CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-08 10:12:53 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #9188 from Security-Onion-Solutions/feature/filebeat_config_ics_event_tag

Browse Source 
Add 'ics' tag to events generated from ICS protocol logs
This commit is contained in:
weslambert
2022-11-21 17:06:25 -05:00
committed by GitHub
parent 31b4d9cd70 72eccd2649
commit 3afa8bd9da
1 changed files with 8 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
salt/filebeat/etc/filebeat.yml
View File

@@ -144,6 +144,10 @@ filebeat.inputs:
dataset: {{ LOGNAME }} dataset: {{ LOGNAME }}
category: network category: network
processors: processors:
{%- if LOGNAME is match('^bacnet*|^cip*|^cotp*|^dnp3*|^ecat*|^enip*|^modbus*|^opcua*'|^profinet*'|^s7comm*') %}
- add_tags:
tags: ["ics"]
{%- endif %}
- drop_fields: - drop_fields:
fields: ["source", "prospector", "input", "offset", "beat"] fields: ["source", "prospector", "input", "offset", "beat"]
@@ -161,6 +165,10 @@ filebeat.inputs:
category: network category: network
imported: true imported: true
processors: processors:
{%- if LOGNAME is match('^bacnet*|^cip*|^cotp*|^dnp3*|^ecat*|^enip*|^modbus*|^opcua*'|^profinet*'|^s7comm*') %}
- add_tags:
tags: ["ics"]
{%- endif %}
- add_tags: - add_tags:
tags: ["import"] tags: ["import"]
- dissect: - dissect: