CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-20 16:03:06 +01:00
Code Issues Packages Projects Releases Wiki Activity

Update ingest pipelines to match updated mappings

Browse Source 
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>
This commit is contained in:
reyesj2
2024-04-10 16:13:06 -04:00
parent 2ab9cbba61
commit 7124f04138
6 changed files with 15 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
salt/elasticsearch/files/ingest/kismet.ap
View File

@@ -3,35 +3,35 @@
{
"rename": {
"field": "message2.dot11_device.dot11_device_last_beaconed_ssid_record.dot11_advertisedssid_cloaked",
"target_field": "wireless.ssid_cloaked",
"target_field": "network.wireless.ssid_cloaked",
"if": "ctx?.message2?.dot11_device?.dot11_device_last_beaconed_ssid_record?.dot11_advertisedssid_cloaked != null"
}
},
{
"rename": {
"field": "message2.dot11_device.dot11_device_last_beaconed_ssid_record.dot11_advertisedssid_ssid",
"target_field": "wireless.ssid",
"target_field": "network.wireless.ssid",
"if": "ctx?.message2?.dot11_device?.dot11_device_last_beaconed_ssid_record?.dot11_advertisedssid_ssid != null"
}
},
{
"set": {
"field": "wireless.ssid",
"field": "network.wireless.ssid",
"value": "Hidden",
"if": "ctx?.wireless?.ssid_cloaked != null && ctx?.wireless?.ssid_cloaked == 1"
"if": "ctx?.network?.wireless?.ssid_cloaked != null && ctx?.network?.wireless?.ssid_cloaked == 1"
}
},
{
"rename": {
"field": "message2.dot11_device.dot11_device_last_beaconed_ssid_record.dot11_advertisedssid_dot11e_channel_utilization_perc",
"target_field": "wireless.channel_utilization",
"target_field": "network.network.wireless.channel_utilization",
"if": "ctx?.message2?.dot11_device?.dot11_device_last_beaconed_ssid_record?.dot11_advertisedssid_dot11e_channel_utilization_perc != null"
}
},
{
"rename": {
"field": "message2.dot11_device.dot11_device_last_bssid",
"target_field": "wireless.bssid"
"target_field": "network.wireless.bssid"
}
},
{
@@ -39,7 +39,7 @@
"field": "message2.dot11_device.dot11_device_associated_client_map",
"processor": {
"append": {
"field": "wireless.associated_clients",
"field": "network.wireless.associated_clients",
"value": "{{_ingest._key}}"
}
},