Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2026-02-20 14:05:26 +01:00 · 2023-01-23 21:44:46 +00:00
parent d342f3c4b8
commit 40c6b380df
113 changed files with 129 additions and 27 deletions
--- a/salt/elasticsearch/files/ingest/zeek.s7comm
+++ b/salt/elasticsearch/files/ingest/zeek.s7comm
@@ -1,6 +1,7 @@
 {
  "description" : "zeek.s7comm",
  "processors" : [
+    { "set": { "field": "event.dataset", "value": "s7comm" } },
    { "remove":   { "field": ["host"],								"ignore_failure": true } },
    { "json":     { "field": "message",			"target_field": "message2",		"ignore_failure": true } },
    { "rename":   { "field": "message2.rosctr_code",	"target_field": "s7.ros.control.code",	"ignore_missing": true } },