diff --git a/salt/elasticsearch/files/ingest/zeek.profinet b/salt/elasticsearch/files/ingest/zeek.profinet new file mode 100644 index 000000000..e9d69c0dc --- /dev/null +++ b/salt/elasticsearch/files/ingest/zeek.profinet @@ -0,0 +1,13 @@ +{ + "description" : "zeek.profinet", + "processors" : [ + { "remove": { "field": ["host"], "ignore_failure": true } }, + { "json": { "field": "message", "target_field": "message2", "ignore_failure": true} }, + { "rename": { "field": "message2.operation_type", "target_field": "profinet.operation_type", "ignore_missing": true } }, + { "rename": { "field": "message2.block_version", "target_field": "profinet.block_version", "ignore_missing": true } }, + { "rename": { "field": "message2.slot_number", "target_field": "profinet.slot_number", "ignore_missing": true } }, + { "rename": { "field": "message2.subslot_number", "target_field": "profinet.subslot_number", "ignore_missing": true } }, + { "rename": { "field": "message2.index", "target_field": "profinet.index", "ignore_missing": true } }, + { "pipeline": { "name": "zeek.common" } } + ] +} diff --git a/salt/elasticsearch/files/ingest/zeek.profinet_dce_rpc b/salt/elasticsearch/files/ingest/zeek.profinet_dce_rpc new file mode 100644 index 000000000..e89fd7d95 --- /dev/null +++ b/salt/elasticsearch/files/ingest/zeek.profinet_dce_rpc @@ -0,0 +1,15 @@ +{ + "description" : "zeek.profinet_dce_rpc", + "processors" : [ + { "remove": { "field": ["host"], "ignore_failure": true } }, + { "json": { "field": "message", "target_field": "message2", "ignore_failure": true} }, + { "rename": { "field": "message2.version", "target_field": "profinet.version", "ignore_missing": true } }, + { "rename": { "field": "message2.packet_type", "target_field": "profinet.packet_type", "ignore_missing": true } }, + { "rename": { "field": "message2.object_uuid", "target_field": "profinet.object_uuid", "ignore_missing": true } }, + { "rename": { "field": "message2.interface_uuid", "target_field": "profinet.interface_uuid", "ignore_missing": true } }, + { "rename": { "field": "message2.activity_uuid", "target_field": "profinet.activity_uuid", "ignore_missing": true } }, + { "rename": { "field": "message2.server_boot_time", "target_field": "profinet.server.boot_time", "ignore_missing": true } }, + { "rename": { "field": "message2.operation", "target_field": "profinet.operation", "ignore_missing": true } }, + { "pipeline": { "name": "zeek.common" } } + ] +} diff --git a/salt/elasticsearch/files/ingest/zeek.s7comm b/salt/elasticsearch/files/ingest/zeek.s7comm new file mode 100644 index 000000000..646c6bec3 --- /dev/null +++ b/salt/elasticsearch/files/ingest/zeek.s7comm @@ -0,0 +1,15 @@ +{ + "description" : "zeek.s7comm", + "processors" : [ + { "remove": { "field": ["host"], "ignore_failure": true } }, + { "json": { "field": "message", "target_field": "message2", "ignore_failure": true} }, + { "rename": { "field": "message2.rosctr_code", "target_field": "s7.ros.control.code", "ignore_missing": true } }, + { "rename": { "field": "message2.rosctr_name", "target_field": "s7.ros.control.name", "ignore_missing": true } }, + { "rename": { "field": "message2.pdu_reference", "target_field": "s7.pdu_reference", "ignore_missing": true } }, + { "rename": { "field": "message2.function_code", "target_field": "s7.function.code", "ignore_missing": true } }, + { "rename": { "field": "message2.function_name", "target_field": "s7.function.name", "ignore_missing": true } }, + { "rename": { "field": "message2.error_class", "target_field": "s7.error.class", "ignore_missing": true } }, + { "rename": { "field": "message2.error_code", "target_field": "s7.error.code", "ignore_missing": true } }, + { "pipeline": { "name": "zeek.common" } } + ] +} diff --git a/salt/elasticsearch/files/ingest/zeek.s7comm_plus b/salt/elasticsearch/files/ingest/zeek.s7comm_plus new file mode 100644 index 000000000..a6acd1b35 --- /dev/null +++ b/salt/elasticsearch/files/ingest/zeek.s7comm_plus @@ -0,0 +1,11 @@ +{ + "description" : "zeek.s7comm_plus", + "processors" : [ + { "remove": { "field": ["host"], "ignore_failure": true } }, + { "json": { "field": "message", "target_field": "message2", "ignore_failure": true} }, + { "rename": { "field": "message2.version", "target_field": "s7.version", "ignore_missing": true } }, + { "rename": { "field": "message2.opcode", "target_field": "s7.opcode.value", "ignore_missing": true } }, + { "rename": { "field": "message2.opcode_name", "target_field": "s7.opcode.name", "ignore_missing": true } }, + { "pipeline": { "name": "zeek.common" } } + ] +} diff --git a/salt/elasticsearch/files/ingest/zeek.stun b/salt/elasticsearch/files/ingest/zeek.stun new file mode 100644 index 000000000..f5e7d1baf --- /dev/null +++ b/salt/elasticsearch/files/ingest/zeek.stun @@ -0,0 +1,15 @@ +{ + "description" : "zeek.stun", + "processors" : [ + { "remove": { "field": ["host"], "ignore_failure": true } }, + { "json": { "field": "message", "target_field": "message2", "ignore_failure": true} }, + { "rename": { "field": "message2.proto", "target_field": "network.protocol", "ignore_missing": true } }, + { "rename": { "field": "message2.is_orig", "target_field": "stun.is_orig", "ignore_missing": true } }, + { "rename": { "field": "message2.trans_id", "target_field": "stun.id", "ignore_missing": true } }, + { "rename": { "field": "message2.method", "target_field": "stun.method", "ignore_missing": true } }, + { "rename": { "field": "message2.class", "target_field": "stun.clas", "ignore_missing": true } }, + { "rename": { "field": "message2.attr_types", "target_field": "stun.attribute.types", "ignore_missing": true } }, + { "rename": { "field": "message2.attr_vals", "target_field": "stun.attribute.values", "ignore_missing": true } }, + { "pipeline": { "name": "zeek.common" } } + ] +} diff --git a/salt/elasticsearch/files/ingest/zeek.stun_nat b/salt/elasticsearch/files/ingest/zeek.stun_nat new file mode 100644 index 000000000..45f9b3055 --- /dev/null +++ b/salt/elasticsearch/files/ingest/zeek.stun_nat @@ -0,0 +1,13 @@ +{ + "description" : "zeek.stun_nat", + "processors" : [ + { "remove": { "field": ["host"], "ignore_failure": true } }, + { "json": { "field": "message", "target_field": "message2", "ignore_failure": true} }, + { "rename": { "field": "message2.proto", "target_field": "network.protocol", "ignore_missing": true } }, + { "rename": { "field": "message2.is_orig", "target_field": "stun.is_orig", "ignore_missing": true } }, + { "rename": { "field": "message2.wan_addrs", "target_field": "stun.wan.addresses", "ignore_missing": true } }, + { "rename": { "field": "message2.wan_ports", "target_field": "stun.wan.ports", "ignore_missing": true } }, + { "rename": { "field": "message2.lan_addrs", "target_field": "stun.lan.addresses", "ignore_missing": true } }, + { "pipeline": { "name": "zeek.common" } } + ] +} diff --git a/salt/elasticsearch/files/ingest/zeek.wireguard b/salt/elasticsearch/files/ingest/zeek.wireguard new file mode 100644 index 000000000..ac8e56964 --- /dev/null +++ b/salt/elasticsearch/files/ingest/zeek.wireguard @@ -0,0 +1,11 @@ +{ + "description" : "zeek.wireguard", + "processors" : [ + { "remove": { "field": ["host"], "ignore_failure": true } }, + { "json": { "field": "message", "target_field": "message2", "ignore_failure": true} }, + { "rename": { "field": "message2.established", "target_field": "wireguard.established", "ignore_missing": true } }, + { "rename": { "field": "message2.initiations", "target_field": "wireguard.initiations", "ignore_missing": true } }, + { "rename": { "field": "message2.responses", "target_field": "wireguard.respsonses", "ignore_missing": true } }, + { "pipeline": { "name": "zeek.common" } } + ] +}