CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-23 01:13:09 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #494 from Security-Onion-Solutions/search_ls_pillar

Browse Source 
Search ls pillar
This commit is contained in:
weslambert
2020-04-01 15:13:17 -04:00
committed by GitHub
parent 38b5cffd16 22e7777d67
commit 5f8d1c29b4
6 changed files with 18 additions and 61 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
salt/logstash/pipelines/config/so/9000_output_bro.conf.jinja → salt/logstash/pipelines/config/so/9000_output_zeek.conf.jinja
View File

@@ -10,17 +10,16 @@
filter {
if "zeek" in [tags] and "test_data" not in [tags] and "import" not in [tags] {
if [module] =~ "zeek" {
mutate {
##add_tag => [ "conf_file_9000"]
}
}
}
output {
if "zeek" in [tags] and "test_data" not in [tags] and "import" not in [tags] {
# stdout { codec => rubydebug }
if [module] =~ "zeek" {
elasticsearch {
pipeline => "%{event_type}"
pipeline => "%{module}.%{dataset}"
hosts => "{{ ES }}"
index => "so-zeek-%{+YYYY.MM.dd}"
template_name => "so-zeek"

5
salt/logstash/pipelines/config/so/9100_output_osquery.conf.jinja
View File

@@ -9,11 +9,12 @@
output {
if "osquery" in [tags] {
if [module] =~ "osquery" {
elasticsearch {
pipeline => "%{module}.%{dataset}"
hosts => "{{ ES }}"
index => "so-osquery-%{+YYYY.MM.dd}"
template => "/so-common-template.json"
}
}
}
}

6
salt/logstash/pipelines/config/so/9400_output_suricata.conf.jinja
View File

@@ -9,16 +9,16 @@
# Last Update: 12/9/2016
filter {
if [event_type] == "suricata" and "test_data" not in [tags] {
if [module] == "suricata" {
mutate {
##add_tag => [ "conf_file_9400"]
}
}
}
output {
if [event_type] == "suricata" and "test_data" not in [tags] {
#stdout { codec => rubydebug }
if [module] =~ "suricata" {
elasticsearch {
pipeline => "%{module}.%{dataset}"
hosts => "{{ ES }}"
index => "so-ids-%{+YYYY.MM.dd}"
template => "/so-common-template.json"

6
salt/logstash/pipelines/config/so/9600_output_ossec.conf.jinja
View File

@@ -9,7 +9,7 @@
# Last Update: 9/19/2018
filter {
if [event_type] =~ "ossec" {
if [module] =~ "ossec" {
mutate {
##add_tag => [ "conf_file_9600"]
}
@@ -17,9 +17,9 @@ filter {
}
output {
if [event_type] =~ "ossec" or "ossec" in [tags] {
if [module] =~ "ossec" {
elasticsearch {
pipeline => "%{event_type}"
pipeline => "%{module}.%{dataset}"
hosts => "{{ ES }}"
index => "so-ossec-%{+YYYY.MM.dd}"
template_name => "so-common"

3
salt/logstash/pipelines/config/so/9700_output_strelka.conf.jinja
View File

@@ -10,7 +10,7 @@
filter {
if [event_type] =~ "strelka" {
if [module] =~ "strelka" {
mutate {
##add_tag => [ "conf_file_9000"]
}
@@ -19,6 +19,7 @@ filter {
output {
if [event_type] =~ "strelka" {
elasticsearch {
pipeline => "%{module}.%{dataset}"
hosts => "{{ ES }}"
index => "so-strelka-%{+YYYY.MM.dd}"
template_name => "so-common"