CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-17 22:42:51 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #9189 from Security-Onion-Solutions/feature/filebeat_config_ics_event_tag_2_4

Browse Source 
Add 'ics' tag to events generated from ICS protocol logs
This commit is contained in:
weslambert
2022-11-21 17:06:14 -05:00
committed by GitHub
parent 6e1e6e15e8 fe180d5657
commit 68efd817e0
1 changed files with 8 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
salt/filebeat/etc/filebeat.yml
View File

@@ -145,6 +145,10 @@ filebeat.inputs:
dataset: {{ LOGNAME }} dataset: {{ LOGNAME }}
category: network category: network
processors: processors:
{%- if LOGNAME is match('^bacnet*|^cip*|^cotp*|^dnp3*|^ecat*|^enip*|^modbus*|^opcua*'|^profinet*'|^s7comm*') %}
- add_tags:
tags: ["ics"]
{%- endif %}
- drop_fields: - drop_fields:
fields: ["source", "prospector", "input", "offset", "beat"] fields: ["source", "prospector", "input", "offset", "beat"]
@@ -162,6 +166,10 @@ filebeat.inputs:
category: network category: network
imported: true imported: true
processors: processors:
{%- if LOGNAME is match('^bacnet*|^cip*|^cotp*|^dnp3*|^ecat*|^enip*|^modbus*|^opcua*'|^profinet*'|^s7comm*') %}
- add_tags:
tags: ["ics"]
{%- endif %}
- add_tags: - add_tags:
tags: ["import"] tags: ["import"]
- dissect: - dissect: