From 310ea633b62bed6622e2f7ec8d5ad189f0471ad9 Mon Sep 17 00:00:00 2001 From: weslambert Date: Mon, 21 Nov 2022 16:43:43 -0500 Subject: [PATCH 1/2] Add 'ics' tag to events generated from ICS protocol logs --- salt/filebeat/etc/filebeat.yml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/salt/filebeat/etc/filebeat.yml b/salt/filebeat/etc/filebeat.yml index 75b45d4e6..43bfcfe30 100644 --- a/salt/filebeat/etc/filebeat.yml +++ b/salt/filebeat/etc/filebeat.yml @@ -144,6 +144,10 @@ filebeat.inputs: dataset: {{ LOGNAME }} category: network processors: + {%- if LOGNAME is match('^bacnet*|^cip*|^cotp*|^dnp3*|^ecat*|^enip*|^modbus*|^opcua*'|^profinet*'|^s7comm*') %} + - add_tags: + tags: ["ics"] + {%- endif %} - drop_fields: fields: ["source", "prospector", "input", "offset", "beat"] @@ -161,6 +165,10 @@ filebeat.inputs: category: network imported: true processors: + {%- if LOGNAME is match('^bacnet*|^cip*|^cotp*|^dnp3*|^ecat*|^enip*|^modbus*|^opcua*'|^profinet*'|^s7comm*') %} + - add_tags: + tags: ["ics"] + {%- endif %} - add_tags: tags: ["import"] - dissect: From 72eccd26490211b90d65b6dfb8a8d3bba52a3e40 Mon Sep 17 00:00:00 2001 From: weslambert Date: Mon, 21 Nov 2022 17:01:16 -0500 Subject: [PATCH 2/2] Fix indentation --- salt/filebeat/etc/filebeat.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/salt/filebeat/etc/filebeat.yml b/salt/filebeat/etc/filebeat.yml index 43bfcfe30..7d8633cbe 100644 --- a/salt/filebeat/etc/filebeat.yml +++ b/salt/filebeat/etc/filebeat.yml @@ -146,7 +146,7 @@ filebeat.inputs: processors: {%- if LOGNAME is match('^bacnet*|^cip*|^cotp*|^dnp3*|^ecat*|^enip*|^modbus*|^opcua*'|^profinet*'|^s7comm*') %} - add_tags: - tags: ["ics"] + tags: ["ics"] {%- endif %} - drop_fields: fields: ["source", "prospector", "input", "offset", "beat"] @@ -167,7 +167,7 @@ filebeat.inputs: processors: {%- if LOGNAME is match('^bacnet*|^cip*|^cotp*|^dnp3*|^ecat*|^enip*|^modbus*|^opcua*'|^profinet*'|^s7comm*') %} - add_tags: - tags: ["ics"] + tags: ["ics"] {%- endif %} - add_tags: tags: ["import"]