mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2025-12-06 09:12:45 +01:00
Merge remote-tracking branch 'remotes/origin/2.4/dev' into 2.4/firewall
This commit is contained in:
m0duspwnens
@@ -1,4 +1,9 @@
|
||||
#/bin/bash
|
||||
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
|
||||
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
|
||||
# https://securityonion.net/license; you may not use this file except in compliance with the
|
||||
# Elastic License 2.0.
|
||||
|
||||
. /usr/sbin/so-common
|
||||
|
||||
POLICY_ID=$1
|
||||
|
||||
@@ -1,4 +1,9 @@
|
||||
#/bin/bash
|
||||
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
|
||||
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
|
||||
# https://securityonion.net/license; you may not use this file except in compliance with the
|
||||
# Elastic License 2.0.
|
||||
|
||||
. /usr/sbin/so-common
|
||||
|
||||
# Let's snag a cookie from Kibana
|
||||
|
||||
@@ -1,4 +1,9 @@
|
||||
#/bin/bash
|
||||
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
|
||||
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
|
||||
# https://securityonion.net/license; you may not use this file except in compliance with the
|
||||
# Elastic License 2.0.
|
||||
|
||||
. /usr/sbin/so-common
|
||||
|
||||
POLICY_ID=$1
|
||||
|
||||
@@ -1,4 +1,9 @@
|
||||
#/bin/bash
|
||||
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
|
||||
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
|
||||
# https://securityonion.net/license; you may not use this file except in compliance with the
|
||||
# Elastic License 2.0.
|
||||
|
||||
. /usr/sbin/so-common
|
||||
|
||||
# Let's snag a cookie from Kibana
|
||||
|
||||
@@ -0,0 +1,21 @@
|
||||
#/bin/bash
|
||||
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
|
||||
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
|
||||
# https://securityonion.net/license; you may not use this file except in compliance with the
|
||||
# Elastic License 2.0.
|
||||
|
||||
. /usr/sbin/so-common
|
||||
|
||||
POLICY_ID=$1
|
||||
|
||||
# Let's snag a cookie from Kibana
|
||||
SESSIONCOOKIE=$(curl -q -K /opt/so/conf/elasticsearch/curl.config -c - -X GET http://localhost:5601/ | grep sid | awk '{print $7}')
|
||||
|
||||
# Get integration policies relative to agent policy
|
||||
INTEGRATION_POLICY_IDS=$(curl -q -K /opt/so/conf/elasticsearch/curl.config -b "sid=$SESSIONCOOKIE" -L -X GET "localhost:5601/api/fleet/agent_policies/$POLICY_ID" | jq -r '.item.package_policies[].id')
|
||||
|
||||
for i in $INTEGRATION_POLICY_IDS; do
|
||||
# Delete integration policies
|
||||
echo "Deleting integration policy: $i..."
|
||||
curl -K /opt/so/conf/elasticsearch/curl.config -b "sid=$SESSIONCOOKIE" -L -X POST "localhost:5601/api/fleet/package_policies/delete" -H 'kbn-xsrf: true' -H 'Content-Type: application/json' -d"{\"packagePolicyIds\": [\"$i\"], \"force\":true}";
|
||||
done
|
||||
@@ -1,4 +1,9 @@
|
||||
#/bin/bash
|
||||
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
|
||||
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
|
||||
# https://securityonion.net/license; you may not use this file except in compliance with the
|
||||
# Elastic License 2.0.
|
||||
|
||||
. /usr/sbin/so-common
|
||||
|
||||
POLICY_ID=$1
|
||||
|
||||
@@ -1,4 +1,9 @@
|
||||
#/bin/bash
|
||||
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
|
||||
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
|
||||
# https://securityonion.net/license; you may not use this file except in compliance with the
|
||||
# Elastic License 2.0.
|
||||
|
||||
. /usr/sbin/so-common
|
||||
|
||||
# Let's snag a cookie from Kibana
|
||||
|
||||
@@ -1,4 +1,8 @@
|
||||
#/bin/bash
|
||||
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
|
||||
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
|
||||
# https://securityonion.net/license; you may not use this file except in compliance with the
|
||||
# Elastic License 2.0.
|
||||
|
||||
. /usr/sbin/so-common
|
||||
|
||||
@@ -18,58 +22,47 @@ echo "Setting up default Security Onion package policies for Elastic Agent..."
|
||||
|
||||
# Set up Suricata logs
|
||||
echo "Setting up Suricata package policy..."
|
||||
curl -K /opt/so/conf/elasticsearch/curl.config -b "sid=$SESSIONCOOKIE" -L -X POST "localhost:5601/api/fleet/package_policies" -H 'kbn-xsrf: true' -H 'Content-Type: application/json' -d'{ "policy_id": "so-grid-nodes", "package": { "name": "log", "version": "1.1.0" }, "id": "suricata-logs", "name": "suricata-logs", "description": "Suricata integration", "namespace": "suricata_so", "inputs": { "logs-logfile": { "enabled": true, "streams": { "log.log": { "enabled": true, "vars": { "paths": [ "/nsm/suricata/eve*.json" ], "data_stream.dataset": "alert", "tags": [],"processors": "- add_fields:\n target: event\n fields:\n category: network\n module: suricata", "custom": "pipeline: suricata.common" }}}}}}'
|
||||
curl -K /opt/so/conf/elasticsearch/curl.config -b "sid=$SESSIONCOOKIE" -L -X POST "localhost:5601/api/fleet/package_policies" -H 'kbn-xsrf: true' -H 'Content-Type: application/json' -d'{ "policy_id": "so-grid-nodes", "package": { "name": "log", "version": "1.1.0" }, "id": "suricata-logs", "name": "suricata-logs", "description": "Suricata integration", "namespace": "so", "inputs": { "logs-logfile": { "enabled": true, "streams": { "log.log": { "enabled": true, "vars": { "paths": [ "/nsm/suricata/eve*.json" ], "data_stream.dataset": "suricata", "tags": [],"processors": "- add_fields:\n target: event\n fields:\n category: network\n module: suricata", "custom": "pipeline: suricata.common" }}}}}}'
|
||||
|
||||
# Set up Zeek logs
|
||||
echo "Setting up Zeek package policy..."
|
||||
curl -K /opt/so/conf/elasticsearch/curl.config -b "sid=$SESSIONCOOKIE" -L -X POST "localhost:5601/api/fleet/package_policies" -H 'kbn-xsrf: true' -H 'Content-Type: application/json' -d'{ "policy_id": "so-grid-nodes", "package": { "name": "log", "version": "1.1.0" }, "name": "zeek-logs", "description": "Zeek logs", "namespace": "so", "inputs": { "logs-logfile": { "enabled": true, "streams": { "log.log": { "enabled": true, "vars": { "paths": ["/nsm/zeek/logs/current/*.log"], "data_stream.dataset": "zeek", "tags": [], "processors": "- dissect:\n tokenizer: \"/nsm/zeek/logs/current/%{pipeline}.log\"\n field: \"log.file.path\"\n trim_chars: \".log\"\n target_prefix: \"\"\n- script:\n lang: javascript\n source: >\n function process(event) {\n var pl = event.Get(\"pipeline\");\n event.Put(\"@metadata.pipeline\", \"zeek.\" + pl);\n }\n- add_fields:\n target: event\n fields:\n category: network\n module: zeek", "custom": "prospector.scanner.exclude_files: [\"(broker | capture_loss | loaded_scripts | packet_filter | stats | stderr | stdout).log$\"]\n" } } } } } }'
|
||||
|
||||
# Import - Suricata
|
||||
echo "Settings up Suricata import package policy..."
|
||||
curl -K /opt/so/conf/elasticsearch/curl.config -b "sid=$SESSIONCOOKIE" -L -X POST "localhost:5601/api/fleet/package_policies" -H 'kbn-xsrf: true' -H 'Content-Type: application/json' -d '{ "policy_id": "so-grid-nodes", "package": { "name": "log", "version": "1.1.0" }, "id": "import-suricata-logs", "name": "import-suricata-logs", "description": "Import Suricata logs", "namespace": "import_so", "inputs": { "logs-logfile": { "enabled": true, "streams": { "log.log": { "enabled": true, "vars": { "paths": ["/nsm/import/*/suricata/eve*.json"], "data_stream.dataset": "alert", "tags": ["import"], "processors": "- add_fields:\n target: event\n fields:\n category: file\n module: suricata\n imported: true\n- dissect:\n tokenizer: \"/nsm/import/%{import.id}/suricata/%{import.file}\"\n field: \"log.file.path\"\n target_prefix: \"\"", "custom": "pipeline: suricata.common" } } } } } }'
|
||||
curl -K /opt/so/conf/elasticsearch/curl.config -b "sid=$SESSIONCOOKIE" -L -X POST "localhost:5601/api/fleet/package_policies" -H 'kbn-xsrf: true' -H 'Content-Type: application/json' -d '{ "policy_id": "so-grid-nodes", "package": { "name": "log", "version": "1.1.0" }, "id": "import-suricata-logs", "name": "import-suricata-logs", "description": "Import Suricata logs", "namespace": "so", "inputs": { "logs-logfile": { "enabled": true, "streams": { "log.log": { "enabled": true, "vars": { "paths": ["/nsm/import/*/suricata/eve*.json"], "data_stream.dataset": "import", "tags": ["import"], "processors": "- add_fields:\n target: event\n fields:\n category: file\n module: suricata\n imported: true\n- dissect:\n tokenizer: \"/nsm/import/%{import.id}/suricata/%{import.file}\"\n field: \"log.file.path\"\n target_prefix: \"\"", "custom": "pipeline: suricata.common" } } } } } }'
|
||||
|
||||
# Zeek logs
|
||||
{%- if grains['role'] in ['so-eval', 'so-standalone', 'so-sensor', 'so-helix', 'so-heavynode', 'so-import'] %}
|
||||
{%- if ZEEKVER != 'SURICATA' %}
|
||||
{% import_yaml 'filebeat/defaults.yaml' as FBD with context %}
|
||||
{% set FBCONFIG = salt['pillar.get']('filebeat:zeek_logs_enabled', default=FBD.filebeat, merge=True) %}
|
||||
{%- for LOGNAME in FBCONFIG.zeek_logs_enabled %}
|
||||
|
||||
# Set up Zeek {{ LOGNAME }} logs
|
||||
echo "Setting up Zeek {{ LOGNAME }} package policy..."
|
||||
curl -K /opt/so/conf/elasticsearch/curl.config -b "sid=$SESSIONCOOKIE" -L -X POST "localhost:5601/api/fleet/package_policies" -H 'kbn-xsrf: true' -H 'Content-Type: application/json' -d'{ "policy_id": "so-grid-nodes", "package": { "name": "log", "version": "1.1.0" }, "name": "zeek-{{ LOGNAME }}", "description": "Zeek {{ LOGNAME }} logs", "namespace": "zeek_so", "inputs": { "logs-logfile": { "enabled": true, "streams": { "log.log": { "enabled": true, "vars": { "paths": [ "/nsm/zeek/logs/current/{{ LOGNAME }}.log" ], "data_stream.dataset": "{{ LOGNAME }}", "tags": [], "processors": "- add_fields:\n target: event\n fields:\n category: network\n module: zeek", "custom": "pipeline: zeek.{{ LOGNAME }}" }}}}}}'
|
||||
echo
|
||||
|
||||
echo "Setting up Zeek import {{ LOGNAME }} package policy..."
|
||||
curl -K /opt/so/conf/elasticsearch/curl.config -b "sid=$SESSIONCOOKIE" -L -X POST "localhost:5601/api/fleet/package_policies" -H 'kbn-xsrf: true' -H 'Content-Type: application/json' -d '{ "policy_id": "so-grid-nodes", "package": { "name": "log", "version": "1.1.0" }, "id": "import-zeek-{{ LOGNAME }}-logs", "name": "import-zeek-{{ LOGNAME }}-logs", "description": "Import Zeek {{ LOGNAME }} logs", "namespace": "import_so", "inputs": { "logs-logfile": { "enabled": true, "streams": { "log.log": { "enabled": true, "vars": { "paths": ["/nsm/import/*/zeek/logs/{{ LOGNAME }}.log"], "data_stream.dataset": "{{ LOGNAME }}", "tags": ["import"], "processors": "- add_fields:\n target: event\n fields:\n category: file\n module: suricata\n imported: true", "custom": "pipeline: zeek.{{ LOGNAME }}" } } } } } }'
|
||||
|
||||
{%- endfor %}
|
||||
{%- endif %}
|
||||
{%- endif %}
|
||||
# Set Import - Zeek logs
|
||||
echo "Setting up Zeek Import package policy..."
|
||||
curl -K /opt/so/conf/elasticsearch/curl.config -b "sid=$SESSIONCOOKIE" -L -X POST "localhost:5601/api/fleet/package_policies" -H 'kbn-xsrf: true' -H 'Content-Type: application/json' -d'{ "policy_id": "so-grid-nodes", "package": { "name": "log", "version": "1.1.0" }, "name": "import-zeek-logs", "description": "Zeek Import logs", "namespace": "so", "inputs": { "logs-logfile": { "enabled": true, "streams": { "log.log": { "enabled": true, "vars": { "paths": ["/nsm/import/*/zeek/logs/*.log"], "data_stream.dataset": "import", "tags": [], "processors": "- dissect:\n tokenizer: \"/nsm/import/%{import.id}/zeek/logs/%{pipeline}.log\"\n field: \"log.file.path\"\n trim_chars: \".log\"\n target_prefix: \"\"\n- script:\n lang: javascript\n source: >\n function process(event) {\n var pl = event.Get(\"pipeline\");\n event.Put(\"@metadata.pipeline\", \"zeek.\" + pl);\n }\n- add_fields:\n target: event\n fields:\n category: network\n module: zeek\n imported: true", "custom": "prospector.scanner.exclude_files: [\"(broker | capture_loss | loaded_scripts | packet_filter | stats | stderr | stdout).log$\"]" } } } } } }'
|
||||
|
||||
# Strelka logs
|
||||
echo "Setting up Strelka package policy"
|
||||
curl -K /opt/so/conf/elasticsearch/curl.config -b "sid=$SESSIONCOOKIE" -L -X POST "localhost:5601/api/fleet/package_policies" -H 'kbn-xsrf: true' -H 'Content-Type: application/json' -d'{ "policy_id": "so-grid-nodes", "package": { "name": "log", "version": "1.1.0" }, "id": "strelka-logs", "name": "strelka-logs", "description": "Strelka logs", "namespace": "strelka_so", "inputs": { "logs-logfile": { "enabled": true, "streams": { "log.log": { "enabled": true, "vars": { "paths": [ "/nsm/strelka/log/strelka.log" ], "data_stream.dataset": "file", "tags": [],"processors": "- add_fields:\n target: event\n fields:\n category: file\n module: strelka", "custom": "pipeline: strelka.file" }}}}}}'
|
||||
curl -K /opt/so/conf/elasticsearch/curl.config -b "sid=$SESSIONCOOKIE" -L -X POST "localhost:5601/api/fleet/package_policies" -H 'kbn-xsrf: true' -H 'Content-Type: application/json' -d'{ "policy_id": "so-grid-nodes", "package": { "name": "log", "version": "1.1.0" }, "id": "strelka-logs", "name": "strelka-logs", "description": "Strelka logs", "namespace": "so", "inputs": { "logs-logfile": { "enabled": true, "streams": { "log.log": { "enabled": true, "vars": { "paths": [ "/nsm/strelka/log/strelka.log" ], "data_stream.dataset": "file", "tags": [],"processors": "- add_fields:\n target: event\n fields:\n category: file\n module: strelka", "custom": "pipeline: strelka.file" }}}}}}'
|
||||
|
||||
# Syslog TCP Port 514
|
||||
echo "Setting up Syslog TCP package policy..."
|
||||
curl -K /opt/so/conf/elasticsearch/curl.config -b "sid=$SESSIONCOOKIE" -L -X POST "localhost:5601/api/fleet/package_policies" -H 'kbn-xsrf: true' -H 'Content-Type: application/json' -d '{ "policy_id": "so-grid-nodes", "package": { "name": "tcp", "version": "1.5.0" }, "id": "syslog-tcp-514", "name": "syslog-tcp-514", "description": "Syslog Over TCP Port 514", "namespace": "syslog_so", "inputs": { "tcp-tcp": { "enabled": true, "streams": { "tcp.generic": { "enabled": true, "vars": { "listen_address": "0.0.0.0", "listen_port": "514", "data_stream.dataset": "syslog", "pipeline": "syslog", "processors": "- add_fields:\n target: event\n fields:\n module: syslog", "tags": [ "syslog" ], "syslog_options": "field: message\n#format: auto\n#timezone: Local" } } } } } }'
|
||||
curl -K /opt/so/conf/elasticsearch/curl.config -b "sid=$SESSIONCOOKIE" -L -X POST "localhost:5601/api/fleet/package_policies" -H 'kbn-xsrf: true' -H 'Content-Type: application/json' -d '{ "policy_id": "so-grid-nodes", "package": { "name": "tcp", "version": "1.5.0" }, "id": "syslog-tcp-514", "name": "syslog-tcp-514", "description": "Syslog Over TCP Port 514", "namespace": "so", "inputs": { "tcp-tcp": { "enabled": true, "streams": { "tcp.generic": { "enabled": true, "vars": { "listen_address": "0.0.0.0", "listen_port": "514", "data_stream.dataset": "syslog", "pipeline": "syslog", "processors": "- add_fields:\n target: event\n fields:\n module: syslog", "tags": [ "syslog" ], "syslog_options": "field: message\n#format: auto\n#timezone: Local" } } } } } }'
|
||||
|
||||
# Syslog UDP Port 514
|
||||
echo "Setting up Syslog UDP package policy..."
|
||||
curl -K /opt/so/conf/elasticsearch/curl.config -b "sid=$SESSIONCOOKIE" -L -X POST "localhost:5601/api/fleet/package_policies" -H 'kbn-xsrf: true' -H 'Content-Type: application/json' -d '{ "policy_id": "so-grid-nodes", "package": { "name": "udp", "version": "1.5.0" }, "id": "syslog-udp-514", "name": "syslog-udp-514", "description": "Syslog over UDP Port 514", "namespace": "syslog_so", "inputs": { "udp-udp": { "enabled": true, "streams": { "udp.generic": { "enabled": true, "vars": { "listen_address": "0.0.0.0", "listen_port": "514", "data_stream.dataset": "syslog", "pipeline": "syslog", "max_message_size": "10KiB", "keep_null": false, "processors": "- add_fields:\n target: event\n fields: \n module: syslog\n", "tags": [ "syslog" ], "syslog_options": "field: message\n#format: auto\n#timezone: Local" } } } } } }'
|
||||
curl -K /opt/so/conf/elasticsearch/curl.config -b "sid=$SESSIONCOOKIE" -L -X POST "localhost:5601/api/fleet/package_policies" -H 'kbn-xsrf: true' -H 'Content-Type: application/json' -d '{ "policy_id": "so-grid-nodes", "package": { "name": "udp", "version": "1.5.0" }, "id": "syslog-udp-514", "name": "syslog-udp-514", "description": "Syslog over UDP Port 514", "namespace": "so", "inputs": { "udp-udp": { "enabled": true, "streams": { "udp.generic": { "enabled": true, "vars": { "listen_address": "0.0.0.0", "listen_port": "514", "data_stream.dataset": "syslog", "pipeline": "syslog", "max_message_size": "10KiB", "keep_null": false, "processors": "- add_fields:\n target: event\n fields: \n module: syslog\n", "tags": [ "syslog" ], "syslog_options": "field: message\n#format: auto\n#timezone: Local" } } } } } }'
|
||||
|
||||
# Kratos logs
|
||||
echo "Setting up Kratos package policy..."
|
||||
curl -K /opt/so/conf/elasticsearch/curl.config -b "sid=$SESSIONCOOKIE" -L -X POST "localhost:5601/api/fleet/package_policies" -H 'kbn-xsrf: true' -H 'Content-Type: application/json' -d'{ "policy_id": "so-grid-nodes", "package": { "name": "log", "version": "1.1.0" }, "id": "kratos-logs", "name": "kratos-logs", "description": "Kratos logs", "namespace": "kratos_so", "inputs": { "logs-logfile": { "enabled": true, "streams": { "log.log": { "enabled": true, "vars": { "paths": [ "/opt/so/log/kratos/kratos.log" ], "data_stream.dataset": "access", "tags": [],"processors": "- decode_json_fields:\n fields: [\"message\"]\n target: \"\"\n add_error_key: true\n- rename:\n fields:\n - from: \"audience\"\n to: \"event.dataset\"\n ignore_missing: true\n- add_fields:\n when:\n not: \n has_fields: ['event.dataset']\n target: ''\n fields:\n event.dataset: access", "custom": "pipeline: kratos" }}}}}}'
|
||||
curl -K /opt/so/conf/elasticsearch/curl.config -b "sid=$SESSIONCOOKIE" -L -X POST "localhost:5601/api/fleet/package_policies" -H 'kbn-xsrf: true' -H 'Content-Type: application/json' -d'{ "policy_id": "so-grid-nodes", "package": { "name": "log", "version": "1.1.0" }, "id": "kratos-logs", "name": "kratos-logs", "description": "Kratos logs", "namespace": "so", "inputs": { "logs-logfile": { "enabled": true, "streams": { "log.log": { "enabled": true, "vars": { "paths": [ "/opt/so/log/kratos/kratos.log" ], "data_stream.dataset": "access", "tags": [],"processors": "- decode_json_fields:\n fields: [\"message\"]\n target: \"\"\n add_error_key: true\n- rename:\n fields:\n - from: \"audience\"\n to: \"event.dataset\"\n ignore_missing: true\n- add_fields:\n when:\n not: \n has_fields: ['event.dataset']\n target: ''\n fields:\n event.dataset: access", "custom": "pipeline: kratos" }}}}}}'
|
||||
|
||||
# RITA Beacon logs
|
||||
echo "Setting up RITA Beacon package policy..."
|
||||
curl -K /opt/so/conf/elasticsearch/curl.config -b "sid=$SESSIONCOOKIE" -L -X POST "localhost:5601/api/fleet/package_policies" -H 'kbn-xsrf: true' -H 'Content-Type: application/json' -d'{ "policy_id": "so-grid-nodes", "package": { "name": "log", "version": "1.1.0" }, "id": "rita-beacon-logs", "name": "rita-beacon-logs", "description": "RITA Beacon logs", "namespace": "rita_so", "inputs": { "logs-logfile": { "enabled": true, "streams": { "log.log": { "enabled": true, "vars": { "paths": [ "/nsm/rita/beacons.csv" ], "data_stream.dataset": "beacon", "tags": [],"processors": "- add_fields:\n target: event\n fields:\n category: network\n module: rita", "custom": "pipeline: rita.beacon" }}}}}}'
|
||||
curl -K /opt/so/conf/elasticsearch/curl.config -b "sid=$SESSIONCOOKIE" -L -X POST "localhost:5601/api/fleet/package_policies" -H 'kbn-xsrf: true' -H 'Content-Type: application/json' -d'{ "policy_id": "so-grid-nodes", "package": { "name": "log", "version": "1.1.0" }, "id": "rita-beacon-logs", "name": "rita-beacon-logs", "description": "RITA Beacon logs", "namespace": "so", "inputs": { "logs-logfile": { "enabled": true, "streams": { "log.log": { "enabled": true, "vars": { "paths": [ "/nsm/rita/beacons.csv" ], "data_stream.dataset": "beacon", "tags": [],"processors": "- add_fields:\n target: event\n fields:\n category: network\n module: rita", "custom": "pipeline: rita.beacon" }}}}}}'
|
||||
|
||||
# RITA Connection Logs
|
||||
echo "Setting up RITA connection package policy..."
|
||||
curl -K /opt/so/conf/elasticsearch/curl.config -b "sid=$SESSIONCOOKIE" -L -X POST "localhost:5601/api/fleet/package_policies" -H 'kbn-xsrf: true' -H 'Content-Type: application/json' -d'{ "policy_id": "so-grid-nodes", "package": { "name": "log", "version": "1.1.0" }, "id": "rita-connection-logs", "name": "rita-connection-logs", "description": "RITA Connection logs", "namespace": "rita_so", "inputs": { "logs-logfile": { "enabled": true, "streams": { "log.log": { "enabled": true, "vars": { "paths": [ "/nsm/rita/long-connections.csv" ], "data_stream.dataset": "connections", "tags": [],"processors": "- add_fields:\n target: event\n fields:\n category: network\n module: rita", "custom": "pipeline: rita.connections" }}}}}}'
|
||||
curl -K /opt/so/conf/elasticsearch/curl.config -b "sid=$SESSIONCOOKIE" -L -X POST "localhost:5601/api/fleet/package_policies" -H 'kbn-xsrf: true' -H 'Content-Type: application/json' -d'{ "policy_id": "so-grid-nodes", "package": { "name": "log", "version": "1.1.0" }, "id": "rita-connection-logs", "name": "rita-connection-logs", "description": "RITA Connection logs", "namespace": "so", "inputs": { "logs-logfile": { "enabled": true, "streams": { "log.log": { "enabled": true, "vars": { "paths": [ "/nsm/rita/long-connections.csv" ], "data_stream.dataset": "connections", "tags": [],"processors": "- add_fields:\n target: event\n fields:\n category: network\n module: rita", "custom": "pipeline: rita.connections" }}}}}}'
|
||||
|
||||
# RITA DNS Logs
|
||||
echo "Setting up RITA DNS package policy..."
|
||||
curl -K /opt/so/conf/elasticsearch/curl.config -b "sid=$SESSIONCOOKIE" -L -X POST "localhost:5601/api/fleet/package_policies" -H 'kbn-xsrf: true' -H 'Content-Type: application/json' -d'{ "policy_id": "so-grid-nodes", "package": { "name": "log", "version": "1.1.0" }, "id": "rita-exploded-dns-logs", "name": "rita-exploded-dns-logs", "description": "RITA Exploded DNS logs", "namespace": "rita_so", "inputs": { "logs-logfile": { "enabled": true, "streams": { "log.log": { "enabled": true, "vars": { "paths": [ "/nsm/rita/exploded-dns.csv" ], "data_stream.dataset": "exploded_dns", "tags": [],"processors": "- add_fields:\n target: event\n fields:\n category: network\n module: rita", "custom": "pipeline: rita.dns" }}}}}}'
|
||||
curl -K /opt/so/conf/elasticsearch/curl.config -b "sid=$SESSIONCOOKIE" -L -X POST "localhost:5601/api/fleet/package_policies" -H 'kbn-xsrf: true' -H 'Content-Type: application/json' -d'{ "policy_id": "so-grid-nodes", "package": { "name": "log", "version": "1.1.0" }, "id": "rita-exploded-dns-logs", "name": "rita-exploded-dns-logs", "description": "RITA Exploded DNS logs", "namespace": "so", "inputs": { "logs-logfile": { "enabled": true, "streams": { "log.log": { "enabled": true, "vars": { "paths": [ "/nsm/rita/exploded-dns.csv" ], "data_stream.dataset": "exploded_dns", "tags": [],"processors": "- add_fields:\n target: event\n fields:\n category: network\n module: rita", "custom": "pipeline: rita.dns" }}}}}}'
|
||||
|
||||
# Elasticsearch logs
|
||||
curl -K /opt/so/conf/elasticsearch/curl.config -b "sid=$SESSIONCOOKIE" -L -X POST "localhost:5601/api/fleet/package_policies" -H 'kbn-xsrf: true' -H 'Content-Type: application/json' -d'{ "policy_id": "so-grid-nodes", "package": { "name": "elasticsearch", "version": "1.0.0" }, "id": "elasticsearch-logs", "name": "elasticsearch-logs", "description": "Elasticsearch Logs", "namespace": "default", "inputs": { "elasticsearch-logfile": { "enabled": true, "streams": { "elasticsearch.audit": { "enabled": false, "vars": { "paths": [ "/var/log/elasticsearch/*_audit.json" ] } }, "elasticsearch.deprecation": { "enabled": false, "vars": { "paths": [ "/var/log/elasticsearch/*_deprecation.json" ] } }, "elasticsearch.gc": { "enabled": false, "vars": { "paths": [ "/var/log/elasticsearch/gc.log.[0-9]*", "/var/log/elasticsearch/gc.log" ] } }, "elasticsearch.server": { "enabled": true, "vars": { "paths": [ "/opt/so/log/elasticsearch/*.log" ] } }, "elasticsearch.slowlog": { "enabled": false, "vars": { "paths": [ "/var/log/elasticsearch/*_index_search_slowlog.json", "/var/log/elasticsearch/*_index_indexing_slowlog.json" ] } } } }, "elasticsearch-elasticsearch/metrics": { "enabled": false, "vars": { "hosts": [ "http://localhost:9200" ], "scope": "node" }, "streams": { "elasticsearch.stack_monitoring.ccr": { "enabled": false }, "elasticsearch.stack_monitoring.cluster_stats": { "enabled": false }, "elasticsearch.stack_monitoring.enrich": { "enabled": false }, "elasticsearch.stack_monitoring.index": { "enabled": false }, "elasticsearch.stack_monitoring.index_recovery": { "enabled": false, "vars": { "active.only": true } }, "elasticsearch.stack_monitoring.index_summary": { "enabled": false }, "elasticsearch.stack_monitoring.ml_job": { "enabled": false }, "elasticsearch.stack_monitoring.node": { "enabled": false }, "elasticsearch.stack_monitoring.node_stats": { "enabled": false }, "elasticsearch.stack_monitoring.pending_tasks": { "enabled": false }, "elasticsearch.stack_monitoring.shard": { "enabled": false } } } } }'
|
||||
@@ -82,3 +75,4 @@ curl -K /opt/so/conf/elasticsearch/curl.config -b "sid=$SESSIONCOOKIE" -L -X POS
|
||||
|
||||
# Redis logs
|
||||
curl -K /opt/so/conf/elasticsearch/curl.config -b "sid=$SESSIONCOOKIE" -L -X POST "localhost:5601/api/fleet/package_policies" -H 'kbn-xsrf: true' -H 'Content-Type: application/json' -d'{ "policy_id": "so-grid-nodes", "package": { "name": "redis", "version": "1.4.0" }, "id": "redis-logs", "name": "redis-logs", "description": "Redis logs", "namespace": "default", "inputs": { "redis-logfile": { "enabled": true, "streams": { "redis.log": { "enabled": true, "vars": { "paths": [ "/opt/so/log/redis/redis.log" ], "tags": [ "redis-log" ], "preserve_original_event": false } } } }, "redis-redis": { "enabled": false, "streams": { "redis.slowlog": { "enabled": false, "vars": { "hosts": [ "127.0.0.1:6379" ], "password": "" } } } }, "redis-redis/metrics": { "enabled": false, "vars": { "hosts": [ "127.0.0.1:6379" ], "idle_timeout": "20s", "maxconn": 10, "network": "tcp", "password": "" }, "streams": { "redis.info": { "enabled": false, "vars": { "period": "10s" } }, "redis.key": { "enabled": false, "vars": { "key.patterns": "- limit: 20\n pattern: '*'\n", "period": "10s" } }, "redis.keyspace": { "enabled": false, "vars": { "period": "10s" } } } } } }'
|
||||
|
||||
|
||||
@@ -1165,7 +1165,7 @@ elasticsearch:
|
||||
index_template:
|
||||
data_stream: {}
|
||||
index_patterns:
|
||||
- logs-*_so
|
||||
- logs-*-so*
|
||||
template:
|
||||
mappings:
|
||||
dynamic_templates:
|
||||
@@ -1418,7 +1418,7 @@ elasticsearch:
|
||||
index_sorting: False
|
||||
index_template:
|
||||
index_patterns:
|
||||
- so-elasticsearch*
|
||||
- logs-elasticsearch-default*
|
||||
template:
|
||||
mappings:
|
||||
dynamic_templates:
|
||||
@@ -2171,7 +2171,7 @@ elasticsearch:
|
||||
index_template:
|
||||
data_stream: {}
|
||||
index_patterns:
|
||||
- logs-*-suricata_so
|
||||
- logs-suricata-so*
|
||||
template:
|
||||
mappings:
|
||||
dynamic_templates:
|
||||
@@ -2339,7 +2339,7 @@ elasticsearch:
|
||||
index_template:
|
||||
data_stream: {}
|
||||
index_patterns:
|
||||
- logs-*-import_so
|
||||
- logs-import-so*
|
||||
template:
|
||||
mappings:
|
||||
dynamic_templates:
|
||||
@@ -2678,7 +2678,7 @@ elasticsearch:
|
||||
index_sorting: False
|
||||
index_template:
|
||||
index_patterns:
|
||||
- logs-*-kratos_so
|
||||
- logs-kratos-so*
|
||||
template:
|
||||
mappings:
|
||||
dynamic_templates:
|
||||
@@ -2755,7 +2755,7 @@ elasticsearch:
|
||||
index_sorting: False
|
||||
index_template:
|
||||
index_patterns:
|
||||
- so-logstash*
|
||||
- logs-logstash-default*
|
||||
template:
|
||||
mappings:
|
||||
dynamic_templates:
|
||||
@@ -3676,7 +3676,7 @@ elasticsearch:
|
||||
index_sorting: False
|
||||
index_template:
|
||||
index_patterns:
|
||||
- so-redis*
|
||||
- logs-redis-default*
|
||||
template:
|
||||
mappings:
|
||||
dynamic_templates:
|
||||
@@ -4178,7 +4178,7 @@ elasticsearch:
|
||||
index_template:
|
||||
data_stream: {}
|
||||
index_patterns:
|
||||
- logs-*-strelka_so
|
||||
- logs-strelka-so*
|
||||
template:
|
||||
mappings:
|
||||
dynamic_templates:
|
||||
@@ -4263,7 +4263,7 @@ elasticsearch:
|
||||
index_sorting: False
|
||||
index_template:
|
||||
index_patterns:
|
||||
- so-syslog*
|
||||
- logs-syslog-so*
|
||||
template:
|
||||
mappings:
|
||||
dynamic_templates:
|
||||
@@ -4432,7 +4432,7 @@ elasticsearch:
|
||||
index_template:
|
||||
data_stream: {}
|
||||
index_patterns:
|
||||
- logs-*-zeek_so
|
||||
- logs-zeek-so*
|
||||
template:
|
||||
mappings:
|
||||
dynamic_templates:
|
||||
|
||||
@@ -9,12 +9,11 @@
|
||||
{ "rename":{ "field": "message2.dest_ip", "target_field": "destination.ip", "ignore_failure": true } },
|
||||
{ "rename":{ "field": "message2.dest_port", "target_field": "destination.port", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.community_id", "target_field": "network.community_id", "ignore_missing": true } },
|
||||
{ "remove":{ "field": "dataset", "ignore_failure": true } },
|
||||
{ "rename":{ "field": "message2.event_type", "target_field": "dataset", "ignore_failure": true } },
|
||||
{ "set": { "field": "event.dataset", "value": "{{ message2.event_type }}" } },
|
||||
{ "set": { "field": "observer.name", "value": "{{agent.name}}" } },
|
||||
{ "set": { "field": "event.ingested", "value": "{{@timestamp}}" } },
|
||||
{ "date": { "field": "message2.timestamp", "target_field": "@timestamp", "formats": ["ISO8601", "UNIX"], "timezone": "UTC", "ignore_failure": true } },
|
||||
{ "remove":{ "field": "agent", "ignore_failure": true } },
|
||||
{ "pipeline": { "if": "ctx?.dataset != null", "name": "suricata.{{dataset}}" } }
|
||||
{ "pipeline": { "if": "ctx?.event?.dataset != null", "name": "suricata.{{event.dataset}}" } }
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"description" : "zeek.bacnet",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event.dataset", "value": "bacnet" } },
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.is_orig", "target_field": "bacnet.is_orig", "ignore_missing": true } },
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"description" : "zeek.bacnet_discovery",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event.dataset", "value": "bacnet_discovery" } },
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.is_orig", "target_field": "bacnet.is_orig", "ignore_missing": true } },
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"description" : "zeek.bacnet_property",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event.dataset", "value": "bacnet_property" } },
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.is_orig", "target_field": "bacnet.is_orig", "ignore_missing": true } },
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"description" : "zeek.bsap_ip_header",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event.dataset", "value": "bsap_ip_header" } },
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.num_msg", "target_field": "bsap.number.messages", "ignore_missing": true } },
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"description" : "zeek.bsap_ip_rdb",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event.dataset", "value": "bsap_ip_rdb" } },
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.header_size", "target_field": "bsap.header.length", "ignore_missing": true } },
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"description" : "zeek.bsap_ip_unknown",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event.dataset", "value": "bsap_ip_unknown" } },
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.data", "target_field": "bsap.ip.unknown.data", "ignore_missing": true } },
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"description" : "zeek.bsap_serial_header",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event.dataset", "value": "bsap_serial_header" } },
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.ser", "target_field": "bsap.message.serial_number", "ignore_missing": true } },
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"description" : "zeek.bsap_serial_rdb",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event.dataset", "value": "bsap_serial_rdb" } },
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.func_code", "target_field": "bsap.rdb.function", "ignore_missing": true } },
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"description" : "zeek.bsap_serial_rdb_ext",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event.dataset", "value": "bsap_serial_rdb_ext" } },
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.dfun", "target_field": "bsap.destination.function", "ignore_missing": true } },
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"description" : "zeek.bsap_serial_unknown",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event.dataset", "value": "bsap_serial_unknown" } },
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.data", "target_field": "bsap.serial.unknown.data", "ignore_missing": true } },
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"description" : "zeek.cip",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event.dataset", "value": "cip" } },
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.is_orig", "target_field": "cip.is_orig", "ignore_missing": true } },
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"description" : "zeek.cip_identity",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event.dataset", "value": "cip_identity" } },
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.encapsulation_version", "target_field": "cip.encapsulation.version", "ignore_missing": true } },
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"description" : "zeek.cip_io",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event.dataset", "value": "cip_io" } },
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.is_orig", "target_field": "cip.is_orig", "ignore_missing": true } },
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"description" : "zeek.conn",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event.dataset", "value": "conn" } },
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.proto", "target_field": "network.transport", "ignore_missing": true } },
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"description" : "zeek.cotp",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event.dataset", "value": "cotp" } },
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.pdu_code", "target_field": "cotp.pdu.code", "ignore_missing": true } },
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"description" : "zeek.dce_rpc",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event.dataset", "value": "dce_rpc" } },
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.rtt", "target_field": "event.duration", "ignore_missing": true } },
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"description" : "zeek.dhcp",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event.dataset", "value": "dhcp" } },
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.uids", "target_field": "log.id.uids", "ignore_missing": true } },
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"description" : "zeek.dnp3",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event.dataset", "value": "dnp3" } },
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.fc_request", "target_field": "dnp3.fc_request", "ignore_missing": true } },
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"description" : "zeek.dnp3_control",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event.dataset", "value": "dnp3_control" } },
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.block_type", "target_field": "dnp3.block_type", "ignore_missing": true } },
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"description" : "zeek.dnp3_objects",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event.dataset", "value": "dnp3_objects" } },
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.function_code", "target_field": "dnp3.function_code", "ignore_missing": true } },
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"description" : "zeek.dns",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event.dataset", "value": "dns" } },
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "dot_expander": { "field": "id.orig_h", "path": "message2", "ignore_failure": true } },
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"description" : "zeek.dpd",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event.dataset", "value": "dpd" } },
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "dot_expander": { "field": "id.orig_h", "path": "message2", "ignore_failure": true } },
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"description" : "zeek.ecat_aoe_info",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event.dataset", "value": "ecat_aoe_info" } },
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.targetid", "target_field": "destination.mac", "ignore_missing": true } },
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"description" : "zeek.ecat_arp_info",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event.dataset", "value": "ecat_arp_info" } },
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.arp_type", "target_field": "ecat.arp.type", "ignore_missing": true } },
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"description" : "zeek.ecat_coe_info",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event.dataset", "value": "ecat_coe_info" } },
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.number", "target_field": "ecat.message.number", "ignore_missing": true } },
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"description" : "zeek.ecat_dev_info",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event.dataset", "value": "ecat_dev_info" } },
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.slave_id", "target_field": "ecat.slave.address", "ignore_missing": true } },
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"description" : "zeek.ecat_foe_info",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event.dataset", "value": "ecat_foe_info" } },
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.opcode", "target_field": "ecat.operation.code", "ignore_missing": true } },
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"description" : "zeek.ecat_log_address",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event.dataset", "value": "ecat_log_address" } },
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.srcmac", "target_field": "source.mac", "ignore_missing": true } },
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"description" : "zeek.ecat_registers",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event.dataset", "value": "ecat_registers" } },
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.srcmac", "target_field": "source.mac", "ignore_missing": true } },
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"description" : "zeek.ecat_soe_info",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event.dataset", "value": "ecat_soe_info" } },
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.opcode", "target_field": "ecat.operation.code", "ignore_missing": true } },
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"description" : "zeek.enip",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event.dataset", "value": "enip" } },
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.is_orig", "target_field": "enip.is_orig", "ignore_missing": true } },
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"description" : "zeek.files",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event.dataset", "value": "files" } },
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.fuid", "target_field": "log.id.fuid", "ignore_missing": true } },
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"description" : "zeek.ftp",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event.dataset", "value": "ftp" } },
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.user", "target_field": "ftp.user", "ignore_missing": true } },
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"description" : "zeek.http",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event.dataset", "value": "http" } },
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.trans_depth", "target_field": "http.trans_depth", "ignore_missing": true } },
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"description" : "zeek.intel",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event.dataset", "value": "intel" } },
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "dot_expander": { "field": "seen.indicator", "path": "message2", "ignore_failure": true } },
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"description" : "zeek.irc",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event.dataset", "value": "irc" } },
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.nick", "target_field": "irc.nickname", "ignore_missing": true } },
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"description" : "zeek.kerberos",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event.dataset", "value": "kerberos" } },
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.request_type", "target_field": "kerberos.request_type", "ignore_missing": true } },
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"description" : "zeek.modbus",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event.dataset", "value": "modbus" } },
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.func", "target_field": "modbus.function", "ignore_missing": true } },
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"description" : "zeek.modbus_detailed",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event.dataset", "value": "modbus_detailed" } },
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.unit_id", "target_field": "modbus.unit_id", "ignore_missing": true } },
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"description" : "zeek.modbus_mask_write_register",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event.dataset", "value": "modbus_mask_write_register" } },
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.unit_id", "target_field": "modbus.unit_id", "ignore_missing": true } },
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"description" : "zeek.read_write_multiple_registers",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event.dataset", "value": "modbus_read_write_multiple_registers" } },
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.unit_id", "target_field": "modbus.unit_id", "ignore_missing": true } },
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"description" : "zeek.mysql",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event.dataset", "value": "mysql" } },
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.cmd", "target_field": "mysql.command", "ignore_missing": true } },
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"description" : "zeek.notice",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event.dataset", "value": "notice" } },
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.fuid", "target_field": "log.id.fuid", "ignore_missing": true } },
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"description" : "zeek.ntlm",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event.dataset", "value": "ntlm" } },
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.hostname", "target_field": "host.name", "ignore_missing": true } },
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"description" : "zeek.opcua_binary",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event.dataset", "value": "opcua_binary" } },
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.msg_type", "target_field": "opcua.message_type", "ignore_missing": true } },
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"description" : "zeek.opcua_binary_activate_session",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event.dataset", "value": "opcua_binary_activate_session" } },
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true} },
|
||||
{ "rename": { "field": "message2.opcua_link_id", "target_field": "opcua.link_id", "ignore_missing": true } },
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"description" : "zeek.opcua_binary_activate_session_client_software_cert",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event.dataset", "value": "opcua_binary_activate_session_client_software_cert" } },
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.client_software_cert_link_id", "target_field": "opcua.client_software_cert_link_id", "ignore_missing": true } },
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"description" : "zeek.opcua_binary_activate_session_diagnostic_info",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event.dataset", "value": "opcua_binary_activate_session_diagnostic_info" } },
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.activate_session_diag_info_link_id", "target_field": "opcua.activate_session_diag_info_link_id", "ignore_missing": true } },
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"description" : "zeek.opcua_binary_activate_session_locale_id",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event.dataset", "value": "opcua_binary_activate_session_locale_id" } },
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.opcua_locale_link_id", "target_field": "opcua.locale_link_id", "ignore_missing": true } },
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"description" : "zeek.opcua_binary_browse",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event.dataset", "value": "opcua_binary_browse" } },
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.opcua_link_id", "target_field": "opcua.link_id", "ignore_missing": true } },
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"description" : "zeek.opcua_binary_browse_description",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event.dataset", "value": "opcua_binary_browse_description" } },
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.browse_description_link_id", "target_field": "opcua.browse_description_link_id", "ignore_missing": true } },
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"description" : "zeek.opcua_binary_browse_diagnostic_info",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event.dataset", "value": "opcua_binary_browse_diagnostic_info" } },
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.browse_diag_info_link_id", "target_field": "opcua.browse_session_diag_info_link_id", "ignore_missing": true } },
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"description" : "zeek.opcua_binary_browse_request_continuation_point",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event.dataset", "value": "opcua_binary_browse_request_continuation_point" } },
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.browse_next_link_id", "target_field": "opcua.browse_next_link_id", "ignore_missing": true } },
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"description" : "zeek.opcua_binary_browse_response_references",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event.dataset", "value": "opcua_binary_browse_response_references" } },
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.browse_reference_link_id", "target_field": "opcua.link_id", "ignore_missing": true } },
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"description" : "zeek.opcua_binary_browse_result",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event.dataset", "value": "opcua_binary_browse_result" } },
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.browse_response_link_id", "target_field": "opcua.response_link_id", "ignore_missing": true } },
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"description" : "zeek.opcua_binary_create_session",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event.dataset", "value": "opcua_binary_create_session" } },
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true} },
|
||||
{ "rename": { "field": "message2.opcua_link_id", "target_field": "opcua.link_id", "ignore_missing": true } },
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"description" : "zeek.opcua_binary_create_session_discovery",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event.dataset", "value": "opcua_binary_create_session_discovery" } },
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.discovery_profile_link_id", "target_field": "opcua.discovery_profile_link_id", "ignore_missing": true } },
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"description" : "zeek.opcua_binary_create_session_endpoints",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event.dataset", "value": "opcua_binary_create_session_endpoints" } },
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.endpoint_link_id", "target_field": "opcua.endpoint_link_id", "ignore_missing": true } },
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"description" : "zeek.opcua_binary_create_session_user_token",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event.dataset", "value": "opcua_binary_create_session_user_token" } },
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.user_token_link_id", "target_field": "opcua.user_token_link_id", "ignore_missing": true } },
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"description" : "zeek.opcua_binary_create_subscription",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event.dataset", "value": "opcua_binary_create_subscription" } },
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.opcua_link_id", "target_field": "opcua.link_id", "ignore_missing": true } },
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"description" : "zeek.opcua_binary_diag_info_detail",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event.dataset", "value": "opcua_binary_diag_info_detail" } },
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.diag_info_link_id", "target_field": "opcua.diag_info_link_id", "ignore_missing": true } },
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"description" : "zeek.opcua_binary_get_endpoints",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event.dataset", "value": "opcua_binary_get_endpoints" } },
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.opcua_link_id", "target_field": "opcua.link_id", "ignore_missing": true } },
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"description" : "zeek.opcua_binary_get_endpoints_description",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event.dataset", "value": "opcua_binary_get_endpoints_description" } },
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.endpoint_description_link_id", "target_field": "opcua.endpoint_description_link_id", "ignore_missing": true } },
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"description" : "zeek.opcua_binary_get_endpoints_discovery",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event.dataset", "value": "opcua_binary_get_endpoints_discovery" } },
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.discovery_profile_link_id", "target_field": "opcua.discovery_profile_link_id", "ignore_missing": true } },
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"description" : "zeek.opcua_binary_get_endpoints_locale_id",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event.dataset", "value": "opcua_binary_get_endpoints_locale_id" } },
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.opcua_locale_link_id", "target_field": "opcua.locale_link_id", "ignore_missing": true } },
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"description" : "zeek.opcua_binary_get_endpoints_profile_uri",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event.dataset", "value": "opcua_binary_get_endpoints_profile_uri" } },
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.profile_uri_link_id", "target_field": "opcua.profile_uri_link_id", "ignore_missing": true } },
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"description" : "zeek.opcua_binary_get_endpoints_user_token",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event.dataset", "value": "opcua_binary_get_endpoints_user_token" } },
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.user_token_link_id", "target_field": "opcua.user_token_link_id", "ignore_missing": true } },
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"description" : "zeek.opcua_binary_opensecure_channel",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event.dataset", "value": "opcua_binary_opensecure_channel" } },
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.opcua_link_id", "target_field": "opcua.link_id", "ignore_missing": true } },
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"description" : "zeek.opcua_binary_read",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event.dataset", "value": "opcua_binary_read" } },
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.opcua_link_id", "target_field": "opcua.link_id", "ignore_missing": true } },
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"description" : "zeek.opcua_binary_read_array_dims",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event.dataset", "value": "opcua_binary_read_array_dims" } },
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.array_dim_link_id", "target_field": "opcua.array_dim_link_id", "ignore_missing": true } },
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"description" : "zeek.opcua_binary_read_array_dims_link",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event.dataset", "value": "opcua_binary_read_array_dims_link" } },
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.variant_data_array_dim_link_id", "target_field": "opcua.variant_data_array_dim_link_id", "ignore_missing": true } },
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"description" : "zeek.opcua_binary_read_diagnostic_info",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event.dataset", "value": "opcua_binary_read_diagnostic_info" } },
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.read_diag_info_link_id", "target_field": "opcua.read_diag_info_link_id", "ignore_missing": true } },
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"description" : "zeek.opcua_binary_read_extension_object",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event.dataset", "value": "opcua_binary_read_extension_object" } },
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.ext_obj_link_id", "target_field": "opcua.ext_obj_link_id", "ignore_missing": true } },
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"description" : "zeek.opcua_binary_read_extension_object_link",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event.dataset", "value": "opcua_binary_read_extension_object_link" } },
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.variant_data_ext_obj_link_id", "target_field": "opcua.variant_data_ext_obj_link_id", "ignore_missing": true } },
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"description" : "zeek.opcua_binary_read_nodes_to_read",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event.dataset", "value": "opcua_binary_read_nodes_to_read" } },
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.nodes_to_read_link_id", "target_field": "opcua.nodes_to_read_link_id", "ignore_missing": true } },
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"description" : "zeek.opcua_binary_read_results",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event.dataset", "value": "opcua_binary_read_results" } },
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.results_link_id", "target_field": "opcua.results_link_id", "ignore_missing": true } },
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"description" : "zeek.opcua_binary_read_results_link",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event.dataset", "value": "opcua_binary_read_results_link" } },
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.read_results_link_id", "target_field": "opcua.read_results_link_id", "ignore_missing": true } },
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"description" : "zeek.opcua_binary_read_status_code",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event.dataset", "value": "opcua_binary_read_status_code" } },
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.read_status_code_link_id", "target_field": "opcua.read_status_code_link_id", "ignore_missing": true } },
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"description" : "zeek.opcua_binary_read_variant_data",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event.dataset", "value": "opcua_binary_read_variant_data" } },
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.read_variant_data_link_id", "target_field": "opcua.read_variant_data_link_id", "ignore_missing": true } },
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"description" : "zeek.opcua_binary_read_variant_data_link",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event.dataset", "value": "opcua_binary_read_variant_data_link" } },
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.read_results_variant_data_link_id", "target_field": "opcua.read_results_variant_data_link_id", "ignore_missing": true } },
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"description" : "zeek.opcua_binary_status_code_detail",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event.dataset", "value": "opcua_binary_status_code_detail" } },
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.status_code", "target_field": "opcua.status_code", "ignore_missing": true } },
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"description" : "zeek.pe",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event.dataset", "value": "pe" } },
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id", "target_field": "log.id.fuid", "ignore_missing": true } },
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"description" : "zeek.profinet",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event.dataset", "value": "profinet" } },
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true} },
|
||||
{ "rename": { "field": "message2.operation_type", "target_field": "profinet.operation_type", "ignore_missing": true } },
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"description" : "zeek.profinet_dce_rpc",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event.dataset", "value": "profinet_dce_rpc" } },
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true} },
|
||||
{ "rename": { "field": "message2.version", "target_field": "profinet.version", "ignore_missing": true } },
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"description" : "zeek.radius",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event.dataset", "value": "radius" } },
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.username", "target_field": "user.name", "ignore_missing": true } },
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"description" : "zeek.rdp",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event.dataset", "value": "rdp" } },
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.cookie", "target_field": "rdp.cookie", "ignore_missing": true } },
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"description" : "zeek.rfb",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event.dataset", "value": "rfb" } },
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.client_major_version", "target_field": "rfb.client_major_version", "ignore_missing": true } },
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"description" : "zeek.s7comm",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event.dataset", "value": "s7comm" } },
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.rosctr_code", "target_field": "s7.ros.control.code", "ignore_missing": true } },
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"description" : "zeek.s7comm_plus",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event.dataset", "value": "s7comm_plus" } },
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.version", "target_field": "s7.version", "ignore_missing": true } },
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"description" : "zeek.s7comm_read_szl",
|
||||
"processors" : [
|
||||
{ "set": { "field": "event.dataset", "value": "s7comm_read_szl" } },
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.pdu_reference", "target_field": "s7.pdu_reference", "ignore_missing": true } },
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user