mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2025-12-11 03:32:53 +01:00
[merge] Merge master into feature/setup-refactor
This commit is contained in:
William Wernert
0
pillar/data/addtotab.sh
Executable file → Normal file
0
pillar/data/addtotab.sh
Executable file → Normal file
0
pillar/firewall/addfirewall.sh
Executable file → Normal file
0
pillar/firewall/addfirewall.sh
Executable file → Normal file
10
pillar/masters/example.sls
Normal file
10
pillar/masters/example.sls
Normal file
@@ -0,0 +1,10 @@
|
||||
# Example Pillar file for a master
|
||||
master:
|
||||
esaccessip: 127.0.0.1
|
||||
esheap: CHANGEME
|
||||
esclustername: {{ grains.host }}
|
||||
freq: 0
|
||||
domainstats: 0
|
||||
lsheap: 1500m
|
||||
lsaccessip: 127.0.0.1
|
||||
elastalert: 1
|
||||
5
pillar/nodes/example.sls
Normal file
5
pillar/nodes/example.sls
Normal file
@@ -0,0 +1,5 @@
|
||||
# Example Pillar file for a sensor
|
||||
node:
|
||||
ls_heapsize: CHANGEME
|
||||
es_heapsize: CHANGEME
|
||||
node_type: CHANGEME
|
||||
14
pillar/sensors/example.sls
Normal file
14
pillar/sensors/example.sls
Normal file
@@ -0,0 +1,14 @@
|
||||
# Example Pillar file for a sensor
|
||||
sensor:
|
||||
interface: CHANGEME
|
||||
bro_pins:
|
||||
- 1
|
||||
- 2
|
||||
- 3
|
||||
- 4
|
||||
brobpf:
|
||||
pcapbpf:
|
||||
nidsbpf:
|
||||
s3bucket:
|
||||
s3key:
|
||||
|
||||
30
salt/auth/init.sls
Normal file
30
salt/auth/init.sls
Normal file
@@ -0,0 +1,30 @@
|
||||
{% set VERSION = salt['pillar.get']('static:soversion', 'HH1.1.4') %}
|
||||
{% set MASTER = salt['grains.get']('master') %}
|
||||
|
||||
so-auth-api-dir:
|
||||
file.directory:
|
||||
- name: /opt/so/conf/auth/api
|
||||
- user: 939
|
||||
- group: 939
|
||||
- makedirs: True
|
||||
|
||||
so-auth-api:
|
||||
docker_container.running:
|
||||
- image: {{ MASTER }}:5000/soshybridhunter/so-auth-api:{{ VERSION }}
|
||||
- hostname: so-auth-api
|
||||
- name: so-auth-api
|
||||
- environment:
|
||||
- BASE_PATH: "/so-auth/api"
|
||||
- AUTH_TOKEN_TIMEOUT: 32400
|
||||
- binds:
|
||||
- /opt/so/conf/auth/api:/data
|
||||
- port_bindings:
|
||||
- 0.0.0.0:5656:5656
|
||||
|
||||
so-auth-ui:
|
||||
docker_container.running:
|
||||
- image: {{ MASTER }}:5000/soshybridhunter/so-auth-ui:{{ VERSION }}
|
||||
- hostname: so-auth-ui
|
||||
- name: so-auth-ui
|
||||
- port_bindings:
|
||||
- 0.0.0.0:4242:80
|
||||
3937
salt/common/grafana/grafana_dashboards/forward_nodes/sensor.json
Normal file
3937
salt/common/grafana/grafana_dashboards/forward_nodes/sensor.json
Normal file
File diff suppressed because it is too large
Load Diff
130
salt/common/nginx/index.html
Normal file
130
salt/common/nginx/index.html
Normal file
@@ -0,0 +1,130 @@
|
||||
<!DOCTYPE html>
|
||||
<html lang="en">
|
||||
<head>
|
||||
<title>Security Onion - Hybrid Hunter</title>
|
||||
<meta charset="utf-8">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1">
|
||||
<link rel="icon" type="image/png" href="favicon-32x32.png" sizes="32x32" />
|
||||
<link rel="icon" type="image/png" href="favicon-16x16.png" sizes="16x16" />
|
||||
<style>
|
||||
* {
|
||||
box-sizing: border-box;
|
||||
font-family: Arial, Helvetica, sans-serif;
|
||||
padding-left: 30px;
|
||||
padding-right: 30px;
|
||||
}
|
||||
|
||||
body {
|
||||
font-family: Arial, Helvetica, sans-serif;
|
||||
background-color: #2a2a2a;
|
||||
|
||||
}
|
||||
a {
|
||||
color: #f2f2f2;
|
||||
text-align: left;
|
||||
padding: 0px;
|
||||
}
|
||||
|
||||
.center {
|
||||
margin: 0 auto;
|
||||
}
|
||||
|
||||
/* Style the top navigation bar */
|
||||
.topnav {
|
||||
overflow: hidden;
|
||||
background-color: #333;
|
||||
width: 1080px;
|
||||
display: flex;
|
||||
align-content: center;
|
||||
}
|
||||
|
||||
/* Style the topnav links */
|
||||
.topnav a {
|
||||
margin: auto;
|
||||
color: #f2f2f2;
|
||||
text-align: center;
|
||||
padding: 14px 16px;
|
||||
text-decoration: none;
|
||||
}
|
||||
|
||||
/* Change color on hover */
|
||||
.topnav a:hover {
|
||||
background-color: #ddd;
|
||||
color: black;
|
||||
}
|
||||
|
||||
/* Style the content */
|
||||
.content {
|
||||
background-color: #2a2a2a;
|
||||
padding: 10px;
|
||||
padding-top: 20px;
|
||||
padding-left: 60px;
|
||||
color: #E3DBCC;
|
||||
width: 1080px;
|
||||
}
|
||||
|
||||
/* Style the footer */
|
||||
.footer {
|
||||
background-color: #2a2a2a;
|
||||
padding: 60px;
|
||||
color: #E3DBCC;
|
||||
width: 1080px;
|
||||
}
|
||||
|
||||
</style>
|
||||
</head>
|
||||
<body>
|
||||
<div class="center">
|
||||
<div class="topnav center">
|
||||
<a href="/so-auth/loginpage/create-user" target="_blank">Create New User</a>
|
||||
<a href="/kibana/" target="_blank">Kibana</a>
|
||||
<a href="/grafana/" target="_blank">Grafana</a>
|
||||
<a href="/sensoroni/" target="_blank">Sensoroni</a>
|
||||
<a href="/playbook/" target="_blank">Playbook</a>
|
||||
<a href="/fleet/" target="_blank">Fleet</a>
|
||||
<a href="/thehive/" target="_blank">TheHive</a>
|
||||
<a href="/packages/" target="_blank">Osquery Packages</a>
|
||||
<a href="https://github.com/Security-Onion-Solutions/securityonion-saltstack/wiki/FAQ" target="_blank">FAQ</a>
|
||||
<a href="https://www.securityonionsolutions.com" target="_blank">Security Onion Solutions</a>
|
||||
<a href="https://blog.securityonion.net" target="_blank">Blog</a>
|
||||
</div>
|
||||
|
||||
<div class="content center">
|
||||
<center><a href="https://securityonion.net"><img STYLE="border: none;" src="alpha_logo.jpg" alt="Security Onion" align="center" target="_blank"></img></a><br></center>
|
||||
|
||||
<p><center><h1>Hybrid Hunter Alpha 1.1.4 - Feature Parity Release</h1></center><br>
|
||||
<h2>Changes:</h2>
|
||||
<ul>
|
||||
<li>Added new in-house auth method [Security Onion Auth](https://github.com/Security-Onion-Solutions/securityonion-auth).</li>
|
||||
<li>Web user creation is done via the browser now instead of so-user-add.</li>
|
||||
<li>New Logstash pipeline setup. Now uses multiple pipelines.</li>
|
||||
<li>New Master + Search node type and well as a Heavy Node type in the install.</li>
|
||||
<li>Change all nodes to point to the docker registry on the Master. This cuts down on the calls to dockerhub.</li>
|
||||
<li>Zeek 3.0.1</li>
|
||||
<li>Elastic 6.8.6</li>
|
||||
<li>New SO Start | Stop | Restart scripts for all components (eg. `so-playbook-restart`).</li>
|
||||
<li>BPF support for Suricata (NIDS), Steno (PCAP) & Zeek ([Docs](https://github.com/Security-Onion-Solutions/securityonion-saltstack/wiki/BPF)).</li>
|
||||
<li>Updated Domain Stats & Frequency Server containers to Python3 & created new Salt states for them.</li>
|
||||
<li>Added so-status script which gives an easy to read look at container status.</li>
|
||||
<li>Manage threshold.conf for Suricata using the thresholding pillar.</li>
|
||||
<li>The ISO now includes all the docker containers for faster install speeds.</li>
|
||||
<li>You now set the password for the onion account during the iso install. This account is temporary and will be removed after so-setup.</li>
|
||||
<li>Updated Helix parsers for better compatibility.</li>
|
||||
<li>Updated telegraf docker to include curl and jq.</li>
|
||||
<li>CVE-2020-0601 Zeek Detection Script.</li>
|
||||
<li>ISO Install now prompts you to create a password for the onion user during imaging. This account gets disabled during setup.</li>
|
||||
<li>Check out the <a href="https://github.com/Security-Onion-Solutions/securityonion-saltstack/wiki/Hybrid-Hunter-Quick-Start-Guide" target="_blank">Hybrid Hunter Quick Start Guide</a>.</li>
|
||||
</ul>
|
||||
</p>
|
||||
</div>
|
||||
|
||||
<div class="footer center">
|
||||
<b>Disclaimer of Warranty</b><br>
|
||||
<small>THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM .AS IS. WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.</small><br>
|
||||
<br>
|
||||
<b>Limitation of Liability</b><br>
|
||||
<small>IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.</small><br>
|
||||
</div>
|
||||
</div>
|
||||
</body>
|
||||
</html>
|
||||
21
salt/common/tools/sbin/so-auth-restart
Normal file
21
salt/common/tools/sbin/so-auth-restart
Normal file
@@ -0,0 +1,21 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Copyright 2014,2015,2016,2017,2018,2019,2020 Security Onion Solutions, LLC
|
||||
#
|
||||
# This program is free software: you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation, either version 3 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
. /usr/sbin/so-common
|
||||
|
||||
/usr/sbin/so-restart auth $1
|
||||
|
||||
20
salt/common/tools/sbin/so-auth-start
Normal file
20
salt/common/tools/sbin/so-auth-start
Normal file
@@ -0,0 +1,20 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Copyright 2014,2015,2016,2017,2018,2019,2020 Security Onion Solutions, LLC
|
||||
#
|
||||
# This program is free software: you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation, either version 3 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
. /usr/sbin/so-common
|
||||
|
||||
/usr/sbin/so-start auth $1
|
||||
20
salt/common/tools/sbin/so-auth-stop
Normal file
20
salt/common/tools/sbin/so-auth-stop
Normal file
@@ -0,0 +1,20 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Copyright 2014,2015,2016,2017,2018,2019,2020 Security Onion Solutions, LLC
|
||||
#
|
||||
# This program is free software: you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation, either version 3 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
. /usr/sbin/so-common
|
||||
|
||||
/usr/sbin/so-stop auth $1
|
||||
9
salt/elasticsearch/files/ingest/bro_common
Normal file
9
salt/elasticsearch/files/ingest/bro_common
Normal file
@@ -0,0 +1,9 @@
|
||||
{
|
||||
"description" : "bro_common",
|
||||
"processors" : [
|
||||
{ "rename": { "field": "@timestamp", "target_field": "timestamp", "ignore_missing": true } },
|
||||
{ "date": { "field": "message2.ts", "target_field": "@timestamp", "formats": ["ISO8601", "UNIX"], "ignore_failure": true } },
|
||||
{ "remove": { "field": "message2.ts", "ignore_failure": true } },
|
||||
{ "pipeline": { "name": "common" } }
|
||||
]
|
||||
}
|
||||
58
salt/elasticsearch/files/ingest/bro_common_ssl
Normal file
58
salt/elasticsearch/files/ingest/bro_common_ssl
Normal file
@@ -0,0 +1,58 @@
|
||||
{
|
||||
"description" : "bro_common_ssl",
|
||||
"processors" : [
|
||||
{
|
||||
"kv": {
|
||||
"field": "certificate_issuer",
|
||||
"field_split": ",",
|
||||
"value_split": "=",
|
||||
"ignore_missing": true,
|
||||
"ignore_failure": true,
|
||||
"include_keys": [ "CN", "C", "O", "OU", "ST", "SN", "L", "DC", "GN", "pseudonym", "serialNumber", "title", "initials" ]
|
||||
}
|
||||
},
|
||||
{ "rename":{ "field": "CN", "target_field": "issuer_common_name", "ignore_failure": true } },
|
||||
{ "rename":{ "field": "C", "target_field": "issuer_country_code", "ignore_failure": true } },
|
||||
{ "rename":{ "field": "O", "target_field": "issuer_organization", "ignore_failure": true } },
|
||||
{ "rename":{ "field": "OU", "target_field": "issuer_organization_unit", "ignore_failure": true } },
|
||||
{ "rename":{ "field": "ST", "target_field": "issuer_state", "ignore_failure": true } },
|
||||
{ "rename":{ "field": "SN", "target_field": "issuer_surname", "ignore_failure": true } },
|
||||
{ "rename":{ "field": "L", "target_field": "issuer_locality", "ignore_failure": true } },
|
||||
{ "rename":{ "field": "DC", "target_field": "issuer_distinguised_name", "ignore_failure": true } },
|
||||
{ "rename":{ "field": "GN", "target_field": "issuer_given_name", "ignore_failure": true } },
|
||||
{ "rename":{ "field": "pseudonym", "target_field": "issuer_pseudonym", "ignore_failure": true } },
|
||||
{ "rename":{ "field": "serialNumber", "target_field": "issuer_serial_number", "ignore_failure": true } },
|
||||
{ "rename":{ "field": "title", "target_field": "issuer_title", "ignore_failure": true } },
|
||||
{ "rename":{ "field": "initials", "target_field": "issuer_initials", "ignore_failure": true } },
|
||||
{
|
||||
"kv": {
|
||||
"field": "certificate_subject",
|
||||
"field_split": ",",
|
||||
"value_split": "=",
|
||||
"ignore_missing": true,
|
||||
"ignore_failure": true,
|
||||
"include_keys": [ "CN", "C", "O", "OU", "ST", "SN", "L", "GN", "pseudonym", "serialNumber", "title", "initials" ]
|
||||
}
|
||||
},
|
||||
{ "rename":{ "field": "CN", "target_field": "certificate_common_name", "ignore_failure": true } },
|
||||
{ "rename":{ "field": "C", "target_field": "certificate_country_code", "ignore_failure": true } },
|
||||
{ "rename":{ "field": "O", "target_field": "certificate_organization", "ignore_failure": true } },
|
||||
{ "rename":{ "field": "OU", "target_field": "certificate_organization_unit","ignore_failure": true } },
|
||||
{ "rename":{ "field": "ST", "target_field": "certificate_state", "ignore_failure": true } },
|
||||
{ "rename":{ "field": "SN", "target_field": "certificate_surname", "ignore_failure": true } },
|
||||
{ "rename":{ "field": "L", "target_field": "certificate_locality", "ignore_failure": true } },
|
||||
{ "rename":{ "field": "GN", "target_field": "certificate_given_name", "ignore_failure": true } },
|
||||
{ "rename":{ "field": "pseudonym", "target_field": "certificate_pseudonym", "ignore_failure": true } },
|
||||
{ "rename":{ "field": "serialNumber", "target_field": "certificate_serial_number", "ignore_failure": true } },
|
||||
{ "rename":{ "field": "title", "target_field": "certificate_title", "ignore_failure": true } },
|
||||
{ "rename":{ "field": "initials", "target_field": "certificate_initials", "ignore_failure": true } },
|
||||
{ "script":{ "lang": "painless", "source": "ctx.certificate_common_name_length = ctx.certificate_common_name.length()", "ignore_failure": true } },
|
||||
{ "script":{ "lang": "painless", "source": "ctx.issuer_common_name_length = ctx.issuer_common_name.length()", "ignore_failure": true } },
|
||||
{ "script":{ "lang": "painless", "source": "ctx.server_name_length = ctx.server_name.length()", "ignore_failure": true } },
|
||||
{
|
||||
"pipeline": {
|
||||
"name": "bro_common"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
48
salt/elasticsearch/files/ingest/bro_conn
Normal file
48
salt/elasticsearch/files/ingest/bro_conn
Normal file
@@ -0,0 +1,48 @@
|
||||
{
|
||||
"description" : "bro_conn",
|
||||
"processors" : [
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.uid", "target_field": "uid", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_h", "target_field": "source_ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_p", "target_field": "source_port", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_h", "target_field": "destination_ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.proto", "target_field": "protocol", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.service", "target_field": "service", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.duration", "target_field": "duration", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.orig_bytes", "target_field": "original_bytes", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.resp_bytes", "target_field": "respond_bytes", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.conn_state", "target_field": "connection_state", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.local_orig", "target_field": "local_orig", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.local_resp", "target_field": "local_respond", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.missed_bytes", "target_field": "missed_bytes", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.history", "target_field": "history", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.orig_pkts", "target_field": "original_packets", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.orig_ip_bytes", "target_field": "original_ip_bytes", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.resp_pkts", "target_field": "respond_packets", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.resp_ip_bytes", "target_field": "respond_ip_bytes", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.tunnel_parents", "target_field": "tunnel_parents", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.orig_cc", "target_field": "original_country_code","ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.resp_cc", "target_field": "respond_country_code", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.sensorname", "target_field": "sensor_name", "ignore_missing": true } },
|
||||
{ "script": { "lang": "painless", "source": "ctx.total_bytes = (ctx.original_bytes + ctx.respond_bytes)", "ignore_failure": true } },
|
||||
{ "set": { "if": "ctx.connection_state == 'S0'", "field": "connection_state_description", "value": "Connection attempt seen, no reply" } },
|
||||
{ "set": { "if": "ctx.connection_state == 'S1'", "field": "connection_state_description", "value": "Connection established, not terminated" } },
|
||||
{ "set": { "if": "ctx.connection_state == 'S2'", "field": "connection_state_description", "value": "Connection established and close attempt by originator seen (but no reply from responder)" } },
|
||||
{ "set": { "if": "ctx.connection_state == 'S3'", "field": "connection_state_description", "value": "Connection established and close attempt by responder seen (but no reply from originator)" } },
|
||||
{ "set": { "if": "ctx.connection_state == 'SF'", "field": "connection_state_description", "value": "Normal SYN/FIN completion" } },
|
||||
{ "set": { "if": "ctx.connection_state == 'REJ'", "field": "connection_state_description", "value": "Connection attempt rejected" } },
|
||||
{ "set": { "if": "ctx.connection_state == 'RSTO'", "field": "connection_state_description", "value": "Connection established, originator aborted (sent a RST)" } },
|
||||
{ "set": { "if": "ctx.connection_state == 'RSTR'", "field": "connection_state_description", "value": "Established, responder aborted" } },
|
||||
{ "set": { "if": "ctx.connection_state == 'RSTOS0'","field": "connection_state_description", "value": "Originator sent a SYN followed by a RST, we never saw a SYN-ACK from the responder" } },
|
||||
{ "set": { "if": "ctx.connection_state == 'RSTRH'", "field": "connection_state_description", "value": "Responder sent a SYN ACK followed by a RST, we never saw a SYN from the (purported) originator" } },
|
||||
{ "set": { "if": "ctx.connection_state == 'SH'", "field": "connection_state_description", "value": "Originator sent a SYN followed by a FIN, we never saw a SYN ACK from the responder (hence the connection was 'half' open)" } },
|
||||
{ "set": { "if": "ctx.connection_state == 'SHR'", "field": "connection_state_description", "value": "Responder sent a SYN ACK followed by a FIN, we never saw a SYN from the originator" } },
|
||||
{ "set": { "if": "ctx.connection_state == 'OTH'", "field": "connection_state_description", "value": "No SYN seen, just midstream traffic (a 'partial connection' that was not later closed)" } },
|
||||
{ "pipeline": { "name": "bro_common" } }
|
||||
]
|
||||
}
|
||||
20
salt/elasticsearch/files/ingest/bro_dce_rpc
Normal file
20
salt/elasticsearch/files/ingest/bro_dce_rpc
Normal file
@@ -0,0 +1,20 @@
|
||||
{
|
||||
"description" : "bro_dce_rpc",
|
||||
"processors" : [
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.uid", "target_field": "uid", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_h", "target_field": "source_ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_p", "target_field": "source_port", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_h", "target_field": "destination_ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.rtt", "target_field": "rtt", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.named_pipe", "target_field": "named_pipe", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.endpoint", "target_field": "endpoint", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.operation", "target_field": "operation", "ignore_missing": true } },
|
||||
{ "pipeline": { "name": "bro_common" } }
|
||||
]
|
||||
}
|
||||
20
salt/elasticsearch/files/ingest/bro_dhcp
Normal file
20
salt/elasticsearch/files/ingest/bro_dhcp
Normal file
@@ -0,0 +1,20 @@
|
||||
{
|
||||
"description" : "bro_dhcp",
|
||||
"processors" : [
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.uids", "target_field": "uid", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.mac", "target_field": "mac", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.assigned_ip", "target_field": "assigned_ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.lease_time", "target_field": "lease_time", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.trans_id", "target_field": "transaction_id", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.assigned_addr", "target_field": "assigned_ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.client_addr", "target_field": "source_ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.server_addr", "target_field": "destination_ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.requested_addr", "target_field": "requested_ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.domain", "target_field": "domain_name", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.host_name", "target_field": "hostname", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.duration", "target_field": "duration", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.msg_types", "target_field": "message_types", "ignore_missing": true } },
|
||||
{ "pipeline": { "name": "bro_common" } }
|
||||
]
|
||||
}
|
||||
19
salt/elasticsearch/files/ingest/bro_dnp3
Normal file
19
salt/elasticsearch/files/ingest/bro_dnp3
Normal file
@@ -0,0 +1,19 @@
|
||||
{
|
||||
"description" : "bro_dnp3",
|
||||
"processors" : [
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.uid", "target_field": "uid", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_h", "target_field": "source_ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_p", "target_field": "source_port", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_h", "target_field": "destination_ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.fc_request", "target_field": "fc_request", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.fc_reply", "target_field": "fc_reply", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.iin", "target_field": "iin", "ignore_missing": true } },
|
||||
{ "pipeline": { "name": "bro_common" } }
|
||||
]
|
||||
}
|
||||
35
salt/elasticsearch/files/ingest/bro_dns
Normal file
35
salt/elasticsearch/files/ingest/bro_dns
Normal file
@@ -0,0 +1,35 @@
|
||||
{
|
||||
"description" : "bro_dns",
|
||||
"processors" : [
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.uid", "target_field": "uid", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_h", "target_field": "source_ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_p", "target_field": "source_port", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_h", "target_field": "destination_ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.proto", "target_field": "protocol", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.trans_id", "target_field": "transaction_id", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.rtt", "target_field": "rtt", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.query", "target_field": "query", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.qclass", "target_field": "query_class", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.qclass_name", "target_field": "query_class_name", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.qtype", "target_field": "query_type", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.qtype_name", "target_field": "query_type_name", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.rcode", "target_field": "rcode", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.rcode_name", "target_field": "rcode_name", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.AA", "target_field": "aa", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.TC", "target_field": "tc", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.RD", "target_field": "rd", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.RA", "target_field": "ra", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.Z", "target_field": "z", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.answers", "target_field": "answers", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.TTLs", "target_field": "ttls", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.rejected", "target_field": "rejected", "ignore_missing": true } },
|
||||
{ "script": { "lang": "painless", "source": "ctx.query_length = ctx.query.length()", "ignore_failure": true } },
|
||||
{ "pipeline": { "name": "bro_common" } }
|
||||
]
|
||||
}
|
||||
19
salt/elasticsearch/files/ingest/bro_dpd
Normal file
19
salt/elasticsearch/files/ingest/bro_dpd
Normal file
@@ -0,0 +1,19 @@
|
||||
{
|
||||
"description" : "bro_dpd",
|
||||
"processors" : [
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.uid", "target_field": "uid", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_h", "target_field": "source_ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_p", "target_field": "source_port", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_h", "target_field": "destination_ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.proto", "target_field": "protocol", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.analyzer", "target_field": "analyzer", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.failure_reason", "target_field": "failure_reason", "ignore_missing": true } },
|
||||
{ "pipeline": { "name": "bro_common" } }
|
||||
]
|
||||
}
|
||||
32
salt/elasticsearch/files/ingest/bro_files
Normal file
32
salt/elasticsearch/files/ingest/bro_files
Normal file
@@ -0,0 +1,32 @@
|
||||
{
|
||||
"description" : "bro_files",
|
||||
"processors" : [
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.fuid", "target_field": "fuid", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.tx_hosts", "target_field": "file_ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.rx_hosts.0", "target_field": "destination_ip", "ignore_missing": true } },
|
||||
{ "remove": { "field": "message2.rx_hosts", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.conn_uids", "target_field": "uid", "ignore_missing": true } },
|
||||
{ "remove": { "field": "source", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.source", "target_field": "source", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.depth", "target_field": "depth", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.analyzers", "target_field": "analyzer", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.mime_type", "target_field": "mimetype", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.filename", "target_field": "file_name", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.duration", "target_field": "duration", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.local_orig", "target_field": "local_orig", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.is_orig", "target_field": "is_orig", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.seen_bytes", "target_field": "seen_bytes", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.total_bytes", "target_field": "total_bytes", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.missing_bytes", "target_field": "missing_bytes", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.overflow_bytes", "target_field": "overflow_bytes", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.timedout", "target_field": "timed_out", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.parent_fuid", "target_field": "parent_fuid", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.md5", "target_field": "md5", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.sha1", "target_field": "sha1", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.extracted", "target_field": "extracted", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.extracted_cutoff", "target_field": "extracted_cutoff", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.extracted_size", "target_field": "extracted_size", "ignore_missing": true } },
|
||||
{ "pipeline": { "name": "bro_common" } }
|
||||
]
|
||||
}
|
||||
33
salt/elasticsearch/files/ingest/bro_ftp
Normal file
33
salt/elasticsearch/files/ingest/bro_ftp
Normal file
@@ -0,0 +1,33 @@
|
||||
{
|
||||
"description" : "bro_http",
|
||||
"processors" : [
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.uid", "target_field": "uid", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_h", "target_field": "source_ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_p", "target_field": "source_port", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_h", "target_field": "destination_ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.user", "target_field": "username", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.password", "target_field": "password", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.command", "target_field": "ftp_command", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.arg", "target_field": "ftp_argument", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.mime_type", "target_field": "mimetype", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.file_size", "target_field": "file_size", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.reply_code", "target_field": "reply_code", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.reply_msg", "target_field": "reply_message", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "data_channel.passive", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.data_channel.passive","target_field": "data_channel_passive", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "data_channel.orig_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.data_channel.orig_h","target_field": "data_channel_source_ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "data_channel.resp_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.data_channel.resp_h","target_field": "data_channel_destination_ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "data_channel.resp_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.data_channel.resp_p","target_field": "data_channel_destination_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.fuid", "target_field": "fuid", "ignore_missing": true } },
|
||||
{ "pipeline": { "name": "bro_common" } }
|
||||
]
|
||||
}
|
||||
42
salt/elasticsearch/files/ingest/bro_http
Normal file
42
salt/elasticsearch/files/ingest/bro_http
Normal file
@@ -0,0 +1,42 @@
|
||||
{
|
||||
"description" : "bro_http",
|
||||
"processors" : [
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.uid", "target_field": "uid", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_h", "target_field": "source_ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_p", "target_field": "source_port", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_h", "target_field": "destination_ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.trans_depth", "target_field": "trans_depth", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.method", "target_field": "method", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.host", "target_field": "virtual_host", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.uri", "target_field": "uri", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.referrer", "target_field": "referrer", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.version", "target_field": "version", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.user_agent", "target_field": "useragent", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.request_body_len", "target_field": "request_body_length", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.response_body_len","target_field": "response_body_length", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.status_code", "target_field": "status_code", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.status_msg", "target_field": "status_message", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.info_code", "target_field": "info_code", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.info_msg", "target_field": "info_message", "ignore_missing": true } },
|
||||
{ "remove": { "field": "message2.tags", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.username", "target_field": "user", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.password", "target_field": "password", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.proxied", "target_field": "proxied", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.orig_fuids", "target_field": "orig_fuids", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.orig_filenames", "target_field": "orig_filenames", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.orig_mime_types", "target_field": "orig_mime_types", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.resp_fuids", "target_field": "resp_fuids", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.resp_filenames", "target_field": "resp_filenames", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.resp_mime_types", "target_field": "resp_mime_types", "ignore_missing": true } },
|
||||
{ "script": { "lang": "painless", "source": "ctx.uri_length = ctx.uri.length()", "ignore_failure": true } },
|
||||
{ "script": { "lang": "painless", "source": "ctx.useragent_length = ctx.useragent.length()", "ignore_failure": true } },
|
||||
{ "script": { "lang": "painless", "source": "ctx.virtual_host_length = ctx.virtual_host.length()", "ignore_failure": true } },
|
||||
{ "pipeline": { "name": "bro_common" } }
|
||||
]
|
||||
}
|
||||
29
salt/elasticsearch/files/ingest/bro_intel
Normal file
29
salt/elasticsearch/files/ingest/bro_intel
Normal file
@@ -0,0 +1,29 @@
|
||||
{
|
||||
"description" : "bro_intel",
|
||||
"processors" : [
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.uid", "target_field": "uid", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_h", "target_field": "source_ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_p", "target_field": "source_port", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_h", "target_field": "destination_ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination_port", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "seen.indicator", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.seen.indicator", "target_field": "indicator", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "seen.indicator_type", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.seen.indicator_type", "target_field": "indicator_type", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "seen.where", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.seen.where", "target_field": "seen_where", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "seen.node", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.seen.node", "target_field": "seen_node", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.matched", "target_field": "matched", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.sources", "target_field": "sources", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.fuid", "target_field": "fuid", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.file_mime_type", "target_field": "mimetype", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.file_desc", "target_field": "file_description", "ignore_missing": true } },
|
||||
{ "pipeline": { "name": "bro_common" } }
|
||||
]
|
||||
}
|
||||
25
salt/elasticsearch/files/ingest/bro_irc
Normal file
25
salt/elasticsearch/files/ingest/bro_irc
Normal file
@@ -0,0 +1,25 @@
|
||||
{
|
||||
"description" : "bro_irc",
|
||||
"processors" : [
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.uid", "target_field": "uid", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_h", "target_field": "source_ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_p", "target_field": "source_port", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_h", "target_field": "destination_ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.nick", "target_field": "nick", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.user", "target_field": "irc_username", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.command", "target_field": "irc_command", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.value", "target_field": "value", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.addl", "target_field": "additional_info", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.dcc_file_name", "target_field": "dcc_file_name", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.dcc_file_size", "target_field": "dcc_file_size", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.dcc_mime_type", "target_field": "dcc_mime_type", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.fuid", "target_field": "fuid", "ignore_missing": true } },
|
||||
{ "pipeline": { "name": "bro_common" } }
|
||||
]
|
||||
}
|
||||
30
salt/elasticsearch/files/ingest/bro_kerberos
Normal file
30
salt/elasticsearch/files/ingest/bro_kerberos
Normal file
@@ -0,0 +1,30 @@
|
||||
{
|
||||
"description" : "bro_kerberos",
|
||||
"processors" : [
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.uid", "target_field": "uid", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_h", "target_field": "source_ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_p", "target_field": "source_port", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_h", "target_field": "destination_ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.request_type", "target_field": "request_type", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.client", "target_field": "client", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.service", "target_field": "service", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.success", "target_field": "kerberos_success", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.error_msg", "target_field": "error_message", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.from", "target_field": "valid_from", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.till", "target_field": "valid_till", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.cipher", "target_field": "cipher", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.forwardable", "target_field": "forwardable", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.renewable", "target_field": "renewable", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.client_cert_subject", "target_field": "client_certificate_subject", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.client_cert_fuid", "target_field": "client_certificate_fuid", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.server_cert_subject", "target_field": "server_certificate_subject", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.server_cert_fuid", "target_field": "server_certificate_fuid", "ignore_missing": true } },
|
||||
{ "pipeline": { "name": "bro_common" } }
|
||||
]
|
||||
}
|
||||
18
salt/elasticsearch/files/ingest/bro_modbus
Normal file
18
salt/elasticsearch/files/ingest/bro_modbus
Normal file
@@ -0,0 +1,18 @@
|
||||
{
|
||||
"description" : "bro_modbus",
|
||||
"processors" : [
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.uid", "target_field": "uid", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_h", "target_field": "source_ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_p", "target_field": "source_port", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_h", "target_field": "destination_ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.func", "target_field": "function", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.exception", "target_field": "exception", "ignore_missing": true } },
|
||||
{ "pipeline": { "name": "bro_common" } }
|
||||
]
|
||||
}
|
||||
21
salt/elasticsearch/files/ingest/bro_mysql
Normal file
21
salt/elasticsearch/files/ingest/bro_mysql
Normal file
@@ -0,0 +1,21 @@
|
||||
{
|
||||
"description" : "bro_mysql",
|
||||
"processors" : [
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.uid", "target_field": "uid", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_h", "target_field": "source_ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_p", "target_field": "source_port", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_h", "target_field": "destination_ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.cmd", "target_field": "mysql_command", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.arg", "target_field": "mysql_argument", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.success", "target_field": "mysql_success", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.rows", "target_field": "rows", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.response", "target_field": "response", "ignore_missing": true } },
|
||||
{ "pipeline": { "name": "bro_common" } }
|
||||
]
|
||||
}
|
||||
36
salt/elasticsearch/files/ingest/bro_notice
Normal file
36
salt/elasticsearch/files/ingest/bro_notice
Normal file
@@ -0,0 +1,36 @@
|
||||
{
|
||||
"description" : "bro_notice",
|
||||
"processors" : [
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "remove": { "field": "message2.dst", "ignore_failure": true } },
|
||||
{ "remove": { "field": "message2.src", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.uid", "target_field": "uid", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_h", "target_field": "source_ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_p", "target_field": "source_port", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_h", "target_field": "destination_ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.fuid", "target_field": "fuid", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.mime", "target_field": "file_mime_type", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.desc", "target_field": "file_description", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.proto", "target_field": "protocol", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.note", "target_field": "note", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.msg", "target_field": "msg", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.sub", "target_field": "sub_msg", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.p", "target_field": "p", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.n", "target_field": "n", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.peer_descr", "target_field": "peer_description", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.actions", "target_field": "action", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.suppress_for", "target_field": "suppress_for", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.dropped", "target_field": "dropped", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.destination_country_code", "target_field": "destination_country_code", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.destination_region", "target_field": "destination_region", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.destination_city", "target_field": "destination_city", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.destination_latitude", "target_field": "destination_latitude", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.destination_longitude", "target_field": "destination_longitude", "ignore_missing": true } },
|
||||
{ "pipeline": { "name": "bro_common" } }
|
||||
]
|
||||
}
|
||||
24
salt/elasticsearch/files/ingest/bro_ntlm
Normal file
24
salt/elasticsearch/files/ingest/bro_ntlm
Normal file
@@ -0,0 +1,24 @@
|
||||
{
|
||||
"description" : "bro_ntlm",
|
||||
"processors" : [
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.uid", "target_field": "uid", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_h", "target_field": "source_ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_p", "target_field": "source_port", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_h", "target_field": "destination_ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.hostname", "target_field": "hostname", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.domainname", "target_field": "domain_name", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.success", "target_field": "ntlm_success", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.status", "target_field": "status", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.username", "target_field": "username", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.server_dns_computer_name", "target_field": "server_dns_computer_name", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.server_nb_computer_name", "target_field": "server_nb_computer_name", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.server_tree_name", "target_field": "server_tree_name", "ignore_missing": true } },
|
||||
{ "pipeline": { "name": "bro_common" } }
|
||||
]
|
||||
}
|
||||
23
salt/elasticsearch/files/ingest/bro_pe
Normal file
23
salt/elasticsearch/files/ingest/bro_pe
Normal file
@@ -0,0 +1,23 @@
|
||||
{
|
||||
"description" : "bro_pe",
|
||||
"processors" : [
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id", "target_field": "fuid", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.machine", "target_field": "machine", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.compile_ts", "target_field": "compile_ts", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.os", "target_field": "os", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.subsystem", "target_field": "subsystem", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.is_exe", "target_field": "is_exe", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.is_64bit", "target_field": "is_64bit", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.uses_aslr", "target_field": "uses_aslr", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.uses_dep", "target_field": "uses_dep", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.uses_code_integrity","target_field": "uses_code_integrity","ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.uses_seh", "target_field": "uses_seh", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.has_import_table", "target_field": "has_import_table", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.has_export_table", "target_field": "has_export_table", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.has_cert_table", "target_field": "has_cert_table", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.has_debug_data", "target_field": "has_debug_data", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.section_names", "target_field": "section_names", "ignore_missing": true } },
|
||||
{ "pipeline": { "name": "bro_common" } }
|
||||
]
|
||||
}
|
||||
25
salt/elasticsearch/files/ingest/bro_radius
Normal file
25
salt/elasticsearch/files/ingest/bro_radius
Normal file
@@ -0,0 +1,25 @@
|
||||
{
|
||||
"description" : "bro_radius",
|
||||
"processors" : [
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.uid", "target_field": "uid", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_h", "target_field": "source_ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_p", "target_field": "source_port", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_h", "target_field": "destination_ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.username", "target_field": "username", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.mac", "target_field": "mac", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.framed_addr", "target_field": "framed_addr", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.remote_ip", "target_field": "remote_ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.connect_info", "target_field": "connect_info", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.reply_msg", "target_field": "reply_message", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.result", "target_field": "result", "ignore_missing": true } },
|
||||
{ "remove": { "field": "message2.ttl", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.logged", "target_field": "logged", "ignore_missing": true } },
|
||||
{ "pipeline": { "name": "bro_common" } }
|
||||
]
|
||||
}
|
||||
31
salt/elasticsearch/files/ingest/bro_rdp
Normal file
31
salt/elasticsearch/files/ingest/bro_rdp
Normal file
@@ -0,0 +1,31 @@
|
||||
{
|
||||
"description" : "bro_rdp",
|
||||
"processors" : [
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.uid", "target_field": "uid", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_h", "target_field": "source_ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_p", "target_field": "source_port", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_h", "target_field": "destination_ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.cookie", "target_field": "cookie", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.result", "target_field": "result", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.security_protocol","target_field": "security_protocol", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.keyboard_layout", "target_field": "keyboard_layout", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.client_build", "target_field": "client_build", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.client_name", "target_field": "client_name", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.client_dig_product_id", "target_field": "client_digital_product_id", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.desktop_width", "target_field": "desktop_width", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.desktop_height", "target_field": "desktop_height", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.requested_color_depth", "target_field": "requested_color_depth", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.cert_type", "target_field": "certificate_type", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.cert_count", "target_field": "certificate_count", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.cert_permanent", "target_field": "certificate_permanent","ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.encryption_level", "target_field": "encryption_level", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.encryption_method","target_field": "encryption_method", "ignore_missing": true } },
|
||||
{ "pipeline": { "name": "bro_common" } }
|
||||
]
|
||||
}
|
||||
26
salt/elasticsearch/files/ingest/bro_rfb
Normal file
26
salt/elasticsearch/files/ingest/bro_rfb
Normal file
@@ -0,0 +1,26 @@
|
||||
{
|
||||
"description" : "bro_rfb",
|
||||
"processors" : [
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.uid", "target_field": "uid", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_h", "target_field": "source_ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_p", "target_field": "source_port", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_h", "target_field": "destination_ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.client_major_version", "target_field": "client_major_version", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.client_minor_version", "target_field": "client_minor_version", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.server_major_version", "target_field": "server_major_version", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.server_minor_version", "target_field": "server_minor_version", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.authentication_method", "target_field": "authentication_method","ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.auth", "target_field": "auth", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.share_flag", "target_field": "share_flag", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.desktop_name", "target_field": "desktop_name", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.width", "target_field": "width", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.height", "target_field": "height", "ignore_missing": true } },
|
||||
{ "pipeline": { "name": "bro_common" } }
|
||||
]
|
||||
}
|
||||
22
salt/elasticsearch/files/ingest/bro_signatures
Normal file
22
salt/elasticsearch/files/ingest/bro_signatures
Normal file
@@ -0,0 +1,22 @@
|
||||
{
|
||||
"description" : "bro_signatures",
|
||||
"processors" : [
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.uid", "target_field": "uid", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_h", "target_field": "source_ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_p", "target_field": "source_port", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_h", "target_field": "destination_ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.note", "target_field": "note", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.sig_id", "target_field": "signature_id", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.event_msg", "target_field": "event_message", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.sub_msg", "target_field": "sub_message", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.sig_count", "target_field": "signature_count", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.host_count", "target_field": "host_count", "ignore_missing": true } },
|
||||
{ "pipeline": { "name": "bro_common" } }
|
||||
]
|
||||
}
|
||||
37
salt/elasticsearch/files/ingest/bro_sip
Normal file
37
salt/elasticsearch/files/ingest/bro_sip
Normal file
@@ -0,0 +1,37 @@
|
||||
{
|
||||
"description" : "bro_sip",
|
||||
"processors" : [
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.uid", "target_field": "uid", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_h", "target_field": "source_ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_p", "target_field": "source_port", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_h", "target_field": "destination_ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.trans_depth", "target_field": "trans_depth", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.method", "target_field": "method", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.uri", "target_field": "uri", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.date", "target_field": "date", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.request_from", "target_field": "request_from", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.request_to", "target_field": "request_to", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.response_from", "target_field": "response_from", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.response_to", "target_field": "response_to", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.reply_to", "target_field": "reply_to", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.call_id", "target_field": "call_id", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.seq", "target_field": "seq", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.subject", "target_field": "subject", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.request_path", "target_field": "request_path", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.response_path", "target_field": "response_path", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.user_agent", "target_field": "user_agent", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.status_code", "target_field": "status_code", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.status_msg", "target_field": "status_msg", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.warning", "target_field": "warning", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.request_body_len", "target_field": "request_body_length", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.response_body_len","target_field": "response_body_length", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.content_type", "target_field": "content_type", "ignore_missing": true } },
|
||||
{ "pipeline": { "name": "bro_common" } }
|
||||
]
|
||||
}
|
||||
31
salt/elasticsearch/files/ingest/bro_smb_files
Normal file
31
salt/elasticsearch/files/ingest/bro_smb_files
Normal file
@@ -0,0 +1,31 @@
|
||||
{
|
||||
"description" : "bro_smb_files",
|
||||
"processors" : [
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.uid", "target_field": "uid", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_h", "target_field": "source_ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_p", "target_field": "source_port", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_h", "target_field": "destination_ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.fuid", "target_field": "fuid", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.action", "target_field": "action", "ignore_missing": true } },
|
||||
{ "remove": { "field": "path", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.path", "target_field": "path", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.name", "target_field": "name", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.size", "target_field": "size", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.prev_name", "target_field": "prev_name", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "times.modified", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.times.modified", "target_field": "times_modified", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "times.accessed", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.times.accessed", "target_field": "times_accessed", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "times.created", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.times.created", "target_field": "times_created", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "times.changed", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.times.changed", "target_field": "times_changed", "ignore_missing": true } },
|
||||
{ "pipeline": { "name": "bro_common" } }
|
||||
]
|
||||
}
|
||||
21
salt/elasticsearch/files/ingest/bro_smb_mapping
Normal file
21
salt/elasticsearch/files/ingest/bro_smb_mapping
Normal file
@@ -0,0 +1,21 @@
|
||||
{
|
||||
"description" : "bro_smb_files",
|
||||
"processors" : [
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.uid", "target_field": "uid", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_h", "target_field": "source_ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_p", "target_field": "source_port", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_h", "target_field": "destination_ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination_port", "ignore_missing": true } },
|
||||
{ "remove": { "field": "path", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.path", "target_field": "path", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.service", "target_field": "service", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.native_file_system", "target_field": "native_file_system", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.share_type", "target_field": "share_type", "ignore_missing": true } },
|
||||
{ "pipeline": { "name": "bro_common" } }
|
||||
]
|
||||
}
|
||||
38
salt/elasticsearch/files/ingest/bro_smtp
Normal file
38
salt/elasticsearch/files/ingest/bro_smtp
Normal file
@@ -0,0 +1,38 @@
|
||||
{
|
||||
"description" : "bro_smtp",
|
||||
"processors" : [
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "remove": { "field": "path", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.uid", "target_field": "uid", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_h", "target_field": "source_ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_p", "target_field": "source_port", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_h", "target_field": "destination_ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.trans_depth", "target_field": "trans_depth", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.helo", "target_field": "helo", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.mailfrom", "target_field": "mail_from", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.rcptto", "target_field": "recipient_to", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.date", "target_field": "mail_date", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.from", "target_field": "from", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.to", "target_field": "to", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.cc", "target_field": "cc", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.reply_to", "target_field": "reply_to", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.msg_id", "target_field": "message_id", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.in_reply_to", "target_field": "in_reply_to", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.subject", "target_field": "subject", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.x_originating_ip", "target_field": "x_originating_ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.first_received", "target_field": "first_received", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.second_received", "target_field": "second_received", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.last_reply", "target_field": "last_reply", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.path", "target_field": "path", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.user_agent", "target_field": "useragent", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.tls", "target_field": "tls", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.fuids", "target_field": "fuids", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.is_webmail", "target_field": "is_webmail", "ignore_missing": true } },
|
||||
{ "pipeline": { "name": "bro_common" } }
|
||||
]
|
||||
}
|
||||
25
salt/elasticsearch/files/ingest/bro_snmp
Normal file
25
salt/elasticsearch/files/ingest/bro_snmp
Normal file
@@ -0,0 +1,25 @@
|
||||
{
|
||||
"description" : "bro_snmp",
|
||||
"processors" : [
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.uid", "target_field": "uid", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_h", "target_field": "source_ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_p", "target_field": "source_port", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_h", "target_field": "destination_ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.duration", "target_field": "duration", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.version", "target_field": "version", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.community", "target_field": "community", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.get_requests", "target_field": "get_requests", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.get_bulk_requests","target_field": "get_bulk_requests", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.get_responses", "target_field": "get_responses", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.set_requests", "target_field": "set_requests", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.display_string", "target_field": "display_string", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.up_since", "target_field": "up_since", "ignore_missing": true } },
|
||||
{ "pipeline": { "name": "bro_common" } }
|
||||
]
|
||||
}
|
||||
28
salt/elasticsearch/files/ingest/bro_socks
Normal file
28
salt/elasticsearch/files/ingest/bro_socks
Normal file
@@ -0,0 +1,28 @@
|
||||
{
|
||||
"description" : "bro_socks",
|
||||
"processors" : [
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.uid", "target_field": "uid", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_h", "target_field": "source_ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_p", "target_field": "source_port", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_h", "target_field": "destination_ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.version", "target_field": "version", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.user", "target_field": "user", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.password", "target_field": "password", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.status", "target_field": "status", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.request_host", "target_field": "request_host", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "request.name", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.request.name", "target_field": "request_name", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.request_p", "target_field": "request_port", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "bound.host", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.bound.host", "target_field": "bound_host", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.bound_name", "target_field": "bound_name", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.bound_p", "target_field": "bound_port", "ignore_missing": true } },
|
||||
{ "pipeline": { "name": "bro_common" } }
|
||||
]
|
||||
}
|
||||
23
salt/elasticsearch/files/ingest/bro_software
Normal file
23
salt/elasticsearch/files/ingest/bro_software
Normal file
@@ -0,0 +1,23 @@
|
||||
{
|
||||
"description" : "bro_software",
|
||||
"processors" : [
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.uid", "target_field": "uid", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "version.major", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.version.major", "target_field": "version_major", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "version.minor", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.version.minor", "target_field": "version_minor", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "version.minor2", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.version.minor2", "target_field": "version_minor2", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "version.minor3", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.version.minor3", "target_field": "version_minor3", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "version.addl", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.version.addl", "target_field": "version_additional_info", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.host", "target_field": "source_ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.host_p", "target_field": "source_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.software_type", "target_field": "software_type", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.name", "target_field": "name", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.unparsed_version", "target_field": "unparsed_version", "ignore_missing": true } },
|
||||
{ "pipeline": { "name": "bro_common" } }
|
||||
]
|
||||
}
|
||||
40
salt/elasticsearch/files/ingest/bro_ssh
Normal file
40
salt/elasticsearch/files/ingest/bro_ssh
Normal file
@@ -0,0 +1,40 @@
|
||||
{
|
||||
"description" : "bro_conn",
|
||||
"processors" : [
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "dot_expander": { "field": "id.orig_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_h", "target_field": "source_ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_p", "target_field": "source_port", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_h", "target_field": "destination_ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.version", "target_field": "version", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.uid", "target_field": "uid", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.hassh", "target_field": "hassh", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.auth_success", "target_field": "authentication_success", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.auth_attempts", "target_field": "authentication_attempts", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.direction", "target_field": "direction", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.client", "target_field": "client", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.server", "target_field": "server", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.cipher_alg", "target_field": "cipher_algorithm", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.compression_alg", "target_field": "compression_algorithm", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.cshka", "target_field": "client_host_key_algorithms", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.host_key_alg", "target_field": "host_key_algorithm", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.hasshAlgorithms", "target_field": "hassh_algorithms", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.hasshServer", "target_field": "hassh_server", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.hasshVersion", "target_field": "hassh_version", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.kex_alg", "target_field": "kex_algorithm", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.mac_alg", "target_field": "mac_algorithm", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.sshka", "target_field": "server_host_key_algorithms", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.host_key", "target_field": "host_key", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.destination_region", "target_field": "destination_region", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.destination_city", "target_field": "destination_city", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.destination_latitude", "target_field": "destination_latitude", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.destination_longitude", "target_field": "destination_longitude", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.destination_country_code", "target_field": "destination_country_code", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.hasshServerAlgorithms", "target_field": "hassh_server_algorithms", "ignore_missing": true } },
|
||||
{ "pipeline": { "name": "bro_common" } }
|
||||
]
|
||||
}
|
||||
33
salt/elasticsearch/files/ingest/bro_ssl
Normal file
33
salt/elasticsearch/files/ingest/bro_ssl
Normal file
@@ -0,0 +1,33 @@
|
||||
{
|
||||
"description" : "bro_ssl",
|
||||
"processors" : [
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.uid", "target_field": "uid", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_h", "target_field": "source_ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_p", "target_field": "source_port", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_h", "target_field": "destination_ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.version", "target_field": "version", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.cipher", "target_field": "cipher", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.curve", "target_field": "curve", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.server_name", "target_field": "server_name", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.resumed", "target_field": "resumed", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.last_alert", "target_field": "last_alert", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.next_protocol", "target_field": "next_protocol", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.established", "target_field": "established", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.cert_chain_fuids", "target_field": "certificate_chain_fuids", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.client_cert_chain_fuids", "target_field": "client_certificate_chain_fuids", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.subject", "target_field": "certificate_subject", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.issuer", "target_field": "certificate_issuer", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.client_subject", "target_field": "client_subject", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.client_issuer", "target_field": "client_issuer", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.validation_status","target_field": "validation_status", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.ja3", "target_field": "ja3", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.ja3s", "target_field": "ja3s", "ignore_missing": true } },
|
||||
{ "pipeline": { "name": "bro_common_ssl" } }
|
||||
]
|
||||
}
|
||||
21
salt/elasticsearch/files/ingest/bro_syslog
Normal file
21
salt/elasticsearch/files/ingest/bro_syslog
Normal file
@@ -0,0 +1,21 @@
|
||||
{
|
||||
"description" : "bro_syslog",
|
||||
"processors" : [
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.uid", "target_field": "uid", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_h", "target_field": "source_ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_p", "target_field": "source_port", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_h", "target_field": "destination_ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.proto", "target_field": "protocol", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.facility", "target_field": "facility", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.severity", "target_field": "severity", "ignore_missing": true } },
|
||||
{ "remove": { "field": "message", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.message", "target_field": "message", "ignore_missing": true } },
|
||||
{ "pipeline": { "name": "bro_common" } }
|
||||
]
|
||||
}
|
||||
7
salt/elasticsearch/files/ingest/bro_tunnel
Normal file
7
salt/elasticsearch/files/ingest/bro_tunnel
Normal file
@@ -0,0 +1,7 @@
|
||||
{
|
||||
"description" : "bro_tunnel",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event_type", "value": "bro_tunnels" } },
|
||||
{ "pipeline": { "name": "bro_tunnels" } }
|
||||
]
|
||||
}
|
||||
18
salt/elasticsearch/files/ingest/bro_tunnels
Normal file
18
salt/elasticsearch/files/ingest/bro_tunnels
Normal file
@@ -0,0 +1,18 @@
|
||||
{
|
||||
"description" : "bro_tunnels",
|
||||
"processors" : [
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.uid", "target_field": "uid", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_h", "target_field": "source_ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_p", "target_field": "source_port", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_h", "target_field": "destination_ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.tunnel_type", "target_field": "tunnel_type", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.action", "target_field": "action", "ignore_missing": true } },
|
||||
{ "pipeline": { "name": "bro_common" } }
|
||||
]
|
||||
}
|
||||
20
salt/elasticsearch/files/ingest/bro_weird
Normal file
20
salt/elasticsearch/files/ingest/bro_weird
Normal file
@@ -0,0 +1,20 @@
|
||||
{
|
||||
"description" : "bro_weird",
|
||||
"processors" : [
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.uid", "target_field": "uid", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_h", "target_field": "source_ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_p", "target_field": "source_port", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_h", "target_field": "destination_ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.name", "target_field": "name", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.addl", "target_field": "additional_info", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.notice", "target_field": "notice", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.peer", "target_field": "peer", "ignore_missing": true } },
|
||||
{ "pipeline": { "name": "bro_common" } }
|
||||
]
|
||||
}
|
||||
44
salt/elasticsearch/files/ingest/bro_x509
Normal file
44
salt/elasticsearch/files/ingest/bro_x509
Normal file
@@ -0,0 +1,44 @@
|
||||
{
|
||||
"description" : "bro_x509",
|
||||
"processors" : [
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id", "target_field": "id", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "certificate.version", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.certificate.version", "target_field": "certificate_version", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "certificate.serial", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.certificate.serial", "target_field": "certificate_serial", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "certificate.subject", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.certificate.subject", "target_field": "certificate_subject", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "certificate.issuer", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.certificate.issuer", "target_field": "certificate_issuer", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "certificate.not_valid_before", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.certificate.not_valid_before", "target_field": "certificate_not_valid_before", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "certificate.not_valid_after", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.certificate.not_valid_after", "target_field": "certificate_not_valid_after", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "certificate.key_alg", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.certificate.key_alg", "target_field": "certificate_key_algorithm", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "certificate.sig_alg", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.certificate.sig_alg", "target_field": "certificate_signing_algorithm", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "certificate.key_type", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.certificate.key_type", "target_field": "certificate_key_type", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "certificate.key_length", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.certificate.key_length", "target_field": "certificate_key_length", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "certificate.exponent", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.certificate.exponent", "target_field": "certificate_exponent", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "certificate.curve", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.certificate.curve", "target_field": "certificate_curve", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "san.dns", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.san.dns", "target_field": "san_dns", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "san.uri", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.san.uri", "target_field": "san_uri", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "san.email", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.san.email", "target_field": "san_email", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "san.ip", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.san.ip", "target_field": "san_ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "basic_constraints.ca", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.basic_constraints.ca", "target_field": "basic_constraints_ca", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "basic_constraints.path_length", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.basic_constraints.path_length", "target_field": "basic_constraints_path_length", "ignore_missing": true } },
|
||||
{ "pipeline": { "name": "bro_common_ssl" } }
|
||||
]
|
||||
}
|
||||
@@ -21,9 +21,6 @@
|
||||
# hostname: {{ grains.host }}
|
||||
#{% endif %}
|
||||
|
||||
include:
|
||||
- mysql
|
||||
|
||||
# Fleet Setup
|
||||
fleetcdir:
|
||||
file.directory:
|
||||
@@ -82,7 +79,6 @@ osquerypackageswebpage:
|
||||
- source: salt://fleet/files/dedicated-index.html
|
||||
- template: jinja
|
||||
|
||||
|
||||
fleetdb:
|
||||
mysql_database.present:
|
||||
- name: fleet
|
||||
@@ -90,8 +86,6 @@ fleetdb:
|
||||
- connection_port: 3306
|
||||
- connection_user: root
|
||||
- connection_pass: {{ MYSQLPASS }}
|
||||
- require:
|
||||
- sls: mysql
|
||||
|
||||
fleetdbuser:
|
||||
mysql_user.present:
|
||||
@@ -101,8 +95,6 @@ fleetdbuser:
|
||||
- connection_port: 3306
|
||||
- connection_user: root
|
||||
- connection_pass: {{ MYSQLPASS }}
|
||||
- require:
|
||||
- fleetdb
|
||||
|
||||
fleetdbpriv:
|
||||
mysql_grants.present:
|
||||
@@ -114,9 +106,8 @@ fleetdbpriv:
|
||||
- connection_port: 3306
|
||||
- connection_user: root
|
||||
- connection_pass: {{ MYSQLPASS }}
|
||||
- require:
|
||||
- fleetdb
|
||||
|
||||
|
||||
|
||||
{% if FLEETPASS == None or FLEETJWT == None %}
|
||||
|
||||
fleet_password_none:
|
||||
|
||||
113
salt/fleet/osquery-packages.html
Normal file
113
salt/fleet/osquery-packages.html
Normal file
@@ -0,0 +1,113 @@
|
||||
<!DOCTYPE html>
|
||||
<html lang="en">
|
||||
<head>
|
||||
<title>Security Onion - Hybrid Hunter</title>
|
||||
<meta charset="utf-8">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1">
|
||||
<link rel="icon" type="image/png" href="favicon-32x32.png" sizes="32x32" />
|
||||
<link rel="icon" type="image/png" href="favicon-16x16.png" sizes="16x16" />
|
||||
<style>
|
||||
* {
|
||||
box-sizing: border-box;
|
||||
font-family: Arial, Helvetica, sans-serif;
|
||||
padding-left: 30px;
|
||||
padding right: 30px;
|
||||
}
|
||||
|
||||
body {
|
||||
font-family: Arial, Helvetica, sans-serif;
|
||||
background-color: #2a2a2a;
|
||||
|
||||
}
|
||||
a {
|
||||
color: #f2f2f2;
|
||||
text-align: left;
|
||||
padding: 0px;
|
||||
}
|
||||
/* Style the top navigation bar */
|
||||
.topnav {
|
||||
overflow: hidden;
|
||||
background-color: #333;
|
||||
width: 1080px;
|
||||
}
|
||||
|
||||
/* Style the topnav links */
|
||||
.topnav a {
|
||||
float: left;
|
||||
display: block;
|
||||
color: #f2f2f2;
|
||||
text-align: center;
|
||||
padding: 14px 16px;
|
||||
text-decoration: none;
|
||||
}
|
||||
|
||||
/* Change color on hover */
|
||||
.topnav a:hover {
|
||||
background-color: #ddd;
|
||||
color: black;
|
||||
}
|
||||
|
||||
/* Style the content */
|
||||
.content {
|
||||
background-color: #2a2a2a;
|
||||
padding: 10px;
|
||||
padding-top: 20px;
|
||||
padding-left: 60px;
|
||||
color: #E3DBCC;
|
||||
width: 1080px;
|
||||
}
|
||||
|
||||
/* Style the footer */
|
||||
.footer {
|
||||
background-color: #2a2a2a;
|
||||
padding: 60px;
|
||||
color: #E3DBCC;
|
||||
width: 1080px;
|
||||
}
|
||||
</style>
|
||||
</head>
|
||||
<body>
|
||||
|
||||
<div class="topnav">
|
||||
<a href="/kibana/" target="_blank">Kibana</a>
|
||||
<a href="/grafana/" target="_blank">Grafana</a>
|
||||
<a href="/fleet/" target="_blank">Fleet</a>
|
||||
<a href="/thehive/" target="_blank">TheHive</a>
|
||||
<a href="/packages/" target="_blank">Osquery Binaries</a>
|
||||
<a href="https://github.com/Security-Onion-Solutions/securityonion-saltstack/wiki/FAQ" target="_blank">FAQ</a>
|
||||
<a href="https://www.securityonionsolutions.com" target="_blank">Security Onion Solutions</a>
|
||||
<a href="https://blog.securityonion.net" target="_blank">Blog</a>
|
||||
</div>
|
||||
|
||||
<div class="content">
|
||||
|
||||
<p><center><h1>Osquery Packages</h1></center><br>
|
||||
|
||||
<h2>Notes</h2>
|
||||
<ul>
|
||||
<li>These packages are customized for this specific Fleet install and will only be generated after the Fleet setup script has been run. If you want vanilla osquery packages, you can get them directly from <a href="https://osquery.io/downloads">osquery.io</a></li>
|
||||
<li>Packages are not signed.</li>
|
||||
</ul>
|
||||
<BR> <h2>Downloads</h2>
|
||||
<ul>
|
||||
|
||||
Generated: N/A
|
||||
<BR><BR>Packages:
|
||||
<li><a href="/packages/launcher.msi" download="msi-launcher.msi">MSI (Windows)</a></li>
|
||||
<li><a href="/packages/launcher.deb" download="deb-launcher.deb">DEB (Debian)</a></li>
|
||||
<li><a href="/packages/launcher.rpm" download="rpm-launcher.rpm">RPM (RPM)</a></li>
|
||||
<BR><BR>Config Files:
|
||||
<li><a href="/packages/launcher.flags" download="launcher.flags.txt">RPM & DEB Flag File</a></li>
|
||||
<li><a href="/packages/launcher-msi.flags" download="launcher-msi.flags.txt">MSI Flag File</a></li>
|
||||
</ul>
|
||||
|
||||
<BR><h2>Known Issues</h2>
|
||||
<ul>
|
||||
<li>None</li>
|
||||
</ul>
|
||||
</p>
|
||||
</div>
|
||||
|
||||
|
||||
</body>
|
||||
</html>
|
||||
0
salt/fleet/packs/PUT.PACKS.IN.HERE
Normal file
0
salt/fleet/packs/PUT.PACKS.IN.HERE
Normal file
13
salt/fleet/packs/hh/hh-post-login.sh
Normal file
13
salt/fleet/packs/hh/hh-post-login.sh
Normal file
@@ -0,0 +1,13 @@
|
||||
#!/bin/sh
|
||||
echo "Applying Post Configuration for Osquery"
|
||||
#fleetctl apply -f /packs/hh/osquery.conf
|
||||
fleetctl apply -f /packs/palantir/Fleet/Endpoints/options.yaml
|
||||
fleetctl apply -f /packs/palantir/Fleet/Endpoints/MacOS/osquery.yaml
|
||||
fleetctl apply -f /packs/palantir/Fleet/Endpoints/Windows/osquery.yaml
|
||||
fleetctl apply -f /packs/hh/hhdefault.yml
|
||||
|
||||
for pack in /packs/palantir/Fleet/Endpoints/packs/*.yaml;
|
||||
do fleetctl apply -f "$pack"
|
||||
done
|
||||
echo ""
|
||||
echo "You can now exit the container by typing exit"
|
||||
28
salt/fleet/packs/hh/hhdefault.yml
Normal file
28
salt/fleet/packs/hh/hhdefault.yml
Normal file
@@ -0,0 +1,28 @@
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
name: users
|
||||
description: Users on the system
|
||||
query: select * from users;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
name: chrome-extensions
|
||||
description: Chrome extensions for all users on the system
|
||||
query: select users.username,chrome_extensions.*,chrome_extensions.path from users cross join chrome_extensions using (uid) where identifier not in ('aapocclcgogkmnckokdopfmhonfmgoek', 'aohghmighlieiainnegkcijnfilokake', 'apdfllckaahabafndbhieahigkjlhalf','felcaaldnbdncclmgdcncolpebgiejap','pjkljhegncpnkpknbcohdijeoejaedia','pkedcjkdefgpdelpbcmbmeomcjbeemfm','blpcfgokakmgnkcojhhkbfbldkacnbeo','ghbmnnjooekpmoecnnnilnnbdlolhkhi','nmmhkkegccagdldgiimedpiccmgmieda');
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: pack
|
||||
spec:
|
||||
name: examples
|
||||
targets:
|
||||
labels:
|
||||
- All Hosts
|
||||
queries:
|
||||
- query: users
|
||||
interval: 180
|
||||
removed: false
|
||||
- query: chrome-extensions
|
||||
interval: 180
|
||||
removed: false
|
||||
29
salt/fleet/packs/hh/osquery.conf
Normal file
29
salt/fleet/packs/hh/osquery.conf
Normal file
@@ -0,0 +1,29 @@
|
||||
apiVersion: v1
|
||||
kind: options
|
||||
spec:
|
||||
config:
|
||||
decorators:
|
||||
always:
|
||||
- SELECT codename FROM os_version;
|
||||
- SELECT uuid AS LiveQuery FROM system_info;
|
||||
- SELECT address AS EndpointIP1 FROM interface_addresses where address not
|
||||
like '%:%' and address not like '127%' and address not like '169%' order by
|
||||
interface desc limit 1;
|
||||
- SELECT address AS EndpointIP2 FROM interface_addresses where address not
|
||||
like '%:%' and address not like '127%' and address not like '169%' order by
|
||||
interface asc limit 1;
|
||||
- SELECT hardware_serial FROM system_info;
|
||||
- SELECT hostname AS hostname FROM system_info;
|
||||
options:
|
||||
decorations_top_level: true
|
||||
disable_distributed: false
|
||||
distributed_interval: 10
|
||||
distributed_plugin: tls
|
||||
distributed_tls_max_attempts: 3
|
||||
distributed_tls_read_endpoint: /api/v1/osquery/distributed/read
|
||||
distributed_tls_write_endpoint: /api/v1/osquery/distributed/write
|
||||
logger_plugin: tls
|
||||
logger_tls_endpoint: /api/v1/osquery/log
|
||||
logger_tls_period: 10
|
||||
pack_delimiter: _
|
||||
overrides: {}
|
||||
694
salt/fleet/packs/palantir/Fleet/Endpoints/MacOS/osquery.yaml
Normal file
694
salt/fleet/packs/palantir/Fleet/Endpoints/MacOS/osquery.yaml
Normal file
@@ -0,0 +1,694 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: pack
|
||||
spec:
|
||||
name: mac-pack
|
||||
queries:
|
||||
- description: 'Query to monitor files for changes inside of /etc/emon.d/ or /private/var/db/emondClients/
|
||||
which can be used for persistence: (https://www.xorrior.com/emond-persistence/)'
|
||||
interval: 3600
|
||||
name: emond
|
||||
platform: darwin
|
||||
query: emond
|
||||
- description: 'Snapshot query to monitor files for changes inside of /etc/emon.d/
|
||||
or /private/var/db/emondClients/ which can be used for persistence: (https://www.xorrior.com/emond-persistence/)'
|
||||
interval: 28800
|
||||
name: emond_snapshot
|
||||
platform: darwin
|
||||
query: emond_snapshot
|
||||
snapshot: true
|
||||
- description: Track time/action changes to files specified in configuration data.
|
||||
interval: 300
|
||||
name: file_events
|
||||
platform: darwin
|
||||
query: file_events
|
||||
removed: false
|
||||
- description: The installed homebrew package database.
|
||||
interval: 28800
|
||||
name: homebrew_packages_snapshot
|
||||
platform: darwin
|
||||
query: homebrew_packages_snapshot
|
||||
snapshot: true
|
||||
- description: List kernel extensions, their signing status, and their hashes (excluding
|
||||
extensions signed by Apple)
|
||||
interval: 3600
|
||||
name: macosx_kextstat
|
||||
platform: darwin
|
||||
query: macosx_kextstat
|
||||
- description: Checks the MD5 hash of /etc/rc.common and records the results if
|
||||
the hash differs from the default value. /etc/rc.common can be used for persistence.
|
||||
interval: 3600
|
||||
name: rc.common
|
||||
platform: darwin
|
||||
query: rc.common
|
||||
- description: Returns information about installed event taps. Can be used to detect
|
||||
keyloggers
|
||||
interval: 300
|
||||
name: event_taps
|
||||
platform: darwin
|
||||
query: event_taps
|
||||
- description: LaunchAgents and LaunchDaemons from default search paths.
|
||||
interval: 3600
|
||||
name: launchd
|
||||
platform: darwin
|
||||
query: launchd
|
||||
- description: Snapshot query for launchd
|
||||
interval: 28800
|
||||
name: launchd_snapshot
|
||||
platform: darwin
|
||||
query: launchd_snapshot
|
||||
snapshot: true
|
||||
- description: Detect the presence of the LD_PRELOAD environment variable
|
||||
interval: 60
|
||||
name: ld_preload
|
||||
platform: darwin
|
||||
query: ld_preload
|
||||
removed: false
|
||||
- description: USB devices that are actively plugged into the host system.
|
||||
interval: 300
|
||||
name: usb_devices
|
||||
platform: darwin
|
||||
query: usb_devices
|
||||
- description: System mounted devices and filesystems (not process specific).
|
||||
interval: 3600
|
||||
name: mounts
|
||||
platform: darwin
|
||||
query: mounts
|
||||
removed: false
|
||||
- description: Apple NVRAM variable listing.
|
||||
interval: 3600
|
||||
name: nvram
|
||||
platform: darwin
|
||||
query: nvram
|
||||
removed: false
|
||||
- description: Line parsed values from system and user cron/tab.
|
||||
interval: 3600
|
||||
name: crontab
|
||||
platform: darwin
|
||||
query: crontab
|
||||
- description: Hardware (PCI/USB/HID) events from UDEV or IOKit.
|
||||
interval: 300
|
||||
name: hardware_events
|
||||
platform: darwin
|
||||
query: hardware_events
|
||||
removed: false
|
||||
- description: The installed homebrew package database.
|
||||
interval: 3600
|
||||
name: homebrew_packages
|
||||
platform: darwin
|
||||
query: homebrew_packages
|
||||
- description: OS X applications installed in known search paths (e.g., /Applications).
|
||||
interval: 3600
|
||||
name: installed_applications
|
||||
platform: darwin
|
||||
query: installed_applications
|
||||
- description: System logins and logouts.
|
||||
interval: 3600
|
||||
name: last
|
||||
platform: darwin
|
||||
query: last
|
||||
removed: false
|
||||
- description: Snapshot query for macosx_kextstat
|
||||
interval: 28800
|
||||
name: macosx_kextstat_snapshot
|
||||
platform: darwin
|
||||
query: macosx_kextstat_snapshot
|
||||
snapshot: true
|
||||
- description: Checks the MD5 hash of /etc/rc.common and records the results if
|
||||
the hash differs from the default value. /etc/rc.common can be used for persistence.
|
||||
interval: 28800
|
||||
name: rc.common_snapshot
|
||||
platform: darwin
|
||||
query: rc.common_snapshot
|
||||
snapshot: true
|
||||
- description: Safari browser extension details for all users.
|
||||
interval: 3600
|
||||
name: safari_extensions
|
||||
platform: darwin
|
||||
query: safari_extensions
|
||||
- description: suid binaries in common locations.
|
||||
interval: 28800
|
||||
name: suid_bin
|
||||
platform: darwin
|
||||
query: suid_bin
|
||||
removed: false
|
||||
- description: Local system users.
|
||||
interval: 28800
|
||||
name: users
|
||||
platform: darwin
|
||||
query: users
|
||||
- description: List authorized_keys for each user on the system
|
||||
interval: 28800
|
||||
name: authorized_keys
|
||||
platform: darwin
|
||||
query: authorized_keys
|
||||
- description: Application, System, and Mobile App crash logs.
|
||||
interval: 3600
|
||||
name: crashes
|
||||
platform: darwin
|
||||
query: crashes
|
||||
removed: false
|
||||
- description: Displays the percentage of free space available on the primary disk
|
||||
partition
|
||||
interval: 3600
|
||||
name: disk_free_space_pct
|
||||
platform: darwin
|
||||
query: disk_free_space_pct
|
||||
snapshot: true
|
||||
- description: Retrieve the interface name, IP address, and MAC address for all
|
||||
interfaces on the host.
|
||||
interval: 600
|
||||
name: network_interfaces_snapshot
|
||||
platform: darwin
|
||||
query: network_interfaces_snapshot
|
||||
snapshot: true
|
||||
- description: Information about EFI/UEFI/ROM and platform/boot.
|
||||
interval: 28800
|
||||
name: platform_info
|
||||
platform: darwin
|
||||
query: platform_info
|
||||
removed: false
|
||||
- description: System uptime
|
||||
interval: 1800
|
||||
name: uptime
|
||||
platform: darwin
|
||||
query: uptime
|
||||
snapshot: true
|
||||
- description: MD5 hash of boot.efi
|
||||
interval: 28800
|
||||
name: boot_efi_hash
|
||||
platform: darwin
|
||||
query: boot_efi_hash
|
||||
- description: Snapshot query for Chrome extensions
|
||||
interval: 28800
|
||||
name: chrome_extensions_snapshot
|
||||
platform: darwin
|
||||
query: chrome_extensions_snapshot
|
||||
- description: Snapshot query for installed_applications
|
||||
interval: 28800
|
||||
name: installed_applications_snapshot
|
||||
platform: darwin
|
||||
query: installed_applications_snapshot
|
||||
snapshot: true
|
||||
- description: NFS shares exported by the host.
|
||||
interval: 3600
|
||||
name: nfs_shares
|
||||
platform: darwin
|
||||
query: nfs_shares
|
||||
removed: false
|
||||
- description: List the version of the resident operating system
|
||||
interval: 28800
|
||||
name: os_version
|
||||
platform: darwin
|
||||
query: os_version
|
||||
- description: Applications and binaries set as user/login startup items.
|
||||
interval: 3600
|
||||
name: startup_items
|
||||
platform: darwin
|
||||
query: startup_items
|
||||
- description: All C/NPAPI browser plugin details for all users.
|
||||
interval: 3600
|
||||
name: browser_plugins
|
||||
platform: darwin
|
||||
query: browser_plugins
|
||||
- description: List installed Firefox addons for all users
|
||||
interval: 3600
|
||||
name: firefox_addons
|
||||
platform: darwin
|
||||
query: firefox_addons
|
||||
- description: Discover hosts that have IP forwarding enabled
|
||||
interval: 28800
|
||||
name: ip_forwarding_enabled
|
||||
platform: darwin
|
||||
query: ip_forwarding_enabled
|
||||
removed: false
|
||||
- description: Platform info snapshot query
|
||||
interval: 28800
|
||||
name: platform_info_snapshot
|
||||
platform: darwin
|
||||
query: platform_info_snapshot
|
||||
- description: Python packages installed in a system.
|
||||
interval: 3600
|
||||
name: python_packages
|
||||
platform: darwin
|
||||
query: python_packages
|
||||
- description: List installed Chrome Extensions for all users
|
||||
interval: 3600
|
||||
name: chrome_extensions
|
||||
platform: darwin
|
||||
query: chrome_extensions
|
||||
- description: Disk encryption status and information.
|
||||
interval: 3600
|
||||
name: disk_encryption
|
||||
platform: darwin
|
||||
query: disk_encryption
|
||||
- description: Local system users.
|
||||
interval: 28800
|
||||
name: users_snapshot
|
||||
platform: darwin
|
||||
query: users_snapshot
|
||||
- description: OS X known/remembered Wi-Fi networks list.
|
||||
interval: 28800
|
||||
name: wireless_networks
|
||||
platform: darwin
|
||||
query: wireless_networks
|
||||
removed: false
|
||||
- description: Determine if the host is running the expected EFI firmware version
|
||||
given their Mac hardware and OS build version (https://github.com/duo-labs/EFIgy)
|
||||
interval: 28800
|
||||
name: efigy
|
||||
platform: darwin
|
||||
query: efigy
|
||||
snapshot: true
|
||||
- description: List the contents of /etc/hosts
|
||||
interval: 28800
|
||||
name: etc_hosts
|
||||
platform: darwin
|
||||
query: etc_hosts
|
||||
- description: Operating system version snapshot query
|
||||
interval: 28800
|
||||
name: os_version_snapshot
|
||||
platform: darwin
|
||||
query: os_version_snapshot
|
||||
snapshot: true
|
||||
- description: Information about the resident osquery process
|
||||
interval: 28800
|
||||
name: osquery_info
|
||||
platform: darwin
|
||||
query: osquery_info
|
||||
snapshot: true
|
||||
- description: Apple's System Integrity Protection (rootless) status.
|
||||
interval: 3600
|
||||
name: sip_config
|
||||
platform: darwin
|
||||
query: sip_config
|
||||
- description: Returns the private keys in the users ~/.ssh directory and whether
|
||||
or not they are encrypted.
|
||||
interval: 3600
|
||||
name: user_ssh_keys
|
||||
platform: darwin
|
||||
query: user_ssh_keys
|
||||
removed: false
|
||||
targets:
|
||||
labels: null
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: 'Query to monitor files for changes inside of /etc/emon.d/ or /private/var/db/emondClients/
|
||||
which can be used for persistence: (https://www.xorrior.com/emond-persistence/)'
|
||||
name: emond
|
||||
query: SELECT * FROM file JOIN hash USING (path) WHERE (path LIKE '/etc/emond.d/%%'
|
||||
AND sha256!='f19f881084f599fa261243918d922373eab14623e78d23c41fcc031aa21ca7b6'
|
||||
AND sha256!='20909c75c14c9f5360a48c889d06a0d6cfbfa28080348940fc077761744f2aa5'
|
||||
AND sha256!='36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068'AND
|
||||
sha256!='2aafb4238cbdd40c66591c01798da942f62c7f06bb84c9328a40581fc22c4af8'AND
|
||||
sha256!='590192452963fdddc1990cd42c3bf77b3532b3e4a2c13e14e42c0d6a4c881ac4'AND
|
||||
sha256!='69f416293592c0a96733498788b79d6516ed1ad5327ac7cafd6d12e8b231519f'AND
|
||||
sha256!='') OR (path LIKE '/private/var/db/emondClients/%');
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: 'Snapshot query to monitor files for changes inside of /etc/emon.d/
|
||||
or /private/var/db/emondClients/ which can be used for persistence: (https://www.xorrior.com/emond-persistence/)'
|
||||
name: emond_snapshot
|
||||
query: SELECT * FROM file JOIN hash USING (path) WHERE (path LIKE '/etc/emond.d/%%'
|
||||
AND sha256!='f19f881084f599fa261243918d922373eab14623e78d23c41fcc031aa21ca7b6'
|
||||
AND sha256!='20909c75c14c9f5360a48c889d06a0d6cfbfa28080348940fc077761744f2aa5'
|
||||
AND sha256!='36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068'AND
|
||||
sha256!='2aafb4238cbdd40c66591c01798da942f62c7f06bb84c9328a40581fc22c4af8'AND
|
||||
sha256!='590192452963fdddc1990cd42c3bf77b3532b3e4a2c13e14e42c0d6a4c881ac4'AND
|
||||
sha256!='69f416293592c0a96733498788b79d6516ed1ad5327ac7cafd6d12e8b231519f'AND
|
||||
sha256!='') OR (path LIKE '/private/var/db/emondClients/%');
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Track time/action changes to files specified in configuration data.
|
||||
name: file_events
|
||||
query: SELECT * FROM file_events;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: The installed homebrew package database.
|
||||
name: homebrew_packages_snapshot
|
||||
query: SELECT name, version FROM homebrew_packages;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: List kernel extensions, their signing status, and their hashes (excluding
|
||||
extensions signed by Apple)
|
||||
name: macosx_kextstat
|
||||
query: SELECT kernel_extensions.idx, kernel_extensions.refs, kernel_extensions.size,
|
||||
kernel_extensions.name, kernel_extensions.version, kernel_extensions.linked_against,
|
||||
kernel_extensions.path, signature.signed, signature.identifier, signature.cdhash,
|
||||
signature.team_identifier, signature.authority, hash.md5 FROM hash JOIN kernel_extensions
|
||||
ON hash.path LIKE printf('%s/Contents/MacOS/%', kernel_extensions.path) JOIN signature
|
||||
ON signature.path LIKE printf('%s/Contents/MacOS/%', kernel_extensions.path) WHERE
|
||||
signature.authority!='Software Signing';
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Checks the MD5 hash of /etc/rc.common and records the results if the
|
||||
hash differs from the default value. /etc/rc.common can be used for persistence.
|
||||
name: rc.common
|
||||
query: SELECT * FROM hash WHERE path='/etc/rc.common' AND md5!='28ce428faefe6168618867f3ff5527f9'
|
||||
and md5!='';
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Returns information about installed event taps. Can be used to detect
|
||||
keyloggers
|
||||
name: event_taps
|
||||
query: SELECT * FROM event_taps INNER JOIN processes ON event_taps.tapping_process
|
||||
= processes.pid WHERE event_tapped NOT LIKE '%mouse%' AND processes.path NOT LIKE
|
||||
'%.app%' AND processes.path!='/Library/Application Support/org.pqrs/Karabiner-Elements/bin/karabiner_grabber'
|
||||
AND processes.path NOT LIKE '/Users/%/bin/kwm' AND processes.path!='/Library/Rapport/bin/rooksd'
|
||||
AND processes.path!='/usr/sbin/universalaccessd' AND processes.path NOT LIKE '/usr/local/Cellar/%'
|
||||
AND processes.path NOT LIKE '/System/Library/%' AND processes.path NOT LIKE '%/steamapps/%'
|
||||
AND event_taps.enabled=1;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: LaunchAgents and LaunchDaemons from default search paths.
|
||||
name: launchd
|
||||
query: SELECT * FROM launchd;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Snapshot query for launchd
|
||||
name: launchd_snapshot
|
||||
query: SELECT path, name, label, program, run_at_load, program_arguments FROM launchd
|
||||
WHERE run_at_load=1;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Detect the presence of the LD_PRELOAD environment variable
|
||||
name: ld_preload
|
||||
query: SELECT process_envs.pid, process_envs.key, process_envs.value, processes.name,
|
||||
processes.path, processes.cmdline, processes.cwd FROM process_envs join processes
|
||||
USING (pid) WHERE key = 'LD_PRELOAD';
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: USB devices that are actively plugged into the host system.
|
||||
name: usb_devices
|
||||
query: SELECT * FROM usb_devices;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: System mounted devices and filesystems (not process specific).
|
||||
name: mounts
|
||||
query: SELECT device, device_alias, path, type, blocks_size FROM mounts;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Apple NVRAM variable listing.
|
||||
name: nvram
|
||||
query: SELECT * FROM nvram;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Line parsed values from system and user cron/tab.
|
||||
name: crontab
|
||||
query: SELECT * FROM crontab;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Hardware (PCI/USB/HID) events from UDEV or IOKit.
|
||||
name: hardware_events
|
||||
query: SELECT * FROM hardware_events;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: The installed homebrew package database.
|
||||
name: homebrew_packages
|
||||
query: SELECT * FROM homebrew_packages;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: OS X applications installed in known search paths (e.g., /Applications).
|
||||
name: installed_applications
|
||||
query: SELECT * FROM apps;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: System logins and logouts.
|
||||
name: last
|
||||
query: SELECT * FROM last;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Snapshot query for macosx_kextstat
|
||||
name: macosx_kextstat_snapshot
|
||||
query: SELECT kernel_extensions.name, kernel_extensions.version, kernel_extensions.path,
|
||||
signature.signed, signature.identifier, signature.cdhash, signature.team_identifier,
|
||||
signature.authority, hash.md5 FROM hash JOIN kernel_extensions ON hash.path LIKE
|
||||
printf('%s/Contents/MacOS/%', kernel_extensions.path) JOIN signature ON signature.path
|
||||
LIKE printf('%s/Contents/MacOS/%', kernel_extensions.path) WHERE signature.authority!='Software
|
||||
Signing';
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Checks the MD5 hash of /etc/rc.common and records the results if the
|
||||
hash differs from the default value. /etc/rc.common can be used for persistence.
|
||||
name: rc.common_snapshot
|
||||
query: SELECT * FROM hash WHERE path='/etc/rc.common' AND md5!='28ce428faefe6168618867f3ff5527f9'
|
||||
and md5!='';
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Safari browser extension details for all users.
|
||||
name: safari_extensions
|
||||
query: SELECT * FROM users JOIN safari_extensions USING (uid);
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: suid binaries in common locations.
|
||||
name: suid_bin
|
||||
query: SELECT * FROM suid_bin;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Local system users.
|
||||
name: users
|
||||
query: SELECT * FROM users;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: List authorized_keys for each user on the system
|
||||
name: authorized_keys
|
||||
query: SELECT * FROM users JOIN authorized_keys USING (uid);
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Application, System, and Mobile App crash logs.
|
||||
name: crashes
|
||||
query: SELECT uid, datetime, responsible, exception_type, identifier, version, crash_path
|
||||
FROM users JOIN crashes USING (uid);
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Displays the percentage of free space available on the primary disk
|
||||
partition
|
||||
name: disk_free_space_pct
|
||||
query: SELECT (blocks_available * 100 / blocks) AS pct FROM mounts WHERE device='/dev/disk1';
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Retrieve the interface name, IP address, and MAC address for all interfaces
|
||||
on the host.
|
||||
name: network_interfaces_snapshot
|
||||
query: SELECT a.interface, a.address, d.mac FROM interface_addresses a JOIN interface_details
|
||||
d USING (interface);
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Information about EFI/UEFI/ROM and platform/boot.
|
||||
name: platform_info
|
||||
query: SELECT * FROM platform_info;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: System uptime
|
||||
name: uptime
|
||||
query: SELECT * FROM uptime;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: MD5 hash of boot.efi
|
||||
name: boot_efi_hash
|
||||
query: SELECT path, md5 FROM hash WHERE path='/System/Library/CoreServices/boot.efi';
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Snapshot query for Chrome extensions
|
||||
name: chrome_extensions_snapshot
|
||||
query: SELECT * FROM users JOIN chrome_extensions USING (uid);
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Snapshot query for installed_applications
|
||||
name: installed_applications_snapshot
|
||||
query: SELECT name, path, bundle_short_version, bundle_version, display_name FROM
|
||||
apps;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: NFS shares exported by the host.
|
||||
name: nfs_shares
|
||||
query: SELECT * FROM nfs_shares;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: List the version of the resident operating system
|
||||
name: os_version
|
||||
query: SELECT * FROM os_version;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Applications and binaries set as user/login startup items.
|
||||
name: startup_items
|
||||
query: SELECT * FROM startup_items;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: All C/NPAPI browser plugin details for all users.
|
||||
name: browser_plugins
|
||||
query: SELECT * FROM users JOIN browser_plugins USING (uid);
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: List installed Firefox addons for all users
|
||||
name: firefox_addons
|
||||
query: SELECT * FROM users JOIN firefox_addons USING (uid);
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Discover hosts that have IP forwarding enabled
|
||||
name: ip_forwarding_enabled
|
||||
query: SELECT * FROM system_controls WHERE name LIKE '%forwarding%' AND name LIKE
|
||||
'%ip%' AND current_value=1;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Platform info snapshot query
|
||||
name: platform_info_snapshot
|
||||
query: SELECT vendor, version, date, revision from platform_info;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Python packages installed in a system.
|
||||
name: python_packages
|
||||
query: SELECT * FROM python_packages;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: List installed Chrome Extensions for all users
|
||||
name: chrome_extensions
|
||||
query: SELECT * FROM users JOIN chrome_extensions USING (uid);
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Disk encryption status and information.
|
||||
name: disk_encryption
|
||||
query: SELECT * FROM disk_encryption;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Local system users.
|
||||
name: users_snapshot
|
||||
query: SELECT * FROM users;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: OS X known/remembered Wi-Fi networks list.
|
||||
name: wireless_networks
|
||||
query: SELECT ssid, network_name, security_type, last_connected, captive_portal,
|
||||
possibly_hidden, roaming, roaming_profile FROM wifi_networks;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Determine if the host is running the expected EFI firmware version
|
||||
given their Mac hardware and OS build version (https://github.com/duo-labs/EFIgy)
|
||||
name: efigy
|
||||
query: SELECT * FROM efigy;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: List the contents of /etc/hosts
|
||||
name: etc_hosts
|
||||
query: SELECT * FROM etc_hosts;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Operating system version snapshot query
|
||||
name: os_version_snapshot
|
||||
query: SELECT * FROM os_version;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Information about the resident osquery process
|
||||
name: osquery_info
|
||||
query: SELECT * FROM osquery_info;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Apple's System Integrity Protection (rootless) status.
|
||||
name: sip_config
|
||||
query: SELECT * FROM sip_config;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Returns the private keys in the users ~/.ssh directory and whether
|
||||
or not they are encrypted.
|
||||
name: user_ssh_keys
|
||||
query: SELECT * FROM users JOIN user_ssh_keys USING (uid);
|
||||
511
salt/fleet/packs/palantir/Fleet/Endpoints/Windows/osquery.yaml
Normal file
511
salt/fleet/packs/palantir/Fleet/Endpoints/Windows/osquery.yaml
Normal file
@@ -0,0 +1,511 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: pack
|
||||
spec:
|
||||
name: windows-pack
|
||||
queries:
|
||||
- description: System info snapshot query
|
||||
interval: 28800
|
||||
name: system_info_snapshot
|
||||
platform: windows
|
||||
query: system_info_snapshot
|
||||
snapshot: true
|
||||
- description: List in-use Windows drivers
|
||||
interval: 3600
|
||||
name: drivers
|
||||
platform: windows
|
||||
query: drivers
|
||||
- description: Displays shared resources on a computer system running Windows. This
|
||||
may be a disk drive, printer, interprocess communication, or other sharable
|
||||
device.
|
||||
interval: 3600
|
||||
name: shared_resources
|
||||
platform: windows
|
||||
query: shared_resources
|
||||
- description: Lists all the patches applied
|
||||
interval: 3600
|
||||
name: patches
|
||||
platform: windows
|
||||
query: patches
|
||||
removed: false
|
||||
- description: Pipes snapshot query
|
||||
interval: 28800
|
||||
name: pipes_snapshot
|
||||
platform: windows
|
||||
query: pipes_snapshot
|
||||
snapshot: true
|
||||
- description: Programs snapshot query
|
||||
interval: 28800
|
||||
name: programs_snapshot
|
||||
platform: windows
|
||||
query: programs_snapshot
|
||||
snapshot: true
|
||||
- description: Services snapshot query
|
||||
interval: 28800
|
||||
name: services_snapshot
|
||||
platform: windows
|
||||
query: services_snapshot
|
||||
snapshot: true
|
||||
- description: WMI CommandLineEventConsumer, which can be used for persistence on
|
||||
Windows. See https://www.blackhat.com/docs/us-15/materials/us-15-Graeber-Abusing-Windows-Management-Instrumentation-WMI-To-Build-A-Persistent%20Asynchronous-And-Fileless-Backdoor-wp.pdf
|
||||
for more details.
|
||||
interval: 3600
|
||||
name: wmi_cli_event_consumers
|
||||
platform: windows
|
||||
query: wmi_cli_event_consumers
|
||||
- description: Lists the relationship between event consumers and filters.
|
||||
interval: 3600
|
||||
name: wmi_filter_consumer_binding
|
||||
platform: windows
|
||||
query: wmi_filter_consumer_binding
|
||||
- description: Snapshot query for Chrome extensions
|
||||
interval: 3600
|
||||
name: chrome_extensions_snapshot
|
||||
platform: windows
|
||||
query: chrome_extensions_snapshot
|
||||
- description: Retrieve the interface name, IP address, and MAC address for all
|
||||
interfaces on the host.
|
||||
interval: 600
|
||||
name: network_interfaces_snapshot
|
||||
platform: windows
|
||||
query: network_interfaces_snapshot
|
||||
snapshot: true
|
||||
- description: Local system users.
|
||||
interval: 3600
|
||||
name: users
|
||||
platform: windows
|
||||
query: users
|
||||
- description: Snapshot query for WMI event consumers.
|
||||
interval: 28800
|
||||
name: wmi_cli_event_consumers_snapshot
|
||||
platform: windows
|
||||
query: wmi_cli_event_consumers_snapshot
|
||||
snapshot: true
|
||||
- description: List all certificates in the trust store
|
||||
interval: 3600
|
||||
name: certificates
|
||||
platform: windows
|
||||
query: certificates
|
||||
removed: false
|
||||
- description: Drivers snapshot query
|
||||
interval: 28800
|
||||
name: drivers_snapshot
|
||||
platform: windows
|
||||
query: drivers_snapshot
|
||||
snapshot: true
|
||||
- description: Lists WMI event filters.
|
||||
interval: 3600
|
||||
name: wmi_event_filters
|
||||
platform: windows
|
||||
query: wmi_event_filters
|
||||
- description: List installed Internet Explorer extensions
|
||||
interval: 3600
|
||||
name: ie_extensions
|
||||
platform: windows
|
||||
query: ie_extensions
|
||||
- description: List the kernel path, version, etc.
|
||||
interval: 3600
|
||||
name: kernel_info
|
||||
platform: windows
|
||||
query: kernel_info
|
||||
- description: List the version of the resident operating system
|
||||
interval: 3600
|
||||
name: os_version
|
||||
platform: windows
|
||||
query: os_version
|
||||
- description: Patches snapshot query
|
||||
interval: 28800
|
||||
name: patches_snapshot
|
||||
platform: windows
|
||||
query: patches_snapshot
|
||||
snapshot: true
|
||||
- description: Named and Anonymous pipes.
|
||||
interval: 3600
|
||||
name: pipes
|
||||
platform: windows
|
||||
query: pipes
|
||||
removed: false
|
||||
- description: Lists installed programs
|
||||
interval: 0
|
||||
name: programs
|
||||
platform: windows
|
||||
query: programs
|
||||
- description: List all certificates in the trust store (snapshot query)
|
||||
interval: 0
|
||||
name: certificates_snapshot
|
||||
platform: windows
|
||||
query: certificates_snapshot
|
||||
snapshot: true
|
||||
- description: List the contents of the Windows hosts file
|
||||
interval: 3600
|
||||
name: etc_hosts
|
||||
platform: windows
|
||||
query: etc_hosts
|
||||
- description: Lists all of the tasks in the Windows task scheduler
|
||||
interval: 3600
|
||||
name: scheduled_tasks
|
||||
platform: windows
|
||||
query: scheduled_tasks
|
||||
- description: Extracted information from Windows crash logs (Minidumps).
|
||||
interval: 3600
|
||||
name: windows_crashes
|
||||
platform: windows
|
||||
query: windows_crashes
|
||||
removed: false
|
||||
- description: System uptime
|
||||
interval: 3600
|
||||
name: uptime
|
||||
platform: windows
|
||||
query: uptime
|
||||
snapshot: true
|
||||
- description: Snapshot query for WMI script event consumers.
|
||||
interval: 3600
|
||||
name: wmi_script_event_consumers
|
||||
platform: windows
|
||||
query: wmi_script_event_consumers
|
||||
snapshot: true
|
||||
- description: List installed Chocolatey packages
|
||||
interval: 3600
|
||||
name: chocolatey_packages
|
||||
platform: windows
|
||||
query: chocolatey_packages
|
||||
- description: Shared resources snapshot query
|
||||
interval: 28800
|
||||
name: shared_resources_snapshot
|
||||
platform: windows
|
||||
query: shared_resources_snapshot
|
||||
snapshot: true
|
||||
- description: Lists all installed services configured to start automatically at
|
||||
boot
|
||||
interval: 3600
|
||||
name: services
|
||||
platform: windows
|
||||
query: services
|
||||
- description: Users snapshot query
|
||||
interval: 28800
|
||||
name: users_snapshot
|
||||
platform: windows
|
||||
query: users_snapshot
|
||||
snapshot: true
|
||||
- description: List installed Chrome Extensions for all users
|
||||
interval: 3600
|
||||
name: chrome_extensions
|
||||
platform: windows
|
||||
query: chrome_extensions
|
||||
- description: Operating system version snapshot query
|
||||
interval: 28800
|
||||
name: os_version_snapshot
|
||||
platform: windows
|
||||
query: os_version_snapshot
|
||||
snapshot: true
|
||||
- description: System information for identification.
|
||||
interval: 3600
|
||||
name: system_info
|
||||
platform: windows
|
||||
query: system_info
|
||||
- description: Snapshot query for WMI event filters.
|
||||
interval: 28800
|
||||
name: wmi_event_filters_snapshot
|
||||
platform: windows
|
||||
query: wmi_event_filters_snapshot
|
||||
snapshot: true
|
||||
- description: Snapshot query for WMI filter consumer bindings.
|
||||
interval: 28800
|
||||
name: wmi_filter_consumer_binding_snapshot
|
||||
platform: windows
|
||||
query: wmi_filter_consumer_binding_snapshot
|
||||
snapshot: true
|
||||
- description: Information about the resident osquery process
|
||||
interval: 28800
|
||||
name: osquery_info
|
||||
platform: windows
|
||||
query: osquery_info
|
||||
snapshot: true
|
||||
- description: Scheduled Tasks snapshot query
|
||||
interval: 28800
|
||||
name: scheduled_tasks_snapshot
|
||||
platform: windows
|
||||
query: scheduled_tasks_snapshot
|
||||
snapshot: true
|
||||
targets:
|
||||
labels: null
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: System info snapshot query
|
||||
name: system_info_snapshot
|
||||
query: SELECT * FROM system_info;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: List in-use Windows drivers
|
||||
name: drivers
|
||||
query: SELECT * FROM drivers;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Displays shared resources on a computer system running Windows. This
|
||||
may be a disk drive, printer, interprocess communication, or other sharable device.
|
||||
name: shared_resources
|
||||
query: SELECT * FROM shared_resources;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Lists all the patches applied
|
||||
name: patches
|
||||
query: SELECT * FROM patches;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Pipes snapshot query
|
||||
name: pipes_snapshot
|
||||
query: SELECT processes.path, processes.cmdline, processes.uid, processes.on_disk,
|
||||
pipes.name, pid FROM pipes JOIN processes USING (pid);
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Programs snapshot query
|
||||
name: programs_snapshot
|
||||
query: SELECT * FROM programs;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Services snapshot query
|
||||
name: services_snapshot
|
||||
query: SELECT * FROM services;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: WMI CommandLineEventConsumer, which can be used for persistence on
|
||||
Windows. See https://www.blackhat.com/docs/us-15/materials/us-15-Graeber-Abusing-Windows-Management-Instrumentation-WMI-To-Build-A-Persistent%20Asynchronous-And-Fileless-Backdoor-wp.pdf
|
||||
for more details.
|
||||
name: wmi_cli_event_consumers
|
||||
query: SELECT * FROM wmi_cli_event_consumers;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Lists the relationship between event consumers and filters.
|
||||
name: wmi_filter_consumer_binding
|
||||
query: SELECT * FROM wmi_filter_consumer_binding;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Snapshot query for Chrome extensions
|
||||
name: chrome_extensions_snapshot
|
||||
query: SELECT * FROM users JOIN chrome_extensions USING (uid);
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Retrieve the interface name, IP address, and MAC address for all interfaces
|
||||
on the host.
|
||||
name: network_interfaces_snapshot
|
||||
query: SELECT a.interface, a.address, d.mac FROM interface_addresses a JOIN interface_details
|
||||
d USING (interface);
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Local system users.
|
||||
name: users
|
||||
query: SELECT * FROM users;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Snapshot query for WMI event consumers.
|
||||
name: wmi_cli_event_consumers_snapshot
|
||||
query: SELECT * FROM wmi_cli_event_consumers;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: List all certificates in the trust store
|
||||
name: certificates
|
||||
query: SELECT * FROM certificates WHERE path != 'Other People';
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Drivers snapshot query
|
||||
name: drivers_snapshot
|
||||
query: SELECT * FROM drivers;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Lists WMI event filters.
|
||||
name: wmi_event_filters
|
||||
query: SELECT * FROM wmi_event_filters;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: List installed Internet Explorer extensions
|
||||
name: ie_extensions
|
||||
query: SELECT * FROM ie_extensions;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: List the kernel path, version, etc.
|
||||
name: kernel_info
|
||||
query: SELECT * FROM kernel_info;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: List the version of the resident operating system
|
||||
name: os_version
|
||||
query: SELECT * FROM os_version;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Patches snapshot query
|
||||
name: patches_snapshot
|
||||
query: SELECT * FROM patches;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Named and Anonymous pipes.
|
||||
name: pipes
|
||||
query: SELECT processes.path, processes.cmdline, processes.uid, processes.on_disk,
|
||||
pipes.name, pid FROM pipes JOIN processes USING (pid);
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Lists installed programs
|
||||
name: programs
|
||||
query: SELECT * FROM programs;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: List all certificates in the trust store (snapshot query)
|
||||
name: certificates_snapshot
|
||||
query: SELECT * FROM certificates WHERE path != 'Other People';
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: List the contents of the Windows hosts file
|
||||
name: etc_hosts
|
||||
query: SELECT * FROM etc_hosts;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Lists all of the tasks in the Windows task scheduler
|
||||
name: scheduled_tasks
|
||||
query: SELECT * FROM scheduled_tasks;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Extracted information from Windows crash logs (Minidumps).
|
||||
name: windows_crashes
|
||||
query: SELECT * FROM windows_crashes;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: System uptime
|
||||
name: uptime
|
||||
query: SELECT * FROM uptime;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Snapshot query for WMI script event consumers.
|
||||
name: wmi_script_event_consumers
|
||||
query: SELECT * FROM wmi_script_event_consumers;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: List installed Chocolatey packages
|
||||
name: chocolatey_packages
|
||||
query: SELECT * FROM chocolatey_packages;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Shared resources snapshot query
|
||||
name: shared_resources_snapshot
|
||||
query: SELECT * FROM shared_resources;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Lists all installed services configured to start automatically at boot
|
||||
name: services
|
||||
query: SELECT * FROM services WHERE start_type='DEMAND_START' OR start_type='AUTO_START';
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Users snapshot query
|
||||
name: users_snapshot
|
||||
query: SELECT * FROM users;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: List installed Chrome Extensions for all users
|
||||
name: chrome_extensions
|
||||
query: SELECT * FROM users JOIN chrome_extensions USING (uid);
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Operating system version snapshot query
|
||||
name: os_version_snapshot
|
||||
query: SELECT * FROM os_version;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: System information for identification.
|
||||
name: system_info
|
||||
query: SELECT * FROM system_info;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Snapshot query for WMI event filters.
|
||||
name: wmi_event_filters_snapshot
|
||||
query: SELECT * FROM wmi_event_filters;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Snapshot query for WMI filter consumer bindings.
|
||||
name: wmi_filter_consumer_binding_snapshot
|
||||
query: SELECT * FROM wmi_filter_consumer_binding;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Information about the resident osquery process
|
||||
name: osquery_info
|
||||
query: SELECT * FROM osquery_info;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Scheduled Tasks snapshot query
|
||||
name: scheduled_tasks_snapshot
|
||||
query: SELECT * FROM scheduled_tasks;
|
||||
46
salt/fleet/packs/palantir/Fleet/Endpoints/options.yaml
Normal file
46
salt/fleet/packs/palantir/Fleet/Endpoints/options.yaml
Normal file
@@ -0,0 +1,46 @@
|
||||
apiVersion: v1
|
||||
kind: options
|
||||
spec:
|
||||
config:
|
||||
decorators:
|
||||
always:
|
||||
- SELECT hostname AS hostname FROM system_info;
|
||||
- SELECT codename FROM os_version;
|
||||
- SELECT uuid AS LiveQuery FROM system_info;
|
||||
- SELECT address AS EndpointIP1 FROM interface_addresses where address not
|
||||
like '%:%' and address not like '127%' and address not like '169%' order by
|
||||
interface desc limit 1;
|
||||
- SELECT address AS EndpointIP2 FROM interface_addresses where address not
|
||||
like '%:%' and address not like '127%' and address not like '169%' order by
|
||||
interface asc limit 1;
|
||||
- SELECT hardware_serial FROM system_info;
|
||||
file_paths:
|
||||
binaries:
|
||||
- /usr/bin/%%
|
||||
- /usr/sbin/%%
|
||||
- /bin/%%
|
||||
- /sbin/%%
|
||||
- /usr/local/bin/%%
|
||||
- /usr/local/sbin/%%
|
||||
- /opt/bin/%%
|
||||
- /opt/sbin/%%
|
||||
configuration:
|
||||
- /etc/%%
|
||||
efi:
|
||||
- /System/Library/CoreServices/boot.efi
|
||||
options:
|
||||
decorations_top_level: true
|
||||
disable_distributed: false
|
||||
disable_tables: windows_events
|
||||
distributed_interval: 10
|
||||
distributed_plugin: tls
|
||||
distributed_tls_max_attempts: 3
|
||||
distributed_tls_read_endpoint: /api/v1/osquery/distributed/read
|
||||
distributed_tls_write_endpoint: /api/v1/osquery/distributed/write
|
||||
logger_plugin: tls
|
||||
logger_snapshot_event_type: true
|
||||
logger_tls_endpoint: /api/v1/osquery/log
|
||||
logger_tls_period: 10
|
||||
pack_delimiter: /
|
||||
schedule_splay_percent: 10
|
||||
overrides: {}
|
||||
@@ -0,0 +1,69 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: pack
|
||||
spec:
|
||||
name: performance-metrics
|
||||
queries:
|
||||
- description: Records the CPU time and memory usage for each individual query.
|
||||
Helpful for identifying queries that may impact performance.
|
||||
interval: 1800
|
||||
name: per_query_perf
|
||||
query: per_query_perf
|
||||
snapshot: true
|
||||
- description: Track the amount of CPU time used by osquery.
|
||||
interval: 1800
|
||||
name: runtime_perf
|
||||
query: runtime_perf
|
||||
snapshot: true
|
||||
- description: Track the percentage of total CPU time utilized by $endpoint_security_tool
|
||||
interval: 1800
|
||||
name: endpoint_security_tool_perf
|
||||
query: endpoint_security_tool_perf
|
||||
snapshot: true
|
||||
- description: Track the percentage of total CPU time utilized by $backup_tool
|
||||
interval: 1800
|
||||
name: backup_tool_perf
|
||||
query: backup_tool_perf
|
||||
snapshot: true
|
||||
targets:
|
||||
labels: null
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Records the CPU time and memory usage for each individual query. Helpful
|
||||
for identifying queries that may impact performance.
|
||||
name: per_query_perf
|
||||
query: SELECT name, interval, executions, output_size, wall_time, (user_time/executions)
|
||||
AS avg_user_time, (system_time/executions) AS avg_system_time, average_memory
|
||||
FROM osquery_schedule;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Track the amount of CPU time used by osquery.
|
||||
name: runtime_perf
|
||||
query: SELECT ov.version AS os_version, ov.platform AS os_platform, ov.codename
|
||||
AS os_codename, i.*, p.resident_size, p.user_time, p.system_time, time.minutes
|
||||
AS counter, db.db_size_mb AS database_size FROM osquery_info i, os_version ov,
|
||||
processes p, time, (SELECT (sum(size) / 1024) / 1024.0 AS db_size_mb FROM (SELECT
|
||||
value FROM osquery_flags WHERE name = 'database_path' LIMIT 1) flags, file WHERE
|
||||
path LIKE flags.value || '%%' AND type = 'regular') db WHERE p.pid = i.pid;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Track the percentage of total CPU time utilized by $endpoint_security_tool
|
||||
name: endpoint_security_tool_perf
|
||||
query: SELECT ((tool_time*100)/(SUM(system_time) + SUM(user_time))) AS pct FROM
|
||||
processes, (SELECT (SUM(processes.system_time)+SUM(processes.user_time)) AS tool_time
|
||||
FROM processes WHERE name='endpoint_security_tool');
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Track the percentage of total CPU time utilized by $backup_tool
|
||||
name: backup_tool_perf
|
||||
query: SELECT ((backuptool_time*100)/(SUM(system_time) + SUM(user_time))) AS pct
|
||||
FROM processes, (SELECT (SUM(processes.system_time)+SUM(processes.user_time))
|
||||
AS backuptool_time FROM processes WHERE name='backup_tool');
|
||||
@@ -0,0 +1,59 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: pack
|
||||
spec:
|
||||
name: security-tooling-checks
|
||||
queries:
|
||||
- description: Returns an event if a EndpointSecurityTool process is not found running
|
||||
from /Applications/EndpointSecurityTool' (OSX) or 'c:\endpointsecuritytool.exe'
|
||||
(Windows)
|
||||
interval: 28800
|
||||
name: endpoint_security_tool_not_running
|
||||
platform: windows,darwin
|
||||
query: endpoint_security_tool_not_running
|
||||
snapshot: true
|
||||
- description: "Returns an event if a BackupTool process is not found running from
|
||||
'/Applications/BackupTool' (OSX) or 'c:\backuptool.exe' (Windows)"
|
||||
interval: 28800
|
||||
name: backup_tool_not_running
|
||||
platform: windows,darwin
|
||||
query: backup_tool_not_running
|
||||
snapshot: true
|
||||
- description: Returns the content of the key if the backend server does not match
|
||||
the expected value
|
||||
interval: 3600
|
||||
name: endpoint_security_tool_backend_server_registry_misconfigured
|
||||
platform: windows
|
||||
query: endpoint_security_tool_backend_server_registry_misconfigured
|
||||
targets:
|
||||
labels: null
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Returns an event if a EndpointSecurityTool process is not found running
|
||||
from /Applications/EndpointSecurityTool' (OSX) or 'c:\endpointsecuritytool.exe'
|
||||
(Windows)
|
||||
name: endpoint_security_tool_not_running
|
||||
query: SELECT IFNULL(process_count,0) as process_exists FROM (SELECT count(*) as
|
||||
process_count from processes where path='/Applications/EndpointSecurityTool' OR
|
||||
lower(path)='c:\endpointsecuritytool.exe') where process_exists!=1;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: "Returns an event if a BackupTool process is not found running from
|
||||
'/Applications/BackupTool' (OSX) or 'c:\backuptool.exe' (Windows)"
|
||||
name: backup_tool_not_running
|
||||
query: SELECT IFNULL(process_count,0) as process_exists FROM (SELECT count(*) as
|
||||
process_count from processes where path='/Applications/BackupTool' OR lower(path)
|
||||
LIKE 'c:\backuptool.exe') where process_exists!=1;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Returns the content of the key if the backend server does not match
|
||||
the expected value
|
||||
name: endpoint_security_tool_backend_server_registry_misconfigured
|
||||
query: SELECT * FROM registry WHERE path='HKEY_LOCAL_MACHINE\Software\EndpointSecurityTool\BackendServerLocation'
|
||||
AND data!='https://expected_endpoint.local';
|
||||
@@ -0,0 +1,93 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: pack
|
||||
spec:
|
||||
name: windows-application-security
|
||||
queries:
|
||||
- description: Controls Bitlocker full-disk encryption settings.
|
||||
interval: 3600
|
||||
name: bitlocker_autoencrypt_settings_registry
|
||||
platform: windows
|
||||
query: bitlocker_autoencrypt_settings_registry
|
||||
- description: Controls Bitlocker full-disk encryption settings.
|
||||
interval: 3600
|
||||
name: bitlocker_fde_settings_registry
|
||||
platform: windows
|
||||
query: bitlocker_fde_settings_registry
|
||||
- description: Controls Google Chrome plugins that are forcibly installed.
|
||||
interval: 3600
|
||||
name: chrome_extension_force_list_registry
|
||||
platform: windows
|
||||
query: chrome_extension_force_list_registry
|
||||
- description: Controls EMET-protected applications and system settings.
|
||||
interval: 3600
|
||||
name: emet_settings_registry
|
||||
platform: windows
|
||||
query: emet_settings_registry
|
||||
- description: Controls Local Administrative Password Solution (LAPS) settings.
|
||||
interval: 3600
|
||||
name: microsoft_laps_settings_registry
|
||||
platform: windows
|
||||
query: microsoft_laps_settings_registry
|
||||
- description: Controls Windows Passport for Work (Hello) settings.
|
||||
interval: 3600
|
||||
name: passport_for_work_settings_registry
|
||||
platform: windows
|
||||
query: passport_for_work_settings_registry
|
||||
- description: Controls UAC. A setting of 0 indicates that UAC is disabled.
|
||||
interval: 3600
|
||||
name: uac_settings_registry
|
||||
platform: windows
|
||||
query: uac_settings_registry
|
||||
targets:
|
||||
labels: null
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Controls Bitlocker full-disk encryption settings.
|
||||
name: bitlocker_autoencrypt_settings_registry
|
||||
query: SELECT * FROM registry WHERE key LIKE 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Bitlocker\%%';
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Controls Bitlocker full-disk encryption settings.
|
||||
name: bitlocker_fde_settings_registry
|
||||
query: SELECT * FROM registry WHERE key LIKE 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\FVE\%%';
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Controls Google Chrome plugins that are forcibly installed.
|
||||
name: chrome_extension_force_list_registry
|
||||
query: SELECT * FROM registry WHERE key='HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\ExtensionInstallForcelist';
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Controls EMET-protected applications and system settings.
|
||||
name: emet_settings_registry
|
||||
query: SELECT * FROM registry WHERE key LIKE 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\%%';
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Controls Local Administrative Password Solution (LAPS) settings.
|
||||
name: microsoft_laps_settings_registry
|
||||
query: SELECT * FROM registry WHERE key='HKEY_LOCAL_MACHINE\Software\Policies\Microsoft
|
||||
Services\AdmPwd';
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Controls Windows Passport for Work (Hello) settings.
|
||||
name: passport_for_work_settings_registry
|
||||
query: SELECT * FROM registry WHERE path LIKE 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\PassportForWork\%%';
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Controls UAC. A setting of 0 indicates that UAC is disabled.
|
||||
name: uac_settings_registry
|
||||
query: SELECT * FROM registry WHERE path='HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA';
|
||||
@@ -0,0 +1,321 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: pack
|
||||
spec:
|
||||
name: windows-compliance
|
||||
queries:
|
||||
- description: 'This key does not exist by default and controls enabling/disabling
|
||||
error reporting display. Some malware creates this key and sets the value to
|
||||
0. See: https://www.documentcloud.org/documents/3477047-Document-07-Neel-Mehta-Billy-Leonard-and-Shane.html'
|
||||
interval: 3600
|
||||
name: error_display_ui_registry
|
||||
platform: windows
|
||||
query: error_display_ui_registry
|
||||
- description: Entries for the FileRenameOperation support the MoveFileEx delayed-rename
|
||||
and delayed-delete capabilities. Sometimes used as a self-deletion technique
|
||||
for malware.
|
||||
interval: 3600
|
||||
name: filerenameoperations_registry
|
||||
platform: windows
|
||||
query: filerenameoperations_registry
|
||||
- description: Controls which security packages store credentials in LSA memory,
|
||||
secure boot, etc.
|
||||
interval: 3600
|
||||
name: local_security_authority_registry
|
||||
platform: windows
|
||||
query: local_security_authority_registry
|
||||
- description: 'This key exists by default and has a default value of 1. Setting
|
||||
this key to 0 disables logging errors/crashes to the System event channel. Some
|
||||
malware sets this value to 0. See: https://www.documentcloud.org/documents/3477047-Document-07-Neel-Mehta-Billy-Leonard-and-Shane.html'
|
||||
interval: 3600
|
||||
name: log_errors_registry
|
||||
platform: windows
|
||||
query: log_errors_registry
|
||||
- description: Controls Windows security provider configurations
|
||||
interval: 3600
|
||||
name: security_providers_registry
|
||||
platform: windows
|
||||
query: security_providers_registry
|
||||
- description: Controls Windows Update server location and installation behavior.
|
||||
interval: 3600
|
||||
name: windows_update_settings_registry
|
||||
platform: windows
|
||||
query: windows_update_settings_registry
|
||||
- description: 'Controls enabling/disabling crash dumps. This key has a default
|
||||
value of 7, but some malware sets this value to 0. See: https://www.documentcloud.org/documents/3477047-Document-07-Neel-Mehta-Billy-Leonard-and-Shane.html'
|
||||
interval: 3600
|
||||
name: crash_dump_registry
|
||||
platform: windows
|
||||
query: crash_dump_registry
|
||||
- description: 'This registry key specifies the path to a DLL to be loaded by a
|
||||
Windows DNS server. This key does not exist by default. Can allow privesc: https://medium.com/@esnesenon/feature-not-bug-dnsadmin-to-dc-compromise-in-one-line-a0f779b8dc83'
|
||||
interval: 3600
|
||||
name: dns_plugin_dll_registry
|
||||
platform: windows
|
||||
query: dns_plugin_dll_registry
|
||||
- description: The KnownDlls key defines the set of DLLs that are first searched
|
||||
during system startup.
|
||||
interval: 3600
|
||||
name: knowndlls_registry
|
||||
platform: windows
|
||||
query: knowndlls_registry
|
||||
- description: This key exists by default and has a default value of 1. Terminal
|
||||
service connections are allowed to the host when the key value is set to 0
|
||||
interval: 3600
|
||||
name: terminal_service_deny_registry
|
||||
platform: windows
|
||||
query: terminal_service_deny_registry
|
||||
- description: Controls Windows command-line auditing
|
||||
interval: 3600
|
||||
name: command_line_auditing_registry
|
||||
platform: windows
|
||||
query: command_line_auditing_registry
|
||||
- description: 'This key (and subkeys) exist by default and are required to allow
|
||||
post-mortem debuggers like Dr. Watson. Some malware deletes this key. See: https://www.documentcloud.org/documents/3477047-Document-07-Neel-Mehta-Billy-Leonard-and-Shane.html'
|
||||
interval: 3600
|
||||
name: dr_watson_registry
|
||||
platform: windows
|
||||
query: dr_watson_registry
|
||||
- description: Controls how many simultaneous terminal services sessions can use
|
||||
the same account
|
||||
interval: 3600
|
||||
name: per_user_ts_session_registry
|
||||
platform: windows
|
||||
query: per_user_ts_session_registry
|
||||
- description: Controls Powershell execution policy, script execution, logging,
|
||||
and more.
|
||||
interval: 3600
|
||||
name: powershell_settings_registry
|
||||
platform: windows
|
||||
query: powershell_settings_registry
|
||||
- description: Controls enabling/disabling SMBv1. Setting this key to 0 disables
|
||||
the SMBv1 protocol on the host.
|
||||
interval: 3600
|
||||
name: smbv1_registry
|
||||
platform: windows
|
||||
query: smbv1_registry
|
||||
- description: Lists information about SecureBoot status.
|
||||
interval: 3600
|
||||
name: secure_boot_registry
|
||||
platform: windows
|
||||
query: secure_boot_registry
|
||||
- description: This key does not exist by default and controls enabling/disabling
|
||||
error reporting. Some malware creates this key sets the value to 0 (disables
|
||||
error reports). See https://msdn.microsoft.com/en-us/library/aa939342(v=winembedded.5).aspx
|
||||
and https://www.documentcloud.org/documents/3477047-Document-07-Neel-Mehta-Billy-Leonard-and-Shane.html
|
||||
interval: 3600
|
||||
name: error_report_registry
|
||||
platform: windows
|
||||
query: error_report_registry
|
||||
- description: Controls behavior, size, and rotation strategy for primary windows
|
||||
event log files.
|
||||
interval: 3600
|
||||
name: event_log_settings_registry
|
||||
platform: windows
|
||||
query: event_log_settings_registry
|
||||
- description: Controls system TPM settings
|
||||
interval: 3600
|
||||
name: tpm_registry
|
||||
platform: windows
|
||||
query: tpm_registry
|
||||
- description: Controls local WinRM client configuration and security.
|
||||
interval: 3600
|
||||
name: winrm_settings_registry
|
||||
platform: windows
|
||||
query: winrm_settings_registry
|
||||
- description: 'Controls the suppression of error dialog boxes. The default value
|
||||
is 0 (all messages are visible), but some malware sets this value to 2 (all
|
||||
messages are invisible). See: https://www.documentcloud.org/documents/3477047-Document-07-Neel-Mehta-Billy-Leonard-and-Shane.html'
|
||||
interval: 3600
|
||||
name: error_mode_registry
|
||||
platform: windows
|
||||
query: error_mode_registry
|
||||
- description: Controls sending administrative notifications after a crash. Some
|
||||
malware sets this value to 0
|
||||
interval: 3600
|
||||
name: send_error_alert_registry
|
||||
platform: windows
|
||||
query: send_error_alert_registry
|
||||
targets:
|
||||
labels: null
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: 'This key does not exist by default and controls enabling/disabling
|
||||
error reporting display. Some malware creates this key and sets the value to 0.
|
||||
See: https://www.documentcloud.org/documents/3477047-Document-07-Neel-Mehta-Billy-Leonard-and-Shane.html'
|
||||
name: error_display_ui_registry
|
||||
query: SELECT * FROM registry WHERE path='HKEY_LOCAL_MACHINE\Software\Microsoft\PCHealth\ErrorReporting\ShowUI';
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Entries for the FileRenameOperation support the MoveFileEx delayed-rename
|
||||
and delayed-delete capabilities. Sometimes used as a self-deletion technique for
|
||||
malware.
|
||||
name: filerenameoperations_registry
|
||||
query: SELECT * FROM registry WHERE path='HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session
|
||||
Manager\FileRenameOperations';
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Controls which security packages store credentials in LSA memory, secure
|
||||
boot, etc.
|
||||
name: local_security_authority_registry
|
||||
query: SELECT * FROM registry WHERE key LIKE 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\%%';
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: 'This key exists by default and has a default value of 1. Setting this
|
||||
key to 0 disables logging errors/crashes to the System event channel. Some malware
|
||||
sets this value to 0. See: https://www.documentcloud.org/documents/3477047-Document-07-Neel-Mehta-Billy-Leonard-and-Shane.html'
|
||||
name: log_errors_registry
|
||||
query: SELECT * FROM registry WHERE path='HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\CrashControl\LogEvent';
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Controls Windows security provider configurations
|
||||
name: security_providers_registry
|
||||
query: SELECT * FROM registry WHERE key LIKE 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\%%';
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Controls Windows Update server location and installation behavior.
|
||||
name: windows_update_settings_registry
|
||||
query: SELECT * FROM registry WHERE key LIKE 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\%%';
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: 'Controls enabling/disabling crash dumps. This key has a default value
|
||||
of 7, but some malware sets this value to 0. See: https://www.documentcloud.org/documents/3477047-Document-07-Neel-Mehta-Billy-Leonard-and-Shane.html'
|
||||
name: crash_dump_registry
|
||||
query: SELECT * FROM registry WHERE path='HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\CrashControl\CrashDumpEnabled';
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: 'This registry key specifies the path to a DLL to be loaded by a Windows
|
||||
DNS server. This key does not exist by default. Can allow privesc: https://medium.com/@esnesenon/feature-not-bug-dnsadmin-to-dc-compromise-in-one-line-a0f779b8dc83'
|
||||
name: dns_plugin_dll_registry
|
||||
query: SELECT * FROM registry WHERE key='HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\DNS\Parameters\ServerLevelPluginDll';
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: The KnownDlls key defines the set of DLLs that are first searched during
|
||||
system startup.
|
||||
name: knowndlls_registry
|
||||
query: SELECT * FROM registry WHERE path LIKE 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session
|
||||
Manager\KnownDLLs\%%';
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: This key exists by default and has a default value of 1. Terminal service
|
||||
connections are allowed to the host when the key value is set to 0
|
||||
name: terminal_service_deny_registry
|
||||
query: SELECT * FROM registry WHERE path='HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal
|
||||
Server\fDenyTSConnections';
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Controls Windows command-line auditing
|
||||
name: command_line_auditing_registry
|
||||
query: SELECT * FROM registry WHERE key='HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\Audit';
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: 'This key (and subkeys) exist by default and are required to allow
|
||||
post-mortem debuggers like Dr. Watson. Some malware deletes this key. See: https://www.documentcloud.org/documents/3477047-Document-07-Neel-Mehta-Billy-Leonard-and-Shane.html'
|
||||
name: dr_watson_registry
|
||||
query: SELECT * FROM registry WHERE key='HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
|
||||
NT\CurrentVersion\AeDebug';
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Controls how many simultaneous terminal services sessions can use the
|
||||
same account
|
||||
name: per_user_ts_session_registry
|
||||
query: SELECT * FROM registry WHERE path='HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal
|
||||
Server\fSingleSessionPerUser';
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Controls Powershell execution policy, script execution, logging, and
|
||||
more.
|
||||
name: powershell_settings_registry
|
||||
query: SELECT * FROM registry WHERE key LIKE 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Powershell\%%';
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Controls enabling/disabling SMBv1. Setting this key to 0 disables the
|
||||
SMBv1 protocol on the host.
|
||||
name: smbv1_registry
|
||||
query: SELECT * FROM registry WHERE path='HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\SMB1';
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Lists information about SecureBoot status.
|
||||
name: secure_boot_registry
|
||||
query: SELECT * FROM registry WHERE key='HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecureBoot';
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: This key does not exist by default and controls enabling/disabling
|
||||
error reporting. Some malware creates this key sets the value to 0 (disables error
|
||||
reports). See https://msdn.microsoft.com/en-us/library/aa939342(v=winembedded.5).aspx
|
||||
and https://www.documentcloud.org/documents/3477047-Document-07-Neel-Mehta-Billy-Leonard-and-Shane.html
|
||||
name: error_report_registry
|
||||
query: SELECT * FROM registry WHERE path='HKEY_LOCAL_MACHINE\Software\Microsoft\PCHealth\ErrorReporting\DoReport';
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Controls behavior, size, and rotation strategy for primary windows
|
||||
event log files.
|
||||
name: event_log_settings_registry
|
||||
query: SELECT * FROM registry WHERE key LIKE 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\EventLog\%%';
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Controls system TPM settings
|
||||
name: tpm_registry
|
||||
query: SELECT * FROM registry WHERE key='HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\TPM';
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Controls local WinRM client configuration and security.
|
||||
name: winrm_settings_registry
|
||||
query: SELECT * FROM registry WHERE key LIKE 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRM\%%';
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: 'Controls the suppression of error dialog boxes. The default value
|
||||
is 0 (all messages are visible), but some malware sets this value to 2 (all messages
|
||||
are invisible). See: https://www.documentcloud.org/documents/3477047-Document-07-Neel-Mehta-Billy-Leonard-and-Shane.html'
|
||||
name: error_mode_registry
|
||||
query: SELECT * FROM registry WHERE path='HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Windows\ErrorMode';
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Controls sending administrative notifications after a crash. Some malware
|
||||
sets this value to 0
|
||||
name: send_error_alert_registry
|
||||
query: SELECT * FROM registry WHERE path='HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\CrashControl\SendAlert';
|
||||
@@ -0,0 +1,475 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: pack
|
||||
spec:
|
||||
name: windows-registry-monitoring
|
||||
queries:
|
||||
- description: Technique used by attackers to prevent computer accounts from changing
|
||||
their password, thus extending the life of Kerberos silver tickets (https://adsecurity.org/?p=2011)
|
||||
interval: 3600
|
||||
name: computer_password_change_disabled_registry
|
||||
platform: windows
|
||||
query: computer_password_change_disabled_registry
|
||||
- description: Returns 0 as a result if the registry key does not exist
|
||||
interval: 3600
|
||||
name: error_mode_registry_missing
|
||||
platform: windows
|
||||
query: error_mode_registry_missing
|
||||
- description: Returns 0 as a result if the registry key does not exist
|
||||
interval: 3600
|
||||
name: per_user_ts_session_registry_missing
|
||||
platform: windows
|
||||
query: per_user_ts_session_registry_missing
|
||||
- description: Returns 0 as a result if the registry key does not exist
|
||||
interval: 3600
|
||||
name: powershell_invocationheader_registry_missing
|
||||
platform: windows
|
||||
query: powershell_invocationheader_registry_missing
|
||||
- description: Returns the content of the key if it does not match the expected
|
||||
value
|
||||
interval: 3600
|
||||
name: bitlocker_encryption_settings_registry_misconfigured
|
||||
platform: windows
|
||||
query: bitlocker_encryption_settings_registry_misconfigured
|
||||
- description: Returns the content of the key if it does not match the expected
|
||||
value
|
||||
interval: 3600
|
||||
name: bitlocker_mbam_registry_misconfigured
|
||||
platform: windows
|
||||
query: bitlocker_mbam_registry_misconfigured
|
||||
- description: Returns the content of this key if it exists, which it shouldn't
|
||||
by default
|
||||
interval: 3600
|
||||
name: dns_plugin_dll_registry_exists
|
||||
platform: windows
|
||||
query: dns_plugin_dll_registry_exists
|
||||
- description: Returns the content of this key if it exists, which it shouldn't
|
||||
by default
|
||||
interval: 3600
|
||||
name: error_display_ui_registry_exists
|
||||
platform: windows
|
||||
query: error_display_ui_registry_exists
|
||||
- description: Returns the content of the key if it does not match the expected
|
||||
value
|
||||
interval: 3600
|
||||
name: log_errors_registry_misconfigured
|
||||
platform: windows
|
||||
query: log_errors_registry_misconfigured
|
||||
- description: Returns the content of the key if it does not match the expected
|
||||
value
|
||||
interval: 3600
|
||||
name: subscription_manager_registry_misconfigured
|
||||
platform: windows
|
||||
query: subscription_manager_registry_misconfigured
|
||||
- description: Returns 0 as a result if the registry key does not exist
|
||||
interval: 3600
|
||||
name: subscription_manager_registry_missing
|
||||
platform: windows
|
||||
query: subscription_manager_registry_missing
|
||||
- description: Returns the content of the key if it does not match the expected
|
||||
value
|
||||
interval: 3600
|
||||
name: command_line_auditing_registry_misconfigured
|
||||
platform: windows
|
||||
query: command_line_auditing_registry_misconfigured
|
||||
- description: Returns 0 as a result if the registry key does not exist
|
||||
interval: 3600
|
||||
name: crash_dump_registry_missing
|
||||
platform: windows
|
||||
query: crash_dump_registry_missing
|
||||
- description: Returns the content of the key if it does not match the expected
|
||||
value
|
||||
interval: 3600
|
||||
name: error_mode_registry_misconfigured
|
||||
platform: windows
|
||||
query: error_mode_registry_misconfigured
|
||||
- description: Returns 0 as a result if the registry key does not exist
|
||||
interval: 3600
|
||||
name: log_errors_registry_missing
|
||||
platform: windows
|
||||
query: log_errors_registry_missing
|
||||
- description: Returns the content of the key if it does not match the expected
|
||||
value
|
||||
interval: 3600
|
||||
name: winrm_settings_registry_misconfigured
|
||||
platform: windows
|
||||
query: winrm_settings_registry_misconfigured
|
||||
- description: Returns the content of the key if it does not match the expected
|
||||
value
|
||||
interval: 3600
|
||||
name: crash_dump_registry_misconfigured
|
||||
platform: windows
|
||||
query: crash_dump_registry_misconfigured
|
||||
- description: Detect a registry based persistence mechanism that allows an attacker
|
||||
to specify a DLL to be loaded when cryptographic libraries are called (https://twitter.com/PsiDragon/status/978367732793135105)
|
||||
interval: 3600
|
||||
name: physicalstore_dll_registry_persistence
|
||||
platform: windows
|
||||
query: physicalstore_dll_registry_persistence
|
||||
- description: Returns the content of the key if it does not match the expected
|
||||
value
|
||||
interval: 3600
|
||||
name: powershell_logging_registry_misconfigured
|
||||
platform: windows
|
||||
query: powershell_logging_registry_misconfigured
|
||||
- description: 'A registry key can be created to disable AMSI on Windows: (https://twitter.com/Moriarty_Meng/status/1011568060883333120)'
|
||||
interval: 3600
|
||||
name: amsi_disabled_registry
|
||||
platform: windows
|
||||
query: amsi_disabled_registry
|
||||
- description: Controls how often to rotate the local computer password (defaults
|
||||
to 30 days). A modification of this value may be an indicator of attacker activity.
|
||||
interval: 3600
|
||||
name: computer_maximum_password_age_changed_registry
|
||||
platform: windows
|
||||
query: computer_maximum_password_age_changed_registry
|
||||
- description: Returns 0 as a result if the registry key does not exist
|
||||
interval: 3600
|
||||
name: dr_watson_registry_missing
|
||||
platform: windows
|
||||
query: dr_watson_registry_missing
|
||||
- description: Returns the content of the key if it does not match the expected
|
||||
value
|
||||
interval: 3600
|
||||
name: per_user_ts_session_registry_misconfigured
|
||||
platform: windows
|
||||
query: per_user_ts_session_registry_misconfigured
|
||||
- description: Registry based persistence mechanism to load DLLs at reboot time
|
||||
and avoids detection by Autoruns (https://oddvar.moe/2018/03/21/persistence-using-runonceex-hidden-from-autoruns-exe/).
|
||||
Subkeys will be deleted after they run, thus (RunOnce). The RunOnceEx key will
|
||||
remain.
|
||||
interval: 3600
|
||||
name: runonceex_persistence_registry
|
||||
platform: windows
|
||||
query: runonceex_persistence_registry
|
||||
- description: Returns 0 as a result if the registry key does not exist
|
||||
interval: 3600
|
||||
name: smbv1_registry_missing
|
||||
platform: windows
|
||||
query: smbv1_registry_missing
|
||||
- description: Returns 0 as a result if the registry key does not exist
|
||||
interval: 3600
|
||||
name: powershell_transcription_logging_registry_missing
|
||||
platform: windows
|
||||
query: powershell_transcription_logging_registry_missing
|
||||
- description: Returns 0 as a result if the registry key does not exist
|
||||
interval: 3600
|
||||
name: powershell_module_logging_registry_missing
|
||||
platform: windows
|
||||
query: powershell_module_logging_registry_missing
|
||||
- description: Returns 0 as a result if the registry key does not exist
|
||||
interval: 3600
|
||||
name: powershell_scriptblock_logging_registry_missing
|
||||
platform: windows
|
||||
query: powershell_scriptblock_logging_registry_missing
|
||||
- description: Returns the content of the key if it does not match the expected
|
||||
value
|
||||
interval: 3600
|
||||
name: bitlocker_mbam_endpoint_registry_misconfigured
|
||||
platform: windows
|
||||
query: bitlocker_mbam_endpoint_registry_misconfigured
|
||||
- description: Returns 0 as a result if the registry key does not exist
|
||||
interval: 3600
|
||||
name: command_line_auditing_registry_missing
|
||||
platform: windows
|
||||
query: command_line_auditing_registry_missing
|
||||
- description: ""
|
||||
interval: 3600
|
||||
name: smbv1_registry_misconfigured
|
||||
platform: windows
|
||||
query: smbv1_registry_misconfigured
|
||||
- description: Returns the content of this key if it exists, which it shouldn't
|
||||
by default
|
||||
interval: 3600
|
||||
name: send_error_alert_registry_exists
|
||||
platform: windows
|
||||
query: send_error_alert_registry_exists
|
||||
targets:
|
||||
labels: null
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Technique used by attackers to prevent computer accounts from changing
|
||||
their password, thus extending the life of Kerberos silver tickets (https://adsecurity.org/?p=2011)
|
||||
name: computer_password_change_disabled_registry
|
||||
query: SELECT * FROM registry WHERE path='HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\DisablePasswordChange'
|
||||
AND data!=0;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Returns 0 as a result if the registry key does not exist
|
||||
name: error_mode_registry_missing
|
||||
query: SELECT IFNULL(key_count,0) AS key_exists FROM (SELECT COUNT(*) AS key_count
|
||||
FROM registry WHERE path='HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Windows\ErrorMode')
|
||||
WHERE key_exists!=1;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Returns 0 as a result if the registry key does not exist
|
||||
name: per_user_ts_session_registry_missing
|
||||
query: SELECT IFNULL(key_count,0) AS key_exists FROM (SELECT COUNT(*) AS key_count
|
||||
FROM registry WHERE path='HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal
|
||||
Server\fSingleSessionPerUser') WHERE key_exists!=1;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Returns 0 as a result if the registry key does not exist
|
||||
name: powershell_invocationheader_registry_missing
|
||||
query: SELECT IFNULL(key_count,0) AS key_exists FROM (SELECT COUNT(*) AS key_count
|
||||
FROM registry WHERE path='HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Powershell\Transcription\EnableInvocationHeader')
|
||||
WHERE key_exists!=1;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Returns the content of the key if it does not match the expected value
|
||||
name: bitlocker_encryption_settings_registry_misconfigured
|
||||
query: SELECT * FROM registry WHERE (path='HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\FVE\MDOPBitLockerManagement\ShouldEncryptOSDrive'
|
||||
OR path='HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\FVE\MDOPBitLockerManagement\OSDriveProtector')
|
||||
AND data!=1;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Returns the content of the key if it does not match the expected value
|
||||
name: bitlocker_mbam_registry_misconfigured
|
||||
query: SELECT * FROM registry WHERE path='HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\FVE\MDOPBitLockerManagement\UseMBAMServices'
|
||||
AND data!=1;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Returns the content of this key if it exists, which it shouldn't by
|
||||
default
|
||||
name: dns_plugin_dll_registry_exists
|
||||
query: SELECT * FROM registry WHERE key='HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\DNS\Parameters\ServerLevelPluginDll';
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Returns the content of this key if it exists, which it shouldn't by
|
||||
default
|
||||
name: error_display_ui_registry_exists
|
||||
query: SELECT * FROM registry WHERE path='HKEY_LOCAL_MACHINE\Software\Microsoft\PCHealth\ErrorReporting\ShowUI';
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Returns the content of the key if it does not match the expected value
|
||||
name: log_errors_registry_misconfigured
|
||||
query: SELECT * FROM registry WHERE path='HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\CrashControl\LogEvent'
|
||||
AND data!=1;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Returns the content of the key if it does not match the expected value
|
||||
name: subscription_manager_registry_misconfigured
|
||||
query: SELECT * FROM registry WHERE path='HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\EventLog\EventForwarding\SubscriptionManager\1'
|
||||
AND (data!='Server=http://subdomain.domain.com:5985/wsman/SubscriptionManager/WEC'
|
||||
AND data!='Server=http://subdomain.domain.com:5985/wsman/SubscriptionManager/WEC');
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Returns 0 as a result if the registry key does not exist
|
||||
name: subscription_manager_registry_missing
|
||||
query: SELECT IFNULL(key_count,0) AS key_exists FROM (SELECT COUNT(*) AS key_count
|
||||
FROM registry WHERE path='HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\EventLog\EventForwarding\SubscriptionManager\1')
|
||||
WHERE key_exists!=1;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Returns the content of the key if it does not match the expected value
|
||||
name: command_line_auditing_registry_misconfigured
|
||||
query: SELECT * FROM registry WHERE path='HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\Audit\ProcessCreationIncludeCmdLine_Enabled'
|
||||
AND data!=1;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Returns 0 as a result if the registry key does not exist
|
||||
name: crash_dump_registry_missing
|
||||
query: SELECT IFNULL(key_count,0) AS key_exists FROM (SELECT COUNT(*) AS key_count
|
||||
FROM registry WHERE path='HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\CrashControl\CrashDumpEnabled')
|
||||
WHERE key_exists!=1;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Returns the content of the key if it does not match the expected value
|
||||
name: error_mode_registry_misconfigured
|
||||
query: SELECT * FROM registry WHERE path='HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Windows\ErrorMode'
|
||||
AND data=2;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Returns 0 as a result if the registry key does not exist
|
||||
name: log_errors_registry_missing
|
||||
query: SELECT IFNULL(key_count,0) AS key_exists FROM (SELECT COUNT(*) AS key_count
|
||||
FROM registry WHERE path='HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\CrashControl\LogEvent')
|
||||
WHERE key_exists!=1;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Returns the content of the key if it does not match the expected value
|
||||
name: winrm_settings_registry_misconfigured
|
||||
query: 'SELECT * FROM registry WHERE (path=''HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRM\Client\AllowBasic''
|
||||
OR path=''HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRM\Client\AllowCredSSP''
|
||||
OR path=''HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRM\Client\AllowUnencryptedTraffic''
|
||||
OR path=''HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRM\Client\AllowDigest''
|
||||
OR path=''HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRM\Service\AllowBasic''
|
||||
OR path=''HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRM\Service\AllowCredSSP''
|
||||
OR path=''HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRM\Service\AllowUnencryptedTraffic''
|
||||
OR path=''HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRM\Service\WinRS\AllowRemoteShellAccess'')
|
||||
AND data!=0; '
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Returns the content of the key if it does not match the expected value
|
||||
name: crash_dump_registry_misconfigured
|
||||
query: SELECT * FROM registry WHERE path='HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\CrashControl\CrashDumpEnabled'
|
||||
AND data=0;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Detect a registry based persistence mechanism that allows an attacker
|
||||
to specify a DLL to be loaded when cryptographic libraries are called (https://twitter.com/PsiDragon/status/978367732793135105)
|
||||
name: physicalstore_dll_registry_persistence
|
||||
query: SELECT key, path, name, mtime, username FROM registry r, users WHERE path
|
||||
LIKE 'HKEY_USERS\'||uuid||'\Software\Microsoft\SystemCertificates\CA\PhysicalStores\%%'
|
||||
OR path LIKE 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType
|
||||
0\CertDllOpenStoreProv\%%' AND name!='#16' AND name!='Ldap';
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Returns the content of the key if it does not match the expected value
|
||||
name: powershell_logging_registry_misconfigured
|
||||
query: SELECT * FROM registry WHERE (path='HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Powershell\ModuleLogging\EnableModuleLogging'
|
||||
OR path='HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Powershell\ScriptBlockLogging\EnableScriptBlockLogging'
|
||||
OR path='HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Powershell\Transcription\EnableTranscripting'
|
||||
OR path='HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Powershell\Transcription\EnableInvocationHeader')
|
||||
AND data!=1;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: 'A registry key can be created to disable AMSI on Windows: (https://twitter.com/Moriarty_Meng/status/1011568060883333120)'
|
||||
name: amsi_disabled_registry
|
||||
query: SELECT key, r.path, r.name, r.mtime, r.data, username from registry r, users
|
||||
WHERE path = 'HKEY_USERS\'||uuid||'\Software\Microsoft\Windows Script\Settings\AmsiEnable'
|
||||
AND data=0;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Controls how often to rotate the local computer password (defaults
|
||||
to 30 days). A modification of this value may be an indicator of attacker activity.
|
||||
name: computer_maximum_password_age_changed_registry
|
||||
query: SELECT * FROM registry WHERE path='HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\MaximumPasswordAge'
|
||||
and data!=30;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Returns 0 as a result if the registry key does not exist
|
||||
name: dr_watson_registry_missing
|
||||
query: SELECT IFNULL(key_count,0) AS key_exists FROM (SELECT COUNT(*) AS key_count
|
||||
FROM registry where key='HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug')
|
||||
WHERE key_exists!=2;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Returns the content of the key if it does not match the expected value
|
||||
name: per_user_ts_session_registry_misconfigured
|
||||
query: SELECT * FROM registry WHERE path='HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal
|
||||
Server\fSingleSessionPerUser' AND data!=1;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Registry based persistence mechanism to load DLLs at reboot time and
|
||||
avoids detection by Autoruns (https://oddvar.moe/2018/03/21/persistence-using-runonceex-hidden-from-autoruns-exe/).
|
||||
Subkeys will be deleted after they run, thus (RunOnce). The RunOnceEx key will
|
||||
remain.
|
||||
name: runonceex_persistence_registry
|
||||
query: SELECT * FROM registry WHERE path = 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx';
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Returns 0 as a result if the registry key does not exist
|
||||
name: smbv1_registry_missing
|
||||
query: SELECT IFNULL(key_count,0) AS key_exists FROM (SELECT COUNT(*) AS key_count
|
||||
FROM registry WHERE path='HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\SMB1')
|
||||
WHERE key_exists!=1;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Returns 0 as a result if the registry key does not exist
|
||||
name: powershell_transcription_logging_registry_missing
|
||||
query: SELECT IFNULL(key_count,0) AS key_exists FROM (SELECT COUNT(*) AS key_count
|
||||
FROM registry WHERE path='HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Powershell\Transcription\EnableTranscripting')
|
||||
WHERE key_exists!=1;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Returns 0 as a result if the registry key does not exist
|
||||
name: powershell_module_logging_registry_missing
|
||||
query: SELECT IFNULL(key_count,0) AS key_exists FROM (SELECT COUNT(*) AS key_count
|
||||
FROM registry WHERE path='HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Powershell\ModuleLogging\EnableModuleLogging')
|
||||
WHERE key_exists!=1;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Returns 0 as a result if the registry key does not exist
|
||||
name: powershell_scriptblock_logging_registry_missing
|
||||
query: SELECT IFNULL(key_count,0) AS key_exists FROM (SELECT COUNT(*) AS key_count
|
||||
FROM registry WHERE path='HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Powershell\ScriptBlockLogging\EnableScriptBlockLogging')
|
||||
WHERE key_exists!=1;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Returns the content of the key if it does not match the expected value
|
||||
name: bitlocker_mbam_endpoint_registry_misconfigured
|
||||
query: SELECT * FROM registry WHERE path='HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\FVE\MDOPBitLockerManagement\KeyRecoveryServiceEndPoint'
|
||||
AND data!='https://mbam.server.com/MBAMRecoveryAndHardwareService/CoreService.svc';
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Returns 0 as a result if the registry key does not exist
|
||||
name: command_line_auditing_registry_missing
|
||||
query: SELECT IFNULL(key_count,0) AS key_exists FROM (SELECT COUNT(*) AS key_count
|
||||
FROM registry WHERE path='HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\Audit\ProcessCreationIncludeCmdLine_Enabled')
|
||||
WHERE key_exists!=1;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
name: smbv1_registry_misconfigured
|
||||
query: SELECT * FROM registry WHERE path='HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\SMB1'
|
||||
AND data!=0;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Returns the content of this key if it exists, which it shouldn't by
|
||||
default
|
||||
name: send_error_alert_registry_exists
|
||||
query: SELECT * FROM registry WHERE key='HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\CrashControl\SendAlert';
|
||||
596
salt/fleet/packs/palantir/Fleet/Servers/Linux/osquery.yaml
Normal file
596
salt/fleet/packs/palantir/Fleet/Servers/Linux/osquery.yaml
Normal file
@@ -0,0 +1,596 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: pack
|
||||
spec:
|
||||
name: LinuxPack
|
||||
queries:
|
||||
- description: Retrieves all the jobs scheduled in crontab in the target system.
|
||||
interval: 0
|
||||
name: crontab_snapshot
|
||||
platform: linux
|
||||
query: crontab_snapshot
|
||||
snapshot: true
|
||||
- description: Various Linux kernel integrity checked attributes.
|
||||
interval: 0
|
||||
name: kernel_integrity
|
||||
platform: linux
|
||||
query: kernel_integrity
|
||||
- description: Linux kernel modules both loaded and within the load search path.
|
||||
interval: 0
|
||||
name: kernel_modules
|
||||
platform: linux
|
||||
query: kernel_modules
|
||||
- description: Retrieves the current list of mounted drives in the target system.
|
||||
interval: 0
|
||||
name: mounts
|
||||
platform: linux
|
||||
query: mounts
|
||||
- description: The percentage of total CPU time (system+user) consumed by osqueryd
|
||||
interval: 0
|
||||
name: osquery_cpu_pct
|
||||
platform: linux
|
||||
query: osquery_cpu_pct
|
||||
snapshot: true
|
||||
- description: Socket events collected from the audit framework
|
||||
interval: 0
|
||||
name: socket_events
|
||||
platform: linux
|
||||
query: socket_events
|
||||
- description: Record the network interfaces and their associated IP and MAC addresses
|
||||
interval: 0
|
||||
name: network_interfaces_snapshot
|
||||
platform: linux
|
||||
query: network_interfaces_snapshot
|
||||
snapshot: true
|
||||
version: 1.4.5
|
||||
- description: Information about the running osquery configuration
|
||||
interval: 0
|
||||
name: osquery_info
|
||||
platform: linux
|
||||
query: osquery_info
|
||||
snapshot: true
|
||||
- description: Display all installed RPM packages
|
||||
interval: 0
|
||||
name: rpm_packages
|
||||
platform: centos
|
||||
query: rpm_packages
|
||||
snapshot: true
|
||||
- description: Record shell history for all users on system (instead of just root)
|
||||
interval: 0
|
||||
name: shell_history
|
||||
platform: linux
|
||||
query: shell_history
|
||||
- description: File events collected from file integrity monitoring
|
||||
interval: 0
|
||||
name: file_events
|
||||
platform: linux
|
||||
query: file_events
|
||||
removed: false
|
||||
- description: Retrieve the EC2 metadata for this endpoint
|
||||
interval: 0
|
||||
name: ec2_instance_metadata
|
||||
platform: linux
|
||||
query: ec2_instance_metadata
|
||||
- description: Retrieve the EC2 tags for this endpoint
|
||||
interval: 0
|
||||
name: ec2_instance_tags
|
||||
platform: linux
|
||||
query: ec2_instance_tags
|
||||
- description: Snapshot query to retrieve the EC2 tags for this instance
|
||||
interval: 0
|
||||
name: ec2_instance_tags_snapshot
|
||||
platform: linux
|
||||
query: ec2_instance_tags_snapshot
|
||||
snapshot: true
|
||||
- description: Retrieves the current filters and chains per filter in the target
|
||||
system.
|
||||
interval: 0
|
||||
name: iptables
|
||||
platform: linux
|
||||
query: iptables
|
||||
- description: Display any SUID binaries that are owned by root
|
||||
interval: 0
|
||||
name: suid_bin
|
||||
platform: linux
|
||||
query: suid_bin
|
||||
- description: Display all installed DEB packages
|
||||
interval: 0
|
||||
name: deb_packages
|
||||
platform: ubuntu
|
||||
query: deb_packages
|
||||
snapshot: true
|
||||
- description: Find shell processes that have open sockets
|
||||
interval: 0
|
||||
name: behavioral_reverse_shell
|
||||
platform: linux
|
||||
query: behavioral_reverse_shell
|
||||
- description: Retrieves all the jobs scheduled in crontab in the target system.
|
||||
interval: 0
|
||||
name: crontab
|
||||
platform: linux
|
||||
query: crontab
|
||||
- description: Records the system resources used by each query
|
||||
interval: 0
|
||||
name: per_query_perf
|
||||
platform: linux
|
||||
query: per_query_perf
|
||||
- description: Records avg rate of socket events since daemon started
|
||||
interval: 0
|
||||
name: socket_rates
|
||||
platform: linux
|
||||
query: socket_rates
|
||||
snapshot: true
|
||||
- description: Local system users.
|
||||
interval: 0
|
||||
name: users
|
||||
platform: linux
|
||||
query: users
|
||||
- description: Process events collected from the audit framework
|
||||
interval: 0
|
||||
name: process_events
|
||||
platform: linux
|
||||
query: process_events
|
||||
- description: Retrieves the list of the latest logins with PID, username and timestamp.
|
||||
interval: 0
|
||||
name: last
|
||||
platform: linux
|
||||
query: last
|
||||
- description: Any processes that run with an LD_PRELOAD environment variable
|
||||
interval: 0
|
||||
name: ld_preload
|
||||
platform: linux
|
||||
query: ld_preload
|
||||
- description: Records avg rate of process events since daemon started
|
||||
interval: 0
|
||||
name: process_rates
|
||||
platform: linux
|
||||
query: process_rates
|
||||
snapshot: true
|
||||
- description: Information about the system hardware and name
|
||||
interval: 0
|
||||
name: system_info
|
||||
platform: linux
|
||||
query: system_info
|
||||
snapshot: true
|
||||
- description: Returns the private keys in the users ~/.ssh directory and whether
|
||||
or not they are encrypted
|
||||
interval: 0
|
||||
name: user_ssh_keys
|
||||
platform: linux
|
||||
query: user_ssh_keys
|
||||
- description: Local system users.
|
||||
interval: 0
|
||||
name: users_snapshot
|
||||
platform: linux
|
||||
query: users_snapshot
|
||||
snapshot: true
|
||||
- description: DNS resolvers used by the host
|
||||
interval: 0
|
||||
name: dns_resolvers
|
||||
platform: linux
|
||||
query: dns_resolvers
|
||||
- description: Retrieves information from the current kernel in the target system.
|
||||
interval: 0
|
||||
name: kernel_info
|
||||
platform: linux
|
||||
query: kernel_info
|
||||
snapshot: true
|
||||
- description: Linux kernel modules both loaded and within the load search path.
|
||||
interval: 0
|
||||
name: kernel_modules_snapshot
|
||||
platform: linux
|
||||
query: kernel_modules_snapshot
|
||||
snapshot: true
|
||||
- description: Generates an event if ld.so.preload is present - used by rootkits
|
||||
such as Jynx
|
||||
interval: 0
|
||||
name: ld_so_preload_exists
|
||||
platform: linux
|
||||
query: ld_so_preload_exists
|
||||
snapshot: true
|
||||
- description: Records system/user time, db size, and many other system metrics
|
||||
interval: 0
|
||||
name: runtime_perf
|
||||
platform: linux
|
||||
query: runtime_perf
|
||||
- description: Retrieves all the entries in the target system /etc/hosts file.
|
||||
interval: 0
|
||||
name: etc_hosts_snapshot
|
||||
platform: linux
|
||||
query: etc_hosts_snapshot
|
||||
snapshot: true
|
||||
- description: Snapshot query to retrieve the EC2 metadata for this endpoint
|
||||
interval: 0
|
||||
name: ec2_instance_metadata_snapshot
|
||||
platform: linux
|
||||
query: ec2_instance_metadata_snapshot
|
||||
snapshot: true
|
||||
- description: ""
|
||||
interval: 0
|
||||
name: hardware_events
|
||||
platform: linux
|
||||
query: hardware_events
|
||||
removed: false
|
||||
- description: Information about memory usage on the system
|
||||
interval: 0
|
||||
name: memory_info
|
||||
platform: linux
|
||||
query: memory_info
|
||||
- description: Displays information from /proc/stat file about the time the CPU
|
||||
cores spent in different parts of the system
|
||||
interval: 0
|
||||
name: cpu_time
|
||||
platform: linux
|
||||
query: cpu_time
|
||||
- description: Retrieves all the entries in the target system /etc/hosts file.
|
||||
interval: 0
|
||||
name: etc_hosts
|
||||
platform: linux
|
||||
query: etc_hosts
|
||||
- description: Retrieves information from the Operating System where osquery is
|
||||
currently running.
|
||||
interval: 0
|
||||
name: os_version
|
||||
platform: linux
|
||||
query: os_version
|
||||
snapshot: true
|
||||
- description: A snapshot of all processes running on the host. Useful for outlier
|
||||
analysis.
|
||||
interval: 0
|
||||
name: processes_snapshot
|
||||
platform: linux
|
||||
query: processes_snapshot
|
||||
snapshot: true
|
||||
- description: Retrieves the current list of USB devices in the target system.
|
||||
interval: 0
|
||||
name: usb_devices
|
||||
platform: linux
|
||||
query: usb_devices
|
||||
- description: A line-delimited authorized_keys table.
|
||||
interval: 0
|
||||
name: authorized_keys
|
||||
platform: linux
|
||||
query: authorized_keys
|
||||
targets:
|
||||
labels: null
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Retrieves all the jobs scheduled in crontab in the target system.
|
||||
name: crontab_snapshot
|
||||
query: SELECT * FROM crontab;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Various Linux kernel integrity checked attributes.
|
||||
name: kernel_integrity
|
||||
query: SELECT * FROM kernel_integrity;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Linux kernel modules both loaded and within the load search path.
|
||||
name: kernel_modules
|
||||
query: SELECT * FROM kernel_modules;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Retrieves the current list of mounted drives in the target system.
|
||||
name: mounts
|
||||
query: SELECT device, device_alias, path, type, blocks_size, flags FROM mounts;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: The percentage of total CPU time (system+user) consumed by osqueryd
|
||||
name: osquery_cpu_pct
|
||||
query: SELECT ((osqueryd_time*100)/(SUM(system_time) + SUM(user_time))) AS pct FROM
|
||||
processes, (SELECT (SUM(processes.system_time)+SUM(processes.user_time)) AS osqueryd_time
|
||||
FROM processes WHERE name='osqueryd');
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Socket events collected from the audit framework
|
||||
name: socket_events
|
||||
query: SELECT action, auid, family, local_address, local_port, path, pid, remote_address,
|
||||
remote_port, success, time FROM socket_events WHERE success=1 AND path NOT IN
|
||||
('/usr/bin/hostname') AND remote_address NOT IN ('127.0.0.1', '169.254.169.254',
|
||||
'', '0000:0000:0000:0000:0000:0000:0000:0001', '::1', '0000:0000:0000:0000:0000:ffff:7f00:0001',
|
||||
'unknown', '0.0.0.0', '0000:0000:0000:0000:0000:0000:0000:0000');
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Record the network interfaces and their associated IP and MAC addresses
|
||||
name: network_interfaces_snapshot
|
||||
query: SELECT a.interface, a.address, d.mac FROM interface_addresses a JOIN interface_details
|
||||
d USING (interface);
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Information about the running osquery configuration
|
||||
name: osquery_info
|
||||
query: SELECT * FROM osquery_info;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Display all installed RPM packages
|
||||
name: rpm_packages
|
||||
query: SELECT name, version, release, arch FROM rpm_packages;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Record shell history for all users on system (instead of just root)
|
||||
name: shell_history
|
||||
query: SELECT * FROM users JOIN shell_history USING (uid);
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: File events collected from file integrity monitoring
|
||||
name: file_events
|
||||
query: SELECT * FROM file_events;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Retrieve the EC2 metadata for this endpoint
|
||||
name: ec2_instance_metadata
|
||||
query: SELECT * FROM ec2_instance_metadata;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Retrieve the EC2 tags for this endpoint
|
||||
name: ec2_instance_tags
|
||||
query: SELECT * FROM ec2_instance_tags;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Snapshot query to retrieve the EC2 tags for this instance
|
||||
name: ec2_instance_tags_snapshot
|
||||
query: SELECT * FROM ec2_instance_tags;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Retrieves the current filters and chains per filter in the target system.
|
||||
name: iptables
|
||||
query: SELECT * FROM iptables;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Display any SUID binaries that are owned by root
|
||||
name: suid_bin
|
||||
query: SELECT * FROM suid_bin;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Display all installed DEB packages
|
||||
name: deb_packages
|
||||
query: SELECT * FROM deb_packages;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Find shell processes that have open sockets
|
||||
name: behavioral_reverse_shell
|
||||
query: SELECT DISTINCT(processes.pid), processes.parent, processes.name, processes.path,
|
||||
processes.cmdline, processes.cwd, processes.root, processes.uid, processes.gid,
|
||||
processes.start_time, process_open_sockets.remote_address, process_open_sockets.remote_port,
|
||||
(SELECT cmdline FROM processes AS parent_cmdline WHERE pid=processes.parent) AS
|
||||
parent_cmdline FROM processes JOIN process_open_sockets USING (pid) LEFT OUTER
|
||||
JOIN process_open_files ON processes.pid = process_open_files.pid WHERE (name='sh'
|
||||
OR name='bash') AND remote_address NOT IN ('0.0.0.0', '::', '') AND remote_address
|
||||
NOT LIKE '10.%' AND remote_address NOT LIKE '192.168.%';
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Retrieves all the jobs scheduled in crontab in the target system.
|
||||
name: crontab
|
||||
query: SELECT * FROM crontab;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Records the system resources used by each query
|
||||
name: per_query_perf
|
||||
query: SELECT name, interval, executions, output_size, wall_time, (user_time/executions)
|
||||
AS avg_user_time, (system_time/executions) AS avg_system_time, average_memory
|
||||
FROM osquery_schedule;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Records avg rate of socket events since daemon started
|
||||
name: socket_rates
|
||||
query: SELECT COUNT(1) AS num, count(1)/s AS rate FROM socket_events, (SELECT (julianday('now')
|
||||
- 2440587.5)*86400.0 - start_time AS s FROM osquery_info LIMIT 1);
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Local system users.
|
||||
name: users
|
||||
query: SELECT * FROM users;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Process events collected from the audit framework
|
||||
name: process_events
|
||||
query: SELECT auid, cmdline, ctime, cwd, egid, euid, gid, parent, path, pid, time,
|
||||
uid FROM process_events WHERE path NOT IN ('/bin/sed', '/usr/bin/tr', '/bin/gawk',
|
||||
'/bin/date', '/bin/mktemp', '/usr/bin/dirname', '/usr/bin/head', '/usr/bin/jq',
|
||||
'/bin/cut', '/bin/uname', '/bin/basename') and cmdline NOT LIKE '%_key%' AND cmdline
|
||||
NOT LIKE '%secret%';
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Retrieves the list of the latest logins with PID, username and timestamp.
|
||||
name: last
|
||||
query: SELECT * FROM last;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Any processes that run with an LD_PRELOAD environment variable
|
||||
name: ld_preload
|
||||
query: SELECT process_envs.pid, process_envs.key, process_envs.value, processes.name,
|
||||
processes.path, processes.cmdline, processes.cwd FROM process_envs join processes
|
||||
USING (pid) WHERE key = 'LD_PRELOAD';
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Records avg rate of process events since daemon started
|
||||
name: process_rates
|
||||
query: SELECT COUNT(1) AS num, count(1)/s AS rate FROM process_events, (SELECT (julianday('now')
|
||||
- 2440587.5)*86400.0 - start_time AS s FROM osquery_info LIMIT 1);
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Information about the system hardware and name
|
||||
name: system_info
|
||||
query: SELECT * FROM system_info;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Returns the private keys in the users ~/.ssh directory and whether
|
||||
or not they are encrypted
|
||||
name: user_ssh_keys
|
||||
query: SELECT * FROM users JOIN user_ssh_keys USING (uid);
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Local system users.
|
||||
name: users_snapshot
|
||||
query: SELECT * FROM users;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: DNS resolvers used by the host
|
||||
name: dns_resolvers
|
||||
query: SELECT * FROM dns_resolvers;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Retrieves information from the current kernel in the target system.
|
||||
name: kernel_info
|
||||
query: SELECT * FROM kernel_info;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Linux kernel modules both loaded and within the load search path.
|
||||
name: kernel_modules_snapshot
|
||||
query: SELECT * FROM kernel_modules;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Generates an event if ld.so.preload is present - used by rootkits such
|
||||
as Jynx
|
||||
name: ld_so_preload_exists
|
||||
query: SELECT * FROM file WHERE path='/etc/ld.so.preload' AND path!='';
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Records system/user time, db size, and many other system metrics
|
||||
name: runtime_perf
|
||||
query: SELECT ov.version AS os_version, ov.platform AS os_platform, ov.codename
|
||||
AS os_codename, i.*, p.resident_size, p.user_time, p.system_time, time.minutes
|
||||
AS counter, db.db_size_mb AS database_size from osquery_info i, os_version ov,
|
||||
processes p, time, (SELECT (SUM(size) / 1024) / 1024.0 AS db_size_mb FROM (SELECT
|
||||
value FROM osquery_flags WHERE name = 'database_path' LIMIT 1) flags, file WHERE
|
||||
path LIKE flags.value || '%%' AND type = 'regular') db WHERE p.pid = i.pid;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Retrieves all the entries in the target system /etc/hosts file.
|
||||
name: etc_hosts_snapshot
|
||||
query: SELECT * FROM etc_hosts;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Snapshot query to retrieve the EC2 metadata for this endpoint
|
||||
name: ec2_instance_metadata_snapshot
|
||||
query: SELECT * FROM ec2_instance_metadata;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
name: hardware_events
|
||||
query: SELECT * FROM hardware_events;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Information about memory usage on the system
|
||||
name: memory_info
|
||||
query: SELECT * FROM memory_info;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Displays information from /proc/stat file about the time the CPU cores
|
||||
spent in different parts of the system
|
||||
name: cpu_time
|
||||
query: SELECT * FROM cpu_time;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Retrieves all the entries in the target system /etc/hosts file.
|
||||
name: etc_hosts
|
||||
query: SELECT * FROM etc_hosts;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Retrieves information from the Operating System where osquery is currently
|
||||
running.
|
||||
name: os_version
|
||||
query: SELECT * FROM os_version;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: A snapshot of all processes running on the host. Useful for outlier
|
||||
analysis.
|
||||
name: processes_snapshot
|
||||
query: select name, path, cmdline, cwd, on_disk from processes;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: Retrieves the current list of USB devices in the target system.
|
||||
name: usb_devices
|
||||
query: SELECT * FROM usb_devices;
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
description: A line-delimited authorized_keys table.
|
||||
name: authorized_keys
|
||||
query: SELECT * FROM users JOIN authorized_keys USING (uid);
|
||||
57
salt/fleet/packs/palantir/Fleet/Servers/options.yaml
Normal file
57
salt/fleet/packs/palantir/Fleet/Servers/options.yaml
Normal file
@@ -0,0 +1,57 @@
|
||||
apiVersion: v1
|
||||
kind: options
|
||||
spec:
|
||||
config:
|
||||
decorators:
|
||||
load:
|
||||
- SELECT uuid AS host_uuid FROM system_info;
|
||||
- SELECT hostname AS hostname FROM system_info;
|
||||
file_paths:
|
||||
binaries:
|
||||
- /usr/bin/%%
|
||||
- /usr/sbin/%%
|
||||
- /bin/%%
|
||||
- /sbin/%%
|
||||
- /usr/local/bin/%%
|
||||
- /usr/local/sbin/%%
|
||||
configuration:
|
||||
- /etc/passwd
|
||||
- /etc/shadow
|
||||
- /etc/ld.so.conf
|
||||
- /etc/ld.so.conf.d/%%
|
||||
- /etc/pam.d/%%
|
||||
- /etc/resolv.conf
|
||||
- /etc/rc%/%%
|
||||
- /etc/my.cnf
|
||||
- /etc/modules
|
||||
- /etc/hosts
|
||||
- /etc/hostname
|
||||
- /etc/fstab
|
||||
- /etc/crontab
|
||||
- /etc/cron%/%%
|
||||
- /etc/init/%%
|
||||
- /etc/rsyslog.conf
|
||||
options:
|
||||
audit_allow_config: true
|
||||
audit_allow_sockets: true
|
||||
audit_persist: true
|
||||
disable_audit: false
|
||||
events_expiry: 1
|
||||
events_max: 500000
|
||||
disable_distributed: false
|
||||
disable_subscribers: user_events
|
||||
distributed_interval: 10
|
||||
distributed_plugin: tls
|
||||
distributed_tls_max_attempts: 3
|
||||
distributed_tls_read_endpoint: /api/v1/osquery/distributed/read
|
||||
distributed_tls_write_endpoint: /api/v1/osquery/distributed/write
|
||||
logger_min_status: 1
|
||||
logger_plugin: tls
|
||||
logger_snapshot_event_type: true
|
||||
logger_tls_endpoint: /api/v1/osquery/log
|
||||
logger_tls_period: 10
|
||||
pack_delimiter: /
|
||||
schedule_splay_percent: 10
|
||||
watchdog_memory_limit: 350
|
||||
watchdog_utilization_limit: 130
|
||||
overrides: {}
|
||||
22
salt/fleet/packs/palantir/LICENSE.md
Executable file
22
salt/fleet/packs/palantir/LICENSE.md
Executable file
@@ -0,0 +1,22 @@
|
||||
# License
|
||||
MIT License
|
||||
|
||||
Copyright (c) 2017 Palantir Technologies Inc.
|
||||
|
||||
Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||
of this software and associated documentation files (the "Software"), to deal
|
||||
in the Software without restriction, including without limitation the rights
|
||||
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
||||
copies of the Software, and to permit persons to whom the Software is
|
||||
furnished to do so, subject to the following conditions:
|
||||
|
||||
The above copyright notice and this permission notice shall be included in all
|
||||
copies or substantial portions of the Software.
|
||||
|
||||
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||||
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
||||
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
||||
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
||||
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
||||
SOFTWARE.
|
||||
164
salt/fleet/packs/palantir/README.md
Executable file
164
salt/fleet/packs/palantir/README.md
Executable file
@@ -0,0 +1,164 @@
|
||||
# Palantir osquery Configuration
|
||||
|
||||
## About This Repository
|
||||
This repository is the companion to the [osquery Across the Enterprise](https://medium.com/@palantir/osquery-across-the-enterprise-3c3c9d13ec55) blog post.
|
||||
|
||||
The goal of this project is to provide a baseline template for any organization considering a deployment of osquery in a production environment. It is
|
||||
our belief that queries which are likely to have a high level of utility for a large percentage of users should be committed directly to the osquery project, which is
|
||||
exactly what we have done with our [unwanted-chrome-extensions](https://github.com/facebook/osquery/pull/3889) query pack and [additions](https://github.com/facebook/osquery/pull/3922) to the windows-attacks pack.
|
||||
|
||||
However, we have included additional query packs
|
||||
that are more tailored to our specific environment that may be useful to some or at least serve as a reference to other organizations. osquery operates best when
|
||||
operators have carefully considered the datasets to be collected and the potential use-cases for that data.
|
||||
* [performance-metrics.conf](https://github.com/palantir/osquery-configuration/blob/master/Endpoints/packs/performance-metrics.conf)
|
||||
* [security-tooling-checks.conf](https://github.com/palantir/osquery-configuration/blob/master/Endpoints/packs/security-tooling-checks.conf)
|
||||
* [windows-application-security.conf](https://github.com/palantir/osquery-configuration/blob/master/Endpoints/packs/windows-application-security.conf)
|
||||
* [windows-compliance.conf](https://github.com/palantir/osquery-configuration/blob/master/Endpoints/packs/windows-compliance.conf)
|
||||
* [windows-registry-monitoring.conf](https://github.com/palantir/osquery-configuration/blob/master/Endpoints/packs/windows-registry-monitoring.conf)
|
||||
|
||||
|
||||
**Note**: We also utilize packs that are maintained in the official osquery project. In order to ensure you receive the most up to date version of the pack, please view them using the links below:
|
||||
* [ossec-rootkit.conf](https://github.com/facebook/osquery/blob/master/packs/ossec-rootkit.conf)
|
||||
* [osx-attacks.conf](https://github.com/facebook/osquery/blob/master/packs/osx-attacks.conf)
|
||||
* [unwanted-chrome-extensions.conf](https://github.com/facebook/osquery/blob/master/packs/unwanted-chrome-extensions.conf)
|
||||
* [windows-attacks.conf](https://github.com/facebook/osquery/blob/master/packs/windows-attacks.conf)
|
||||
|
||||
## Repository Layout
|
||||
This repository is organized as follows:
|
||||
* At the top level, there are two directories titled "Classic" and "Fleet"
|
||||
* The [Classic](./Classic/) directory contains configuration files for a standard osquery deployment
|
||||
* The [Fleet](./Fleet/) directory contains YAML files to be imported into Kolide's [Fleet](https://github.com/kolide/fleet) osquery management tool
|
||||
|
||||
Within each of those folders, you will find the following subdirectories:
|
||||
* **Endpoints**: The contents of this folder are tailored towards monitoring MacOS and Windows endpoints that are not expected to be online at all times. You may notice the interval of many queries in this folder set to 28800. We purposely set the interval to this value because the interval timer only moves forward when a host is online and we would only expect an endpoint to be online for about 8 hours, or 28800 seconds, per day.
|
||||
* **Servers**: The contents of this folder are tailored towards monitoring Linux servers. This configuration has process and network auditing enabled, so expect an exponentially higher volume of logs to be returned from the agent.
|
||||
|
||||
|
||||
## Using This Repository
|
||||
**Note**: We recommend that you spin up a lab environment before deploying any of these configurations to a production
|
||||
environment.
|
||||
|
||||
**Endpoints Configuration Overview**
|
||||
* The configurations in this folder are meant for MacOS and Windows and the interval timings assume that these hosts are only online for ~8 hours per day
|
||||
* The flags included in this configuration enable TLS client mode in osquery and assume it will be connected to a TLS server. We have also included non-TLS flagfiles for local testing.
|
||||
* File integrity monitoring on MacOS is enabled for specific files and directories defined in [osquery.conf](./Endpoints/MacOS/osquery.conf)
|
||||
* Events are disabled on Windows via the `--disable_events` flag in [osquery.flags](./Endpoints/Windows/osquery.flags). We use [Windows Event Forwarding](https://github.com/palantir/windows-event-forwarding) and don't have a need for osquery to process Windows event logs.
|
||||
* These configuration files utilize packs within the [packs](./Endpoints/packs) folder and may generate errors if started without them
|
||||
|
||||
**Servers Configuration Overview**
|
||||
* This configuration assumes the destination operating system is Linux-based and that the hosts are online at all times
|
||||
* Auditing mode is enabled for processes and network events. Ensure auditd is disabled or removed from the system where this will be running as it may conflict with osqueryd.
|
||||
* File integrity monitoring is enabled for specific files and directories defined in [osquery.conf](./Servers/Linux/osquery.conf)
|
||||
* Requires the [ossec-rootkit.conf](./Servers/Linux/packs/ossec-rootkit.conf) pack found to be located at `/etc/osquery/packs/ossec-rootkit.conf`
|
||||
* The subscriber for `user_events` is disabled
|
||||
|
||||
## Quickstart - Classic
|
||||
1. [Install osquery](https://osquery.io/downloads/)
|
||||
2. Copy the osquery.conf and osquery.flags files from this repository onto the system and match the directory structure shown below
|
||||
3. Start osquery via `sudo osqueryctl start` on Linux/MacOS or `Start-Process osqueryd` on Windows
|
||||
4. Logs are located in `/var/log/osquery` (Linux/MacOS) and `c:\ProgramData\osquery\logs` (Windows)
|
||||
|
||||
## Quickstart - Fleet
|
||||
1. Install Fleet version 2.0.0 or higher
|
||||
2. [Enroll hosts to your Fleet server](https://github.com/kolide/fleet/blob/master/docs/infrastructure/adding-hosts-to-fleet.md) by configuring the appropriate [flags](https://github.com/kolide/fleet/blob/master/tools/osquery/example_osquery.flags)
|
||||
2. [Configure the fleetctl utility](https://github.com/kolide/fleet/blob/master/docs/cli/setup-guide.md#fleetctl-setup) to communicate with your Fleet server
|
||||
3. Assuming you'd like to use the endpoint configs, you can use the commands below to apply them:
|
||||
|
||||
```
|
||||
git clone https://github.com/palantir/osquery-configuration.git
|
||||
fleetctl apply -f osquery-configuration/Fleet/Endpoints/options.yaml
|
||||
fleetctl apply -f osquery-configuration/Fleet/Endpoints/MacOS/osquery.yaml
|
||||
fleetctl apply -f osquery-configuration/Fleet/Endpoints/Windows/osquery.yaml
|
||||
for pack in osquery-configuration/Fleet/Endpoints/packs/*.yaml;
|
||||
do fleetctl apply -f "$pack"
|
||||
done
|
||||
```
|
||||
|
||||
The desired osquery directory structure for Linux, MacOS, and Windows is outlined below:
|
||||
|
||||
**Linux**
|
||||
```
|
||||
$ git clone https://github.com/palantir/osquery-configuration.git
|
||||
$ cp -R osquery-configuration/Servers/Linux/* /etc/osquery
|
||||
$ sudo osqueryctl start
|
||||
|
||||
/etc/osquery
|
||||
├── osquery.conf
|
||||
├── osquery.db
|
||||
├── osquery.flags
|
||||
└── packs
|
||||
└── ossec-rootkit.conf
|
||||
|
||||
```
|
||||
**MacOS**
|
||||
```
|
||||
$ git clone https://github.com/palantir/osquery-configuration.git
|
||||
$ cp osquery-configuration/Endpoints/MacOS/* /var/osquery
|
||||
$ cp osquery-configuration/Endpoints/packs/* /var/osquery/packs
|
||||
$ mv /var/osquery/osquery_no_tls.flags /var/osquery/osquery.flags ## Non-TLS server testing
|
||||
$ sudo osqueryctl start
|
||||
|
||||
/var/osquery
|
||||
├── certfile.crt [if using TLS endpoint]
|
||||
├── osquery.conf
|
||||
├── osquery.db
|
||||
├── osquery.flags
|
||||
└── packs
|
||||
├── performance-metrics.conf
|
||||
├── security-tooling-checks.conf
|
||||
├── unwanted-chrome-extensions.conf
|
||||
└── osx-attacks.conf
|
||||
```
|
||||
|
||||
**Windows**
|
||||
```
|
||||
PS> git clone https://github.com/palantir/osquery-configuration.git
|
||||
PS> copy-item osquery-configuration/Endpoints/Windows/* c:\ProgramData\osquery
|
||||
PS> copy-item osquery-configuration/Endpoints/packs/* c:\ProgramData\osquery\packs
|
||||
PS> copy-item c:\ProgramData\osquery\osquery_no_tls.flags c:\ProgramData\osquery\osquery.flags -force ## Non-TLS server testing
|
||||
PS> start-service osqueryd
|
||||
|
||||
c:\ProgramData\osquery
|
||||
├── certfile.crt [if using TLS endpoint]
|
||||
├── log
|
||||
├── osquery.conf
|
||||
├── osquery.db
|
||||
├── osquery.flags
|
||||
├── osqueryi.exe
|
||||
├─── osqueryd
|
||||
| └── osqueryd.exe
|
||||
└── packs
|
||||
├── performance-metrics.conf
|
||||
├── security-tooling-checks.conf
|
||||
├── unwanted-chrome-extensions.conf
|
||||
├── windows-application-security.conf
|
||||
├── windows-compliance.conf
|
||||
├── windows-registry-monitoring.conf
|
||||
└── windows-attacks.conf
|
||||
```
|
||||
|
||||
## Contributing
|
||||
Contributions, fixes, and improvements can be submitted directly against this project as a GitHub issue or pull request.
|
||||
|
||||
## License
|
||||
MIT License
|
||||
|
||||
Copyright (c) 2017 Palantir Technologies Inc.
|
||||
|
||||
Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||
of this software and associated documentation files (the "Software"), to deal
|
||||
in the Software without restriction, including without limitation the rights
|
||||
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
||||
copies of the Software, and to permit persons to whom the Software is
|
||||
furnished to do so, subject to the following conditions:
|
||||
|
||||
The above copyright notice and this permission notice shall be included in all
|
||||
copies or substantial portions of the Software.
|
||||
|
||||
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||||
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
||||
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
||||
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
||||
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
||||
SOFTWARE.
|
||||
53
salt/fleet/so-fleet-setup.sh
Normal file
53
salt/fleet/so-fleet-setup.sh
Normal file
@@ -0,0 +1,53 @@
|
||||
#!/bin/bash
|
||||
|
||||
#so-fleet-setup.sh $MasterIP $FleetEmail
|
||||
|
||||
if [ ! "$(docker ps -q -f name=so-fleet)" ]; then
|
||||
echo "so-fleet container not running... Exiting..."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
initpw=$(date +%s | sha256sum | base64 | head -c 16 ; echo)
|
||||
|
||||
docker exec so-fleet fleetctl config set --address https://$1:443 --tls-skip-verify --url-prefix /fleet
|
||||
docker exec so-fleet fleetctl setup --email $2 --password $initpw
|
||||
|
||||
docker exec so-fleet fleetctl apply -f /packs/palantir/Fleet/Endpoints/options.yaml
|
||||
docker exec so-fleet fleetctl apply -f /packs/palantir/Fleet/Endpoints/MacOS/osquery.yaml
|
||||
docker exec so-fleet fleetctl apply -f /packs/palantir/Fleet/Endpoints/Windows/osquery.yaml
|
||||
docker exec so-fleet fleetctl apply -f /packs/hh/hhdefault.yml
|
||||
docker exec so-fleet /bin/sh -c 'for pack in /packs/palantir/Fleet/Endpoints/packs/*.yaml; do fleetctl apply -f "$pack"; done'
|
||||
|
||||
esecret=$(docker exec so-fleet fleetctl get enroll-secret)
|
||||
|
||||
#Concat fleet.crt & ca.crt - this is required for launcher connectivity
|
||||
cat /etc/pki/fleet.crt /etc/pki/ca.crt > /etc/pki/launcher.crt
|
||||
|
||||
#Create the output directory
|
||||
mkdir /opt/so/conf/fleet/packages
|
||||
|
||||
#At some point we should version launcher `latest` to avoid hard pinning here
|
||||
docker run \
|
||||
--rm \
|
||||
--mount type=bind,source=/opt/so/conf/fleet/packages,target=/output \
|
||||
--mount type=bind,source=/etc/pki/launcher.crt,target=/var/launcher/launcher.crt \
|
||||
docker.io/soshybridhunter/so-fleet-launcher:HH1.1.0 "$esecret" "$1":8080
|
||||
|
||||
cp /opt/so/conf/fleet/packages/launcher.* /opt/so/saltstack/salt/launcher/packages/
|
||||
#Update timestamp on packages webpage
|
||||
sed -i "s@.*Generated.*@Generated: $(date '+%m%d%Y')@g" /opt/so/conf/fleet/packages/index.html
|
||||
sed -i "s@.*Generated.*@Generated: $(date '+%m%d%Y')@g" /opt/so/saltstack/salt/fleet/osquery-packages.html
|
||||
|
||||
# Enable Fleet on all the other parts of the infrastructure
|
||||
sed -i 's/fleetsetup: 0/fleetsetup: 1/g' /opt/so/saltstack/pillar/static.sls
|
||||
|
||||
# Install osquery locally
|
||||
#if cat /etc/os-release | grep -q 'debian'; then
|
||||
# dpkg -i /opt/so/conf/fleet/packages/launcher.deb
|
||||
#else
|
||||
# rpm -i /opt/so/conf/fleet/packages/launcher.rpm
|
||||
#fi
|
||||
echo "Installing launcher via salt"
|
||||
salt-call state.apply launcher queue=True > /root/launcher.log
|
||||
echo "Fleet Setup Complete - Login here: https://$1"
|
||||
echo "Your username is $2 and your password is $initpw"
|
||||
12
salt/launcher/init.sls
Normal file
12
salt/launcher/init.sls
Normal file
@@ -0,0 +1,12 @@
|
||||
{%- set FLEETSETUP = salt['pillar.get']('static:fleetsetup', '0') -%}
|
||||
|
||||
{%- if FLEETSETUP != 0 %}
|
||||
launcherpkg:
|
||||
pkg.installed:
|
||||
- sources:
|
||||
{% if grains['os'] == 'CentOS' %}
|
||||
- launcher-final: salt://launcher/packages/launcher.rpm
|
||||
{% elif grains['os'] == 'Ubuntu' %}
|
||||
- launcher-final: salt://launcher/packages/launcher.deb
|
||||
{% endif %}
|
||||
{%- endif %}
|
||||
1
salt/launcher/packages/info.txt
Normal file
1
salt/launcher/packages/info.txt
Normal file
@@ -0,0 +1 @@
|
||||
Fleet Packages will be copied to this folder
|
||||
17
salt/logstash/conf/conf.enabled.txt
Normal file
17
salt/logstash/conf/conf.enabled.txt
Normal file
@@ -0,0 +1,17 @@
|
||||
# This is where can specify which LogStash configs get loaded.
|
||||
#
|
||||
# The custom folder on the master gets automatically synced to each logstash
|
||||
# node.
|
||||
#
|
||||
# To enable a custom configuration see the following example and uncomment:
|
||||
# /usr/share/logstash/pipeline.custom/1234_input_custom.conf
|
||||
##
|
||||
# All of the defaults are loaded.
|
||||
/usr/share/logstash/pipeline.so/0000_input_syslogng.conf
|
||||
/usr/share/logstash/pipeline.so/0001_input_json.conf
|
||||
/usr/share/logstash/pipeline.so/0002_input_windows_json.conf
|
||||
/usr/share/logstash/pipeline.so/0003_input_syslog.conf
|
||||
/usr/share/logstash/pipeline.so/0005_input_suricata.conf
|
||||
/usr/share/logstash/pipeline.so/0006_input_beats.conf
|
||||
/usr/share/logstash/pipeline.so/0007_input_import.conf
|
||||
/usr/share/logstash/pipeline.dynamic/9999_output_redis.conf
|
||||
17
salt/logstash/conf/conf.enabled.txt.forward
Normal file
17
salt/logstash/conf/conf.enabled.txt.forward
Normal file
@@ -0,0 +1,17 @@
|
||||
# This is where can specify which LogStash configs get loaded.
|
||||
#
|
||||
# The custom folder on the master gets automatically synced to each logstash
|
||||
# node.
|
||||
#
|
||||
# To enable a custom configuration see the following example and uncomment:
|
||||
# /usr/share/logstash/pipeline.custom/1234_input_custom.conf
|
||||
##
|
||||
# All of the defaults are loaded.
|
||||
/usr/share/logstash/pipeline.so/0000_input_syslogng.conf
|
||||
/usr/share/logstash/pipeline.so/0001_input_json.conf
|
||||
/usr/share/logstash/pipeline.so/0002_input_windows_json.conf
|
||||
/usr/share/logstash/pipeline.so/0003_input_syslog.conf
|
||||
/usr/share/logstash/pipeline.so/0005_input_suricata.conf
|
||||
/usr/share/logstash/pipeline.so/0006_input_beats.conf
|
||||
/usr/share/logstash/pipeline.so/0007_input_import.conf
|
||||
/usr/share/logstash/pipeline.dynamic/9999_output_redis.conf
|
||||
85
salt/logstash/conf/conf.enabled.txt.parser
Normal file
85
salt/logstash/conf/conf.enabled.txt.parser
Normal file
@@ -0,0 +1,85 @@
|
||||
# This is where can specify which LogStash configs get loaded.
|
||||
#
|
||||
# The custom folder on the master gets automatically synced to each logstash
|
||||
# node.
|
||||
#
|
||||
# To enable a custom configuration see the following example and uncomment:
|
||||
# /usr/share/logstash/pipeline.custom/1234_input_custom.conf
|
||||
##
|
||||
# All of the defaults are loaded.
|
||||
# Please note that Bro config is commented out because we're moving that parsing to Elasticsearch ingest.
|
||||
/usr/share/logstash/pipeline.dynamic/0900_input_redis.conf
|
||||
/usr/share/logstash/pipeline.so/1000_preprocess_log_elapsed.conf
|
||||
/usr/share/logstash/pipeline.so/1001_preprocess_syslogng.conf
|
||||
/usr/share/logstash/pipeline.so/1002_preprocess_json.conf
|
||||
#/usr/share/logstash/pipeline.so/1003_preprocess_bro.conf
|
||||
/usr/share/logstash/pipeline.so/1004_preprocess_syslog_types.conf
|
||||
/usr/share/logstash/pipeline.so/1026_preprocess_dhcp.conf
|
||||
/usr/share/logstash/pipeline.so/1029_preprocess_esxi.conf
|
||||
/usr/share/logstash/pipeline.so/1030_preprocess_greensql.conf
|
||||
/usr/share/logstash/pipeline.so/1031_preprocess_iis.conf
|
||||
/usr/share/logstash/pipeline.so/1032_preprocess_mcafee.conf
|
||||
/usr/share/logstash/pipeline.so/1033_preprocess_snort.conf
|
||||
/usr/share/logstash/pipeline.so/1034_preprocess_syslog.conf
|
||||
#/usr/share/logstash/pipeline.so/1100_preprocess_bro_conn.conf
|
||||
#/usr/share/logstash/pipeline.so/1101_preprocess_bro_dhcp.conf
|
||||
#/usr/share/logstash/pipeline.so/1102_preprocess_bro_dns.conf
|
||||
#/usr/share/logstash/pipeline.so/1103_preprocess_bro_dpd.conf
|
||||
#/usr/share/logstash/pipeline.so/1104_preprocess_bro_files.conf
|
||||
#/usr/share/logstash/pipeline.so/1105_preprocess_bro_ftp.conf
|
||||
#/usr/share/logstash/pipeline.so/1106_preprocess_bro_http.conf
|
||||
#/usr/share/logstash/pipeline.so/1107_preprocess_bro_irc.conf
|
||||
#/usr/share/logstash/pipeline.so/1108_preprocess_bro_kerberos.conf
|
||||
#/usr/share/logstash/pipeline.so/1109_preprocess_bro_notice.conf
|
||||
#/usr/share/logstash/pipeline.so/1110_preprocess_bro_rdp.conf
|
||||
#/usr/share/logstash/pipeline.so/1111_preprocess_bro_signatures.conf
|
||||
#/usr/share/logstash/pipeline.so/1112_preprocess_bro_smtp.conf
|
||||
#/usr/share/logstash/pipeline.so/1113_preprocess_bro_snmp.conf
|
||||
#/usr/share/logstash/pipeline.so/1114_preprocess_bro_software.conf
|
||||
#/usr/share/logstash/pipeline.so/1115_preprocess_bro_ssh.conf
|
||||
#/usr/share/logstash/pipeline.so/1116_preprocess_bro_ssl.conf
|
||||
#/usr/share/logstash/pipeline.so/1117_preprocess_bro_syslog.conf
|
||||
#/usr/share/logstash/pipeline.so/1118_preprocess_bro_tunnel.conf
|
||||
#/usr/share/logstash/pipeline.so/1119_preprocess_bro_weird.conf
|
||||
#/usr/share/logstash/pipeline.so/1121_preprocess_bro_mysql.conf
|
||||
#/usr/share/logstash/pipeline.so/1122_preprocess_bro_socks.conf
|
||||
#/usr/share/logstash/pipeline.so/1123_preprocess_bro_x509.conf
|
||||
#/usr/share/logstash/pipeline.so/1124_preprocess_bro_intel.conf
|
||||
#/usr/share/logstash/pipeline.so/1125_preprocess_bro_modbus.conf
|
||||
#/usr/share/logstash/pipeline.so/1126_preprocess_bro_sip.conf
|
||||
#/usr/share/logstash/pipeline.so/1127_preprocess_bro_radius.conf
|
||||
#/usr/share/logstash/pipeline.so/1128_preprocess_bro_pe.conf
|
||||
#/usr/share/logstash/pipeline.so/1129_preprocess_bro_rfb.conf
|
||||
#/usr/share/logstash/pipeline.so/1130_preprocess_bro_dnp3.conf
|
||||
#/usr/share/logstash/pipeline.so/1131_preprocess_bro_smb_files.conf
|
||||
#/usr/share/logstash/pipeline.so/1132_preprocess_bro_smb_mapping.conf
|
||||
#/usr/share/logstash/pipeline.so/1133_preprocess_bro_ntlm.conf
|
||||
#/usr/share/logstash/pipeline.so/1134_preprocess_bro_dce_rpc.conf
|
||||
/usr/share/logstash/pipeline.so/1998_test_data.conf
|
||||
/usr/share/logstash/pipeline.so/2000_network_flow.conf
|
||||
#/usr/share/logstash/pipeline.so/6000_bro.conf
|
||||
#/usr/share/logstash/pipeline.so/6001_bro_import.conf
|
||||
/usr/share/logstash/pipeline.so/6002_syslog.conf
|
||||
/usr/share/logstash/pipeline.so/6101_switch_brocade.conf
|
||||
/usr/share/logstash/pipeline.so/6200_firewall_fortinet.conf
|
||||
/usr/share/logstash/pipeline.so/6201_firewall_pfsense.conf
|
||||
/usr/share/logstash/pipeline.so/6300_windows.conf
|
||||
/usr/share/logstash/pipeline.so/6301_dns_windows.conf
|
||||
/usr/share/logstash/pipeline.so/6400_suricata.conf
|
||||
/usr/share/logstash/pipeline.so/6500_ossec.conf
|
||||
/usr/share/logstash/pipeline.so/6501_ossec_sysmon.conf
|
||||
/usr/share/logstash/pipeline.so/6502_ossec_autoruns.conf
|
||||
#/usr/share/logstash/pipeline.so/8000_postprocess_bro_cleanup.conf
|
||||
/usr/share/logstash/pipeline.so/8001_postprocess_common_ip_augmentation.conf
|
||||
/usr/share/logstash/pipeline.so/8006_postprocess_dns.conf
|
||||
/usr/share/logstash/pipeline.so/8007_postprocess_dns_top1m_tagging.conf
|
||||
/usr/share/logstash/pipeline.so/8007_postprocess_http.conf
|
||||
/usr/share/logstash/pipeline.so/8008_postprocess_dns_whois_age.conf
|
||||
/usr/share/logstash/pipeline.so/8200_postprocess_tagging.conf
|
||||
#/usr/share/logstash/pipeline.so/8502_postprocess_freq_analysis_bro_dns.conf
|
||||
#/usr/share/logstash/pipeline.so/8503_postprocess_freq_analysis_bro_http.conf
|
||||
#/usr/share/logstash/pipeline.so/8504_postprocess_freq_analysis_bro_ssl.conf
|
||||
#/usr/share/logstash/pipeline.so/8505_postprocess_freq_analysis_bro_x509.conf
|
||||
/usr/share/logstash/pipeline.so/8998_postprocess_log_elapsed.conf
|
||||
/usr/share/logstash/pipeline.so/8999_postprocess_rename_type.conf
|
||||
/usr/share/logstash/pipeline.dynamic/9999_output_redis.conf
|
||||
106
salt/logstash/conf/conf.enabled.txt.search
Normal file
106
salt/logstash/conf/conf.enabled.txt.search
Normal file
@@ -0,0 +1,106 @@
|
||||
# This is where can specify which LogStash configs get loaded.
|
||||
#
|
||||
# The custom folder on the master gets automatically synced to each logstash
|
||||
# node.
|
||||
#
|
||||
# To enable a custom configuration see the following example and uncomment:
|
||||
# /usr/share/logstash/pipeline.custom/1234_input_custom.conf
|
||||
##
|
||||
# All of the defaults are loaded.
|
||||
# Please note that Bro config is commented out because we're moving that parsing to Elasticsearch ingest.
|
||||
/usr/share/logstash/pipeline.dynamic/0900_input_redis.conf
|
||||
/usr/share/logstash/pipeline.so/1000_preprocess_log_elapsed.conf
|
||||
/usr/share/logstash/pipeline.so/1001_preprocess_syslogng.conf
|
||||
/usr/share/logstash/pipeline.so/1002_preprocess_json.conf
|
||||
#/usr/share/logstash/pipeline.so/1003_preprocess_bro.conf
|
||||
/usr/share/logstash/pipeline.so/1004_preprocess_syslog_types.conf
|
||||
/usr/share/logstash/pipeline.so/1026_preprocess_dhcp.conf
|
||||
/usr/share/logstash/pipeline.so/1029_preprocess_esxi.conf
|
||||
/usr/share/logstash/pipeline.so/1030_preprocess_greensql.conf
|
||||
/usr/share/logstash/pipeline.so/1031_preprocess_iis.conf
|
||||
/usr/share/logstash/pipeline.so/1032_preprocess_mcafee.conf
|
||||
/usr/share/logstash/pipeline.so/1033_preprocess_snort.conf
|
||||
/usr/share/logstash/pipeline.so/1034_preprocess_syslog.conf
|
||||
#/usr/share/logstash/pipeline.so/1100_preprocess_bro_conn.conf
|
||||
#/usr/share/logstash/pipeline.so/1101_preprocess_bro_dhcp.conf
|
||||
#/usr/share/logstash/pipeline.so/1102_preprocess_bro_dns.conf
|
||||
#/usr/share/logstash/pipeline.so/1103_preprocess_bro_dpd.conf
|
||||
#/usr/share/logstash/pipeline.so/1104_preprocess_bro_files.conf
|
||||
#/usr/share/logstash/pipeline.so/1105_preprocess_bro_ftp.conf
|
||||
#/usr/share/logstash/pipeline.so/1106_preprocess_bro_http.conf
|
||||
#/usr/share/logstash/pipeline.so/1107_preprocess_bro_irc.conf
|
||||
#/usr/share/logstash/pipeline.so/1108_preprocess_bro_kerberos.conf
|
||||
#/usr/share/logstash/pipeline.so/1109_preprocess_bro_notice.conf
|
||||
#/usr/share/logstash/pipeline.so/1110_preprocess_bro_rdp.conf
|
||||
#/usr/share/logstash/pipeline.so/1111_preprocess_bro_signatures.conf
|
||||
#/usr/share/logstash/pipeline.so/1112_preprocess_bro_smtp.conf
|
||||
#/usr/share/logstash/pipeline.so/1113_preprocess_bro_snmp.conf
|
||||
#/usr/share/logstash/pipeline.so/1114_preprocess_bro_software.conf
|
||||
#/usr/share/logstash/pipeline.so/1115_preprocess_bro_ssh.conf
|
||||
#/usr/share/logstash/pipeline.so/1116_preprocess_bro_ssl.conf
|
||||
#/usr/share/logstash/pipeline.so/1117_preprocess_bro_syslog.conf
|
||||
#/usr/share/logstash/pipeline.so/1118_preprocess_bro_tunnel.conf
|
||||
#/usr/share/logstash/pipeline.so/1119_preprocess_bro_weird.conf
|
||||
#/usr/share/logstash/pipeline.so/1121_preprocess_bro_mysql.conf
|
||||
#/usr/share/logstash/pipeline.so/1122_preprocess_bro_socks.conf
|
||||
#/usr/share/logstash/pipeline.so/1123_preprocess_bro_x509.conf
|
||||
#/usr/share/logstash/pipeline.so/1124_preprocess_bro_intel.conf
|
||||
#/usr/share/logstash/pipeline.so/1125_preprocess_bro_modbus.conf
|
||||
#/usr/share/logstash/pipeline.so/1126_preprocess_bro_sip.conf
|
||||
#/usr/share/logstash/pipeline.so/1127_preprocess_bro_radius.conf
|
||||
#/usr/share/logstash/pipeline.so/1128_preprocess_bro_pe.conf
|
||||
#/usr/share/logstash/pipeline.so/1129_preprocess_bro_rfb.conf
|
||||
#/usr/share/logstash/pipeline.so/1130_preprocess_bro_dnp3.conf
|
||||
#/usr/share/logstash/pipeline.so/1131_preprocess_bro_smb_files.conf
|
||||
#/usr/share/logstash/pipeline.so/1132_preprocess_bro_smb_mapping.conf
|
||||
#/usr/share/logstash/pipeline.so/1133_preprocess_bro_ntlm.conf
|
||||
#/usr/share/logstash/pipeline.so/1134_preprocess_bro_dce_rpc.conf
|
||||
/usr/share/logstash/pipeline.so/1998_test_data.conf
|
||||
/usr/share/logstash/pipeline.so/2000_network_flow.conf
|
||||
#/usr/share/logstash/pipeline.so/6000_bro.conf
|
||||
#/usr/share/logstash/pipeline.so/6001_bro_import.conf
|
||||
/usr/share/logstash/pipeline.so/6002_syslog.conf
|
||||
/usr/share/logstash/pipeline.so/6101_switch_brocade.conf
|
||||
/usr/share/logstash/pipeline.so/6200_firewall_fortinet.conf
|
||||
/usr/share/logstash/pipeline.so/6201_firewall_pfsense.conf
|
||||
/usr/share/logstash/pipeline.so/6300_windows.conf
|
||||
/usr/share/logstash/pipeline.so/6301_dns_windows.conf
|
||||
/usr/share/logstash/pipeline.so/6400_suricata.conf
|
||||
/usr/share/logstash/pipeline.so/6500_ossec.conf
|
||||
/usr/share/logstash/pipeline.so/6501_ossec_sysmon.conf
|
||||
/usr/share/logstash/pipeline.so/6502_ossec_autoruns.conf
|
||||
/usr/share/logstash/pipeline.so/6600_winlogbeat_sysmon.conf
|
||||
/usr/share/logstash/pipeline.so/6700_winlogbeat.conf
|
||||
#/usr/share/logstash/pipeline.so/8000_postprocess_bro_cleanup.conf
|
||||
/usr/share/logstash/pipeline.so/8001_postprocess_common_ip_augmentation.conf
|
||||
#/usr/share/logstash/pipeline.so/8006_postprocess_dns.conf
|
||||
#/usr/share/logstash/pipeline.so/8007_postprocess_dns_top1m_tagging.conf
|
||||
/usr/share/logstash/pipeline.so/8007_postprocess_http.conf
|
||||
#/usr/share/logstash/pipeline.so/8008_postprocess_dns_whois_age.conf
|
||||
/usr/share/logstash/pipeline.so/8200_postprocess_tagging.conf
|
||||
#/usr/share/logstash/pipeline.so/8502_postprocess_freq_analysis_bro_dns.conf
|
||||
#/usr/share/logstash/pipeline.so/8503_postprocess_freq_analysis_bro_http.conf
|
||||
#/usr/share/logstash/pipeline.so/8504_postprocess_freq_analysis_bro_ssl.conf
|
||||
#/usr/share/logstash/pipeline.so/8505_postprocess_freq_analysis_bro_x509.conf
|
||||
/usr/share/logstash/pipeline.so/8998_postprocess_log_elapsed.conf
|
||||
/usr/share/logstash/pipeline.so/8999_postprocess_rename_type.conf
|
||||
/usr/share/logstash/pipeline.dynamic/9000_output_bro.conf
|
||||
/usr/share/logstash/pipeline.dynamic/9001_output_switch.conf
|
||||
/usr/share/logstash/pipeline.dynamic/9002_output_import.conf
|
||||
/usr/share/logstash/pipeline.dynamic/9004_output_flow.conf
|
||||
/usr/share/logstash/pipeline.dynamic/9026_output_dhcp.conf
|
||||
/usr/share/logstash/pipeline.dynamic/9029_output_esxi.conf
|
||||
/usr/share/logstash/pipeline.dynamic/9030_output_greensql.conf
|
||||
/usr/share/logstash/pipeline.dynamic/9031_output_iis.conf
|
||||
/usr/share/logstash/pipeline.dynamic/9032_output_mcafee.conf
|
||||
/usr/share/logstash/pipeline.dynamic/9033_output_snort.conf
|
||||
/usr/share/logstash/pipeline.dynamic/9034_output_syslog.conf
|
||||
/usr/share/logstash/pipeline.dynamic/9200_output_firewall.conf
|
||||
/usr/share/logstash/pipeline.dynamic/9300_output_windows.conf
|
||||
/usr/share/logstash/pipeline.dynamic/9301_output_dns_windows.conf
|
||||
/usr/share/logstash/pipeline.dynamic/9400_output_suricata.conf
|
||||
/usr/share/logstash/pipeline.dynamic/9500_output_beats.conf
|
||||
/usr/share/logstash/pipeline.dynamic/9600_output_ossec.conf
|
||||
/usr/share/logstash/pipeline.dynamic/9998_output_test_data.conf
|
||||
/usr/share/logstash/pipeline.dynamic/7100_osquery_wel.conf
|
||||
/usr/share/logstash/pipeline.dynamic/9100_output_osquery.conf
|
||||
113
salt/logstash/conf/conf.enabled.txt.so-eval
Normal file
113
salt/logstash/conf/conf.enabled.txt.so-eval
Normal file
@@ -0,0 +1,113 @@
|
||||
# This is where can specify which LogStash configs get loaded.
|
||||
#
|
||||
# The custom folder on the master gets automatically synced to each logstash
|
||||
# node.
|
||||
#
|
||||
# To enable a custom configuration see the following example and uncomment:
|
||||
# /usr/share/logstash/pipeline.custom/1234_input_custom.conf
|
||||
##
|
||||
# All of the defaults are loaded.
|
||||
# Please note that Bro config is commented out because we're moving that parsing to Elasticsearch ingest.
|
||||
#/usr/share/logstash/pipeline.so/0000_input_syslogng.conf
|
||||
#/usr/share/logstash/pipeline.so/0001_input_json.conf
|
||||
#/usr/share/logstash/pipeline.so/0002_input_windows_json.conf
|
||||
#/usr/share/logstash/pipeline.so/0003_input_syslog.conf
|
||||
#/usr/share/logstash/pipeline.so/0005_input_suricata.conf
|
||||
#/usr/share/logstash/pipeline.dynamic/0006_input_beats.conf
|
||||
/usr/share/logstash/pipeline.so/0007_input_import.conf
|
||||
/usr/share/logstash/pipeline.dynamic/0010_input_hhbeats.conf
|
||||
#/usr/share/logstash/pipeline.so/1000_preprocess_log_elapsed.conf
|
||||
#/usr/share/logstash/pipeline.so/1001_preprocess_syslogng.conf
|
||||
#/usr/share/logstash/pipeline.so/1002_preprocess_json.conf
|
||||
#/usr/share/logstash/pipeline.so/1003_preprocess_bro.conf
|
||||
#/usr/share/logstash/pipeline.so/1004_preprocess_syslog_types.conf
|
||||
/usr/share/logstash/pipeline.so/1026_preprocess_dhcp.conf
|
||||
#/usr/share/logstash/pipeline.so/1029_preprocess_esxi.conf
|
||||
#/usr/share/logstash/pipeline.so/1030_preprocess_greensql.conf
|
||||
#/usr/share/logstash/pipeline.so/1031_preprocess_iis.conf
|
||||
#/usr/share/logstash/pipeline.so/1032_preprocess_mcafee.conf
|
||||
/usr/share/logstash/pipeline.so/1033_preprocess_snort.conf
|
||||
#/usr/share/logstash/pipeline.so/1034_preprocess_syslog.conf
|
||||
#/usr/share/logstash/pipeline.so/1100_preprocess_bro_conn.conf
|
||||
#/usr/share/logstash/pipeline.so/1101_preprocess_bro_dhcp.conf
|
||||
#/usr/share/logstash/pipeline.so/1102_preprocess_bro_dns.conf
|
||||
#/usr/share/logstash/pipeline.so/1103_preprocess_bro_dpd.conf
|
||||
#/usr/share/logstash/pipeline.so/1104_preprocess_bro_files.conf
|
||||
#/usr/share/logstash/pipeline.so/1105_preprocess_bro_ftp.conf
|
||||
#/usr/share/logstash/pipeline.so/1106_preprocess_bro_http.conf
|
||||
#/usr/share/logstash/pipeline.so/1107_preprocess_bro_irc.conf
|
||||
#/usr/share/logstash/pipeline.so/1108_preprocess_bro_kerberos.conf
|
||||
#/usr/share/logstash/pipeline.so/1109_preprocess_bro_notice.conf
|
||||
#/usr/share/logstash/pipeline.so/1110_preprocess_bro_rdp.conf
|
||||
#/usr/share/logstash/pipeline.so/1111_preprocess_bro_signatures.conf
|
||||
#/usr/share/logstash/pipeline.so/1112_preprocess_bro_smtp.conf
|
||||
#/usr/share/logstash/pipeline.so/1113_preprocess_bro_snmp.conf
|
||||
#/usr/share/logstash/pipeline.so/1114_preprocess_bro_software.conf
|
||||
#/usr/share/logstash/pipeline.so/1115_preprocess_bro_ssh.conf
|
||||
#/usr/share/logstash/pipeline.so/1116_preprocess_bro_ssl.conf
|
||||
#/usr/share/logstash/pipeline.so/1117_preprocess_bro_syslog.conf
|
||||
#/usr/share/logstash/pipeline.so/1118_preprocess_bro_tunnel.conf
|
||||
#/usr/share/logstash/pipeline.so/1119_preprocess_bro_weird.conf
|
||||
#/usr/share/logstash/pipeline.so/1121_preprocess_bro_mysql.conf
|
||||
#/usr/share/logstash/pipeline.so/1122_preprocess_bro_socks.conf
|
||||
#/usr/share/logstash/pipeline.so/1123_preprocess_bro_x509.conf
|
||||
#/usr/share/logstash/pipeline.so/1124_preprocess_bro_intel.conf
|
||||
#/usr/share/logstash/pipeline.so/1125_preprocess_bro_modbus.conf
|
||||
#/usr/share/logstash/pipeline.so/1126_preprocess_bro_sip.conf
|
||||
#/usr/share/logstash/pipeline.so/1127_preprocess_bro_radius.conf
|
||||
#/usr/share/logstash/pipeline.so/1128_preprocess_bro_pe.conf
|
||||
#/usr/share/logstash/pipeline.so/1129_preprocess_bro_rfb.conf
|
||||
#/usr/share/logstash/pipeline.so/1130_preprocess_bro_dnp3.conf
|
||||
#/usr/share/logstash/pipeline.so/1131_preprocess_bro_smb_files.conf
|
||||
#/usr/share/logstash/pipeline.so/1132_preprocess_bro_smb_mapping.conf
|
||||
#/usr/share/logstash/pipeline.so/1133_preprocess_bro_ntlm.conf
|
||||
#/usr/share/logstash/pipeline.so/1134_preprocess_bro_dce_rpc.conf
|
||||
#/usr/share/logstash/pipeline.so/1998_test_data.conf
|
||||
#/usr/share/logstash/pipeline.so/2000_network_flow.conf
|
||||
#/usr/share/logstash/pipeline.so/6000_bro.conf
|
||||
#/usr/share/logstash/pipeline.so/6001_bro_import.conf
|
||||
#/usr/share/logstash/pipeline.so/6002_syslog.conf
|
||||
#/usr/share/logstash/pipeline.so/6101_switch_brocade.conf
|
||||
#/usr/share/logstash/pipeline.so/6200_firewall_fortinet.conf
|
||||
#/usr/share/logstash/pipeline.so/6201_firewall_pfsense.conf
|
||||
#/usr/share/logstash/pipeline.so/6300_windows.conf
|
||||
#/usr/share/logstash/pipeline.so/6301_dns_windows.conf
|
||||
#/usr/share/logstash/pipeline.so/6400_suricata.conf
|
||||
/usr/share/logstash/pipeline.so/6500_ossec.conf
|
||||
/usr/share/logstash/pipeline.so/6501_ossec_sysmon.conf
|
||||
/usr/share/logstash/pipeline.so/6502_ossec_autoruns.conf
|
||||
/usr/share/logstash/pipeline.so/6600_winlogbeat_sysmon.conf
|
||||
/usr/share/logstash/pipeline.so/6700_winlogbeat.conf
|
||||
#/usr/share/logstash/pipeline.so/8000_postprocess_bro_cleanup.conf
|
||||
/usr/share/logstash/pipeline.so/8001_postprocess_common_ip_augmentation.conf
|
||||
#/usr/share/logstash/pipeline.so/8006_postprocess_dns.conf
|
||||
#/usr/share/logstash/pipeline.so/8007_postprocess_dns_top1m_tagging.conf
|
||||
/usr/share/logstash/pipeline.so/8007_postprocess_http.conf
|
||||
#/usr/share/logstash/pipeline.so/8008_postprocess_dns_whois_age.conf
|
||||
/usr/share/logstash/pipeline.so/8200_postprocess_tagging.conf
|
||||
#/usr/share/logstash/pipeline.so/8502_postprocess_freq_analysis_bro_dns.conf
|
||||
#/usr/share/logstash/pipeline.so/8503_postprocess_freq_analysis_bro_http.conf
|
||||
#/usr/share/logstash/pipeline.so/8504_postprocess_freq_analysis_bro_ssl.conf
|
||||
#/usr/share/logstash/pipeline.so/8505_postprocess_freq_analysis_bro_x509.conf
|
||||
#/usr/share/logstash/pipeline.so/8998_postprocess_log_elapsed.conf
|
||||
/usr/share/logstash/pipeline.so/8999_postprocess_rename_type.conf
|
||||
/usr/share/logstash/pipeline.dynamic/9000_output_bro.conf
|
||||
#/usr/share/logstash/pipeline.dynamic/9001_output_switch.conf
|
||||
/usr/share/logstash/pipeline.dynamic/9002_output_import.conf
|
||||
#/usr/share/logstash/pipeline.dynamic/9004_output_flow.conf
|
||||
#/usr/share/logstash/pipeline.dynamic/9026_output_dhcp.conf
|
||||
#/usr/share/logstash/pipeline.dynamic/9029_output_esxi.conf
|
||||
#/usr/share/logstash/pipeline.dynamic/9030_output_greensql.conf
|
||||
#/usr/share/logstash/pipeline.dynamic/9031_output_iis.conf
|
||||
#/usr/share/logstash/pipeline.dynamic/9032_output_mcafee.conf
|
||||
/usr/share/logstash/pipeline.dynamic/9033_output_snort.conf
|
||||
#/usr/share/logstash/pipeline.dynamic/9034_output_syslog.conf
|
||||
#/usr/share/logstash/pipeline.dynamic/9200_output_firewall.conf
|
||||
#/usr/share/logstash/pipeline.dynamic/9300_output_windows.conf
|
||||
#/usr/share/logstash/pipeline.dynamic/9301_output_dns_windows.conf
|
||||
/usr/share/logstash/pipeline.dynamic/9400_output_suricata.conf
|
||||
/usr/share/logstash/pipeline.dynamic/9500_output_beats.conf
|
||||
/usr/share/logstash/pipeline.dynamic/9600_output_ossec.conf
|
||||
#/usr/share/logstash/pipeline.dynamic/9998_output_test_data.conf
|
||||
/usr/share/logstash/pipeline.dynamic/7100_osquery_wel.conf
|
||||
/usr/share/logstash/pipeline.dynamic/9100_output_osquery.conf
|
||||
109
salt/logstash/conf/conf.enabled.txt.so-eval.old
Normal file
109
salt/logstash/conf/conf.enabled.txt.so-eval.old
Normal file
@@ -0,0 +1,109 @@
|
||||
# This is where can specify which LogStash configs get loaded.
|
||||
#
|
||||
# The custom folder on the master gets automatically synced to each logstash
|
||||
# node.
|
||||
#
|
||||
# To enable a custom configuration see the following example and uncomment:
|
||||
# /usr/share/logstash/pipeline.custom/1234_input_custom.conf
|
||||
##
|
||||
# All of the defaults are loaded.
|
||||
/usr/share/logstash/pipeline.so/0000_input_syslogng.conf
|
||||
/usr/share/logstash/pipeline.so/0001_input_json.conf
|
||||
/usr/share/logstash/pipeline.so/0002_input_windows_json.conf
|
||||
/usr/share/logstash/pipeline.so/0003_input_syslog.conf
|
||||
/usr/share/logstash/pipeline.so/0005_input_suricata.conf
|
||||
/usr/share/logstash/pipeline.so/0007_input_import.conf
|
||||
/usr/share/logstash/pipeline.so/0008_input_eval.conf
|
||||
/usr/share/logstash/pipeline.so/1000_preprocess_log_elapsed.conf
|
||||
/usr/share/logstash/pipeline.so/1001_preprocess_syslogng.conf
|
||||
/usr/share/logstash/pipeline.so/1002_preprocess_json.conf
|
||||
/usr/share/logstash/pipeline.so/1003_preprocess_bro.conf
|
||||
/usr/share/logstash/pipeline.so/1004_preprocess_syslog_types.conf
|
||||
/usr/share/logstash/pipeline.so/1026_preprocess_dhcp.conf
|
||||
/usr/share/logstash/pipeline.so/1029_preprocess_esxi.conf
|
||||
/usr/share/logstash/pipeline.so/1030_preprocess_greensql.conf
|
||||
/usr/share/logstash/pipeline.so/1031_preprocess_iis.conf
|
||||
/usr/share/logstash/pipeline.so/1032_preprocess_mcafee.conf
|
||||
/usr/share/logstash/pipeline.so/1033_preprocess_snort.conf
|
||||
/usr/share/logstash/pipeline.so/1034_preprocess_syslog.conf
|
||||
/usr/share/logstash/pipeline.so/1100_preprocess_bro_conn.conf
|
||||
/usr/share/logstash/pipeline.so/1101_preprocess_bro_dhcp.conf
|
||||
/usr/share/logstash/pipeline.so/1102_preprocess_bro_dns.conf
|
||||
/usr/share/logstash/pipeline.so/1103_preprocess_bro_dpd.conf
|
||||
/usr/share/logstash/pipeline.so/1104_preprocess_bro_files.conf
|
||||
/usr/share/logstash/pipeline.so/1105_preprocess_bro_ftp.conf
|
||||
/usr/share/logstash/pipeline.so/1106_preprocess_bro_http.conf
|
||||
/usr/share/logstash/pipeline.so/1107_preprocess_bro_irc.conf
|
||||
/usr/share/logstash/pipeline.so/1108_preprocess_bro_kerberos.conf
|
||||
/usr/share/logstash/pipeline.so/1109_preprocess_bro_notice.conf
|
||||
/usr/share/logstash/pipeline.so/1110_preprocess_bro_rdp.conf
|
||||
/usr/share/logstash/pipeline.so/1111_preprocess_bro_signatures.conf
|
||||
/usr/share/logstash/pipeline.so/1112_preprocess_bro_smtp.conf
|
||||
/usr/share/logstash/pipeline.so/1113_preprocess_bro_snmp.conf
|
||||
/usr/share/logstash/pipeline.so/1114_preprocess_bro_software.conf
|
||||
/usr/share/logstash/pipeline.so/1115_preprocess_bro_ssh.conf
|
||||
/usr/share/logstash/pipeline.so/1116_preprocess_bro_ssl.conf
|
||||
/usr/share/logstash/pipeline.so/1117_preprocess_bro_syslog.conf
|
||||
/usr/share/logstash/pipeline.so/1118_preprocess_bro_tunnel.conf
|
||||
/usr/share/logstash/pipeline.so/1119_preprocess_bro_weird.conf
|
||||
/usr/share/logstash/pipeline.so/1121_preprocess_bro_mysql.conf
|
||||
/usr/share/logstash/pipeline.so/1122_preprocess_bro_socks.conf
|
||||
/usr/share/logstash/pipeline.so/1123_preprocess_bro_x509.conf
|
||||
/usr/share/logstash/pipeline.so/1124_preprocess_bro_intel.conf
|
||||
/usr/share/logstash/pipeline.so/1125_preprocess_bro_modbus.conf
|
||||
/usr/share/logstash/pipeline.so/1126_preprocess_bro_sip.conf
|
||||
/usr/share/logstash/pipeline.so/1127_preprocess_bro_radius.conf
|
||||
/usr/share/logstash/pipeline.so/1128_preprocess_bro_pe.conf
|
||||
/usr/share/logstash/pipeline.so/1129_preprocess_bro_rfb.conf
|
||||
/usr/share/logstash/pipeline.so/1130_preprocess_bro_dnp3.conf
|
||||
/usr/share/logstash/pipeline.so/1131_preprocess_bro_smb_files.conf
|
||||
/usr/share/logstash/pipeline.so/1132_preprocess_bro_smb_mapping.conf
|
||||
/usr/share/logstash/pipeline.so/1133_preprocess_bro_ntlm.conf
|
||||
/usr/share/logstash/pipeline.so/1134_preprocess_bro_dce_rpc.conf
|
||||
/usr/share/logstash/pipeline.so/1998_test_data.conf
|
||||
/usr/share/logstash/pipeline.so/2000_network_flow.conf
|
||||
/usr/share/logstash/pipeline.so/6000_bro.conf
|
||||
/usr/share/logstash/pipeline.so/6001_bro_import.conf
|
||||
/usr/share/logstash/pipeline.so/6002_syslog.conf
|
||||
/usr/share/logstash/pipeline.so/6101_switch_brocade.conf
|
||||
/usr/share/logstash/pipeline.so/6200_firewall_fortinet.conf
|
||||
/usr/share/logstash/pipeline.so/6201_firewall_pfsense.conf
|
||||
/usr/share/logstash/pipeline.so/6300_windows.conf
|
||||
/usr/share/logstash/pipeline.so/6301_dns_windows.conf
|
||||
/usr/share/logstash/pipeline.so/6400_suricata.conf
|
||||
/usr/share/logstash/pipeline.so/6500_ossec.conf
|
||||
/usr/share/logstash/pipeline.so/6501_ossec_sysmon.conf
|
||||
/usr/share/logstash/pipeline.so/6502_ossec_autoruns.conf
|
||||
/usr/share/logstash/pipeline.so/6600_winlogbeat_sysmon.conf
|
||||
/usr/share/logstash/pipeline.so/6700_winlogbeat.conf
|
||||
/usr/share/logstash/pipeline.so/8000_postprocess_bro_cleanup.conf
|
||||
/usr/share/logstash/pipeline.so/8001_postprocess_common_ip_augmentation.conf
|
||||
#/usr/share/logstash/pipeline.so/8006_postprocess_dns.conf
|
||||
#/usr/share/logstash/pipeline.so/8007_postprocess_dns_top1m_tagging.conf
|
||||
/usr/share/logstash/pipeline.so/8007_postprocess_http.conf
|
||||
#/usr/share/logstash/pipeline.so/8008_postprocess_dns_whois_age.conf
|
||||
/usr/share/logstash/pipeline.so/8200_postprocess_tagging.conf
|
||||
#/usr/share/logstash/pipeline.so/8502_postprocess_freq_analysis_bro_dns.conf
|
||||
#/usr/share/logstash/pipeline.so/8503_postprocess_freq_analysis_bro_http.conf
|
||||
#/usr/share/logstash/pipeline.so/8504_postprocess_freq_analysis_bro_ssl.conf
|
||||
#/usr/share/logstash/pipeline.so/8505_postprocess_freq_analysis_bro_x509.conf
|
||||
/usr/share/logstash/pipeline.so/8998_postprocess_log_elapsed.conf
|
||||
/usr/share/logstash/pipeline.so/8999_postprocess_rename_type.conf
|
||||
/usr/share/logstash/pipeline.dynamic/9000_output_bro.conf
|
||||
/usr/share/logstash/pipeline.dynamic/9001_output_switch.conf
|
||||
/usr/share/logstash/pipeline.dynamic/9002_output_import.conf
|
||||
/usr/share/logstash/pipeline.dynamic/9004_output_flow.conf
|
||||
/usr/share/logstash/pipeline.dynamic/9026_output_dhcp.conf
|
||||
/usr/share/logstash/pipeline.dynamic/9029_output_esxi.conf
|
||||
/usr/share/logstash/pipeline.dynamic/9030_output_greensql.conf
|
||||
/usr/share/logstash/pipeline.dynamic/9031_output_iis.conf
|
||||
/usr/share/logstash/pipeline.dynamic/9032_output_mcafee.conf
|
||||
/usr/share/logstash/pipeline.dynamic/9033_output_snort.conf
|
||||
/usr/share/logstash/pipeline.dynamic/9034_output_syslog.conf
|
||||
/usr/share/logstash/pipeline.dynamic/9200_output_firewall.conf
|
||||
/usr/share/logstash/pipeline.dynamic/9300_output_windows.conf
|
||||
/usr/share/logstash/pipeline.dynamic/9301_output_dns_windows.conf
|
||||
/usr/share/logstash/pipeline.dynamic/9400_output_suricata.conf
|
||||
/usr/share/logstash/pipeline.dynamic/9500_output_beats.conf
|
||||
/usr/share/logstash/pipeline.dynamic/9600_output_ossec.conf
|
||||
/usr/share/logstash/pipeline.dynamic/9998_output_test_data.conf
|
||||
47
salt/logstash/conf/conf.enabled.txt.so-helix
Normal file
47
salt/logstash/conf/conf.enabled.txt.so-helix
Normal file
@@ -0,0 +1,47 @@
|
||||
# This is where can specify which LogStash configs get loaded.
|
||||
#
|
||||
# The custom folder on the master gets automatically synced to each logstash
|
||||
# node.
|
||||
#
|
||||
# To enable a custom configuration see the following example and uncomment:
|
||||
# /usr/share/logstash/pipeline.custom/1234_input_custom.conf
|
||||
##
|
||||
# All of the defaults are loaded.
|
||||
/usr/share/logstash/pipeline.dynamic/0010_input_hhbeats.conf
|
||||
/usr/share/logstash/pipeline.so/1033_preprocess_snort.conf
|
||||
/usr/share/logstash/pipeline.so/1100_preprocess_bro_conn.conf
|
||||
/usr/share/logstash/pipeline.so/1101_preprocess_bro_dhcp.conf
|
||||
/usr/share/logstash/pipeline.so/1102_preprocess_bro_dns.conf
|
||||
/usr/share/logstash/pipeline.so/1103_preprocess_bro_dpd.conf
|
||||
/usr/share/logstash/pipeline.so/1104_preprocess_bro_files.conf
|
||||
/usr/share/logstash/pipeline.so/1105_preprocess_bro_ftp.conf
|
||||
/usr/share/logstash/pipeline.so/1106_preprocess_bro_http.conf
|
||||
/usr/share/logstash/pipeline.so/1107_preprocess_bro_irc.conf
|
||||
/usr/share/logstash/pipeline.so/1108_preprocess_bro_kerberos.conf
|
||||
/usr/share/logstash/pipeline.so/1109_preprocess_bro_notice.conf
|
||||
/usr/share/logstash/pipeline.so/1110_preprocess_bro_rdp.conf
|
||||
/usr/share/logstash/pipeline.so/1111_preprocess_bro_signatures.conf
|
||||
/usr/share/logstash/pipeline.so/1112_preprocess_bro_smtp.conf
|
||||
/usr/share/logstash/pipeline.so/1113_preprocess_bro_snmp.conf
|
||||
/usr/share/logstash/pipeline.so/1114_preprocess_bro_software.conf
|
||||
/usr/share/logstash/pipeline.so/1115_preprocess_bro_ssh.conf
|
||||
/usr/share/logstash/pipeline.so/1116_preprocess_bro_ssl.conf
|
||||
/usr/share/logstash/pipeline.so/1117_preprocess_bro_syslog.conf
|
||||
/usr/share/logstash/pipeline.so/1118_preprocess_bro_tunnel.conf
|
||||
/usr/share/logstash/pipeline.so/1119_preprocess_bro_weird.conf
|
||||
/usr/share/logstash/pipeline.so/1121_preprocess_bro_mysql.conf
|
||||
/usr/share/logstash/pipeline.so/1122_preprocess_bro_socks.conf
|
||||
/usr/share/logstash/pipeline.so/1123_preprocess_bro_x509.conf
|
||||
/usr/share/logstash/pipeline.so/1124_preprocess_bro_intel.conf
|
||||
/usr/share/logstash/pipeline.so/1125_preprocess_bro_modbus.conf
|
||||
/usr/share/logstash/pipeline.so/1126_preprocess_bro_sip.conf
|
||||
/usr/share/logstash/pipeline.so/1127_preprocess_bro_radius.conf
|
||||
/usr/share/logstash/pipeline.so/1128_preprocess_bro_pe.conf
|
||||
/usr/share/logstash/pipeline.so/1129_preprocess_bro_rfb.conf
|
||||
/usr/share/logstash/pipeline.so/1130_preprocess_bro_dnp3.conf
|
||||
/usr/share/logstash/pipeline.so/1131_preprocess_bro_smb_files.conf
|
||||
/usr/share/logstash/pipeline.so/1132_preprocess_bro_smb_mapping.conf
|
||||
/usr/share/logstash/pipeline.so/1133_preprocess_bro_ntlm.conf
|
||||
/usr/share/logstash/pipeline.so/1134_preprocess_bro_dce_rpc.conf
|
||||
/usr/share/logstash/pipeline.so/8001_postprocess_common_ip_augmentation.conf
|
||||
/usr/share/logstash/pipeline.dynamic/9997_output_helix.conf
|
||||
18
salt/logstash/conf/conf.enabled.txt.so-master
Normal file
18
salt/logstash/conf/conf.enabled.txt.so-master
Normal file
@@ -0,0 +1,18 @@
|
||||
# This is where can specify which LogStash configs get loaded.
|
||||
#
|
||||
# The custom folder on the master gets automatically synced to each logstash
|
||||
# node.
|
||||
#
|
||||
# To enable a custom configuration see the following example and uncomment:
|
||||
# /usr/share/logstash/pipeline.custom/1234_input_custom.conf
|
||||
##
|
||||
# All of the defaults are loaded.
|
||||
/usr/share/logstash/pipeline.so/0000_input_syslogng.conf
|
||||
/usr/share/logstash/pipeline.so/0001_input_json.conf
|
||||
/usr/share/logstash/pipeline.so/0002_input_windows_json.conf
|
||||
/usr/share/logstash/pipeline.so/0003_input_syslog.conf
|
||||
/usr/share/logstash/pipeline.so/0005_input_suricata.conf
|
||||
#/usr/share/logstash/pipeline.dynamic/0006_input_beats.conf
|
||||
/usr/share/logstash/pipeline.dynamic/0010_input_hhbeats.conf
|
||||
/usr/share/logstash/pipeline.so/0007_input_import.conf
|
||||
/usr/share/logstash/pipeline.dynamic/9999_output_redis.conf
|
||||
18
salt/logstash/conf/conf.enabled.txt.so-mastersearch
Normal file
18
salt/logstash/conf/conf.enabled.txt.so-mastersearch
Normal file
@@ -0,0 +1,18 @@
|
||||
# This is where can specify which LogStash configs get loaded.
|
||||
#
|
||||
# The custom folder on the master gets automatically synced to each logstash
|
||||
# node.
|
||||
#
|
||||
# To enable a custom configuration see the following example and uncomment:
|
||||
# /usr/share/logstash/pipeline.custom/1234_input_custom.conf
|
||||
##
|
||||
# All of the defaults are loaded.
|
||||
/usr/share/logstash/pipeline.so/0000_input_syslogng.conf
|
||||
/usr/share/logstash/pipeline.so/0001_input_json.conf
|
||||
/usr/share/logstash/pipeline.so/0002_input_windows_json.conf
|
||||
/usr/share/logstash/pipeline.so/0003_input_syslog.conf
|
||||
/usr/share/logstash/pipeline.so/0005_input_suricata.conf
|
||||
#/usr/share/logstash/pipeline.dynamic/0006_input_beats.conf
|
||||
/usr/share/logstash/pipeline.dynamic/0010_input_hhbeats.conf
|
||||
/usr/share/logstash/pipeline.so/0007_input_import.conf
|
||||
/usr/share/logstash/pipeline.dynamic/9999_output_redis.conf
|
||||
228
salt/logstash/conf/pipelines/6000_bro.conf
Normal file
228
salt/logstash/conf/pipelines/6000_bro.conf
Normal file
@@ -0,0 +1,228 @@
|
||||
# Original Author: Justin Henderson
|
||||
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
|
||||
# Updated by: Doug Burks
|
||||
# Last Update: 2/10/2018
|
||||
#
|
||||
filter {
|
||||
if "bro" in [tags] {
|
||||
|
||||
# Bro logs have a high quality timestamp, so let's copy that to @timestamp.
|
||||
# Before we do, let's copy the existing logstash @timestamp to timestamp.
|
||||
mutate {
|
||||
add_field => { "logstash_timestamp" => "%{@timestamp}" }
|
||||
}
|
||||
mutate {
|
||||
convert => { "logstash_timestamp" => "string" }
|
||||
}
|
||||
mutate {
|
||||
convert => { "timestamp" => "string" }
|
||||
}
|
||||
# New Bro JSON logs use ISO8601 timestamps.
|
||||
# Old Bro TSV logs use UNIX timestamps.
|
||||
date {
|
||||
match => [ "timestamp", "ISO8601", "UNIX" ]
|
||||
}
|
||||
mutate {
|
||||
rename => { "logstash_timestamp" => "timestamp" }
|
||||
}
|
||||
|
||||
if [duration] == "-" {
|
||||
mutate {
|
||||
replace => [ "duration", "0" ]
|
||||
}
|
||||
}
|
||||
if [original_bytes] == "-" {
|
||||
mutate {
|
||||
replace => [ "original_bytes", "0" ]
|
||||
}
|
||||
}
|
||||
# If MissedBytes is unspecified set it to zero so it is an integer
|
||||
if [missed_bytes] == "-" {
|
||||
mutate {
|
||||
replace => [ "missed_bytes", "0" ]
|
||||
}
|
||||
}
|
||||
# If OriginalIPBytes is unspecified set it to zero so it is an integer
|
||||
if [original_ip_bytes] == "-" {
|
||||
mutate {
|
||||
replace => [ "original_ip_bytes", "0" ]
|
||||
}
|
||||
}
|
||||
# If RespondBytes is unspecified set it to zero so it is an integer
|
||||
if [respond_bytes] == "-" {
|
||||
mutate {
|
||||
replace => [ "respond_bytes", "0" ]
|
||||
}
|
||||
}
|
||||
# If RespondIPBytes is unspecified set it to zero so it is an integer
|
||||
if [respond_ip_bytes] == "-" {
|
||||
mutate {
|
||||
replace => [ "respond_ip_bytes", "0" ]
|
||||
}
|
||||
}
|
||||
if [request_body_length] == "-" {
|
||||
mutate {
|
||||
replace => [ "request_body_length", "0" ]
|
||||
}
|
||||
}
|
||||
if [response_body_length] == "-" {
|
||||
mutate {
|
||||
replace => [ "response_body_length", "0" ]
|
||||
}
|
||||
}
|
||||
if [source_port] == "-" {
|
||||
mutate {
|
||||
remove_field => ["source_port"]
|
||||
}
|
||||
}
|
||||
if [destination_port] == "-" {
|
||||
mutate {
|
||||
remove_field => ["destination_port"]
|
||||
}
|
||||
}
|
||||
if [virtual_host] == "-" {
|
||||
mutate {
|
||||
remove_field => ["virtual_host"]
|
||||
}
|
||||
}
|
||||
if [x_originating_ip] == "-" {
|
||||
mutate {
|
||||
remove_field => ["x_originating_ip"]
|
||||
}
|
||||
}
|
||||
if [basic_constraints_path_length] == "-" {
|
||||
mutate {
|
||||
remove_field => ["basic_constraints_path_length"]
|
||||
}
|
||||
}
|
||||
if [data_channel_source_ip] == "-" {
|
||||
mutate {
|
||||
remove_field => ["data_channel_source_ip"]
|
||||
}
|
||||
}
|
||||
if [data_channel_destination_ip] == "-" {
|
||||
mutate {
|
||||
remove_field => ["data_channel_destination_ip"]
|
||||
}
|
||||
}
|
||||
if [desktop_width] == "-" {
|
||||
mutate {
|
||||
remove_field => ["desktop_width"]
|
||||
}
|
||||
}
|
||||
if [desktop_height] == "-" {
|
||||
mutate {
|
||||
remove_field => ["desktop_height"]
|
||||
}
|
||||
}
|
||||
if [height] == "-" {
|
||||
mutate {
|
||||
remove_field => ["height"]
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
# I renamed conn_uids to uid so that it is easy to pivot to all things tied to a connection
|
||||
mutate {
|
||||
rename => [ "connection_uids", "uid" ]
|
||||
}
|
||||
# If total_bytes is set to "-" change it to 0 so it is an integer
|
||||
if [total_bytes] == "-" {
|
||||
mutate {
|
||||
replace => [ "total_bytes", "0" ]
|
||||
}
|
||||
}
|
||||
# If seen_bytes is set to "-" change it to 0 so it is an integer
|
||||
if [seen_bytes] == "-" {
|
||||
mutate {
|
||||
replace => [ "seen_bytes", "0" ]
|
||||
}
|
||||
}
|
||||
# If missing_bytes is set to "-" change it to 0 so it is an integer
|
||||
if [missing_bytes] == "-" {
|
||||
mutate {
|
||||
replace => [ "missing_bytes", "0" ]
|
||||
}
|
||||
}
|
||||
# If overflow_bytes is set to "-" change it to 0 so it is an integer
|
||||
if [overflow_bytes] == "-" {
|
||||
mutate {
|
||||
replace => [ "overflow_bytes", "0" ]
|
||||
}
|
||||
}
|
||||
if [dcc_file_size] == "-" {
|
||||
mutate {
|
||||
replace => [ "dcc_file_size", "0" ]
|
||||
}
|
||||
}
|
||||
if [authentication_attempts] == "-" {
|
||||
mutate {
|
||||
replace => [ "authentication_attempts", "0" ]
|
||||
}
|
||||
}
|
||||
if [file_size] == "-" {
|
||||
mutate {
|
||||
replace => [ "file_size", "0" ]
|
||||
}
|
||||
}
|
||||
if [original_ip_bytes] == "-" {
|
||||
mutate {
|
||||
replace => [ "original_ip_bytes", "0" ]
|
||||
}
|
||||
}
|
||||
|
||||
# I recommend changing the field types below to integer or floats so searches can do greater than or less than
|
||||
# and also so math functions can be ran against them
|
||||
mutate {
|
||||
convert => [ "bound_port", "integer" ]
|
||||
convert => [ "data_channel_destination_port", "integer" ]
|
||||
convert => [ "destination_port", "integer" ]
|
||||
convert => [ "depth", "integer" ]
|
||||
#convert => [ "duration", "float" ]
|
||||
convert => [ "info_code", "integer" ]
|
||||
convert => [ "missed_bytes", "integer" ]
|
||||
convert => [ "missing_bytes", "integer" ]
|
||||
convert => [ "n", "integer" ]
|
||||
convert => [ "original_bytes", "integer" ]
|
||||
convert => [ "original_packets", "integer" ]
|
||||
convert => [ "original_ip_bytes", "integer" ]
|
||||
convert => [ "overflow_bytes", "integer" ]
|
||||
convert => [ "p", "integer" ]
|
||||
convert => [ "query_class", "integer" ]
|
||||
convert => [ "query_type", "integer" ]
|
||||
convert => [ "rcode", "integer" ]
|
||||
convert => [ "request_body_length", "integer" ]
|
||||
convert => [ "request_port", "integer" ]
|
||||
convert => [ "respond_bytes", "integer" ]
|
||||
convert => [ "respond_packets", "integer" ]
|
||||
convert => [ "respond_ip_bytes", "integer" ]
|
||||
convert => [ "response_body_length", "integer" ]
|
||||
convert => [ "seen_bytes", "integer" ]
|
||||
convert => [ "source_port", "integer" ]
|
||||
convert => [ "status_code", "integer" ]
|
||||
#convert => [ "suppress_for", "float" ]
|
||||
convert => [ "total_bytes", "integer" ]
|
||||
convert => [ "trans_depth", "integer" ]
|
||||
convert => [ "transaction_id", "integer" ]
|
||||
# convert the following boolean to text for now
|
||||
convert => [ "local_respond", "string" ]
|
||||
convert => [ "tc", "string" ]
|
||||
convert => [ "is_orig", "string" ]
|
||||
convert => [ "local_orig", "string" ]
|
||||
lowercase => [ "query" ]
|
||||
#remove_field => [ "timestamp" ]
|
||||
}
|
||||
|
||||
# Combine OriginalBytes and RespondBytes and save the value to total_bytes
|
||||
if [original_bytes] {
|
||||
if [respond_bytes] {
|
||||
ruby {
|
||||
code => "event.set('total_bytes', event.get('original_bytes') + event.get('respond_bytes'))"
|
||||
}
|
||||
}
|
||||
}
|
||||
mutate {
|
||||
#add_tag => [ "conf_file_6000"]
|
||||
}
|
||||
}
|
||||
}
|
||||
16
salt/logstash/conf/pipelines/6001_bro_import.conf
Normal file
16
salt/logstash/conf/pipelines/6001_bro_import.conf
Normal file
@@ -0,0 +1,16 @@
|
||||
# Updated by: Doug Burks
|
||||
# Last Update: 2/10/2018
|
||||
#
|
||||
filter {
|
||||
if "import" in [tags] and "bro" in [tags] {
|
||||
|
||||
# we're setting timestamp in 6000 now
|
||||
#date {
|
||||
# match => [ "timestamp", "UNIX" ]
|
||||
#}
|
||||
|
||||
mutate {
|
||||
#add_tag => [ "conf_file_6001"]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,17 @@
|
||||
# Author: Justin Henderson
|
||||
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
|
||||
# Email: justin@hasecuritysolution.com
|
||||
# Last Update: 12/9/2016
|
||||
|
||||
filter {
|
||||
if "bro" in [tags] {
|
||||
if "_grokparsefailure" not in [tags] and "_csvparsefailure" not in [tags] and "_jsonparsefailure" not in [tags] {
|
||||
#mutate {
|
||||
# remove_field => [ "message" ]
|
||||
#}
|
||||
}
|
||||
mutate {
|
||||
#add_tag => [ "conf_file_8000"]
|
||||
}
|
||||
}
|
||||
}
|
||||
47
salt/logstash/conf/pipelines/8006_postprocess_dns.conf
Normal file
47
salt/logstash/conf/pipelines/8006_postprocess_dns.conf
Normal file
@@ -0,0 +1,47 @@
|
||||
# Original Author: Justin Henderson
|
||||
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
|
||||
# Updated by: Doug Burks
|
||||
# Last Update: 5/13/2017
|
||||
|
||||
filter {
|
||||
if [type] == "bro_dns" or "dns" in [tags] {
|
||||
# Used for whois lookups - can create log loop
|
||||
if [query] =~ "^whois\." {
|
||||
drop { }
|
||||
}
|
||||
# REPLACE test.int with your internal domain
|
||||
if [query] and [query] !~ "\.test\.int$" {
|
||||
mutate {
|
||||
lowercase => [ "query" ]
|
||||
}
|
||||
if [query_type_name] != "NB" and [query_type_name] != "TKEY" and [query_type_name] != "NBSTAT" and [query_type_name] != "PTR" {
|
||||
tld {
|
||||
source => "query"
|
||||
}
|
||||
ruby {
|
||||
code => "event.set('query_length', event.get('query').length)"
|
||||
}
|
||||
mutate {
|
||||
rename => { "[SubLog][sessionid]" => "sub_session_id" }
|
||||
rename => { "[tld][domain]" => "highest_registered_domain" }
|
||||
rename => { "[tld][trd]" => "subdomain" }
|
||||
rename => { "[tld][tld]" => "top_level_domain" }
|
||||
rename => { "[tld][sld]" => "parent_domain" }
|
||||
}
|
||||
if [parent_domain] {
|
||||
ruby {
|
||||
code => "event.set('parent_domain_length', event.get('parent_domain').length)"
|
||||
}
|
||||
}
|
||||
if [subdomain] {
|
||||
ruby {
|
||||
code => "event.set('subdomain_length', event.get('subdomain').length)"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
mutate {
|
||||
#add_tag => [ "conf_file_8006"]
|
||||
}
|
||||
}
|
||||
}
|
||||
204
salt/logstash/conf/pipelines/eval/0800_input_eval.conf
Normal file
204
salt/logstash/conf/pipelines/eval/0800_input_eval.conf
Normal file
@@ -0,0 +1,204 @@
|
||||
# Updated by: Mike Reeves
|
||||
# Last Update: 11/1/2018
|
||||
|
||||
input {
|
||||
file {
|
||||
path => "/suricata/eve.json"
|
||||
type => "ids"
|
||||
add_field => { "engine" => "suricata" }
|
||||
}
|
||||
file {
|
||||
path => "/nsm/zeek/logs/current/conn*.log"
|
||||
type => "bro_conn"
|
||||
tags => ["bro"]
|
||||
}
|
||||
file {
|
||||
path => "/nsm/zeek/logs/current/dce_rpc*.log"
|
||||
type => "bro_dce_rpc"
|
||||
tags => ["bro"]
|
||||
}
|
||||
file {
|
||||
path => "/nsm/zeek/logs/current/dhcp*.log"
|
||||
type => "bro_dhcp"
|
||||
tags => ["bro"]
|
||||
}
|
||||
file {
|
||||
path => "/nsm/zeek/logs/current/dnp3*.log"
|
||||
type => "bro_dnp3"
|
||||
tags => ["bro"]
|
||||
}
|
||||
file {
|
||||
path => "/nsm/zeek/logs/current/dns*.log"
|
||||
type => "bro_dns"
|
||||
tags => ["bro"]
|
||||
}
|
||||
file {
|
||||
path => "/nsm/zeek/logs/current/dpd*.log"
|
||||
type => "bro_dpd"
|
||||
tags => ["bro"]
|
||||
}
|
||||
file {
|
||||
path => "/nsm/zeek/logs/current/files*.log"
|
||||
type => "bro_files"
|
||||
tags => ["bro"]
|
||||
}
|
||||
file {
|
||||
path => "/nsm/zeek/logs/current/ftp*.log"
|
||||
type => "bro_ftp"
|
||||
tags => ["bro"]
|
||||
}
|
||||
file {
|
||||
path => "/nsm/zeek/logs/current/http*.log"
|
||||
type => "bro_http"
|
||||
tags => ["bro"]
|
||||
}
|
||||
file {
|
||||
path => "/nsm/zeek/logs/current/intel*.log"
|
||||
type => "bro_intel"
|
||||
tags => ["bro"]
|
||||
}
|
||||
file {
|
||||
path => "/nsm/zeek/logs/current/irc*.log"
|
||||
type => "bro_irc"
|
||||
tags => ["bro"]
|
||||
}
|
||||
file {
|
||||
path => "/nsm/zeek/logs/current/kerberos*.log"
|
||||
type => "bro_kerberos"
|
||||
tags => ["bro"]
|
||||
}
|
||||
file {
|
||||
path => "/nsm/zeek/logs/current/modbus*.log"
|
||||
type => "bro_modbus"
|
||||
tags => ["bro"]
|
||||
}
|
||||
file {
|
||||
path => "/nsm/zeek/logs/current/mysql*.log"
|
||||
type => "bro_mysql"
|
||||
tags => ["bro"]
|
||||
}
|
||||
file {
|
||||
path => "/nsm/zeek/logs/current/notice*.log"
|
||||
type => "bro_notice"
|
||||
tags => ["bro"]
|
||||
}
|
||||
file {
|
||||
path => "/nsm/zeek/logs/current/ntlm*.log"
|
||||
type => "bro_ntlm"
|
||||
tags => ["bro"]
|
||||
}
|
||||
file {
|
||||
path => "/nsm/zeek/logs/current/pe*.log"
|
||||
type => "bro_pe"
|
||||
tags => ["bro"]
|
||||
}
|
||||
file {
|
||||
path => "/nsm/zeek/logs/current/radius*.log"
|
||||
type => "bro_radius"
|
||||
tags => ["bro"]
|
||||
}
|
||||
file {
|
||||
path => "/nsm/zeek/logs/current/rdp*.log"
|
||||
type => "bro_rdp"
|
||||
tags => ["bro"]
|
||||
}
|
||||
file {
|
||||
path => "/nsm/zeek/logs/current/rfb*.log"
|
||||
type => "bro_rfb"
|
||||
tags => ["bro"]
|
||||
}
|
||||
file {
|
||||
path => "/nsm/zeek/logs/current/signatures*.log"
|
||||
type => "bro_signatures"
|
||||
tags => ["bro"]
|
||||
}
|
||||
file {
|
||||
path => "/nsm/zeek/logs/current/sip*.log"
|
||||
type => "bro_sip"
|
||||
tags => ["bro"]
|
||||
}
|
||||
file {
|
||||
path => "/nsm/zeek/logs/current/smb_files*.log"
|
||||
type => "bro_smb_files"
|
||||
tags => ["bro"]
|
||||
}
|
||||
file {
|
||||
path => "/nsm/zeek/logs/current/smb_mapping*.log"
|
||||
type => "bro_smb_mapping"
|
||||
tags => ["bro"]
|
||||
}
|
||||
file {
|
||||
path => "/nsm/zeek/logs/current/smtp*.log"
|
||||
type => "bro_smtp"
|
||||
tags => ["bro"]
|
||||
}
|
||||
file {
|
||||
path => "/nsm/zeek/logs/current/snmp*.log"
|
||||
type => "bro_snmp"
|
||||
tags => ["bro"]
|
||||
}
|
||||
file {
|
||||
path => "/nsm/zeek/logs/current/socks*.log"
|
||||
type => "bro_socks"
|
||||
tags => ["bro"]
|
||||
}
|
||||
file {
|
||||
path => "/nsm/zeek/logs/current/software*.log"
|
||||
type => "bro_software"
|
||||
tags => ["bro"]
|
||||
}
|
||||
file {
|
||||
path => "/nsm/zeek/logs/current/ssh*.log"
|
||||
type => "bro_ssh"
|
||||
tags => ["bro"]
|
||||
}
|
||||
file {
|
||||
path => "/nsm/zeek/logs/current/ssl*.log"
|
||||
type => "bro_ssl"
|
||||
tags => ["bro"]
|
||||
}
|
||||
file {
|
||||
path => "/nsm/zeek/logs/current/syslog*.log"
|
||||
type => "bro_syslog"
|
||||
tags => ["bro"]
|
||||
}
|
||||
file {
|
||||
path => "/nsm/zeek/logs/current/tunnel*.log"
|
||||
type => "bro_tunnels"
|
||||
tags => ["bro"]
|
||||
}
|
||||
file {
|
||||
path => "/nsm/zeek/logs/current/weird*.log"
|
||||
type => "bro_weird"
|
||||
tags => ["bro"]
|
||||
}
|
||||
file {
|
||||
path => "/nsm/zeek/logs/current/x509*.log"
|
||||
type => "bro_x509"
|
||||
tags => ["bro"]
|
||||
}
|
||||
file {
|
||||
path => "/wazuh/alerts/alerts.json"
|
||||
type => "ossec"
|
||||
}
|
||||
file {
|
||||
path => "/wazuh/archives/archives.json"
|
||||
type => "ossec_archive"
|
||||
}
|
||||
file {
|
||||
path => "/osquery/logs/result.log"
|
||||
type => "osquery"
|
||||
tags => ["osquery"]
|
||||
}
|
||||
file {
|
||||
path => "/strelka/strelka.log"
|
||||
type => "strelka"
|
||||
}
|
||||
}
|
||||
filter {
|
||||
if "import" in [tags] {
|
||||
mutate {
|
||||
#add_tag => [ "conf_file_0007"]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,13 @@
|
||||
# Author: Justin Henderson
|
||||
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
|
||||
# Email: justin@hasecuritysolution.com
|
||||
# Last Update: 12/9/2016
|
||||
|
||||
filter {
|
||||
ruby {
|
||||
code => "event.set('task_start', Time.now.to_f)"
|
||||
}
|
||||
mutate {
|
||||
#add_tag => [ "conf_file_1000"]
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,33 @@
|
||||
# Updated by: Doug Burks and Wes Lambert
|
||||
# Last Update: 10/30/2018
|
||||
|
||||
filter {
|
||||
if "syslogng" in [tags] {
|
||||
mutate {
|
||||
rename => { "MESSAGE" => "message" }
|
||||
rename => { "PROGRAM" => "type" }
|
||||
rename => { "FACILITY" => "syslog-facility" }
|
||||
rename => { "FILE_NAME" => "syslog-file_name" }
|
||||
rename => { "HOST" => "syslog-host" }
|
||||
rename => { "HOST_FROM" => "syslog-host_from" }
|
||||
rename => { "LEGACY_MSGHDR" => "syslog-legacy_msghdr" }
|
||||
rename => { "PID" => "syslog-pid" }
|
||||
rename => { "PRIORITY" => "syslog-priority" }
|
||||
rename => { "SOURCEIP" => "syslog-sourceip" }
|
||||
rename => { "TAGS" => "syslog-tags" }
|
||||
lowercase => [ "syslog-host_from" ]
|
||||
remove_field => [ "ISODATE" ]
|
||||
remove_field => [ "SEQNUM" ]
|
||||
#add_tag => [ "conf_file_1001"]
|
||||
}
|
||||
if "bro_" in [type] {
|
||||
mutate {
|
||||
add_tag => [ "bro" ]
|
||||
}
|
||||
} else if [type] !~ /ossec.*|snort/ and "firewall" not in [tags] {
|
||||
mutate {
|
||||
add_tag => [ "syslog" ]
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
18
salt/logstash/conf/pipelines/eval/1002_preprocess_json.conf
Normal file
18
salt/logstash/conf/pipelines/eval/1002_preprocess_json.conf
Normal file
@@ -0,0 +1,18 @@
|
||||
# Author: Justin Henderson
|
||||
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
|
||||
# Email: justin@hasecuritysolution.com
|
||||
# Last Update: 12/9/2016
|
||||
|
||||
filter {
|
||||
if "json" in [tags]{
|
||||
json {
|
||||
source => "message"
|
||||
}
|
||||
mutate {
|
||||
remove_tag => [ "json" ]
|
||||
}
|
||||
mutate {
|
||||
#add_tag => [ "conf_file_1002"]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,19 @@
|
||||
filter {
|
||||
if "syslog" in [tags] {
|
||||
if [host] == "172.16.1.1" {
|
||||
mutate {
|
||||
add_field => { "type" => "fortinet" }
|
||||
add_tag => [ "firewall" ]
|
||||
}
|
||||
}
|
||||
if [host] == "10.0.0.101" {
|
||||
mutate {
|
||||
add_field => { "type" => "brocade" }
|
||||
add_tag => [ "switch" ]
|
||||
}
|
||||
}
|
||||
mutate {
|
||||
#add_tag => [ "conf_file_1004"]
|
||||
}
|
||||
}
|
||||
}
|
||||
140
salt/logstash/conf/pipelines/eval/1026_preprocess_dhcp.conf
Normal file
140
salt/logstash/conf/pipelines/eval/1026_preprocess_dhcp.conf
Normal file
@@ -0,0 +1,140 @@
|
||||
# Author: Justin Henderson
|
||||
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
|
||||
# Email: justin@hasecuritysolutions.com
|
||||
# Last Update: 12/9/2016
|
||||
# This conf file is based on accepting logs for DHCP. It is currently based on Windows DHCP only.
|
||||
filter {
|
||||
if [type] == "dhcp" {
|
||||
mutate {
|
||||
add_field => { "Hostname" => "%{host}" }
|
||||
}
|
||||
mutate {
|
||||
strip => "message"
|
||||
}
|
||||
# This is the initial parsing of the log
|
||||
grok {
|
||||
# Server 2008+
|
||||
match => { "message" => "%{DATA:id},%{DATE_US:date},(?<time>%{HOUR}:%{MINUTE}:%{SECOND}),%{DATA:description},%{IPV4:ip},%{DATA:Hostname},%{DATA:mac},%{DATA:Username},%{INT:TransactionID},%{INT:QResult},%{DATA:ProbationTime},%{DATA:CorrelationID}"}
|
||||
# Server 2003
|
||||
match => { "message" => "%{DATA:id},%{DATE_US:date},(?<time>%{HOUR}:%{MINUTE}:%{SECOND}),%{DATA:description},%{IPV4:ip},%{DATA:Hostname},%{DATA:mac},"}
|
||||
match => { "message" => "%{DATA:id},%{DATA:date},(?<time>%{HOUR}:%{MINUTE}:%{SECOND}),%{DATA:description},%{DATA:ip},%{DATA:Hostname},%{DATA:mac},"}
|
||||
}
|
||||
# This section below translates the message ID into something humans can understand.
|
||||
if [id] == "00" {
|
||||
mutate {
|
||||
add_field => [ "event", "The log was started"]
|
||||
}
|
||||
}
|
||||
if [id] == "01" {
|
||||
mutate {
|
||||
add_field => [ "event", "The log was stopped"]
|
||||
}
|
||||
}
|
||||
if [id] == "02" {
|
||||
mutate {
|
||||
add_field => [ "event", "The log was temporarily paused due to low disk space"]
|
||||
}
|
||||
}
|
||||
if [id] == "10" {
|
||||
mutate {
|
||||
add_field => [ "event", "A new IP address was leased to a client"]
|
||||
}
|
||||
}
|
||||
if [id] == "11" {
|
||||
mutate {
|
||||
add_field => [ "event", "A lease was renewed by a client"]
|
||||
}
|
||||
}
|
||||
if [id] == "12" {
|
||||
mutate {
|
||||
add_field => [ "event", "A lease was released by a client"]
|
||||
}
|
||||
}
|
||||
if [id] == "13" {
|
||||
mutate {
|
||||
add_field => [ "event", "An IP address was found to be in use on the network"]
|
||||
}
|
||||
}
|
||||
if [id] == "14" {
|
||||
mutate {
|
||||
add_field => [ "event", "A lease request could not be satisfied because the scope's address pool was exhausted"]
|
||||
}
|
||||
}
|
||||
if [id] == "15" {
|
||||
mutate {
|
||||
add_field => [ "event", "A lease was denied"]
|
||||
}
|
||||
}
|
||||
if [id] == "16" {
|
||||
mutate {
|
||||
add_field => [ "event", "A lease was deleted"]
|
||||
}
|
||||
}
|
||||
if [id] == "17" {
|
||||
mutate {
|
||||
add_field => [ "event", "A lease was expired and DNS records for an expired leases have not been deleted"]
|
||||
}
|
||||
}
|
||||
if [id] == "18" {
|
||||
mutate {
|
||||
add_field => [ "event", "A lease was expired and DNS records were deleted"]
|
||||
}
|
||||
}
|
||||
if [id] == "20" {
|
||||
mutate {
|
||||
add_field => [ "event", "A BOOTP address was leased to a client"]
|
||||
}
|
||||
}
|
||||
if [id] == "21" {
|
||||
mutate {
|
||||
add_field => [ "event", "A dynamic BOOTP address was leased to a client"]
|
||||
}
|
||||
}
|
||||
if [id] == "22" {
|
||||
mutate {
|
||||
add_field => [ "event", "A BOOTP request could not be satisfied because the scope's address pool for BOOTP was exhausted"]
|
||||
}
|
||||
}
|
||||
if [id] == "23" {
|
||||
mutate {
|
||||
add_field => [ "event", "A BOOTP IP address was deleted after checking to see it was not in use"]
|
||||
}
|
||||
}
|
||||
if [id] == "24" {
|
||||
mutate {
|
||||
add_field => [ "event", "IP address cleanup operation has began"]
|
||||
}
|
||||
}
|
||||
if [id] == "25" {
|
||||
mutate {
|
||||
add_field => [ "event", "IP address cleanup statistics"]
|
||||
}
|
||||
}
|
||||
if [id] == "30" {
|
||||
mutate {
|
||||
add_field => [ "event", "DNS update request to the named DNS server"]
|
||||
}
|
||||
}
|
||||
if [id] == "31" {
|
||||
mutate {
|
||||
add_field => [ "event", "DNS update failed"]
|
||||
}
|
||||
}
|
||||
if [id] == "32" {
|
||||
mutate {
|
||||
add_field => [ "event", "DNS update successful"]
|
||||
}
|
||||
}
|
||||
if [id] == "33" {
|
||||
mutate {
|
||||
add_field => [ "event", "Packet dropped due to NAP policy"]
|
||||
}
|
||||
}
|
||||
# If the message failed to parse correctly keep the message for debugging. Otherwise, drop it.
|
||||
#if "_grokparsefailure" not in [tags] {
|
||||
# mutate {
|
||||
# remove_field => [ "message"]
|
||||
# }
|
||||
#}
|
||||
}
|
||||
}
|
||||
31
salt/logstash/conf/pipelines/eval/1029_preprocess_esxi.conf
Normal file
31
salt/logstash/conf/pipelines/eval/1029_preprocess_esxi.conf
Normal file
@@ -0,0 +1,31 @@
|
||||
# Author: Justin Henderson
|
||||
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
|
||||
# Email: justin@hasecuritysolution.com
|
||||
# Last Update: 12/9/2016
|
||||
#
|
||||
# This configuration file takes ESXi syslog messages and filters them. There is no input as the logs would have came in via syslog
|
||||
filter {
|
||||
# This is an example of using an IP address range to classify a syslog message to a specific type of log
|
||||
# This is helpful as so many devices only send logs via syslog
|
||||
if [host] =~ "10\.[0-1]\.9\." {
|
||||
mutate {
|
||||
replace => ["type", "esxi"]
|
||||
}
|
||||
}
|
||||
if [host] =~ "\.234$" {
|
||||
mutate {
|
||||
replace => ["type", "esxi"]
|
||||
}
|
||||
}
|
||||
if [type] == "esxi" {
|
||||
grok {
|
||||
match => { "message" => "(?:%{SYSLOGTIMESTAMP:timestamp}|%{TIMESTAMP_ISO8601:timestamp8601}) (?:%{SYSLOGHOST:logsource}) (?:%{SYSLOGPROG}): (?<messagebody>(?:\[(?<esxi_thread_id>[0-9A-Z]{8,8}) %{DATA:esxi_loglevel} \'%{DATA:esxi_service}\'\] %{GREEDYDATA:esxi_message}|%{GREEDYDATA}))"}
|
||||
|
||||
# pattern => ['(?:%{SYSLOGTIMESTAMP:timestamp}|%{TIMESTAMP_ISO8601:timestamp8601}) (?:%{SYSLOGHOST:logsource}) (?:%{SYSLOGPROG}): (?<messagebody>(?:\[(?<esxi_thread_id>[0-9A-Z]{8,8}) %{DATA:esxi_loglevel} \'%{DATA:esxi_service}\'\] %{GREEDYDATA:esxi_message}|%{GREEDYDATA}))']
|
||||
}
|
||||
mutate {
|
||||
#add_tag => [ "conf_file_1029"]
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -0,0 +1,21 @@
|
||||
# Author: Justin Henderson
|
||||
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
|
||||
# Email: justin@hasecuritysolution.com
|
||||
# Last Update: 12/9/2016
|
||||
|
||||
filter {
|
||||
if [type] == "greensql" {
|
||||
# This section is parsing out the fields for GreenSQL syslog data
|
||||
grok {
|
||||
match => { "message" => "<%{INT:Code}>%{DATA:Category}\[%{INT:Transcation}\]:\s*Database=%{DATA:Database}\sUser=%{DATA:UserName}\sApplication Name=%{DATA:Application}\sSource IP=%{IPV4:SrcIp}\sSource Port=%{INT:SrcPort}\sTarget IP=?%{IPV4:DstIp}\sTarget Port=%{DATA:DstPort}\sQuery=%{GREEDYDATA:Query}"}
|
||||
match => { "message" => "<%{INT:Code}>%{DATA:Category}\[%{INT:Transcation}\]:\sAdmin_Name=%{DATA:UserName}\sIP_Address=%{IPV4:SrcIp}\sUser_Agent=%{DATA:UserAgent}\sMessage=%{DATA:StatusMessage}\sDescription=%{DATA:Description}\sSeverity=%{GREEDYDATA:Severity}"}
|
||||
}
|
||||
# Remove the message field as it is unnecessary
|
||||
#mutate {
|
||||
# remove_field => [ "message"]
|
||||
#}
|
||||
mutate {
|
||||
#add_tag => [ "conf_file_1030"]
|
||||
}
|
||||
}
|
||||
}
|
||||
21
salt/logstash/conf/pipelines/eval/1031_preprocess_iis.conf
Normal file
21
salt/logstash/conf/pipelines/eval/1031_preprocess_iis.conf
Normal file
@@ -0,0 +1,21 @@
|
||||
# Author: Justin Henderson
|
||||
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
|
||||
# Email: justin@hasecuritysolution.com
|
||||
# Last Update: 12/9/2016
|
||||
|
||||
filter {
|
||||
if [type] == "iis" {
|
||||
# The log is expected to have come from NXLog and in JSON format. This allows for automatic parsing of fields
|
||||
json {
|
||||
source => "message"
|
||||
}
|
||||
# This removes the message field as it is unneccesary and tags the packet as web
|
||||
mutate {
|
||||
# remove_field => [ "message"]
|
||||
add_tag => [ "web" ]
|
||||
}
|
||||
mutate {
|
||||
#add_tag => [ "conf_file_1031"]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,26 @@
|
||||
# Author: Justin Henderson
|
||||
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
|
||||
# Email: justin@hasecuritysolution.com
|
||||
# Last Update: 12/9/2016
|
||||
#
|
||||
# This file looks for McAfee EPO logs
|
||||
filter {
|
||||
if [type] == "mcafee" {
|
||||
# NXLog should be sending the logs in JSON format so they auto parse
|
||||
json {
|
||||
source => "message"
|
||||
}
|
||||
# This section converts the UTC fields to the proper time format
|
||||
date {
|
||||
match => [ "ReceivedUTC", "YYYY-MM-dd HH:mm:ss" ]
|
||||
target => [ "ReceivedUTC" ]
|
||||
}
|
||||
date {
|
||||
match => [ "DetectedUTC", "YYYY-MM-dd HH:mm:ss" ]
|
||||
target => [ "DetectedUTC" ]
|
||||
}
|
||||
mutate {
|
||||
#add_tag => [ "conf_file_1032"]
|
||||
}
|
||||
}
|
||||
}
|
||||
181
salt/logstash/conf/pipelines/eval/1033_preprocess_snort.conf
Normal file
181
salt/logstash/conf/pipelines/eval/1033_preprocess_snort.conf
Normal file
@@ -0,0 +1,181 @@
|
||||
# Author: Justin Henderson
|
||||
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
|
||||
# Updated by: Doug Burks
|
||||
# Last Update: 3/15/2018
|
||||
|
||||
filter {
|
||||
if [type] == "ids" {
|
||||
# This is the initial parsing of the log
|
||||
if [engine] == "suricata" {
|
||||
json {
|
||||
source => "message"
|
||||
}
|
||||
mutate {
|
||||
rename => { "alert" => "orig_alert" }
|
||||
rename => { "[orig_alert][gid]" => "gid" }
|
||||
rename => { "[orig_alert][signature_id]" => "sid" }
|
||||
rename => { "[orig_alert][rev]" => "rev" }
|
||||
rename => { "[orig_alert][signature]" => "alert" }
|
||||
rename => { "[orig_alert][category]" => "classification" }
|
||||
rename => { "[orig_alert][severity]" => "priority" }
|
||||
rename => { "[orig_alert][rule]" => "rule_signature" }
|
||||
rename => { "app_proto" => "application_protocol" }
|
||||
rename => { "dest_ip" => "destination_ip" }
|
||||
rename => { "dest_port" => "destination_port" }
|
||||
rename => { "in_iface" => "interface" }
|
||||
rename => { "proto" => "protocol" }
|
||||
rename => { "src_ip" => "source_ip" }
|
||||
rename => { "src_port" => "source_port" }
|
||||
#rename => { "[fileinfo][filename]" => "filename" }
|
||||
#rename => { "[fileinfo][gaps]" => "gaps" }
|
||||
#rename => { "[fileinfo][size]" => "size" }
|
||||
#rename => { "[fileinfo][state]" => "state" }
|
||||
#rename => { "[fileinfo][stored]" => "stored" }
|
||||
#rename => { "[fileinfo][tx_id]" => "tx_id" }
|
||||
#rename => { "[flow][age]" => "duration" }
|
||||
#rename => { "[flow][alerted]" => "flow_alerted" }
|
||||
#rename => { "[flow][bytes_toclient]" => "bytes_to_client" }
|
||||
#rename => { "[flow][bytes_toserver]" => "bytes_to_server" }
|
||||
#rename => { "[flow][end]" => "flow_end" }
|
||||
#rename => { "[flow][pkts_toclient]" => "packets_to_client" }
|
||||
#rename => { "[flow][pkts_toserver]" => "packets_to_server" }
|
||||
#rename => { "[flow][reason]" => "reason" }
|
||||
#rename => { "[flow][start]" => "flow_start" }
|
||||
#rename => { "[flow][state]" => "state" }
|
||||
#rename => { "[netflow][age]" => "duration" }
|
||||
#rename => { "[netflow][bytes]" => "bytes" }
|
||||
#rename => { "[netflow][end]" => "netflow_end" }
|
||||
#rename => { "[netflow][start]" => "netflow_start" }
|
||||
#rename => { "[netflow][pkts]" => "packets" }
|
||||
rename => { "[alert][action]" => "action" }
|
||||
rename => { "[alert][category]" => "category" }
|
||||
rename => { "[alert][gid]" => "gid" }
|
||||
rename => { "[alert][rev]" => "rev" }
|
||||
rename => { "[alert][severity]" => "severity" }
|
||||
rename => { "[alert][signature]" => "signature" }
|
||||
rename => { "[alert][signature_id]" => "sid" }
|
||||
#rename => { "[dns][aa]" => "aa" }
|
||||
#rename => { "[dns][flags]" => "flags" }
|
||||
#rename => { "[dns][id]" => "id" }
|
||||
#rename => { "[dns][qr]" => "qr" }
|
||||
#rename => { "[dns][rcode]" => "rcode_name" }
|
||||
#rename => { "[dns][rrname]" => "rrname" }
|
||||
#rename => { "[dns][rrtype]" => "rrtype" }
|
||||
#rename => { "[dns][tx_id]" => "tx_id" }
|
||||
#rename => { "[dns][type]" => "record_type" }
|
||||
#rename => { "[dns][version]" => "version" }
|
||||
rename => { "[http][hostname]" => "virtual_host" }
|
||||
rename => { "[http][http_content_type]" => "content_type" }
|
||||
rename => { "[http][http_port]" => "http_port" }
|
||||
rename => { "[http][http_method]" => "method" }
|
||||
rename => { "[http][http_user_agent]" => "useragent" }
|
||||
#rename => { "[http][length]" => "payload_length" }
|
||||
#rename => { "[http][protocol]" => "http_version" }
|
||||
rename => { "[http][status]" => "status_message" }
|
||||
rename => { "[http][url]" => "url" }
|
||||
#rename => { "[metadata][flowbits]" => "flowbits" }
|
||||
rename => { "[tls][fingerprint]" => "certificate_serial_number" }
|
||||
rename => { "[tls][issuerdn]" => "issuer_distinguished_name" }
|
||||
rename => { "[tls][notafter]" => "certificate_not_valid_after" }
|
||||
rename => { "[tls][notbefore]" => "certificate_not_valid_before" }
|
||||
rename => { "[tls][subject]" => "certificate_common_name" }
|
||||
rename => { "[tls][version]" => "tls_version" }
|
||||
rename => { "event_type" => "ids_event_type" }
|
||||
remove_field => [ "offset", "orig_alert", "beat", "input", "prospector" ]
|
||||
remove_tag => [ "beats_input_codec_plain_applied" ]
|
||||
add_tag => [ "eve" ]
|
||||
|
||||
}
|
||||
} else {
|
||||
grok {
|
||||
match => ["message", "\[%{INT:gid}:%{INT:sid}:%{INT:rev}\]\s%{DATA:alert}\[Classification:\s+%{DATA:classification}\]\s+\[Priority:\s+%{INT:priority}\]:\s+<%{DATA:interface}>\s+{%{DATA:protocol}}\s+(?:%{IPV4:source_ip}|%{IPV6:source_ip}):%{INT:source_port}\s+->\s+(?:%{IPV4:destination_ip}|%{IPV6:destination_ip}):%{INT:destination_port}",
|
||||
"message", "\[%{INT:gid}:%{INT:sid}:%{INT:rev}\]\s%{DATA:alert}\[Classification:\s+%{DATA:classification}\]\s+\[Priority:\s+%{INT:priority}\]:\s+<%{DATA:interface}>\s+{%{DATA:protocol}}\s(?:%{IPV4:source_ip}|%{IPV6:source_ip})\s+->\s+(?:%{IPV4:destination_ip}|%{IPV6:destination_ip})",
|
||||
"message", "\[%{INT:gid}:%{INT:sid}:%{INT:rev}\]\s%{DATA:alert}\[Classification:\s+%{DATA:classification}\]\s+\[Priority:\s+%{INT:priority}\]:\s+{%{DATA:protocol}}\s+(?:%{IPV4:source_ip}|%{IPV6:source_ip}):%{INT:source_port}\s+->\s+%{IPV4:destination_ip}:%{INT:destination_port}",
|
||||
"message", "\[%{INT:gid}:%{INT:sid}:%{INT:rev}\]\s%{DATA:alert}\[Classification:\s+%{DATA:classification}\]\s+\[Priority:\s+%{INT:priority}\]:\s+{%{DATA:protocol}}\s(?:%{IPV4:source_ip}|%{IPV6:source_ip})\s+->\s+(?:%{IPV4:destination_ip}|%{IPV6:destination_ip})",
|
||||
"message", "\[%{INT:gid}:%{INT:sid}:%{INT:rev}\]\s%{DATA:alert}\[Classification:\s+%{DATA:classification}\]\s+\[Priority:\s+%{INT:priority}\]:\s+{%{DATA:protocol}}\s+(?:%{IPV4:source_ip}|%{IPV6:source_ip}):%{INT:source_port}\s+->\s+(?:%{IPV4:destination_ip}|%{IPV6:destination_ip}):%{INT:destination_port}",
|
||||
"message", "\[%{INT:gid}:%{INT:sid}:%{INT:rev}\]\s%{DATA:alert}\[Classification:\s+%{DATA:classification}\]\s+\[Priority:\s+%{INT:priority}\]:\s+{%{DATA:protocol}}\s(?:%{IPV4:source_ip}|%{IPV6:source_ip})\s+->\s+(?:%{IPV4:source_ip}|%{IPV6:source_ip})",
|
||||
"message", "\[%{INT:gid}:%{INT:sid}:%{INT:rev}\]\s%{DATA:alert}\[Classification:\s+%{DATA:classification}\]\s+\[Priority:\s+%{INT:priority}\]:\s+{%{DATA:protocol}}",
|
||||
"message", "\A%{TIME} pid\(%{INT}\) Alert Received: %{INT} %{INT:priority} %{DATA:classification} %{DATA:interface} \{%{DATA:timestamp}} %{INT} %{INT} \{%{DATA:alert}} %{IP:source_ip} %{IP:destination_ip} %{INT:protocol} %{INT:source_port} %{INT:destination_port} %{INT:gid} %{INT:sid} %{INT:rev} %{INT} %{INT}\Z",
|
||||
"message", "%{GREEDYDATA:alert}"]
|
||||
}
|
||||
}
|
||||
if [timestamp] {
|
||||
mutate {
|
||||
add_field => { "logstash_timestamp" => "%{@timestamp}" }
|
||||
}
|
||||
mutate {
|
||||
convert => { "logstash_timestamp" => "string" }
|
||||
}
|
||||
date {
|
||||
match => [ "timestamp", "ISO8601" ]
|
||||
}
|
||||
mutate {
|
||||
rename => { "logstash_timestamp" => "timestamp" }
|
||||
}
|
||||
}
|
||||
|
||||
# If the alert is a Snort GPL alert break it apart for easier reading and categorization
|
||||
if [alert] =~ "GPL " {
|
||||
# This will parse out the category type from the alert
|
||||
grok {
|
||||
match => { "alert" => "GPL\s+%{DATA:category}\s" }
|
||||
}
|
||||
# This will store the category
|
||||
mutate {
|
||||
add_field => { "rule_type" => "Snort GPL" }
|
||||
lowercase => [ "category"]
|
||||
}
|
||||
}
|
||||
# If the alert is an Emerging Threat alert break it apart for easier reading and categorization
|
||||
if [alert] =~ "ET " {
|
||||
# This will parse out the category type from the alert
|
||||
grok {
|
||||
match => { "alert" => "ET\s+%{DATA:category}\s" }
|
||||
}
|
||||
# This will store the category
|
||||
mutate {
|
||||
add_field => { "rule_type" => "Emerging Threats" }
|
||||
lowercase => [ "category"]
|
||||
}
|
||||
}
|
||||
# I recommend changing the field types below to integer so searches can do greater than or less than
|
||||
# and also so math functions can be ran against them
|
||||
mutate {
|
||||
convert => [ "source_port", "integer" ]
|
||||
convert => [ "destination_port", "integer" ]
|
||||
convert => [ "gid", "integer" ]
|
||||
convert => [ "sid", "integer" ]
|
||||
# remove_field => [ "message"]
|
||||
}
|
||||
# This will translate the priority field into a severity field of either High, Medium, or Low
|
||||
if [priority] == 1 {
|
||||
mutate {
|
||||
add_field => { "severity" => "High" }
|
||||
}
|
||||
}
|
||||
if [priority] == 2 {
|
||||
mutate {
|
||||
add_field => { "severity" => "Medium" }
|
||||
}
|
||||
}
|
||||
if [priority] == 3 {
|
||||
mutate {
|
||||
add_field => { "severity" => "Low" }
|
||||
}
|
||||
}
|
||||
# This section adds URLs to lookup information about a rule online
|
||||
if [sid] and [sid] > 0 and [sid] < 1000000 {
|
||||
mutate {
|
||||
add_field => [ "signature_info", "https://www.snort.org/search?query=%{gid}-%{sid}" ]
|
||||
}
|
||||
}
|
||||
if [sid] and [sid] > 1999999 and [sid] < 2999999 {
|
||||
mutate {
|
||||
add_field => [ "signature_info", "http://doc.emergingthreats.net/%{sid}" ]
|
||||
}
|
||||
}
|
||||
# mutate {
|
||||
#add_tag => [ "conf_file_1033"]
|
||||
# }
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,16 @@
|
||||
# Author: Justin Henderson
|
||||
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
|
||||
# Updated by: Doug Burks
|
||||
# Last Update: 5/22/2017
|
||||
|
||||
filter {
|
||||
if [type] == "syslog" {
|
||||
# This drops syslog messages regarding license messages. You may want to comment it out.
|
||||
#if [message] =~ "license" {
|
||||
# drop { }
|
||||
#}
|
||||
mutate {
|
||||
#convert => [ "status_code", "integer" ]
|
||||
}
|
||||
}
|
||||
}
|
||||
59
salt/logstash/conf/pipelines/eval/2000_network_flow.conf
Normal file
59
salt/logstash/conf/pipelines/eval/2000_network_flow.conf
Normal file
@@ -0,0 +1,59 @@
|
||||
# Author: Justin Henderson
|
||||
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
|
||||
# Email: justin@hasecuritysolution.com
|
||||
# Last Update: 12/9/2016
|
||||
|
||||
filter {
|
||||
if [type] == "sflow" {
|
||||
if [message] =~ /CNTR/ {
|
||||
drop { }
|
||||
}
|
||||
|
||||
grok {
|
||||
match => { "message" => "%{WORD:sample_type},%{IP:sflow_source_ip},%{WORD:in_port:int},%{WORD:out_port:int},%{WORD:source_mac},%{WORD:destination_mac},%{WORD:ether_type},%{NUMBER:in_vlan:int},%{NUMBER:out_vlan:int},%{IP:source_ip},%{IP:destination_ip},%{NUMBER:protocol:int},%{WORD:type_of_service},%{WORD:ttl:int},%{NUMBER:source_port:int},%{NUMBER:destination_port:int},%{DATA:tcp_flags},%{NUMBER:packet_size:int},%{NUMBER:ip_size:int},%{NUMBER:sample_rate:int}" }
|
||||
}
|
||||
|
||||
if "_grokparsefailure" in [tags] {
|
||||
drop { }
|
||||
}
|
||||
|
||||
mutate {
|
||||
add_field => {
|
||||
"[source_hostname]" => "%{source_ip}"
|
||||
"[destination_hostname]" => "%{destination_ip}"
|
||||
"[sflow_source_hostname]" => "%{sflow_source_ip}"
|
||||
}
|
||||
}
|
||||
|
||||
translate {
|
||||
field => "[source_port]"
|
||||
destination => "[source_service]"
|
||||
dictionary_path => "/lib/dictionaries/iana_services.yaml"
|
||||
}
|
||||
|
||||
translate {
|
||||
field => "[destination_port]"
|
||||
destination => "[destination_service]"
|
||||
dictionary_path => "/lib/dictionaries/iana_services.yaml"
|
||||
}
|
||||
|
||||
translate {
|
||||
field => "[protocol]"
|
||||
destination => "[protocol_name]"
|
||||
dictionary_path => "/lib/dictionaries/iana_protocols.yaml"
|
||||
}
|
||||
|
||||
translate {
|
||||
field => "[tcp_flags]"
|
||||
destination => "[tcp_flag]"
|
||||
dictionary_path => "/lib/dictionaries/tcp_flags.yaml"
|
||||
}
|
||||
|
||||
mutate {
|
||||
add_field => { "ips" => [ "%{sflow_source_ip}" ] }
|
||||
}
|
||||
mutate {
|
||||
#add_tag => [ "conf_file_2000"]
|
||||
}
|
||||
}
|
||||
}
|
||||
11
salt/logstash/conf/pipelines/eval/6002_syslog.conf
Normal file
11
salt/logstash/conf/pipelines/eval/6002_syslog.conf
Normal file
@@ -0,0 +1,11 @@
|
||||
# Updated by: Doug Burks
|
||||
# Last Update: 5/16/2017
|
||||
#
|
||||
filter {
|
||||
if "syslog" in [tags] {
|
||||
mutate {
|
||||
#convert => [ "status_code", "integer" ]
|
||||
#add_tag => [ "conf_file_6002"]
|
||||
}
|
||||
}
|
||||
}
|
||||
33
salt/logstash/conf/pipelines/eval/6101_switch_brocade.conf
Normal file
33
salt/logstash/conf/pipelines/eval/6101_switch_brocade.conf
Normal file
@@ -0,0 +1,33 @@
|
||||
# Author: Justin Henderson
|
||||
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
|
||||
# Email: justin@hasecuritysolution.com
|
||||
# Last Update: 12/9/2016
|
||||
|
||||
filter {
|
||||
if [type] == "brocade" {
|
||||
grok {
|
||||
match => ["message", "<%{DATA}>%{GREEDYDATA:sys_message}"]
|
||||
}
|
||||
grok {
|
||||
match => { "sys_message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid:int}\])?: %{GREEDYDATA:syslog_message}" }
|
||||
add_field => [ "received_at", "%{@timestamp}" ]
|
||||
}
|
||||
if [syslog_message] =~ "Interface ethernet" or [syslog_program] == "PORT" {
|
||||
grok {
|
||||
match => { "syslog_message" => "%{DATA}%{INT:unit}\/%{INT:interface_type}\/%{INT:interface:int}" }
|
||||
}
|
||||
mutate {
|
||||
add_field => { "interface_port" => "%{unit}/%{interface_type}/%{interface}" }
|
||||
}
|
||||
}
|
||||
date {
|
||||
match => [ "syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss" ]
|
||||
timezone => "America/Chicago"
|
||||
remove_field => "syslog_timestamp"
|
||||
remove_field => "received_at"
|
||||
}
|
||||
mutate {
|
||||
#add_tag => [ "conf_file_6101"]
|
||||
}
|
||||
}
|
||||
}
|
||||
281
salt/logstash/conf/pipelines/eval/6200_firewall_fortinet.conf
Normal file
281
salt/logstash/conf/pipelines/eval/6200_firewall_fortinet.conf
Normal file
@@ -0,0 +1,281 @@
|
||||
# Author: Justin Henderson
|
||||
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
|
||||
# Email: justin@hasecuritysolution.com
|
||||
# Last Update: 12/9/2016
|
||||
|
||||
filter {
|
||||
if [type] == "fortinet" {
|
||||
mutate {
|
||||
gsub => [ "message", "= ", "=NA " ]
|
||||
}
|
||||
|
||||
grok {
|
||||
match => ["message", "type=%{DATA:event_type}\s+"]
|
||||
tag_on_failure => []
|
||||
}
|
||||
grok {
|
||||
match => ["message", "<%{DATA}>%{GREEDYDATA:kv}"]
|
||||
tag_on_failure => []
|
||||
}
|
||||
kv {
|
||||
source => "kv"
|
||||
exclude_keys => [ "type" ]
|
||||
}
|
||||
mutate {
|
||||
gsub => [ "log", "= ", "=NA " ]
|
||||
}
|
||||
kv {
|
||||
source => "log"
|
||||
target => "SubLog"
|
||||
}
|
||||
grok {
|
||||
match => ["message", "custom: DOM-ALL, dns_query=%{DATA:dns_query};"]
|
||||
tag_on_failure => [ "" ]
|
||||
}
|
||||
mutate {
|
||||
rename => { "action" => "action" }
|
||||
rename => { "addr" => "addr_ip" }
|
||||
rename => { "age" => "age" }
|
||||
rename => { "assigned" => "assigned_ip" }
|
||||
rename => { "assignip" => "assign_ip" }
|
||||
rename => { "ap" => "access_point" }
|
||||
rename => { "app" => "application" }
|
||||
rename => { "appcat" => "application_category" }
|
||||
rename => { "applist" => "application_list" }
|
||||
rename => { "apprisk" => "application_risk" }
|
||||
rename => { "approfile" => "accessPoint_profile" }
|
||||
rename => { "apscan" => "access_point_scan" }
|
||||
rename => { "apstatus" => "acces_point_status" }
|
||||
rename => { "aptype" => "access_point_type" }
|
||||
rename => { "authproto" => "authentication_protocol" }
|
||||
rename => { "bandwidth" => "bandwidth" }
|
||||
rename => { "banned_src" => "banned_source" }
|
||||
rename => { "cat" => "category" }
|
||||
rename => { "catdesc" => "category_description" }
|
||||
rename => { "cfgattr" => "configuration_attribute" }
|
||||
rename => { "cfgobj" => "configuration_object" }
|
||||
rename => { "cfgpath" => "configuration_path" }
|
||||
rename => { "cfgtid" => "configuration_transaction_id" }
|
||||
rename => { "channel" => "channel" }
|
||||
rename => { "community" => "community" }
|
||||
rename => { "cookies" => "cookies" }
|
||||
rename => { "craction" => "cr_action" }
|
||||
rename => { "crlevel" => "cr_level" }
|
||||
rename => { "crscore" => "cr_score" }
|
||||
rename => { "datarange" => "data_range" }
|
||||
rename => { "desc" => "description" }
|
||||
rename => { "detectionmethod" => "detection_method" }
|
||||
rename => { "devid" => "device_id" }
|
||||
rename => { "devname" => "device_name" }
|
||||
rename => { "devtype" => "device_type" }
|
||||
rename => { "dhcp_msg" => "dhcp_message" }
|
||||
rename => { "disklograte" => "disk_lograte" }
|
||||
rename => { "dstcountry" => "destination_country" }
|
||||
rename => { "dstintf" => "destination_interface" }
|
||||
rename => { "dstip" => "destination_ip" }
|
||||
rename => { "dstport" => "destination_port" }
|
||||
rename => { "duration" => "elapsed_time" }
|
||||
rename => { "error_num" => "error_number" }
|
||||
rename => { "espauth" => "esp_authentication" }
|
||||
rename => { "esptransform" => "esp_transform" }
|
||||
rename => { "eventid" => "event_id" }
|
||||
rename => { "eventtype" => "event_type" }
|
||||
rename => { "fazlograte" => "faz_lograte" }
|
||||
rename => { "filename" => "file_name" }
|
||||
rename => { "filesize" => "file_size" }
|
||||
rename => { "filetype" => "file_type" }
|
||||
rename => { "hostname" => "hostname" }
|
||||
rename => { "ip" => "source_ip" }
|
||||
rename => { "localip" => "source_ip" }
|
||||
rename => { "locip" => "local_ip" }
|
||||
rename => { "locport" => "source_port" }
|
||||
rename => { "logid" => "log_id" }
|
||||
rename => { "logver" => "log_version" }
|
||||
rename => { "manuf" => "manufacturer" }
|
||||
rename => { "mem" => "memory" }
|
||||
rename => { "meshmode" => "mesh_mode" }
|
||||
rename => { "msg" => "message" }
|
||||
rename => { "nextstat" => "next_stat" }
|
||||
rename => { "onwire" => "on_wire" }
|
||||
rename => { "osname" => "os_name" }
|
||||
rename => { "osversion" => "unauthenticated_user" }
|
||||
rename => { "outintf" => "outbound_interface" }
|
||||
rename => { "peer_notif" => "peer_notification" }
|
||||
rename => { "phase2_name" => "phase2_name" }
|
||||
rename => { "policyid" => "policy_id" }
|
||||
rename => { "policytype" => "policy_type" }
|
||||
rename => { "port" => "port" }
|
||||
rename => { "probeproto" => "probe_protocol" }
|
||||
rename => { "proto" => "protocol_number" }
|
||||
rename => { "radioband" => "radio_band" }
|
||||
rename => { "radioidclosest" => "radio_id_closest" }
|
||||
rename => { "radioiddetected" => "radio_id_detected" }
|
||||
rename => { "rcvd" => "bytes_received" }
|
||||
rename => { "rcvdbyte" => "bytes_received" }
|
||||
rename => { "rcvdpkt" => "packets_received" }
|
||||
rename => { "remip" => "destination_ip" }
|
||||
rename => { "remport" => "remote_port" }
|
||||
rename => { "reqtype" => "request_type" }
|
||||
rename => { "scantime" => "scan_time" }
|
||||
rename => { "securitymode" => "security_mode" }
|
||||
rename => { "sent" => "bytes_sent" }
|
||||
rename => { "sentbyte" => "bytes_sent" }
|
||||
rename => { "sentpkt" => "packets_sent" }
|
||||
rename => { "session_id" => "session_id" }
|
||||
rename => { "setuprate" => "setup_rate" }
|
||||
rename => { "sn" => "serial" }
|
||||
rename => { "snclosest" => "serial_closest_access_point" }
|
||||
rename => { "sndetected" => "serial_access_point_that_detected_rogue_ap" }
|
||||
rename => { "snmeshparent" => "serial_mesh_parent" }
|
||||
rename => { "srccountry" => "source_country" }
|
||||
rename => { "srcip" => "source_ip" }
|
||||
rename => { "srcmac" => "source_mac" }
|
||||
rename => { "srcname" => "source_name" }
|
||||
rename => { "srcintf" => "source_interface" }
|
||||
rename => { "srcport" => "source_port" }
|
||||
rename => { "stacount" => "station_count" }
|
||||
rename => { "stamac" => "static_mac" }
|
||||
rename => { "srccountry" => "source_country" }
|
||||
rename => { "srcip" => "source_ip" }
|
||||
rename => { "srcmac" => "source_mac" }
|
||||
rename => { "srcname" => "source_name" }
|
||||
rename => { "sn" => "serial" }
|
||||
rename => { "srcintf" => "source_interface" }
|
||||
rename => { "srcport" => "source_port" }
|
||||
rename => { "total" => "total_bytes" }
|
||||
rename => { "totalsession" => "total_sessions" }
|
||||
rename => { "trandisp" => "nat_translation_type" }
|
||||
rename => { "tranip" => "nat_destination_ip" }
|
||||
rename => { "tranport" => "nat_destination_port" }
|
||||
rename => { "transip" => "nat_source_ip" }
|
||||
rename => { "transport" => "nat_source_port" }
|
||||
rename => { "tunnelid" => "tunnel_id" }
|
||||
rename => { "tunnelip" => "tunnel_ip" }
|
||||
rename => { "tunneltype" => "tunnel_type" }
|
||||
rename => { "unauthuser" => "unauthenticated_user_source" }
|
||||
rename => { "unauthusersource" => "os_version" }
|
||||
rename => { "vendorurl" => "vendor_url" }
|
||||
rename => { "vpntunnel" => "vpn_tunnel" }
|
||||
rename => { "vulncat" => "vulnerability_category" }
|
||||
rename => { "vulncmt" => "vulnerability_count" }
|
||||
rename => { "vulnid" => "vulnerability_id" }
|
||||
rename => { "vulnname" => "vulnerability_name" }
|
||||
rename => { "vulnref" => "vulnerability_reference" }
|
||||
rename => { "vulnscore" => "vulnerability_score" }
|
||||
rename => { "xauthgroup" => "x_authentication_group" }
|
||||
rename => { "xauthuser" => "x_authentication_user" }
|
||||
rename => { "[SubLog][appid]" => "sub_application_id" }
|
||||
rename => { "[SubLog][devid]" => "sub_device_id" }
|
||||
rename => { "[SubLog][dstip]" => "sub_destination_ip" }
|
||||
rename => { "[SubLog][srcip]" => "sub_source_ip" }
|
||||
rename => { "[SubLog][dstport]" => "sub_destination_port" }
|
||||
rename => { "[SubLog][eventtype]" => "sub_event_type" }
|
||||
rename => { "[SubLog][proto]" => "sub_protocol_number" }
|
||||
rename => { "[SubLog][date]" => "sub_date" }
|
||||
rename => { "[SubLog][time]" => "sub_time" }
|
||||
rename => { "[SubLog][srcport]" => "sub_source_port" }
|
||||
rename => { "[SubLog][subtype]" => "sub_subtype" }
|
||||
rename => { "[SubLog][devname]" => "sub_device_name" }
|
||||
rename => { "[SubLog][itime]" => "sub_itime" }
|
||||
rename => { "[SubLog][level]" => "sub_level" }
|
||||
rename => { "[SubLog][logid]" => "sub_log_id" }
|
||||
rename => { "[SubLog][logver]" => "sub_log_version" }
|
||||
rename => { "[SubLog][type]" => "sub_event_type" }
|
||||
rename => { "[SubLog][vd]" => "sub_vd" }
|
||||
rename => { "[SubLog][action]" => "sub_action" }
|
||||
rename => { "[SubLog][logdesc]" => "sub_destination_ip" }
|
||||
rename => { "[SubLog][policyid]" => "sub_olicy_id" }
|
||||
rename => { "[SubLog][reason]" => "sub_reason" }
|
||||
rename => { "[SubLog][service]" => "sub_service" }
|
||||
rename => { "[SubLog][sessionid]" => "sub_session_id" }
|
||||
rename => { "[SubLog][src]" => "sub_source_ip" }
|
||||
rename => { "[SubLog][status]" => "sub_status" }
|
||||
rename => { "[SubLog][ui]" => "sub_ui" }
|
||||
rename => { "[SubLog][urlfilteridx]" => "sub_url_filter_idx" }
|
||||
strip => [ "bytes_sent", "bytes_received" ]
|
||||
convert => [ "bytes_sent", "integer" ]
|
||||
convert => [ "bytes_received", "integer" ]
|
||||
convert => [ "cr_score", "integer" ]
|
||||
convert => [ "cr_action", "integer" ]
|
||||
convert => [ "elapsed_time", "integer" ]
|
||||
convert => [ "destination_port", "integer" ]
|
||||
convert => [ "source_port", "integer" ]
|
||||
convert => [ "local_port", "integer" ]
|
||||
convert => [ "remote_port", "integer" ]
|
||||
convert => [ "packets_sent", "integer" ]
|
||||
convert => [ "packets_received", "integer" ]
|
||||
convert => [ "port", "integer" ]
|
||||
convert => [ "ProtocolNumber", "integer" ]
|
||||
convert => [ "XAuthUser", "string" ]
|
||||
remove_field => [ "kv", "log" ]
|
||||
}
|
||||
if [tunnel_ip] == "N/A" {
|
||||
mutate {
|
||||
remove_field => [ "tunnel_ip" ]
|
||||
}
|
||||
}
|
||||
if [nat_destination_ip] {
|
||||
mutate {
|
||||
add_field => { "ips" => [ "%{nat_destination_ip}" ] }
|
||||
add_field => { "destination_ips" => [ "%{nat_destination_ip}" ] }
|
||||
}
|
||||
}
|
||||
if [sub_destination_ip] {
|
||||
mutate {
|
||||
add_field => { "ips" => [ "%{sub_destination_ip}" ] }
|
||||
add_field => { "destination_ips" => [ "%{sub_destination_ip}" ] }
|
||||
}
|
||||
}
|
||||
if [nat_source_ip] {
|
||||
mutate {
|
||||
add_field => { "ips" => [ "%{nat_source_ip}" ] }
|
||||
add_field => { "source_ips" => [ "%{nat_source_ip}" ] }
|
||||
}
|
||||
}
|
||||
if [sub_source_ip] {
|
||||
mutate {
|
||||
add_field => { "ips" => [ "%{sub_source_ip}" ] }
|
||||
add_field => { "source_ips" => [ "%{sub_source_ip}" ] }
|
||||
}
|
||||
}
|
||||
if [addr_ip] {
|
||||
mutate {
|
||||
add_field => { "ips" => [ "%{addr_ip}" ] }
|
||||
}
|
||||
}
|
||||
if [assign_ip] {
|
||||
mutate {
|
||||
add_field => { "ips" => [ "%{assign_ip}" ] }
|
||||
}
|
||||
}
|
||||
if [assigned_ip] {
|
||||
mutate {
|
||||
add_field => { "ips" => [ "%{assigned_ip}" ] }
|
||||
}
|
||||
}
|
||||
grok {
|
||||
match => ["message", "type=%{DATA:event_type}\s+"]
|
||||
}
|
||||
if [date] and [time] {
|
||||
mutate {
|
||||
add_field => { "receive_time" => "%{date} %{time}" }
|
||||
remove_field => [ "date", "time" ]
|
||||
}
|
||||
date {
|
||||
timezone => "America/Chicago"
|
||||
match => [ "receive_time", "YYYY-MM-dd HH:mm:ss" ]
|
||||
target => "receive_time"
|
||||
}
|
||||
mutate {
|
||||
rename => { "receive_time" => "@timestamp" }
|
||||
}
|
||||
} else {
|
||||
mutate {
|
||||
add_tag => [ "missing_date" ]
|
||||
}
|
||||
}
|
||||
mutate {
|
||||
#add_tag => [ "conf_file_6200"]
|
||||
}
|
||||
}
|
||||
}
|
||||
56
salt/logstash/conf/pipelines/eval/6201_firewall_pfsense.conf
Normal file
56
salt/logstash/conf/pipelines/eval/6201_firewall_pfsense.conf
Normal file
@@ -0,0 +1,56 @@
|
||||
# Author: Wes Lambert
|
||||
# Updated by: Doug Burks
|
||||
|
||||
filter {
|
||||
if [type] == "filterlog" {
|
||||
dissect {
|
||||
mapping => {
|
||||
"message" => "%{rule_number},%{sub_rule_number},%{anchor},%{tracker_id},%{interface},%{reason},%{action},%{direction},%{ip_version},%{sub_msg}"
|
||||
}
|
||||
}
|
||||
if [ip_version] == "4" {
|
||||
dissect {
|
||||
mapping => {
|
||||
"sub_msg" => "%{ipv4_tos},%{ipv4_ecn},%{ipv4_ttl},%{ipv4_id},%{ipv4_offset},%{ipv4_flags},%{protocol_id},%{protocol},%{protocol_length},%{source_ip},%{destination_ip},%{ip_sub_msg}"
|
||||
}
|
||||
}
|
||||
}
|
||||
if [ip_version] == "6" {
|
||||
dissect {
|
||||
mapping => {
|
||||
"sub_msg" => "%{class},%{flow_label},%{hop_limit},%{protocol},%{protocol_id},%{length},%{source_ip},%{destination_ip},%{ip_sub_msg}"
|
||||
}
|
||||
}
|
||||
}
|
||||
if [protocol] == "tcp" {
|
||||
dissect {
|
||||
mapping => {
|
||||
"ip_sub_msg" => "%{source_port},%{destination_port},%{data_length},%{tcp_flags},"
|
||||
}
|
||||
}
|
||||
}
|
||||
if [protocol] == "udp" {
|
||||
dissect {
|
||||
mapping => {
|
||||
"ip_sub_msg" => "%{source_port},%{destination_port},%{data_length}"
|
||||
}
|
||||
}
|
||||
}
|
||||
if [protocol] == "Options" {
|
||||
mutate {
|
||||
copy => { "ip_sub_msg" => "options" }
|
||||
}
|
||||
mutate {
|
||||
split => { "options" => "," }
|
||||
}
|
||||
}
|
||||
mutate {
|
||||
convert => [ "destination_port", "integer" ]
|
||||
convert => [ "source_port", "integer" ]
|
||||
convert => [ "ip_version", "integer" ]
|
||||
replace => { "type" => "firewall" }
|
||||
add_tag => [ "pfsense","firewall" ]
|
||||
remove_field => [ "sub_msg", "ip_sub_msg" ]
|
||||
}
|
||||
}
|
||||
}
|
||||
161
salt/logstash/conf/pipelines/eval/6300_windows.conf
Normal file
161
salt/logstash/conf/pipelines/eval/6300_windows.conf
Normal file
@@ -0,0 +1,161 @@
|
||||
# Author: Justin Henderson
|
||||
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
|
||||
# Email: justin@hasecuritysolution.com
|
||||
# Last Update: 12/9/2016
|
||||
|
||||
filter {
|
||||
if [type] == "windows" {
|
||||
# json {
|
||||
# source => "message"
|
||||
# }
|
||||
date {
|
||||
match => ["EventTime", "YYYY-MM-dd HH:mm:ss"]
|
||||
remove_field => [ "EventTime" ]
|
||||
}
|
||||
if [EventID] == 4634 {
|
||||
mutate {
|
||||
add_tag => [ "logoff" ]
|
||||
}
|
||||
}
|
||||
if [EventID] == 4624 or [EventID] == 528 or [EventID] == 540 or [EventID] == 552 or [EventID] == 682 or [EventID] == 4648 or [EventID] == 4778 {
|
||||
mutate {
|
||||
add_tag => [ "logon" ]
|
||||
add_tag => [ "alert_data" ]
|
||||
}
|
||||
}
|
||||
if [EventID] == 529 or [EventID] == 4625 or [EventID] == 530 or [EventID] == 531 or [EventID] == 532 or [EventID] == 533 or [EventID] == 534 or [EventID] == 535 or [EventID] == 536 or [EventID] == 536 or [EventID] == 537 or [EventID] == 538 or [EventID] == 539 or [EventID] == 4625 or [EventID] == 4771 {
|
||||
mutate {
|
||||
add_tag => [ "logon_failure" ]
|
||||
add_tag => [ "alert_data" ]
|
||||
}
|
||||
}
|
||||
# Critical event IDs to monitor
|
||||
if [EventID] == 7030 or [EventID] == 4720 or [EventID] == 4722 or [EventID] == 4724 or [EventID] == 4738 or [EventID] == 4732 or [EventID] == 1102 or [EventID] == 1056 or [EventID] == 2003 or [EventID] == 2005 or [EventID] == 8003 or [EventID] == 8004 or [EventID] == 8006 or [EventID] == 8007 {
|
||||
mutate {
|
||||
add_tag => [ "alert_data" ]
|
||||
}
|
||||
}
|
||||
# Critical event IDs to monitor
|
||||
if [EventID] == 5152 { drop {} }
|
||||
if [EventID] == 4688 { drop {} }
|
||||
if [EventID] == 4689 { drop {} } # Process Termination:Not needed due to Sysmon
|
||||
if [Channel] == "Microsoft-Windows-Known Folders API Service" { drop {} }
|
||||
if [EventID] == 3 and [SourceIp] =~ "255$" { drop {} }
|
||||
if [EventID] == 3 and [DestinationIp] =~ "255$" { drop {} }
|
||||
# Whitelist/Blacklist check
|
||||
if [EventID] == 7045 {
|
||||
translate {
|
||||
field => "ServiceName"
|
||||
destination => "ServiceCheck"
|
||||
dictionary_path => "/lib/dictionaries/services.yaml"
|
||||
}
|
||||
}
|
||||
if [EventID] == 7045 and !([ServiceCheck]) {
|
||||
mutate {
|
||||
add_tag => [ "alert_data","new_service" ]
|
||||
}
|
||||
}
|
||||
if [ServiceCheck] == 'whitelist' {
|
||||
mutate {
|
||||
remove_field => [ "ServiceCheck" ]
|
||||
add_tag => [ "whitelist" ]
|
||||
}
|
||||
}
|
||||
if [ServiceCheck] == 'blacklist' {
|
||||
mutate {
|
||||
remove_field => [ "ServiceCheck" ]
|
||||
add_tag => [ "blacklist" ]
|
||||
}
|
||||
}
|
||||
if [EventID] == 5158 {
|
||||
if [Application] == "System" { drop {} }
|
||||
if [Application] =~ "\\windows\\system32\\spoolsv\.exe" { drop {} }
|
||||
if [Application] =~ "\\windows\\system32\\wbem\\wmiprvse\.exe" { drop {} }
|
||||
if [Application] =~ "mcafee" { drop {} }
|
||||
if [Application] =~ "carestream" { drop {} }
|
||||
if [Application] =~ "Softdent" { drop {} }
|
||||
}
|
||||
if [ProcessName] == "C:\\Windows\\System32\\wbem\\WmiPrvSE\.exe" and [SubjectUserName] == "SolarwindsHO" { drop {} }
|
||||
if [EventID] == 4690 { drop {} }
|
||||
if [EventID] == 861 and [AccountName] == "ntp" { drop {} }
|
||||
if [EventID] == 5158 and [Application] =~ "\\windows\\system32\\lsass\.exe$" { drop {} }
|
||||
if [EventID] == 5158 and [Application] =~ "\\windows\\system32\\svchost\.exe$" { drop {} }
|
||||
if [EventID] == 5158 and [Application] =~ "\\windows\\system32\\dfsrs\.exe$" { drop {} }
|
||||
if [EventID] == 5447 { drop {} }
|
||||
|
||||
mutate {
|
||||
rename => [ "AccountName", "user" ]
|
||||
rename => [ "AccountType", "account_type" ]
|
||||
rename => [ "ActivityID", "activity_id" ]
|
||||
rename => [ "Category", "category" ]
|
||||
rename => [ "ClientAddress", "client_ip" ]
|
||||
rename => [ "Channel", "channel" ]
|
||||
rename => [ "DCIPAddress", "domain_controller_ip" ]
|
||||
rename => [ "DCName", "domain_controller_name" ]
|
||||
rename => [ "EventID", "event_id" ]
|
||||
rename => [ "EventReceivedTime", "event_received_time" ]
|
||||
rename => [ "EventType", "event_type" ]
|
||||
rename => [ "GatewayIPAddress", "gateway_ip" ]
|
||||
rename => [ "IPAddress", "client_ip" ]
|
||||
rename => [ "Ipaddress", "client_ip" ]
|
||||
rename => [ "IpAddress", "client_ip" ]
|
||||
rename => [ "IPPort", "source_port" ]
|
||||
rename => [ "OpcodeValue", "opcode_value" ]
|
||||
rename => [ "PreAuthType", "preauthentication_type" ]
|
||||
rename => [ "PrincipleSAMName", "user" ]
|
||||
rename => [ "ProcessID", "process_id" ]
|
||||
rename => [ "ProviderGUID", "providerguid" ]
|
||||
rename => [ "RecordNumber", "record_number" ]
|
||||
rename => [ "RemoteAddress", "destination_ip" ]
|
||||
rename => [ "ServiceName", "service_name" ]
|
||||
rename => [ "ServiceID", "service_id" ]
|
||||
rename => [ "SeverityValue", "severity_value" ]
|
||||
rename => [ "SourceAddress", "client_ip" ]
|
||||
rename => [ "SourceModuleName", "source_module_name" ]
|
||||
rename => [ "SourceModuleType", "source_module_type" ]
|
||||
rename => [ "SourceName", "source_name" ]
|
||||
rename => [ "SubjectUserName", "user" ]
|
||||
rename => [ "TaskName", "task_name" ]
|
||||
rename => [ "TargetDomainName", "target_domain_name" ]
|
||||
rename => [ "TargetUserName", "user" ]
|
||||
rename => [ "ThreadID", "thread_id" ]
|
||||
rename => [ "User_ID", "user" ]
|
||||
rename => [ "UserID", "user" ]
|
||||
rename => [ "username", "user" ]
|
||||
}
|
||||
# For any accounts that are service accounts or special accounts add the tag of service_account
|
||||
# This example applies the tag to any username that starts with SVC_. If you use a different
|
||||
# standard change this.
|
||||
if [user] =~ "^DWM-*" or [user] == "SYSTEM" or [user] == "NETWORK SERVICE" or [user] == "LOCAL SERVICE" or [user] =~ "^SVC_*" {
|
||||
mutate {
|
||||
add_tag => [ "service_account" ]
|
||||
}
|
||||
}
|
||||
# This looks for events that are typically noisy but may be of use for deep dive investigations
|
||||
# A tag of noise is added to quickly filter out noise
|
||||
if [event_id] == 7036 or [source_name] == "Desktop Window Manager" or [category] == "Engine Lifecycle" or [category] == "Provider Lifecycle" {
|
||||
mutate {
|
||||
add_tag => [ "noise" ]
|
||||
}
|
||||
}
|
||||
#Identify machine accounts
|
||||
if [user] =~ /\$/ {
|
||||
mutate {
|
||||
add_tag => [ "machine", "noise" ]
|
||||
}
|
||||
}
|
||||
# Lower case all field names
|
||||
ruby {
|
||||
code => "
|
||||
event_hash = event.to_hash
|
||||
new_event = {}
|
||||
event_hash.keys.each do |key|
|
||||
new_event[key.downcase] = event[key]
|
||||
end
|
||||
event.instance_variable_set(:@data, new_event)"
|
||||
}
|
||||
mutate {
|
||||
#add_tag => [ "conf_file_6300"]
|
||||
}
|
||||
}
|
||||
}
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user