diff --git a/salt/elasticsearch/files/ingest/zeek.bacnet b/salt/elasticsearch/files/ingest/zeek.bacnet index d4484aa4a..c3f1582e3 100644 --- a/salt/elasticsearch/files/ingest/zeek.bacnet +++ b/salt/elasticsearch/files/ingest/zeek.bacnet @@ -1,14 +1,14 @@ { "description" : "zeek.bacnet", "processors" : [ - { "remove": { "field": ["host"], "ignore_failure": true } }, + { "remove": { "field": ["host"], "ignore_failure": true } }, { "json": { "field": "message", "target_field": "message2", "ignore_failure": true } }, - { "rename": { "field": "message2.is_orig", "target_field": "bacnet.is.originator", "ignore_missing": true } }, - { "rename": { "field": "message2.bvlc_function", "target_field": "bacnet.bclv.function", "ignore_missing": true } }, - { "rename": { "field": "message2.pdu_type", "target_field": "bacnet.pdu.type", "ignore_missing": true } }, - { "rename": { "field": "message2.pdu_service", "target_field": "bacnet.pdu.service", "ignore_missing": true } }, - { "rename": { "field": "message2.invoke_id", "target_field": "bacnet.invoke.id", "ignore_missing": true } }, - { "rename": { "field": "message2.result_code", "target_field": "bacnet.result.code", "ignore_missing": true } }, - { "pipeline": { "name": "zeek.common" } } + { "rename": { "field": "message2.is_orig", "target_field": "bacnet.is.originator", "ignore_missing": true } }, + { "rename": { "field": "message2.bvlc_function", "target_field": "bacnet.bclv.function", "ignore_missing": true } }, + { "rename": { "field": "message2.pdu_type", "target_field": "bacnet.pdu.type", "ignore_missing": true } }, + { "rename": { "field": "message2.pdu_service", "target_field": "bacnet.pdu.service", "ignore_missing": true } }, + { "rename": { "field": "message2.invoke_id", "target_field": "bacnet.invoke.id", "ignore_missing": true } }, + { "rename": { "field": "message2.result_code", "target_field": "bacnet.result.code", "ignore_missing": true } }, + { "pipeline": { "name": "zeek.common" } } ] } diff --git a/salt/elasticsearch/files/ingest/zeek.bacnet_discovery b/salt/elasticsearch/files/ingest/zeek.bacnet_discovery index a2b155bf1..149a3b3d9 100644 --- a/salt/elasticsearch/files/ingest/zeek.bacnet_discovery +++ b/salt/elasticsearch/files/ingest/zeek.bacnet_discovery @@ -1,16 +1,15 @@ { "description" : "zeek.bacnet_discovery", "processors" : [ - { "remove": { "field": ["host"], "ignore_failure": true } }, - { "json": { "field": "message", "target_field": "message2", "ignore_failure": true } }, - { "rename": { "field": "message2.is_orig", "target_field": "bacnet.is.originator", "ignore_missing": true } }, - { "rename": { "field": "message2.instance_number", "target_field": "bacnet.instance.number", "ignore_missing": true } }, - { "rename": { "field": "message2.pdu_service", "target_field": "bacnet.pdu.service", "ignore_missing": true } }, - { "rename": { "field": "message2.object_type", "target_field": "bacnet.object.type", "ignore_missing": true } }, - { "rename": { "field": "message2.instance_number", "target_field": "bacnet.instance.number", "ignore_missing": true } }, - { "rename": { "field": "message2.vendor", "target_field": "bacnet.vendor", "ignore_missing": true } }, - { "rename": { "field": "message2.range", "target_field": "bacnet.range", "ignore_missing": true } }, - { "rename": { "field": "message2.object_name", "target_field": "bacnet.object.name", "ignore_missing": true } }, - { "pipeline": { "name": "zeek.common" } } + { "remove": { "field": ["host"], "ignore_failure": true } }, + { "json": { "field": "message", "target_field": "message2", "ignore_failure": true } }, + { "rename": { "field": "message2.is_orig", "target_field": "bacnet.is.originator", "ignore_missing": true } }, + { "rename": { "field": "message2.pdu_service", "target_field": "bacnet.pdu.service", "ignore_missing": true } }, + { "rename": { "field": "message2.object_type", "target_field": "bacnet.object.type", "ignore_missing": true } }, + { "rename": { "field": "message2.instance_number", "target_field": "bacnet.instance.number", "ignore_missing": true } }, + { "rename": { "field": "message2.vendor", "target_field": "bacnet.vendor", "ignore_missing": true } }, + { "rename": { "field": "message2.range", "target_field": "bacnet.range", "ignore_missing": true } }, + { "rename": { "field": "message2.object_name", "target_field": "bacnet.object.name", "ignore_missing": true } }, + { "pipeline": { "name": "zeek.common" } } ] } diff --git a/salt/elasticsearch/files/ingest/zeek.bacnet_property b/salt/elasticsearch/files/ingest/zeek.bacnet_property index 9a39ae5a0..b58c54c86 100644 --- a/salt/elasticsearch/files/ingest/zeek.bacnet_property +++ b/salt/elasticsearch/files/ingest/zeek.bacnet_property @@ -1,16 +1,15 @@ { "description" : "zeek.bacnet_property", "processors" : [ - { "remove": { "field": ["host"], "ignore_failure": true } }, - { "json": { "field": "message", "target_field": "message2", "ignore_failure": true } }, - { "json": { "field": "message", "target_field": "message2", "ignore_failure": true } }, + { "remove": { "field": ["host"], "ignore_failure": true } }, + { "json": { "field": "message", "target_field": "message2", "ignore_failure": true } }, { "rename": { "field": "message2.is_orig", "target_field": "bacnet.is.originator", "ignore_missing": true } }, - { "rename": { "field": "message2.instance_number", "target_field": "bacnet.instance.number", "ignore_missing": true } }, - { "rename": { "field": "message2.pdu_service", "target_field": "bacnet.pdu.service", "ignore_missing": true } }, - { "rename": { "field": "message2.object_type", "target_field": "bacnet.object.type", "ignore_missing": true } }, - { "rename": { "field": "message2.property", "target_field": "bacnet.property", "ignore_missing": true } }, - { "rename": { "field": "message2.array_index", "target_field": "bacnet.array.index", "ignore_missing": true } }, - { "rename": { "field": "message2.value", "target_field": "bacnet.value", "ignore_missing": true } }, - { "pipeline": { "name": "zeek.common" } } + { "rename": { "field": "message2.instance_number", "target_field": "bacnet.instance.number", "ignore_missing": true } }, + { "rename": { "field": "message2.pdu_service", "target_field": "bacnet.pdu.service", "ignore_missing": true } }, + { "rename": { "field": "message2.object_type", "target_field": "bacnet.object.type", "ignore_missing": true } }, + { "rename": { "field": "message2.property", "target_field": "bacnet.property", "ignore_missing": true } }, + { "rename": { "field": "message2.array_index", "target_field": "bacnet.array.index", "ignore_missing": true } }, + { "rename": { "field": "message2.value", "target_field": "bacnet.value", "ignore_missing": true } }, + { "pipeline": { "name": "zeek.common" } } ] } diff --git a/salt/elasticsearch/files/ingest/zeek.bsap_ip_header b/salt/elasticsearch/files/ingest/zeek.bsap_ip_header index 59f7bca04..b92d7f233 100644 --- a/salt/elasticsearch/files/ingest/zeek.bsap_ip_header +++ b/salt/elasticsearch/files/ingest/zeek.bsap_ip_header @@ -1,10 +1,10 @@ { "description" : "zeek.bsap_ip_header", "processors" : [ - { "remove": { "field": ["host"], "ignore_failure": true } }, - { "json": { "field": "message", "target_field": "message2", "ignore_failure": true } }, - { "rename": { "field": "message2.num_msg", "target_field": "bsap.number.messages", "ignore_missing": true } }, - { "rename": { "field": "message2.type_name", "target_field": "bsap.message.type", "ignore_missing": true } }, - { "pipeline": { "name": "zeek.common" } } + { "remove": { "field": ["host"], "ignore_failure": true } }, + { "json": { "field": "message", "target_field": "message2", "ignore_failure": true } }, + { "rename": { "field": "message2.num_msg", "target_field": "bsap.number.messages", "ignore_missing": true } }, + { "rename": { "field": "message2.type_name", "target_field": "bsap.message.type", "ignore_missing": true } }, + { "pipeline": { "name": "zeek.common" } } ] -} \ No newline at end of file +} diff --git a/salt/elasticsearch/files/ingest/zeek.bsap_ip_rdb b/salt/elasticsearch/files/ingest/zeek.bsap_ip_rdb index 6490e0aa9..7139983cf 100644 --- a/salt/elasticsearch/files/ingest/zeek.bsap_ip_rdb +++ b/salt/elasticsearch/files/ingest/zeek.bsap_ip_rdb @@ -1,20 +1,20 @@ { "description" : "zeek.bsap_ip_rdb", "processors" : [ - { "remove": { "field": ["host"], "ignore_failure": true } }, - { "json": { "field": "message", "target_field": "message2", "ignore_failure": true } }, - { "rename": { "field": "message2.header_size", "target_field": "bsap.header.legnth", "ignore_missing": true } }, - { "rename": { "field": "message2.mes_seq", "target_field": "bsap.message.sequence", "ignore_missing": true } }, - { "rename": { "field": "message2.res_seq", "target_field": "bsap.response.sequence", "ignore_missing": true } }, - { "rename": { "field": "message2.data_len", "target_field": "bsap.data.lenght", "ignore_missing": true } }, - { "rename": { "field": "message2.sequence", "target_field": "bsap.function.sequence", "ignore_missing": true } }, - { "rename": { "field": "message2.app_func_code", "target_field": "bsap.application.function", "ignore_missing": true } }, - { "rename": { "field": "message2.node_status", "target_field": "bsap.node.status", "ignore_missing": true } }, - { "rename": { "field": "message2.func_code", "target_field": "bsap.application.sub.function", "ignore_missing": true } }, - { "rename": { "field": "message2.variable_count", "target_field": "bsap.variable.count", "ignore_missing": true } }, - { "rename": { "field": "message2.variables", "target_field": "bsap.vector.variables", "ignore_missing": true } }, - { "rename": { "field": "message2.variable_value", "target_field": "bsap.vector.variable.value", "ignore_missing": true } }, - { "rename": { "field": "message2.value", "target_field": "bacnet.value", "ignore_missing": true } }, - { "pipeline": { "name": "zeek.common" } } + { "remove": { "field": ["host"], "ignore_failure": true } }, + { "json": { "field": "message", "target_field": "message2", "ignore_failure": true } }, + { "rename": { "field": "message2.header_size", "target_field": "bsap.header.length", "ignore_missing": true } }, + { "rename": { "field": "message2.mes_seq", "target_field": "bsap.message.sequence", "ignore_missing": true } }, + { "rename": { "field": "message2.res_seq", "target_field": "bsap.response.sequence", "ignore_missing": true } }, + { "rename": { "field": "message2.data_len", "target_field": "bsap.data.length", "ignore_missing": true } }, + { "rename": { "field": "message2.sequence", "target_field": "bsap.function.sequence", "ignore_missing": true } }, + { "rename": { "field": "message2.app_func_code", "target_field": "bsap.application.function", "ignore_missing": true } }, + { "rename": { "field": "message2.node_status", "target_field": "bsap.node.status", "ignore_missing": true } }, + { "rename": { "field": "message2.func_code", "target_field": "bsap.application.sub.function", "ignore_missing": true } }, + { "rename": { "field": "message2.variable_count", "target_field": "bsap.variable.count", "ignore_missing": true } }, + { "rename": { "field": "message2.variables", "target_field": "bsap.vector.variables", "ignore_missing": true } }, + { "rename": { "field": "message2.variable_value", "target_field": "bsap.vector.variable.value", "ignore_missing": true } }, + { "rename": { "field": "message2.value", "target_field": "bsap.value", "ignore_missing": true } }, + { "pipeline": { "name": "zeek.common" } } ] } diff --git a/salt/elasticsearch/files/ingest/zeek.bsap_ip_unknown b/salt/elasticsearch/files/ingest/zeek.bsap_ip_unknown index 2e94f55b5..15d9a8fd9 100644 --- a/salt/elasticsearch/files/ingest/zeek.bsap_ip_unknown +++ b/salt/elasticsearch/files/ingest/zeek.bsap_ip_unknown @@ -1,9 +1,9 @@ { "description" : "zeek.bsap_ip_unknown", "processors" : [ - { "remove": { "field": ["host"], "ignore_failure": true } }, - { "json": { "field": "message", "target_field": "message2", "ignore_failure": true } }, - { "rename": { "field": "message2.data", "target_field": "bsap.ip.unknown.data", "ignore_missing": true } }, - { "pipeline": { "name": "zeek.common" } } + { "remove": { "field": ["host"], "ignore_failure": true } }, + { "json": { "field": "message", "target_field": "message2", "ignore_failure": true } }, + { "rename": { "field": "message2.data", "target_field": "bsap.ip.unknown.data", "ignore_missing": true } }, + { "pipeline": { "name": "zeek.common" } } ] } diff --git a/salt/elasticsearch/files/ingest/zeek.bsap_serial_header b/salt/elasticsearch/files/ingest/zeek.bsap_serial_header index 8647e94c8..e4262b3c3 100644 --- a/salt/elasticsearch/files/ingest/zeek.bsap_serial_header +++ b/salt/elasticsearch/files/ingest/zeek.bsap_serial_header @@ -1,17 +1,17 @@ { "description" : "zeek.bsap_serial_header", "processors" : [ - { "remove": { "field": ["host"], "ignore_failure": true } }, - { "json": { "field": "message", "target_field": "message2", "ignore_failure": true } }, - { "rename": { "field": "message2.ser", "target_field": "bsap.message.serial.number", "ignore_missing": true } }, - { "rename": { "field": "message2.dadd", "target_field": "bsap.destination.address", "ignore_missing": true } }, - { "rename": { "field": "message2.sadd", "target_field": "bsap.source.address", "ignore_missing": true } }, - { "rename": { "field": "message2.ctl", "target_field": "bsap.control.byte", "ignore_missing": true } }, - { "rename": { "field": "message2.dfun", "target_field": "bsap.destination.function", "ignore_missing": true } }, - { "rename": { "field": "message2.seq", "target_field": "bsap.message.sequence", "ignore_missing": true } }, - { "rename": { "field": "message2.sfun", "target_field": "bsap.source.function", "ignore_missing": true } }, - { "rename": { "field": "message2.nsb", "target_field": "bsap.node.status.byte", "ignore_missing": true } }, - { "rename": { "field": "message2.type_name", "target_field": "bsap.message.type", "ignore_missing": true } }, - { "pipeline": { "name": "zeek.common" } } + { "remove": { "field": ["host"], "ignore_failure": true } }, + { "json": { "field": "message", "target_field": "message2", "ignore_failure": true } }, + { "rename": { "field": "message2.ser", "target_field": "bsap.message.serial.number", "ignore_missing": true } }, + { "rename": { "field": "message2.dadd", "target_field": "bsap.destination.address", "ignore_missing": true } }, + { "rename": { "field": "message2.sadd", "target_field": "bsap.source.address", "ignore_missing": true } }, + { "rename": { "field": "message2.ctl", "target_field": "bsap.control.byte", "ignore_missing": true } }, + { "rename": { "field": "message2.dfun", "target_field": "bsap.destination.function", "ignore_missing": true } }, + { "rename": { "field": "message2.seq", "target_field": "bsap.message.sequence", "ignore_missing": true } }, + { "rename": { "field": "message2.sfun", "target_field": "bsap.source.function", "ignore_missing": true } }, + { "rename": { "field": "message2.nsb", "target_field": "bsap.node.status.byte", "ignore_missing": true } }, + { "rename": { "field": "message2.type_name", "target_field": "bsap.message.type", "ignore_missing": true } }, + { "pipeline": { "name": "zeek.common" } } ] } diff --git a/salt/elasticsearch/files/ingest/zeek.bsap_serial_rdb b/salt/elasticsearch/files/ingest/zeek.bsap_serial_rdb index 71e0ad9e1..f45d8c0cd 100644 --- a/salt/elasticsearch/files/ingest/zeek.bsap_serial_rdb +++ b/salt/elasticsearch/files/ingest/zeek.bsap_serial_rdb @@ -1,11 +1,11 @@ { "description" : "zeek.bsap_serial_rdb", "processors" : [ - { "remove": { "field": ["host"], "ignore_failure": true } }, - { "json": { "field": "message", "target_field": "message2", "ignore_failure": true } }, - { "rename": { "field": "message2.func_code", "target_field": "bsap.rdb.function", "ignore_missing": true } }, - { "rename": { "field": "message2.variables", "target_field": "bsap.vector.variables", "ignore_missing": true } }, - { "rename": { "field": "message2.variable_value", "target_field": "bsap.vector.value", "ignore_missing": true } }, - { "pipeline": { "name": "zeek.common" } } + { "remove": { "field": ["host"], "ignore_failure": true } }, + { "json": { "field": "message", "target_field": "message2", "ignore_failure": true } }, + { "rename": { "field": "message2.func_code", "target_field": "bsap.rdb.function", "ignore_missing": true } }, + { "rename": { "field": "message2.variables", "target_field": "bsap.vector.variables", "ignore_missing": true } }, + { "rename": { "field": "message2.variable_value", "target_field": "bsap.vector.value", "ignore_missing": true } }, + { "pipeline": { "name": "zeek.common" } } ] -} \ No newline at end of file +} diff --git a/salt/elasticsearch/files/ingest/zeek.bsap_serial_rdb_ext b/salt/elasticsearch/files/ingest/zeek.bsap_serial_rdb_ext index 9809d68a0..a1a08e6b7 100644 --- a/salt/elasticsearch/files/ingest/zeek.bsap_serial_rdb_ext +++ b/salt/elasticsearch/files/ingest/zeek.bsap_serial_rdb_ext @@ -1,13 +1,13 @@ { "description" : "zeek.bsap_serial_rdb_ext", "processors" : [ - { "remove": { "field": ["host"], "ignore_failure": true } }, - { "json": { "field": "message", "target_field": "message2", "ignore_failure": true } }, - { "rename": { "field": "message2.dfun", "target_field": "bsap.destination.function", "ignore_missing": true } }, - { "rename": { "field": "message2.seq", "target_field": "bsap.message.sequence", "ignore_missing": true } }, - { "rename": { "field": "message2.nsb", "target_field": "bsap.node.status.byte", "ignore_missing": true } }, - { "rename": { "field": "message2.extfun", "target_field": "bsap.extenstion.function", "ignore_missing": true } }, - { "rename": { "field": "message2.data", "target_field": "bsap.extenstion.function.data", "ignore_missing": true } }, - { "pipeline": { "name": "zeek.common" } } + { "remove": { "field": ["host"], "ignore_failure": true } }, + { "json": { "field": "message", "target_field": "message2", "ignore_failure": true } }, + { "rename": { "field": "message2.dfun", "target_field": "bsap.destination.function", "ignore_missing": true } }, + { "rename": { "field": "message2.seq", "target_field": "bsap.message.sequence", "ignore_missing": true } }, + { "rename": { "field": "message2.nsb", "target_field": "bsap.node.status.byte", "ignore_missing": true } }, + { "rename": { "field": "message2.extfun", "target_field": "bsap.extension.function", "ignore_missing": true } }, + { "rename": { "field": "message2.data", "target_field": "bsap.extension.function.data", "ignore_missing": true } }, + { "pipeline": { "name": "zeek.common" } } ] -} \ No newline at end of file +} diff --git a/salt/elasticsearch/files/ingest/zeek.bsap_serial_unknown b/salt/elasticsearch/files/ingest/zeek.bsap_serial_unknown index 2b9331c93..ea0c5e471 100644 --- a/salt/elasticsearch/files/ingest/zeek.bsap_serial_unknown +++ b/salt/elasticsearch/files/ingest/zeek.bsap_serial_unknown @@ -1,9 +1,9 @@ { "description" : "zeek.bsap_serial_unknown", "processors" : [ - { "remove": { "field": ["host"], "ignore_failure": true } }, - { "json": { "field": "message", "target_field": "message2", "ignore_failure": true } }, - { "rename": { "field": "message2.data", "target_field": "bsap.serial.unknown.data", "ignore_missing": true } }, - { "pipeline": { "name": "zeek.common" } } + { "remove": { "field": ["host"], "ignore_failure": true } }, + { "json": { "field": "message", "target_field": "message2", "ignore_failure": true } }, + { "rename": { "field": "message2.data", "target_field": "bsap.serial.unknown.data", "ignore_missing": true } }, + { "pipeline": { "name": "zeek.common" } } ] } diff --git a/salt/elasticsearch/files/ingest/zeek.cip b/salt/elasticsearch/files/ingest/zeek.cip index 22f678594..e03237ad6 100644 --- a/salt/elasticsearch/files/ingest/zeek.cip +++ b/salt/elasticsearch/files/ingest/zeek.cip @@ -1,19 +1,19 @@ { "description" : "zeek.cip", "processors" : [ - { "remove": { "field": ["host"], "ignore_failure": true } }, - { "json": { "field": "message", "target_field": "message2", "ignore_failure": true } }, - { "rename": { "field": "message2.is_orig", "target_field": "cip.is.origin", "ignore_missing": true } }, - { "rename": { "field": "message2.cip_sequence_count", "target_field": "cip.sequence_count", "ignore_missing": true } }, - { "rename": { "field": "message2.direction", "target_field": "cip.direction", "ignore_missing": true } }, - { "rename": { "field": "message2.cip_service_code", "target_field": "cip.service_code", "ignore_missing": true } }, - { "rename": { "field": "message2.cip_service", "target_field": "cip.service", "ignore_missing": true } }, - { "convert": { "field": "cip.service", "type": "string", "ignore_missing": true } }, - { "rename": { "field": "message2.cip_status", "target_field": "cip.status_code", "ignore_missing": true } }, - { "rename": { "field": "message2.class_id", "target_field": "cip.request.path.class.id", "ignore_missing": true } }, - { "rename": { "field": "message2.class_name", "target_field": "cip.request.path.class.name", "ignore_missing": true } }, - { "rename": { "field": "message2.instance_id", "target_field": "cip.request.path.instance.id", "ignore_missing": true } }, - { "rename": { "field": "message2.attribute_id", "target_field": "cip.request.path.attribute.id", "ignore_missing": true } }, - { "pipeline": { "name": "zeek.common" } } + { "remove": { "field": ["host"], "ignore_failure": true } }, + { "json": { "field": "message", "target_field": "message2", "ignore_failure": true } }, + { "rename": { "field": "message2.is_orig", "target_field": "cip.is.origin", "ignore_missing": true } }, + { "rename": { "field": "message2.cip_sequence_count", "target_field": "cip.sequence_count", "ignore_missing": true } }, + { "rename": { "field": "message2.direction", "target_field": "cip.direction", "ignore_missing": true } }, + { "rename": { "field": "message2.cip_service_code", "target_field": "cip.service_code", "ignore_missing": true } }, + { "rename": { "field": "message2.cip_service", "target_field": "cip.service", "ignore_missing": true } }, + { "convert": { "field": "cip.service", "type": "string", "ignore_missing": true } }, + { "rename": { "field": "message2.cip_status", "target_field": "cip.status_code", "ignore_missing": true } }, + { "rename": { "field": "message2.class_id", "target_field": "cip.request.path.class.id", "ignore_missing": true } }, + { "rename": { "field": "message2.class_name", "target_field": "cip.request.path.class.name", "ignore_missing": true } }, + { "rename": { "field": "message2.instance_id", "target_field": "cip.request.path.instance.id", "ignore_missing": true } }, + { "rename": { "field": "message2.attribute_id", "target_field": "cip.request.path.attribute.id", "ignore_missing": true } }, + { "pipeline": { "name": "zeek.common" } } ] } diff --git a/salt/elasticsearch/files/ingest/zeek.cip_identity b/salt/elasticsearch/files/ingest/zeek.cip_identity index 092f63fa7..8a9cacb29 100644 --- a/salt/elasticsearch/files/ingest/zeek.cip_identity +++ b/salt/elasticsearch/files/ingest/zeek.cip_identity @@ -1,21 +1,21 @@ { "description" : "zeek.cip_identity", "processors" : [ - { "remove": { "field": ["host"], "ignore_failure": true } }, - { "json": { "field": "message", "target_field": "message2", "ignore_failure": true } }, - { "rename": { "field": "message2.encapsulation_version", "target_field": "cip.encapsulation.version", "ignore_missing": true } }, - { "rename": { "field": "message2.socket_address", "target_field": "cip.socket.address", "ignore_missing": true } }, - { "rename": { "field": "message2.socket_port", "target_field": "cip.socket.port", "ignore_missing": true } }, - { "rename": { "field": "message2.vendor_id", "target_field": "cip.vendor.id", "ignore_missing": true } }, - { "rename": { "field": "message2.vendor_name", "target_field": "cip.vendor.name", "ignore_missing": true } }, - { "rename": { "field": "message2.device_type_id", "target_field": "cip.device.type.id", "ignore_missing": true } }, - { "rename": { "field": "message2.device_type_name", "target_field": "cip.device.type.name", "ignore_missing": true } }, - { "rename": { "field": "message2.product_code", "target_field": "cip.device.product.code", "ignore_missing": true } }, - { "rename": { "field": "message2.revision", "target_field": "cip.device.revision", "ignore_missing": true } }, - { "rename": { "field": "message2.device_status", "target_field": "cip.device.status", "ignore_missing": true } }, - { "rename": { "field": "message2.serial_number", "target_field": "cip.device.serial.number", "ignore_missing": true } }, - { "rename": { "field": "message2.product_name", "target_field": "cip.device.product.name", "ignore_missing": true } }, - { "rename": { "field": "message2.device_state", "target_field": "cip.device.state", "ignore_missing": true } }, - { "pipeline": { "name": "zeek.common" } } + { "remove": { "field": ["host"], "ignore_failure": true } }, + { "json": { "field": "message", "target_field": "message2", "ignore_failure": true } }, + { "rename": { "field": "message2.encapsulation_version", "target_field": "cip.encapsulation.version", "ignore_missing": true } }, + { "rename": { "field": "message2.socket_address", "target_field": "cip.socket.address", "ignore_missing": true } }, + { "rename": { "field": "message2.socket_port", "target_field": "cip.socket.port", "ignore_missing": true } }, + { "rename": { "field": "message2.vendor_id", "target_field": "cip.vendor.id", "ignore_missing": true } }, + { "rename": { "field": "message2.vendor_name", "target_field": "cip.vendor.name", "ignore_missing": true } }, + { "rename": { "field": "message2.device_type_id", "target_field": "cip.device.type.id", "ignore_missing": true } }, + { "rename": { "field": "message2.device_type_name", "target_field": "cip.device.type.name", "ignore_missing": true } }, + { "rename": { "field": "message2.product_code", "target_field": "cip.device.product.code", "ignore_missing": true } }, + { "rename": { "field": "message2.revision", "target_field": "cip.device.revision", "ignore_missing": true } }, + { "rename": { "field": "message2.device_status", "target_field": "cip.device.status", "ignore_missing": true } }, + { "rename": { "field": "message2.serial_number", "target_field": "cip.device.serial.number", "ignore_missing": true } }, + { "rename": { "field": "message2.product_name", "target_field": "cip.device.product.name", "ignore_missing": true } }, + { "rename": { "field": "message2.device_state", "target_field": "cip.device.state", "ignore_missing": true } }, + { "pipeline": { "name": "zeek.common" } } ] -} \ No newline at end of file +} diff --git a/salt/elasticsearch/files/ingest/zeek.cip_io b/salt/elasticsearch/files/ingest/zeek.cip_io index 4a66d83bf..73aed8cae 100644 --- a/salt/elasticsearch/files/ingest/zeek.cip_io +++ b/salt/elasticsearch/files/ingest/zeek.cip_io @@ -1,13 +1,13 @@ { "description" : "zeek.cip_io", "processors" : [ - { "remove": { "field": ["host"], "ignore_failure": true } }, + { "remove": { "field": ["host"], "ignore_failure": true } }, { "json": { "field": "message", "target_field": "message2", "ignore_failure": true } }, - { "rename": { "field": "message2.is_orig", "target_field": "cip.is.origin", "ignore_missing": true } }, - { "rename": { "field": "message2.connection_id", "target_field": "cip.connection.id", "ignore_missing": true } }, - { "rename": { "field": "message2.sequence_number", "target_field": "cip.sequence.count", "ignore_missing": true } }, - { "rename": { "field": "message2.data_length", "target_field": "cip.data.length", "ignore_missing": true } }, - { "rename": { "field": "message2.io_data", "target_field": "cip.io.data", "ignore_missing": true } }, - { "pipeline": { "name": "zeek.common" } } + { "rename": { "field": "message2.is_orig", "target_field": "cip.is.origin", "ignore_missing": true } }, + { "rename": { "field": "message2.connection_id", "target_field": "cip.connection.id", "ignore_missing": true } }, + { "rename": { "field": "message2.sequence_number", "target_field": "cip.sequence.count", "ignore_missing": true } }, + { "rename": { "field": "message2.data_length", "target_field": "cip.data.length", "ignore_missing": true } }, + { "rename": { "field": "message2.io_data", "target_field": "cip.io.data", "ignore_missing": true } }, + { "pipeline": { "name": "zeek.common" } } ] -} \ No newline at end of file +} diff --git a/salt/elasticsearch/files/ingest/zeek.s7comm b/salt/elasticsearch/files/ingest/zeek.s7comm index 646c6bec3..e9f5e6318 100644 --- a/salt/elasticsearch/files/ingest/zeek.s7comm +++ b/salt/elasticsearch/files/ingest/zeek.s7comm @@ -1,15 +1,15 @@ { "description" : "zeek.s7comm", "processors" : [ - { "remove": { "field": ["host"], "ignore_failure": true } }, - { "json": { "field": "message", "target_field": "message2", "ignore_failure": true} }, - { "rename": { "field": "message2.rosctr_code", "target_field": "s7.ros.control.code", "ignore_missing": true } }, - { "rename": { "field": "message2.rosctr_name", "target_field": "s7.ros.control.name", "ignore_missing": true } }, - { "rename": { "field": "message2.pdu_reference", "target_field": "s7.pdu_reference", "ignore_missing": true } }, - { "rename": { "field": "message2.function_code", "target_field": "s7.function.code", "ignore_missing": true } }, - { "rename": { "field": "message2.function_name", "target_field": "s7.function.name", "ignore_missing": true } }, - { "rename": { "field": "message2.error_class", "target_field": "s7.error.class", "ignore_missing": true } }, - { "rename": { "field": "message2.error_code", "target_field": "s7.error.code", "ignore_missing": true } }, + { "remove": { "field": ["host"], "ignore_failure": true } }, + { "json": { "field": "message", "target_field": "message2", "ignore_failure": true } }, + { "rename": { "field": "message2.rosctr_code", "target_field": "s7.ros.control.code", "ignore_missing": true } }, + { "rename": { "field": "message2.rosctr_name", "target_field": "s7.ros.control.name", "ignore_missing": true } }, + { "rename": { "field": "message2.pdu_reference", "target_field": "s7.pdu_reference", "ignore_missing": true } }, + { "rename": { "field": "message2.function_code", "target_field": "s7.function.code", "ignore_missing": true } }, + { "rename": { "field": "message2.function_name", "target_field": "s7.function.name", "ignore_missing": true } }, + { "rename": { "field": "message2.error_class", "target_field": "s7.error.class", "ignore_missing": true } }, + { "rename": { "field": "message2.error_code", "target_field": "s7.error.code", "ignore_missing": true } }, { "pipeline": { "name": "zeek.common" } } ] } diff --git a/salt/elasticsearch/files/ingest/zeek.s7comm_plus b/salt/elasticsearch/files/ingest/zeek.s7comm_plus index a6acd1b35..cbb7d5723 100644 --- a/salt/elasticsearch/files/ingest/zeek.s7comm_plus +++ b/salt/elasticsearch/files/ingest/zeek.s7comm_plus @@ -1,11 +1,11 @@ { "description" : "zeek.s7comm_plus", "processors" : [ - { "remove": { "field": ["host"], "ignore_failure": true } }, - { "json": { "field": "message", "target_field": "message2", "ignore_failure": true} }, - { "rename": { "field": "message2.version", "target_field": "s7.version", "ignore_missing": true } }, - { "rename": { "field": "message2.opcode", "target_field": "s7.opcode.value", "ignore_missing": true } }, - { "rename": { "field": "message2.opcode_name", "target_field": "s7.opcode.name", "ignore_missing": true } }, + { "remove": { "field": ["host"], "ignore_failure": true } }, + { "json": { "field": "message", "target_field": "message2", "ignore_failure": true } }, + { "rename": { "field": "message2.version", "target_field": "s7.version", "ignore_missing": true } }, + { "rename": { "field": "message2.opcode", "target_field": "s7.opcode.value", "ignore_missing": true } }, + { "rename": { "field": "message2.opcode_name", "target_field": "s7.opcode.name", "ignore_missing": true } }, { "pipeline": { "name": "zeek.common" } } ] } diff --git a/salt/elasticsearch/files/ingest/zeek.tds b/salt/elasticsearch/files/ingest/zeek.tds index f9922f52c..43c2cad18 100644 --- a/salt/elasticsearch/files/ingest/zeek.tds +++ b/salt/elasticsearch/files/ingest/zeek.tds @@ -1,9 +1,9 @@ { "description" : "zeek.tds", "processors" : [ - { "remove": { "field": ["host"], "ignore_failure": true } }, - { "json": { "field": "message", "target_field": "message2", "ignore_failure": true } }, - { "rename": { "field": "message2.command", "target_field": "tds.command", "ignore_missing": true } }, - { "pipeline": { "name": "zeek.common" } } + { "remove": { "field": ["host"], "ignore_failure": true } }, + { "json": { "field": "message", "target_field": "message2", "ignore_failure": true } }, + { "rename": { "field": "message2.command", "target_field": "tds.command", "ignore_missing": true } }, + { "pipeline": { "name": "zeek.common" } } ] } diff --git a/salt/elasticsearch/files/ingest/zeek.tds_rpc b/salt/elasticsearch/files/ingest/zeek.tds_rpc index 379a1efe5..75a73c6ba 100644 --- a/salt/elasticsearch/files/ingest/zeek.tds_rpc +++ b/salt/elasticsearch/files/ingest/zeek.tds_rpc @@ -1,10 +1,10 @@ { "description" : "zeek.tds_rpc", "processors" : [ - { "remove": { "field": ["host"], "ignore_failure": true } }, + { "remove": { "field": ["host"], "ignore_failure": true } }, { "json": { "field": "message", "target_field": "message2", "ignore_failure": true } }, - { "rename": { "field": "message2.procedure_name", "target_field": "tds.procedure_name", "ignore_missing": true } }, - { "rename": { "field": "message2.parameters", "target_field": "tds.parameters", "ignore_missing": true } }, - { "pipeline": { "name": "zeek.common" } } + { "rename": { "field": "message2.procedure_name", "target_field": "tds.procedure_name", "ignore_missing": true } }, + { "rename": { "field": "message2.parameters", "target_field": "tds.parameters", "ignore_missing": true } }, + { "pipeline": { "name": "zeek.common" } } ] } diff --git a/salt/elasticsearch/files/ingest/zeek.tds_sql_batch b/salt/elasticsearch/files/ingest/zeek.tds_sql_batch index 00174feb6..560cd1ef3 100644 --- a/salt/elasticsearch/files/ingest/zeek.tds_sql_batch +++ b/salt/elasticsearch/files/ingest/zeek.tds_sql_batch @@ -1,10 +1,10 @@ { "description" : "zeek.tds_sql_batch", "processors" : [ - { "remove": { "field": ["host"], "ignore_failure": true } }, + { "remove": { "field": ["host"], "ignore_failure": true } }, { "json": { "field": "message", "target_field": "message2", "ignore_failure": true } }, - { "rename": { "field": "message2.header_type", "target_field": "tds.header_type", "ignore_missing": true } }, - { "rename": { "field": "message2.query", "target_field": "tds.query", "ignore_missing": true } }, - { "pipeline": { "name": "zeek.common" } } + { "rename": { "field": "message2.header_type", "target_field": "tds.header_type", "ignore_missing": true } }, + { "rename": { "field": "message2.query", "target_field": "tds.query", "ignore_missing": true } }, + { "pipeline": { "name": "zeek.common" } } ] } diff --git a/salt/elasticsearch/files/ingest/zeek.wireguard b/salt/elasticsearch/files/ingest/zeek.wireguard index e8a56bfe0..1df929666 100644 --- a/salt/elasticsearch/files/ingest/zeek.wireguard +++ b/salt/elasticsearch/files/ingest/zeek.wireguard @@ -1,11 +1,11 @@ { "description" : "zeek.wireguard", "processors" : [ - { "remove": { "field": ["host"], "ignore_failure": true } }, - { "json": { "field": "message", "target_field": "message2", "ignore_failure": true} }, - { "rename": { "field": "message2.established", "target_field": "wireguard.established", "ignore_missing": true } }, - { "rename": { "field": "message2.initiations", "target_field": "wireguard.initiations", "ignore_missing": true } }, - { "rename": { "field": "message2.responses", "target_field": "wireguard.responses", "ignore_missing": true } }, + { "remove": { "field": ["host"], "ignore_failure": true } }, + { "json": { "field": "message", "target_field": "message2", "ignore_failure": true } }, + { "rename": { "field": "message2.established", "target_field": "wireguard.established", "ignore_missing": true } }, + { "rename": { "field": "message2.initiations", "target_field": "wireguard.initiations", "ignore_missing": true } }, + { "rename": { "field": "message2.responses", "target_field": "wireguard.responses", "ignore_missing": true } }, { "pipeline": { "name": "zeek.common" } } ] } diff --git a/salt/soc/files/soc/dashboards.queries.json b/salt/soc/files/soc/dashboards.queries.json index 5a6f490d0..6458d8806 100644 --- a/salt/soc/files/soc/dashboards.queries.json +++ b/salt/soc/files/soc/dashboards.queries.json @@ -43,7 +43,7 @@ { "name": "SSL", "description": "SSL/TLS network metadata", "query": "event.dataset:ssl | groupby ssl.version | groupby ssl.validation_status | groupby ssl.server_name | groupby ssl.certificate.issuer | groupby ssl.certificate.subject | groupby source.ip | groupby destination.ip | groupby destination.port"}, { "name": "STUN", "description": "STUN (Session Traversal Utilities for NAT) network metadata", "query": "event.dataset:stun* | groupby -sankey event.dataset source.ip destination.ip | groupby event.dataset | groupby source.ip | groupby destination.ip | groupby destination.port"}, { "name": "Syslog", "description": "Syslog logs", "query": "event.dataset:syslog | groupby syslog.severity_label | groupby syslog.facility_label | groupby network.protocol | groupby source.ip | groupby destination.ip | groupby destination.port"}, - { "name": "TDS", "description": "TDS (Tabular Data Stream) network metadata", "query": "event.dataset:tds* | groupby -sankey event.dataset source.ip destination.ip | groupby event.dataset | groupby tds.command | groupby tds.header_type | groupby tds.procedure_name | groupby source.ip | groupby destination.ip | groupby destination.port"}, + { "name": "TDS", "description": "TDS (Tabular Data Stream) network metadata", "query": "event.dataset:tds* | groupby -sankey event.dataset source.ip destination.ip | groupby event.dataset | groupby tds.command | groupby tds.header_type | groupby tds.procedure_name | groupby source.ip | groupby destination.ip | groupby destination.port | groupby tds.query"}, { "name": "Tunnel", "description": "Tunnels seen by Zeek", "query": "event.dataset:tunnel | groupby tunnel.type | groupby event.action | groupby source.ip | groupby destination.ip | groupby destination.port"}, { "name": "Weird", "description": "Weird network traffic seen by Zeek", "query": "event.dataset:weird | groupby weird.name | groupby weird.additional_info | groupby source.ip | groupby destination.ip | groupby destination.port "}, { "name": "WireGuard", "description": "WireGuard VPN network metadata", "query": "event.dataset:wireguard | groupby -sankey source.ip destination.ip | groupby source.ip | groupby destination.ip | groupby destination.port"}, diff --git a/salt/soc/files/soc/hunt.eventfields.json b/salt/soc/files/soc/hunt.eventfields.json index 3dfda1fc4..530f145d7 100644 --- a/salt/soc/files/soc/hunt.eventfields.json +++ b/salt/soc/files/soc/hunt.eventfields.json @@ -61,6 +61,10 @@ "::bacnet": ["soc_timestamp", "source.ip", "source.port", "destination.ip", "destination.port", "bacnet.bclv.function", "bacnet.result.code", "log.id.uid" ], "::bacnet_discovery": ["soc_timestamp", "source.ip", "source.port", "destination.ip", "destination.port", "bacnet.vendor", "bacnet.pdu.service", "log.id.uid" ], "::bacnet_property": ["soc_timestamp", "source.ip", "source.port", "destination.ip", "destination.port", "bacnet.property", "bacnet.pdu.service", "log.id.uid" ], + "::bsap_ip_header": ["soc_timestamp", "source.ip", "source.port", "destination.ip", "destination.port", "bsap.message.type", "bsap.number.messages", "log.id.uid" ], + "::bsap_ip_rdb": ["soc_timestamp", "bsap.application.function", "bsap.application.sub.function", "bsap.vector.variables", "log.id.uid" ], + "::bsap_serial_header": ["soc_timestamp", "source.ip", "source.port", "destination.ip", "destination.port", "bsap.source.function", "bsap.destination.function", "bsap.message.type", "log.id.uid" ], + "::bsap_serial_rdb": ["soc_timestamp", "bsap.rdb.function", "bsap.vector.variables", "log.id.uid" ], "::cip": ["soc_timestamp", "source.ip", "source.port", "destination.ip", "destination.port", "cip.service", "cip.status_code", "log.id.uid", "event.dataset" ], "::cip_identity": ["soc_timestamp", "source.ip", "source.port", "destination.ip", "destination.port", "cip.device.type.name", "cip.vendor.name", "log.id.uid" ], "::cip_io": ["soc_timestamp", "source.ip", "source.port", "destination.ip", "destination.port", "cip.connection.id", "cip.io.data", "log.id.uid" ],