From 60d2a0818bf0337197b0a5938abb861a7bafdf90 Mon Sep 17 00:00:00 2001 From: Doug Burks Date: Fri, 15 May 2020 15:31:17 -0400 Subject: [PATCH 1/2] Add to zeek.dns and have it send to zeek.dns.tld https://github.com/Security-Onion-Solutions/securityonion-saltstack/issues/599 --- salt/elasticsearch/files/ingest/zeek.dns | 1 + 1 file changed, 1 insertion(+) diff --git a/salt/elasticsearch/files/ingest/zeek.dns b/salt/elasticsearch/files/ingest/zeek.dns index ecbb9f1e8..b017699ed 100644 --- a/salt/elasticsearch/files/ingest/zeek.dns +++ b/salt/elasticsearch/files/ingest/zeek.dns @@ -23,6 +23,7 @@ { "rename": { "field": "message2.TTLs", "target_field": "dns.ttls", "ignore_missing": true } }, { "rename": { "field": "message2.rejected", "target_field": "dns.query.rejected", "ignore_missing": true } }, { "script": { "lang": "painless", "source": "ctx.dns.query.length = ctx.dns.query.name.length()", "ignore_failure": true } }, + { "pipeline": { "if": "ctx.dns.query.type_name != 'NB' && ctx.dns.query.type_name != 'TKEY' && ctx.dns.query.type_name != 'NBSTAT' && ctx.dns.query.type_name != 'PTR'", "name": "zeek.dns.tld"} }, { "pipeline": { "name": "zeek.common" } } ] } From cc7a244d0b8416231f93790998a16cbcd1573407 Mon Sep 17 00:00:00 2001 From: Doug Burks Date: Fri, 15 May 2020 15:32:25 -0400 Subject: [PATCH 2/2] Create zeek.dns.tld https://github.com/Security-Onion-Solutions/securityonion-saltstack/issues/599 --- salt/elasticsearch/files/ingest/zeek.dns.tld | 13 +++++++++++++ 1 file changed, 13 insertions(+) create mode 100644 salt/elasticsearch/files/ingest/zeek.dns.tld diff --git a/salt/elasticsearch/files/ingest/zeek.dns.tld b/salt/elasticsearch/files/ingest/zeek.dns.tld new file mode 100644 index 000000000..f82cc628a --- /dev/null +++ b/salt/elasticsearch/files/ingest/zeek.dns.tld @@ -0,0 +1,13 @@ +{ + "description" : "zeek.dns.tld", + "processors" : [ + { "script": { "lang": "painless", "source": "ctx.top_level_domain = ctx.dns.query.name.substring(ctx.dns.query.name.lastIndexOf('.') + 1)", "ignore_failure": true } }, + { "script": { "lang": "painless", "source": "ctx.query_without_tld = ctx.dns.query.name.substring(0, (ctx.dns.query.name.lastIndexOf('.')))", "ignore_failure": true } }, + { "script": { "lang": "painless", "source": "ctx.parent_domain = ctx.query_without_tld.substring(ctx.query_without_tld.lastIndexOf('.') + 1)", "ignore_failure": true } }, + { "script": { "lang": "painless", "source": "ctx.subdomain = ctx.query_without_tld.substring(0, (ctx.query_without_tld.lastIndexOf('.')))", "ignore_failure": true } }, + { "script": { "lang": "painless", "source": "ctx.highest_registered_domain = ctx.parent_domain + '.' + ctx.top_level_domain", "ignore_failure": true } }, + { "script": { "lang": "painless", "source": "ctx.subdomain_length = ctx.subdomain.length()", "ignore_failure": true } }, + { "script": { "lang": "painless", "source": "ctx.parent_domain_length = ctx.parent_domain.length()", "ignore_failure": true } }, + { "remove": { "field": "query_without_tld", "ignore_failure": true } } + ] +}