CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 09:12:45 +01:00
Code Issues Packages Projects Releases Wiki Activity

Update 9997_output_helix.conf

Browse Source
This commit is contained in:
Mike Reeves
2020-02-10 22:47:11 -05:00
committed by GitHub
parent 9e5c96ddfa
commit 521de8f154
1 changed files with 40 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files

48
salt/logstash/conf/pipelines/helix/templates/9997_output_helix.conf
View File

@@ -3,7 +3,7 @@
{% set CBNAME = grains.host %}
filter {
if [type] =~ /^bro_conn|bro_dns|bro_http|bro_files|bro_ssl|bro_dhcp|bro_x509$/ {
if [type] =~ /^bro_conn|bro_dns|bro_http|bro_files|bro_ssl|bro_dhcp|bro_x509|suricata$/ {
grok {
match => [
"source_ip", "^%{IPV4:srcipv4}$",
@@ -17,28 +17,27 @@ filter {
]
}
geoip {
source => "[source_ip]"
target => "source_geo"
}
geoip {
source => "[destination_ip]"
target => "destination_geo"
}
#geoip {
# source => "[source_ip]"
# target => "source_geo"
#}
#geoip {
# source => "[destination_ip]"
# target => "destination_geo"
#}
mutate {
#rename => { "%{[source_geo][country_code]}" => "srccountrycode" }
#rename => { "%{[destination_geo][country_code]}" => "dstcountrycode" }
rename => { "[beat_host][name]" => "sensor" }
copy => { "sensor" => "rawmsghostname" }
rename => { "message" => "rawmsg" }
#rename => { "event_type" => "program" }
copy => { "type" => "class" }
copy => { "class" => "program"}
rename => { "source_port" => "srcport" }
rename => { "destination_port" => "dstport" }
add_field => { "metacbid" => "{{ UNIQUEID }}"}
add_field => { "metacbname" => "{{ CBNAME }}"}
remove_field => ["source_ip", "destination_ip"]
rename => { "[log][file][path]" => "filepath" }
add_field => { "meta_cbid" => "{{ UNIQUEID }}" }
add_field => { "meta_cbname" => "{{ CBNAME }}" }
remove_field => ["source_ip", "destination_ip", "syslog-host_from"]
remove_field => ["beat_host", "timestamp", "type", "log", "@version", "@timestamp"]
remove_field => ["sensorname", "sensor_name", "service", "source", "tags", "syslog-host"]
remove_field => ["sensor_name", "source_ips", "ips", "destination_ips", "syslog-priority", "syslog-file_name", "syslog-facility"]
}
@@ -56,6 +55,7 @@ filter {
rename => { "local_respond" => "local_resp" }
rename => { "local_orig" => "localorig" }
rename => { "missed_bytes" => "missingbytes" }
rename => { "connection_state_description" => "description" }
}
}
if "bro_dns" in [class] {
@@ -69,12 +69,16 @@ filter {
rename => { "query_type_name" => "querytypename" }
rename => { "ra" => "recursionavailable" }
rename => { "rd" => "recursiondesired" }
rename => { "uid" => "connectionid" }
rename => { "ttls" => "ttl" }
rename => { "transaction_id" => "transactionid" }
}
}
if "bro_dhcp" in [class] {
mutate{
#add_field = { "metaclass" => "dhcp"}
rename => { "message_types" => "direction" }
rename => { "uid" => "connectionid" }
rename => { "lease_time" => "duration" }
}
}
@@ -82,8 +86,14 @@ filter {
mutate{
#add_field = { "metaclass" => "dns"}
rename => { "missing_bytes" => "missingbytes" }
rename => { "seen_bytes" => "seenbytes" }
rename => { "overflow_bytes" => "overflowbytes" }
rename => { "fuid" => "fileid" }
rename => { "uid" => "connectionid" }
rename => { "conn_uids" => "connectionid" }
rename => { "is_orig" => "isorig" }
rename => { "timed_out" => "timedout" }
rename => { "local_orig" => "localorig" }
rename => { "file_ip" => "tx_host" }
}
}
if "bro_http" in [class] {
@@ -99,6 +109,9 @@ filter {
rename => { "uid" => "connectionid" }
rename => { "ts"=> "eventtime" }
rename => { "@timestamp"=> "eventtime" }
rename => { "trans_depth" => "depth" }
rename => { "request_body_length" => "sentbodybytes" }
rename => { "response_body_length" => "rcvdbodybytes" }
}
}
if "bro_ssl" in [class] {
@@ -110,6 +123,7 @@ filter {
rename => { "resp_fuids" => "rcvdfileid" }
rename => { "response_body_len" => "rcvdbodybytes" }
rename => { "request_body_len" => "sentbodybytes" }
rename => { "uid" => "connectionid" }
}
}
if "bro_weird" in [class] {
@@ -133,7 +147,7 @@ filter {
}
output {
if [type] =~ /^bro_conn|bro_dns|bro_http|bro_files|bro_ssl|bro_dhcp|bro_x509$/ {
if [class] =~ /^bro_conn|bro_dns|bro_http|bro_files|bro_ssl|bro_dhcp|bro_x509|suricata$/ {
http {
url => "https://helix-integrations.cloud.aws.apps.fireeye.com/api/upload"
http_method => post