From 5c62fedd12df410ead0ea963b1b07682b54dbf39 Mon Sep 17 00:00:00 2001 From: Mike Reeves Date: Thu, 4 Jun 2020 15:42:51 -0400 Subject: [PATCH] Suricata DNS parser --- salt/elasticsearch/files/ingest/suricata.common | 2 +- salt/elasticsearch/files/ingest/suricata.dns | 5 +++++ 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/salt/elasticsearch/files/ingest/suricata.common b/salt/elasticsearch/files/ingest/suricata.common index cd0ea3fc5..dd08b08a0 100644 --- a/salt/elasticsearch/files/ingest/suricata.common +++ b/salt/elasticsearch/files/ingest/suricata.common @@ -3,7 +3,7 @@ "processors" : [ { "json": { "field": "message", "target_field": "message2", "ignore_failure": true } }, { "rename":{ "field": "message2.proto", "target_field": "network.transport", "ignore_failure": true } }, - { "rename":{ "field": "message2.flow_id", "target_field": "event.id", "ignore_failure": true } }, + { "rename":{ "field": "message2.flow_id", "target_field": "log.id.uid", "ignore_failure": true } }, { "rename":{ "field": "message2.src_ip", "target_field": "source.ip", "ignore_failure": true } }, { "rename":{ "field": "message2.src_port", "target_field": "source.port", "ignore_failure": true } }, { "rename":{ "field": "message2.dest_ip", "target_field": "destination.ip", "ignore_failure": true } }, diff --git a/salt/elasticsearch/files/ingest/suricata.dns b/salt/elasticsearch/files/ingest/suricata.dns index 2db1427b7..45381bfd6 100644 --- a/salt/elasticsearch/files/ingest/suricata.dns +++ b/salt/elasticsearch/files/ingest/suricata.dns @@ -2,7 +2,12 @@ "description" : "suricata.dns", "processors" : [ { "rename": { "field": "message2.proto", "target_field": "network.transport", "ignore_missing": true } }, + { "rename": { "field": "message2.dns.type", "target_field": "dns.type", "ignore_missing": true } }, + { "rename": { "field": "message2.dns.tx_id", "target_field": "dns.id", "ignore_missing": true } }, + { "rename": { "field": "message2.dns.version", "target_field": "dns.version", "ignore_missing": true } }, { "rename": { "field": "message2.dns.rrname", "target_field": "dns.query.name", "ignore_missing": true } }, + { "rename": { "field": "message2.grouped.A", "target_field": "dns.answers", "ignore_missing": true } }, + { "pipeline": { "name": "common" } } ] }