mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2026-05-02 01:17:56 +02:00
Add integrations and cleanup
This commit is contained in:
Josh Brower
@@ -0,0 +1,76 @@
|
||||
{
|
||||
"package": {
|
||||
"name": "system",
|
||||
"version": "1.25.2"
|
||||
},
|
||||
"name": "system-endpoints",
|
||||
"namespace": "default",
|
||||
"policy_id": "endpoints-initial",
|
||||
"inputs": {
|
||||
"system-logfile": {
|
||||
"enabled": true,
|
||||
"streams": {
|
||||
"system.auth": {
|
||||
"enabled": true,
|
||||
"vars": {
|
||||
"ignore_older": "72h",
|
||||
"paths": [
|
||||
"/var/log/auth.log*",
|
||||
"/var/log/secure*"
|
||||
],
|
||||
"preserve_original_event": false,
|
||||
"tags": [
|
||||
"system-auth"
|
||||
]
|
||||
}
|
||||
},
|
||||
"system.syslog": {
|
||||
"enabled": true,
|
||||
"vars": {
|
||||
"paths": [
|
||||
"/var/log/messages*",
|
||||
"/var/log/syslog*"
|
||||
],
|
||||
"tags": [],
|
||||
"ignore_older": "72h"
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"system-winlog": {
|
||||
"enabled": true,
|
||||
"streams": {
|
||||
"system.application": {
|
||||
"enabled": true,
|
||||
"vars": {
|
||||
"preserve_original_event": false,
|
||||
"ignore_older": "72h",
|
||||
"language": 0,
|
||||
"tags": []
|
||||
}
|
||||
},
|
||||
"system.security": {
|
||||
"enabled": true,
|
||||
"vars": {
|
||||
"preserve_original_event": false,
|
||||
"ignore_older": "72h",
|
||||
"language": 0,
|
||||
"tags": []
|
||||
}
|
||||
},
|
||||
"system.system": {
|
||||
"enabled": true,
|
||||
"vars": {
|
||||
"preserve_original_event": false,
|
||||
"ignore_older": "72h",
|
||||
"language": 0,
|
||||
"tags": []
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"system-system/metrics": {
|
||||
"enabled": false
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,59 @@
|
||||
{
|
||||
"package": {
|
||||
"name": "windows",
|
||||
"version": "1.19.1"
|
||||
},
|
||||
"name": "windows-endpoints",
|
||||
"namespace": "default",
|
||||
"policy_id": "endpoints-initial",
|
||||
"inputs": {
|
||||
"windows-winlog": {
|
||||
"enabled": true,
|
||||
"streams": {
|
||||
"windows.forwarded": {
|
||||
"enabled": true,
|
||||
"vars": {
|
||||
"preserve_original_event": false,
|
||||
"ignore_older": "72h",
|
||||
"language": 0,
|
||||
"tags": [
|
||||
"forwarded"
|
||||
]
|
||||
}
|
||||
},
|
||||
"windows.powershell": {
|
||||
"enabled": true,
|
||||
"vars": {
|
||||
"preserve_original_event": false,
|
||||
"event_id": "400, 403, 600, 800",
|
||||
"ignore_older": "72h",
|
||||
"language": 0,
|
||||
"tags": []
|
||||
}
|
||||
},
|
||||
"windows.powershell_operational": {
|
||||
"enabled": true,
|
||||
"vars": {
|
||||
"preserve_original_event": false,
|
||||
"event_id": "4103, 4104, 4105, 4106",
|
||||
"ignore_older": "72h",
|
||||
"language": 0,
|
||||
"tags": []
|
||||
}
|
||||
},
|
||||
"windows.sysmon_operational": {
|
||||
"enabled": true,
|
||||
"vars": {
|
||||
"preserve_original_event": false,
|
||||
"ignore_older": "72h",
|
||||
"language": 0,
|
||||
"tags": []
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"windows-windows/metrics": {
|
||||
"enabled": false
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,106 @@
|
||||
{
|
||||
"package": {
|
||||
"name": "elasticsearch",
|
||||
"version": "1.0.0"
|
||||
},
|
||||
"name": "elasticsearch-logs",
|
||||
"namespace": "default",
|
||||
"description": "Elasticsearch Logs",
|
||||
"policy_id": "so-grid-nodes",
|
||||
"inputs": {
|
||||
"elasticsearch-logfile": {
|
||||
"enabled": true,
|
||||
"streams": {
|
||||
"elasticsearch.audit": {
|
||||
"enabled": false,
|
||||
"vars": {
|
||||
"paths": [
|
||||
"/var/log/elasticsearch/*_audit.json"
|
||||
]
|
||||
}
|
||||
},
|
||||
"elasticsearch.deprecation": {
|
||||
"enabled": false,
|
||||
"vars": {
|
||||
"paths": [
|
||||
"/var/log/elasticsearch/*_deprecation.json"
|
||||
]
|
||||
}
|
||||
},
|
||||
"elasticsearch.gc": {
|
||||
"enabled": false,
|
||||
"vars": {
|
||||
"paths": [
|
||||
"/var/log/elasticsearch/gc.log.[0-9]*",
|
||||
"/var/log/elasticsearch/gc.log"
|
||||
]
|
||||
}
|
||||
},
|
||||
"elasticsearch.server": {
|
||||
"enabled": true,
|
||||
"vars": {
|
||||
"paths": [
|
||||
"/opt/so/log/elasticsearch/*.log"
|
||||
]
|
||||
}
|
||||
},
|
||||
"elasticsearch.slowlog": {
|
||||
"enabled": false,
|
||||
"vars": {
|
||||
"paths": [
|
||||
"/var/log/elasticsearch/*_index_search_slowlog.json",
|
||||
"/var/log/elasticsearch/*_index_indexing_slowlog.json"
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"elasticsearch-elasticsearch/metrics": {
|
||||
"enabled": false,
|
||||
"vars": {
|
||||
"hosts": [
|
||||
"http://localhost:9200"
|
||||
],
|
||||
"scope": "node"
|
||||
},
|
||||
"streams": {
|
||||
"elasticsearch.stack_monitoring.ccr": {
|
||||
"enabled": false
|
||||
},
|
||||
"elasticsearch.stack_monitoring.cluster_stats": {
|
||||
"enabled": false
|
||||
},
|
||||
"elasticsearch.stack_monitoring.enrich": {
|
||||
"enabled": false
|
||||
},
|
||||
"elasticsearch.stack_monitoring.index": {
|
||||
"enabled": false
|
||||
},
|
||||
"elasticsearch.stack_monitoring.index_recovery": {
|
||||
"enabled": false,
|
||||
"vars": {
|
||||
"active.only": true
|
||||
}
|
||||
},
|
||||
"elasticsearch.stack_monitoring.index_summary": {
|
||||
"enabled": false
|
||||
},
|
||||
"elasticsearch.stack_monitoring.ml_job": {
|
||||
"enabled": false
|
||||
},
|
||||
"elasticsearch.stack_monitoring.node": {
|
||||
"enabled": false
|
||||
},
|
||||
"elasticsearch.stack_monitoring.node_stats": {
|
||||
"enabled": false
|
||||
},
|
||||
"elasticsearch.stack_monitoring.pending_tasks": {
|
||||
"enabled": false
|
||||
},
|
||||
"elasticsearch.stack_monitoring.shard": {
|
||||
"enabled": false
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,29 @@
|
||||
{
|
||||
"package": {
|
||||
"name": "log",
|
||||
"version": "1.1.0"
|
||||
},
|
||||
"name": "import-evtx-logs",
|
||||
"namespace": "so",
|
||||
"description": "Import Windows EVTX logs",
|
||||
"policy_id": "so-grid-nodes",
|
||||
"inputs": {
|
||||
"logs-logfile": {
|
||||
"enabled": true,
|
||||
"streams": {
|
||||
"log.log": {
|
||||
"enabled": true,
|
||||
"vars": {
|
||||
"paths": [
|
||||
"/nsm/import/*/evtx/data.json"
|
||||
],
|
||||
"data_stream.dataset": "import",
|
||||
"tags": [],
|
||||
"processors": "- dissect:\n tokenizer: \"/nsm/import/%{import.id}/evtx/%{import.file}\"\n field: \"log.file.path\"\n target_prefix: \"\"\n- decode_json_fields:\n fields: [\"message\"]\n target: \"\"\n- add_fields:\n target: event\n fields:\n module: windows_eventlog\n imported: true",
|
||||
"custom": "pipeline: import.wel"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,29 @@
|
||||
{
|
||||
"package": {
|
||||
"name": "log",
|
||||
"version": "1.1.0"
|
||||
},
|
||||
"name": "import-suricata-logs",
|
||||
"namespace": "so",
|
||||
"description": "Import Suricata logs",
|
||||
"policy_id": "so-grid-nodes",
|
||||
"inputs": {
|
||||
"logs-logfile": {
|
||||
"enabled": true,
|
||||
"streams": {
|
||||
"log.log": {
|
||||
"enabled": true,
|
||||
"vars": {
|
||||
"paths": [
|
||||
"/nsm/import/*/suricata/eve*.json"
|
||||
],
|
||||
"data_stream.dataset": "import",
|
||||
"tags": [],
|
||||
"processors": "- add_fields:\n target: event\n fields:\n category: network\n module: suricata\n imported: true\n- dissect:\n tokenizer: \"/nsm/import/%{import.id}/suricata/%{import.file}\"\n field: \"log.file.path\"\n target_prefix: \"\"",
|
||||
"custom": "pipeline: suricata.common"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,29 @@
|
||||
{
|
||||
"package": {
|
||||
"name": "log",
|
||||
"version": "1.1.0"
|
||||
},
|
||||
"name": "import-zeek-logs",
|
||||
"namespace": "so",
|
||||
"description": "Zeek Import logs",
|
||||
"policy_id": "so-grid-nodes",
|
||||
"inputs": {
|
||||
"logs-logfile": {
|
||||
"enabled": true,
|
||||
"streams": {
|
||||
"log.log": {
|
||||
"enabled": true,
|
||||
"vars": {
|
||||
"paths": [
|
||||
"/nsm/import/*/zeek/logs/*.log"
|
||||
],
|
||||
"data_stream.dataset": "import",
|
||||
"tags": [],
|
||||
"processors": "- dissect:\n tokenizer: \"/nsm/import/%{import.id}/zeek/logs/%{import.file}\"\n field: \"log.file.path\"\n target_prefix: \"\"\n- script:\n lang: javascript\n source: >\n function process(event) {\n var pl = event.Get(\"import.file\").slice(0,-4);\n event.Put(\"@metadata.pipeline\", \"zeek.\" + pl);\n }\n- add_fields:\n target: event\n fields:\n category: network\n module: zeek\n imported: true\n- add_tags:\n tags: \"ics\"\n when:\n regexp:\n import.file: \"^bacnet*|^bsap*|^cip*|^cotp*|^dnp3*|^ecat*|^enip*|^modbus*|^opcua*|^profinet*|^s7comm*\"",
|
||||
"custom": "exclude_files: [\"broker|capture_loss|ecat_arp_info|loaded_scripts|packet_filter|stats|stderr|stdout.log$\"]\n"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,20 @@
|
||||
{
|
||||
"package": {
|
||||
"name": "osquery_manager",
|
||||
"version": "1.6.0"
|
||||
},
|
||||
"name": "osquery-grid-nodes",
|
||||
"namespace": "default",
|
||||
"policy_id": "so-grid-nodes",
|
||||
"inputs": {
|
||||
"osquery_manager-osquery": {
|
||||
"enabled": true,
|
||||
"streams": {
|
||||
"osquery_manager.result": {
|
||||
"enabled": true,
|
||||
"vars": {}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,76 @@
|
||||
{
|
||||
"package": {
|
||||
"name": "redis",
|
||||
"version": "1.4.0"
|
||||
},
|
||||
"name": "redis-logs",
|
||||
"namespace": "default",
|
||||
"description": "Redis logs",
|
||||
"policy_id": "so-grid-nodes",
|
||||
"inputs": {
|
||||
"redis-logfile": {
|
||||
"enabled": true,
|
||||
"streams": {
|
||||
"redis.log": {
|
||||
"enabled": true,
|
||||
"vars": {
|
||||
"paths": [
|
||||
"/opt/so/log/redis/redis.log"
|
||||
],
|
||||
"tags": [
|
||||
"redis-log"
|
||||
],
|
||||
"preserve_original_event": false
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"redis-redis": {
|
||||
"enabled": false,
|
||||
"streams": {
|
||||
"redis.slowlog": {
|
||||
"enabled": false,
|
||||
"vars": {
|
||||
"hosts": [
|
||||
"127.0.0.1:6379"
|
||||
],
|
||||
"password": ""
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"redis-redis/metrics": {
|
||||
"enabled": false,
|
||||
"vars": {
|
||||
"hosts": [
|
||||
"127.0.0.1:6379"
|
||||
],
|
||||
"idle_timeout": "20s",
|
||||
"maxconn": 10,
|
||||
"network": "tcp",
|
||||
"password": ""
|
||||
},
|
||||
"streams": {
|
||||
"redis.info": {
|
||||
"enabled": false,
|
||||
"vars": {
|
||||
"period": "10s"
|
||||
}
|
||||
},
|
||||
"redis.key": {
|
||||
"enabled": false,
|
||||
"vars": {
|
||||
"key.patterns": "- limit: 20\n pattern: *\n",
|
||||
"period": "10s"
|
||||
}
|
||||
},
|
||||
"redis.keyspace": {
|
||||
"enabled": false,
|
||||
"vars": {
|
||||
"period": "10s"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,29 @@
|
||||
{
|
||||
"package": {
|
||||
"name": "log",
|
||||
"version": "1.1.2"
|
||||
},
|
||||
"name": "soc-auth-sync-logs",
|
||||
"namespace": "so",
|
||||
"description": "Security Onion - Elastic Auth Sync - Logs",
|
||||
"policy_id": "so-grid-nodes",
|
||||
"inputs": {
|
||||
"logs-logfile": {
|
||||
"enabled": true,
|
||||
"streams": {
|
||||
"log.log": {
|
||||
"enabled": true,
|
||||
"vars": {
|
||||
"paths": [
|
||||
"/opt/so/log/soc/sync.log"
|
||||
],
|
||||
"data_stream.dataset": "soc",
|
||||
"tags": [],
|
||||
"processors": "- dissect:\n tokenizer: \"%{event.action}\"\n field: \"message\"\n target_prefix: \"\"\n- add_fields:\n target: event\n fields:\n category: host\n module: soc\n dataset_temp: auth_sync",
|
||||
"custom": "pipeline: common"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,29 @@
|
||||
{
|
||||
"package": {
|
||||
"name": "log",
|
||||
"version": "1.1.2"
|
||||
},
|
||||
"name": "soc-salt-relay-logs",
|
||||
"namespace": "so",
|
||||
"description": "Security Onion - Salt Relay - Logs",
|
||||
"policy_id": "so-grid-nodes",
|
||||
"inputs": {
|
||||
"logs-logfile": {
|
||||
"enabled": true,
|
||||
"streams": {
|
||||
"log.log": {
|
||||
"enabled": true,
|
||||
"vars": {
|
||||
"paths": [
|
||||
"/opt/so/log/soc/salt-relay.log"
|
||||
],
|
||||
"data_stream.dataset": "soc",
|
||||
"tags": [],
|
||||
"processors": "- dissect:\n tokenizer: \"%{soc.ts} | %{event.action}\"\n field: \"message\"\n target_prefix: \"\"\n- add_fields:\n target: event\n fields:\n category: host\n module: soc\n dataset_temp: salt_relay",
|
||||
"custom": "pipeline: common"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,29 @@
|
||||
{
|
||||
"package": {
|
||||
"name": "log",
|
||||
"version": "1.1.2"
|
||||
},
|
||||
"name": "soc-sensoroni-logs",
|
||||
"namespace": "so",
|
||||
"description": "Security Onion - Sensoroni - Logs",
|
||||
"policy_id": "so-grid-nodes",
|
||||
"inputs": {
|
||||
"logs-logfile": {
|
||||
"enabled": true,
|
||||
"streams": {
|
||||
"log.log": {
|
||||
"enabled": true,
|
||||
"vars": {
|
||||
"paths": [
|
||||
"/opt/so/log/sensoroni/sensoroni.log"
|
||||
],
|
||||
"data_stream.dataset": "soc",
|
||||
"tags": [],
|
||||
"processors": "- decode_json_fields:\n fields: [\"message\"]\n target: \"sensoroni\"\n process_array: true\n max_depth: 2\n add_error_key: true \n- add_fields:\n target: event\n fields:\n category: host\n module: soc\n dataset_temp: sensoroni\n- rename:\n fields:\n - from: \"sensoroni.fields.sourceIp\"\n to: \"source.ip\"\n - from: \"sensoroni.fields.status\"\n to: \"http.response.status_code\"\n - from: \"sensoroni.fields.method\"\n to: \"http.request.method\"\n - from: \"sensoroni.fields.path\"\n to: \"url.path\"\n - from: \"sensoroni.message\"\n to: \"event.action\"\n - from: \"sensoroni.level\"\n to: \"log.level\"\n ignore_missing: true",
|
||||
"custom": "pipeline: common"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,29 @@
|
||||
{
|
||||
"package": {
|
||||
"name": "log",
|
||||
"version": "1.1.2"
|
||||
},
|
||||
"name": "soc-server-logs",
|
||||
"namespace": "so",
|
||||
"description": "Security Onion Console Logs",
|
||||
"policy_id": "so-grid-nodes",
|
||||
"inputs": {
|
||||
"logs-logfile": {
|
||||
"enabled": true,
|
||||
"streams": {
|
||||
"log.log": {
|
||||
"enabled": true,
|
||||
"vars": {
|
||||
"paths": [
|
||||
"/opt/so/log/soc/sensoroni-server.log"
|
||||
],
|
||||
"data_stream.dataset": "soc",
|
||||
"tags": [],
|
||||
"processors": "- decode_json_fields:\n fields: [\"message\"]\n target: \"soc\"\n process_array: true\n max_depth: 2\n add_error_key: true \n- add_fields:\n target: event\n fields:\n category: host\n module: soc\n dataset_temp: server\n- rename:\n fields:\n - from: \"soc.fields.sourceIp\"\n to: \"source.ip\"\n - from: \"soc.fields.status\"\n to: \"http.response.status_code\"\n - from: \"soc.fields.method\"\n to: \"http.request.method\"\n - from: \"soc.fields.path\"\n to: \"url.path\"\n - from: \"soc.message\"\n to: \"event.action\"\n - from: \"soc.level\"\n to: \"log.level\"\n ignore_missing: true",
|
||||
"custom": "pipeline: common"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,29 @@
|
||||
{
|
||||
"package": {
|
||||
"name": "log",
|
||||
"version": "1.1.0"
|
||||
},
|
||||
"name": "strelka-logs",
|
||||
"namespace": "so",
|
||||
"description": "Strelka logs",
|
||||
"policy_id": "so-grid-nodes",
|
||||
"inputs": {
|
||||
"logs-logfile": {
|
||||
"enabled": true,
|
||||
"streams": {
|
||||
"log.log": {
|
||||
"enabled": true,
|
||||
"vars": {
|
||||
"paths": [
|
||||
"/nsm/strelka/log/strelka.log"
|
||||
],
|
||||
"data_stream.dataset": "strelka",
|
||||
"tags": [],
|
||||
"processors": "- add_fields:\n target: event\n fields:\n category: file\n module: strelka",
|
||||
"custom": "pipeline: strelka.file"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,29 @@
|
||||
{
|
||||
"package": {
|
||||
"name": "log",
|
||||
"version": "1.1.0"
|
||||
},
|
||||
"name": "suricata-logs",
|
||||
"namespace": "so",
|
||||
"description": "Suricata integration",
|
||||
"policy_id": "so-grid-nodes",
|
||||
"inputs": {
|
||||
"logs-logfile": {
|
||||
"enabled": true,
|
||||
"streams": {
|
||||
"log.log": {
|
||||
"enabled": true,
|
||||
"vars": {
|
||||
"paths": [
|
||||
"/nsm/suricata/eve*.json"
|
||||
],
|
||||
"data_stream.dataset": "suricata",
|
||||
"tags": [],
|
||||
"processors": "- add_fields:\n target: event\n fields:\n category: network\n module: suricata",
|
||||
"custom": "pipeline: suricata.common"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,32 @@
|
||||
{
|
||||
"package": {
|
||||
"name": "tcp",
|
||||
"version": "1.5.0"
|
||||
},
|
||||
"name": "syslog-tcp-514",
|
||||
"namespace": "so",
|
||||
"description": "Syslog Over TCP Port 514",
|
||||
"policy_id": "so-grid-nodes",
|
||||
"inputs": {
|
||||
"tcp-tcp": {
|
||||
"enabled": true,
|
||||
"streams": {
|
||||
"tcp.generic": {
|
||||
"enabled": true,
|
||||
"vars": {
|
||||
"listen_address": "0.0.0.0",
|
||||
"listen_port": "514",
|
||||
"data_stream.dataset": "syslog",
|
||||
"pipeline": "syslog",
|
||||
"processors": "- add_fields:\n target: event\n fields:\n module: syslog",
|
||||
"tags": [
|
||||
"syslog"
|
||||
],
|
||||
"syslog_options": "field: message\n#format: auto\n#timezone: Local",
|
||||
"ssl": ""
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,33 @@
|
||||
{
|
||||
"package": {
|
||||
"name": "udp",
|
||||
"version": "1.5.0"
|
||||
},
|
||||
"name": "syslog-udp-514",
|
||||
"namespace": "so",
|
||||
"description": "Syslog over UDP Port 514",
|
||||
"policy_id": "so-grid-nodes",
|
||||
"inputs": {
|
||||
"udp-udp": {
|
||||
"enabled": true,
|
||||
"streams": {
|
||||
"udp.generic": {
|
||||
"enabled": true,
|
||||
"vars": {
|
||||
"listen_address": "0.0.0.0",
|
||||
"listen_port": "514",
|
||||
"data_stream.dataset": "syslog",
|
||||
"pipeline": "syslog",
|
||||
"max_message_size": "10KiB",
|
||||
"keep_null": false,
|
||||
"processors": "- add_fields:\n target: event\n fields: \n module: syslog\n",
|
||||
"tags": [
|
||||
"syslog"
|
||||
],
|
||||
"syslog_options": "field: message\n#format: auto\n#timezone: Local"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,47 @@
|
||||
{
|
||||
"package": {
|
||||
"name": "system",
|
||||
"version": "1.25.2"
|
||||
},
|
||||
"name": "system-grid-nodes",
|
||||
"namespace": "default",
|
||||
"policy_id": "so-grid-nodes",
|
||||
"inputs": {
|
||||
"system-logfile": {
|
||||
"enabled": true,
|
||||
"streams": {
|
||||
"system.auth": {
|
||||
"enabled": true,
|
||||
"vars": {
|
||||
"ignore_older": "72h",
|
||||
"paths": [
|
||||
"/var/log/auth.log*",
|
||||
"/var/log/secure*"
|
||||
],
|
||||
"preserve_original_event": false,
|
||||
"tags": [
|
||||
"system-auth"
|
||||
]
|
||||
}
|
||||
},
|
||||
"system.syslog": {
|
||||
"enabled": true,
|
||||
"vars": {
|
||||
"paths": [
|
||||
"/var/log/messages*",
|
||||
"/var/log/syslog*"
|
||||
],
|
||||
"tags": [],
|
||||
"ignore_older": "72h"
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"system-winlog": {
|
||||
"enabled": false
|
||||
},
|
||||
"system-system/metrics": {
|
||||
"enabled": false
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,29 @@
|
||||
{
|
||||
"package": {
|
||||
"name": "log",
|
||||
"version": "1.1.0"
|
||||
},
|
||||
"name": "zeek-logs",
|
||||
"namespace": "so",
|
||||
"description": "Zeek logs",
|
||||
"policy_id": "so-grid-nodes",
|
||||
"inputs": {
|
||||
"logs-logfile": {
|
||||
"enabled": true,
|
||||
"streams": {
|
||||
"log.log": {
|
||||
"enabled": true,
|
||||
"vars": {
|
||||
"paths": [
|
||||
"/nsm/zeek/logs/current/*.log"
|
||||
],
|
||||
"data_stream.dataset": "zeek",
|
||||
"tags": [],
|
||||
"processors": "- dissect:\n tokenizer: \"/nsm/zeek/logs/current/%{pipeline}.log\"\n field: \"log.file.path\"\n trim_chars: \".log\"\n target_prefix: \"\"\n- script:\n lang: javascript\n source: >\n function process(event) {\n var pl = event.Get(\"pipeline\");\n event.Put(\"@metadata.pipeline\", \"zeek.\" + pl);\n }\n- add_fields:\n target: event\n fields:\n category: network\n module: zeek\n- add_tags:\n tags: \"ics\"\n when:\n regexp:\n pipeline: \"^bacnet*|^bsap*|^cip*|^cotp*|^dnp3*|^ecat*|^enip*|^modbus*|^opcua*|^profinet*|^s7comm*\"",
|
||||
"custom": "exclude_files: [\"broker|capture_loss|ecat_arp_info|loaded_scripts|packet_filter|stats|stderr|stdout.log$\"]\n"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user