":"dashboard","updated_at":"2022-01-28T16:04:58.421Z","version":"WzE0MDg3LDE1XQ=="}
|
||||
{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"title":"Security Onion - File Size","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"title\":\"Security Onion - File Size\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"percentageCol\":\"\",\"dimensions\":{\"metrics\":[{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"label\":\"Count\",\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"number\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\",\"parsedUrl\":{\"origin\":\"https://PLACEHOLDER\",\"pathname\":\"/kibana/app/kibana\",\"basePath\":\"/kibana\"}}},\"params\":{},\"label\":\"file.size: Descending\",\"aggType\":\"terms\"}]},\"showToolbar\":true},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"file.size\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Size\"}}]}"},"coreMigrationVersion":"7.16.2","id":"50b4c880-72df-11ea-8dd2-9d8795a1200b","migrationVersion":{"visualization":"7.14.0"},"references":[{"id":"2289a0c0-6970-11ea-a0cd-ffa0f6a1bc29","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"sort":[1643385898421,1307],"type":"visualization","updated_at":"2022-01-28T16:04:58.421Z","version":"WzE0MDg4LDE1XQ=="}
|
||||
{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"filter\":[]}"},"savedSearchRefName":"search_0","title":"RDP - Client","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"title\":\"RDP - Client\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMeticsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"showToolbar\":true},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"client_name.keyword\",\"size\":100,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Client\"}}],\"listeners\":{}}"},"coreMigrationVersion":"7.16.2","id":"524e13b0-371c-11e7-90f8-87842d5eedc9","migrationVersion":{"visualization":"7.14.0"},"references":[{"id":"823dd600-342e-11e7-9e93-53b62e1857b2","name":"search_0","type":"search"}],"sort":[1643385898421,1309],"type":"visualization","updated_at":"2022-01-28T16:04:58.421Z","version":"WzE0MDg5LDE1XQ=="}
|
||||
{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"title":"Security Onion - DNS - Answers","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"title\":\"Security Onion - DNS - Answers\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"percentageCol\":\"\",\"dimensions\":{\"metrics\":[{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"label\":\"Count\",\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\",\"parsedUrl\":{\"origin\":\"https://PLACEHOLDER\",\"pathname\":\"/kibana/app/kibana\",\"basePath\":\"/kibana\"}}},\"params\":{},\"label\":\"dns.answers.keyword: Descending\",\"aggType\":\"terms\"}]},\"showToolbar\":true},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"dns.answers.keyword\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Answer\"}}]}"},"coreMigrationVersion":"7.16.2","id":"536876a0-72ba-11ea-8dd2-9d8795a1200b","migrationVersion":{"visualization":"7.14.0"},"references":[{"id":"2289a0c0-6970-11ea-a0cd-ffa0f6a1bc29","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"sort":[1643385898421,1311],"type":"visualization","updated_at":"2022-01-28T16:04:58.421Z","version":"WzE0MDkwLDE1XQ=="}
|
||||
{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"title":"Security Onion - DNS - Answers","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"title\":\"Security Onion - DNS - Answers\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"percentageCol\":\"\",\"dimensions\":{\"metrics\":[{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"label\":\"Count\",\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\",\"parsedUrl\":{\"origin\":\"https://PLACEHOLDER\",\"pathname\":\"/kibana/app/kibana\",\"basePath\":\"/kibana\"}}},\"params\":{},\"label\":\"dns.answers.name.keyword: Descending\",\"aggType\":\"terms\"}]},\"showToolbar\":true},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"dns.answers.name.keyword\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Answer\"}}]}"},"coreMigrationVersion":"7.16.2","id":"536876a0-72ba-11ea-8dd2-9d8795a1200b","migrationVersion":{"visualization":"7.14.0"},"references":[{"id":"2289a0c0-6970-11ea-a0cd-ffa0f6a1bc29","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"sort":[1643385898421,1311],"type":"visualization","updated_at":"2022-01-28T16:04:58.421Z","version":"WzE0MDkwLDE1XQ=="}
|
||||
{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"filter\":[]}"},"savedSearchRefName":"search_0","title":"Tunnels - Destination Port","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"title\":\"Tunnels - Destination Port\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMeticsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"showToolbar\":true},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"destination_port\",\"size\":100,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Port\"}}],\"listeners\":{}}"},"coreMigrationVersion":"7.16.2","id":"53824da0-6e35-11e7-9a19-a5996f8250c6","migrationVersion":{"visualization":"7.14.0"},"references":[{"id":"d26d5510-342e-11e7-9e93-53b62e1857b2","name":"search_0","type":"search"}],"sort":[1643385898421,1313],"type":"visualization","updated_at":"2022-01-28T16:04:58.421Z","version":"WzE0MDkxLDE1XQ=="}
|
||||
{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"filter\":[]}"},"savedSearchRefName":"search_0","title":"SIP - Log Count Over Time","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"SIP - Log Count Over Time\",\"type\":\"line\",\"params\":{\"grid\":{\"categoryLines\":false,\"style\":{\"color\":\"#eee\"}},\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"type\":\"category\",\"position\":\"bottom\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\"},\"labels\":{\"show\":true,\"truncate\":100},\"title\":{\"text\":\"@timestamp per 12 hours\"}}],\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"name\":\"LeftAxis-1\",\"type\":\"value\",\"position\":\"left\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\",\"mode\":\"normal\"},\"labels\":{\"show\":true,\"rotate\":0,\"filter\":false,\"truncate\":100},\"title\":{\"text\":\"Count\"}}],\"seriesParams\":[{\"show\":true,\"mode\":\"normal\",\"type\":\"line\",\"drawLinesBetweenPoints\":true,\"showCircles\":true,\"interpolate\":\"linear\",\"lineWidth\":2,\"data\":{\"id\":\"1\",\"label\":\"Count\"},\"valueAxis\":\"ValueAxis-1\"}],\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"showCircles\":true,\"interpolate\":\"linear\",\"scale\":\"linear\",\"drawLinesBetweenPoints\":true,\"radiusRatio\":9,\"times\":[],\"addTimeMarker\":false,\"defaultYExtents\":false,\"setYExtents\":false},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"date_histogram\",\"schema\":\"segment\",\"params\":{\"field\":\"@timestamp\",\"interval\":\"auto\",\"min_doc_count\":1,\"extended_bounds\":{}}}],\"listeners\":{}}"},"coreMigrationVersion":"7.16.2","id":"5393c710-3640-11e7-a6f7-4f44d7bf1c33","migrationVersion":{"visualization":"7.14.0"},"references":[{"id":"9e131480-342e-11e7-9e93-53b62e1857b2","name":"search_0","type":"search"}],"sort":[1643385898421,1315],"type":"visualization","updated_at":"2022-01-28T16:04:58.421Z","version":"WzE0MDkyLDE1XQ=="}
|
||||
{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"filter\":[]}"},"savedSearchRefName":"search_0","title":"SSL - Server","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"title\":\"SSL - Server\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMeticsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"showToolbar\":true},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"server_name.keyword\",\"size\":100,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Server\"}}],\"listeners\":{}}"},"coreMigrationVersion":"7.16.2","id":"53ac63e0-365b-11e7-8bd0-1db2c55fb7a1","migrationVersion":{"visualization":"7.14.0"},"references":[{"id":"c8f21de0-342e-11e7-9e93-53b62e1857b2","name":"search_0","type":"search"}],"sort":[1643385898421,1317],"type":"visualization","updated_at":"2022-01-28T16:04:58.421Z","version":"WzE0MDkzLDE1XQ=="}
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
{% set DIGITS = "1234567890" %}
|
||||
{% set LOWERCASE = "qwertyuiopasdfghjklzxcvbnm" %}
|
||||
{% set UPPERCASE = "QWERTYUIOPASDFGHJKLZXCVBNM" %}
|
||||
{% set SYMBOLS = "~!@#$^&*()-_=+[]|;:,.<>?" %}
|
||||
{% set SYMBOLS = "~!@#^&*()-_=+[]|;:,.<>?" %}
|
||||
{% set CHARS = DIGITS~LOWERCASE~UPPERCASE~SYMBOLS %}
|
||||
{% set kibana_encryptedSavedObjects_encryptionKey = salt['pillar.get']('kibana:secrets:encryptedSavedObjects:encryptionKey', salt['random.get_str'](72, chars=CHARS)) %}
|
||||
{% set kibana_security_encryptionKey = salt['pillar.get']('kibana:secrets:security:encryptionKey', salt['random.get_str'](72, chars=CHARS)) %}
|
||||
|
||||
@@ -1,9 +1,12 @@
|
||||
{%- set WEBACCESS = salt['pillar.get']('global:url_base', '') -%}
|
||||
{%- set KRATOSKEY = salt['pillar.get']('kratos:kratoskey', '') -%}
|
||||
{%- set SESSIONTIMEOUT = salt['pillar.get']('kratos:sessiontimeout', '24h') -%}
|
||||
{%- set MFA_ISSUER = salt['pillar.get']('kratos:mfa_issuer', 'Security Onion') -%}
|
||||
|
||||
session:
|
||||
lifespan: {{ SESSIONTIMEOUT }}
|
||||
whoami:
|
||||
required_aal: highest_available
|
||||
|
||||
selfservice:
|
||||
methods:
|
||||
@@ -11,10 +14,15 @@ selfservice:
|
||||
enabled: true
|
||||
config:
|
||||
haveibeenpwned_enabled: false
|
||||
totp:
|
||||
enabled: true
|
||||
config:
|
||||
issuer: {{ MFA_ISSUER }}
|
||||
|
||||
flows:
|
||||
settings:
|
||||
ui_url: https://{{ WEBACCESS }}/?r=/settings
|
||||
required_aal: highest_available
|
||||
|
||||
verification:
|
||||
ui_url: https://{{ WEBACCESS }}/
|
||||
|
||||
@@ -17,6 +17,9 @@
|
||||
"credentials": {
|
||||
"password": {
|
||||
"identifier": true
|
||||
},
|
||||
"totp": {
|
||||
"account_name": true
|
||||
}
|
||||
},
|
||||
"verification": {
|
||||
|
||||
@@ -199,9 +199,6 @@ so-logstash:
|
||||
{% for CONFIGFILE in PIPELINES[PL].config %}
|
||||
- file: ls_pipeline_{{PL}}_{{CONFIGFILE.split('.')[0] | replace("/","_") }}
|
||||
{% endfor %}
|
||||
{% endfor %}
|
||||
{% for TEMPLATE in TEMPLATES %}
|
||||
- file: es_template_{{TEMPLATE.split('.')[0] | replace("/","_") }}
|
||||
{% endfor %}
|
||||
- require:
|
||||
{% if grains['role'] in ['so-manager', 'so-helix', 'so-managersearch', 'so-standalone', 'so-import', 'so-heavynode', 'so-receiver'] %}
|
||||
|
||||
@@ -399,12 +399,18 @@ http {
|
||||
}
|
||||
|
||||
error_page 401 = @error401;
|
||||
error_page 403 = @error403;
|
||||
|
||||
location @error401 {
|
||||
add_header Set-Cookie "AUTH_REDIRECT=$request_uri;Path=/;Max-Age=14400";
|
||||
return 302 /auth/self-service/login/browser;
|
||||
}
|
||||
|
||||
location @error403 {
|
||||
add_header Set-Cookie "ory_kratos_session=;Path=/;Max-Age=0;expires=Thu, 01 Jan 1970 00:00:00 GMT;";
|
||||
return 302 /auth/self-service/login/browser;
|
||||
}
|
||||
|
||||
error_page 500 502 503 504 /50x.html;
|
||||
location = /usr/share/nginx/html/50x.html {
|
||||
}
|
||||
|
||||
@@ -0,0 +1,9 @@
|
||||
{%- if salt['pillar.get']('sensor:hnsensor') %}
|
||||
{%- set HOME_NET = salt['pillar.get']('sensor:hnsensor') %}
|
||||
{%- else %}
|
||||
{%- set HOME_NET = salt['pillar.get']('global:hnmanager') %}
|
||||
{%- endif %}
|
||||
{%- set HNLIST = HOME_NET.split(',') %}
|
||||
{%- for HN in HNLIST %}
|
||||
{{ HN }}
|
||||
{%- endfor %}
|
||||
@@ -127,6 +127,14 @@ nodecfg:
|
||||
- group: 939
|
||||
- template: jinja
|
||||
|
||||
networkscfg:
|
||||
file.managed:
|
||||
- name: /opt/so/conf/zeek/networks.cfg
|
||||
- source: salt://zeek/files/networks.cfg.jinja
|
||||
- user: 937
|
||||
- group: 939
|
||||
- template: jinja
|
||||
|
||||
#zeekcleanscript:
|
||||
# file.managed:
|
||||
# - name: /usr/local/bin/zeek_clean
|
||||
@@ -209,6 +217,7 @@ so-zeek:
|
||||
- /nsm/zeek/extracted:/nsm/zeek/extracted:rw
|
||||
- /opt/so/conf/zeek/local.zeek:/opt/zeek/share/zeek/site/local.zeek:ro
|
||||
- /opt/so/conf/zeek/node.cfg:/opt/zeek/etc/node.cfg:ro
|
||||
- /opt/so/conf/zeek/networks.cfg:/opt/zeek/etc/networks.cfg:ro
|
||||
- /opt/so/conf/zeek/zeekctl.cfg:/opt/zeek/etc/zeekctl.cfg:ro
|
||||
- /opt/so/conf/zeek/policy/securityonion:/opt/zeek/share/zeek/policy/securityonion:ro
|
||||
- /opt/so/conf/zeek/policy/custom:/opt/zeek/share/zeek/policy/custom:ro
|
||||
@@ -219,6 +228,7 @@ so-zeek:
|
||||
- watch:
|
||||
- file: /opt/so/conf/zeek/local.zeek
|
||||
- file: /opt/so/conf/zeek/node.cfg
|
||||
- file: /opt/so/conf/zeek/networks.cfg
|
||||
- file: /opt/so/conf/zeek/zeekctl.cfg
|
||||
- file: /opt/so/conf/zeek/policy
|
||||
- file: /opt/so/conf/zeek/bpf
|
||||
|
||||
Reference in new issue
Block a user