CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2026-01-03 06:43:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

Add ID for RITA filestream inputs

Browse Source
This commit is contained in:
weslambert
2022-05-25 10:09:01 -04:00
committed by GitHub
parent 99864f4787
commit 44622350ea
1 changed files with 3 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
salt/filebeat/etc/filebeat.yml
View File

@@ -267,6 +267,7 @@ filebeat.inputs:
{%- if RITAENABLED %}
- type: filestream
id: rita-beacon
paths:
- /nsm/rita/beacons.csv
exclude_lines: ['^Score', '^Source', '^Domain', '^No results']
@@ -282,6 +283,7 @@ filebeat.inputs:
index: "so-rita"
- type: filestream
id: rita-connection
paths:
- /nsm/rita/long-connections.csv
- /nsm/rita/open-connections.csv
@@ -298,6 +300,7 @@ filebeat.inputs:
index: "so-rita"
- type: filestream
id: rita-dns
paths:
- /nsm/rita/exploded-dns.csv
exclude_lines: ['^Domain', '^No results']