From 56aa24d874a51f8b1ab01cc6e6574242bc2fdcb5 Mon Sep 17 00:00:00 2001 From: Josh Brower Date: Mon, 10 Jan 2022 13:55:38 -0500 Subject: [PATCH] Fix Wazuh WEL Parsing --- salt/elasticsearch/files/ingest/ossec | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/salt/elasticsearch/files/ingest/ossec b/salt/elasticsearch/files/ingest/ossec index 20da23213..eceb20f28 100644 --- a/salt/elasticsearch/files/ingest/ossec +++ b/salt/elasticsearch/files/ingest/ossec @@ -39,6 +39,12 @@ { "rename": { "field": "decoder.name", "target_field": "event.dataset", "ignore_missing": true } }, { "rename": { "field": "rule.description", "target_field": "rule.name", "ignore_missing": true } }, { "rename": { "field": "rule.id", "target_field": "rule.uuid", "ignore_missing": true } }, + { "script": { + "if": "ctx.winlog?.event_data != null", + "lang": "painless", + "source": "Map eventData = ctx['winlog']['event_data']; Map updatedEventData = new HashMap(); for (String key: eventData.keySet()) { updatedEventData[key.substring(0,1).toUpperCase() + key.substring(1)] = eventData[key] } ctx['winlog']['event_data'] = updatedEventData" + } + }, { "set": { "if": "ctx.rule != null && ctx.rule.level == 1", "field": "rule.category", "value": "None" } }, { "set": { "if": "ctx.rule != null && ctx.rule.level == 2", "field": "rule.category", "value": "System low priority notification" } }, { "set": { "if": "ctx.rule != null && ctx.rule.level == 3", "field": "rule.category", "value": "Successful/authorized event" } },