From 715d801ce8072d3ef55d5d84e8e7c3c232aab5d4 Mon Sep 17 00:00:00 2001 From: reyesj2 <94730068+reyesj2@users.noreply.github.com> Date: Fri, 14 Nov 2025 13:02:44 -0600 Subject: [PATCH] format json zeek.dns --- salt/elasticsearch/files/ingest/zeek.dns | 257 ++++++++++++++++++++--- 1 file changed, 224 insertions(+), 33 deletions(-) diff --git a/salt/elasticsearch/files/ingest/zeek.dns b/salt/elasticsearch/files/ingest/zeek.dns index 7be8afec6..2df71a8e4 100644 --- a/salt/elasticsearch/files/ingest/zeek.dns +++ b/salt/elasticsearch/files/ingest/zeek.dns @@ -1,35 +1,226 @@ { - "description" : "zeek.dns", - "processors" : [ - { "set": { "field": "event.dataset", "value": "dns" } }, - { "remove": { "field": ["host"], "ignore_failure": true } }, - { "json": { "field": "message", "target_field": "message2", "ignore_failure": true } }, - { "dot_expander": { "field": "id.orig_h", "path": "message2", "ignore_failure": true } }, - { "rename": { "field": "message2.proto", "target_field": "network.transport", "ignore_missing": true } }, - { "rename": { "field": "message2.trans_id", "target_field": "dns.id", "ignore_missing": true } }, - { "rename": { "field": "message2.rtt", "target_field": "event.duration", "ignore_missing": true } }, - { "rename": { "field": "message2.query", "target_field": "dns.query.name", "ignore_missing": true } }, - { "rename": { "field": "message2.qclass", "target_field": "dns.query.class", "ignore_missing": true } }, - { "rename": { "field": "message2.qclass_name", "target_field": "dns.query.class_name", "ignore_missing": true } }, - { "rename": { "field": "message2.qtype", "target_field": "dns.query.type", "ignore_missing": true } }, - { "rename": { "field": "message2.qtype_name", "target_field": "dns.query.type_name", "ignore_missing": true } }, - { "rename": { "field": "message2.rcode", "target_field": "dns.response.code", "ignore_missing": true } }, - { "rename": { "field": "message2.rcode_name", "target_field": "dns.response.code_name", "ignore_missing": true } }, - { "rename": { "field": "message2.AA", "target_field": "dns.authoritative", "ignore_missing": true } }, - { "rename": { "field": "message2.TC", "target_field": "dns.truncated", "ignore_missing": true } }, - { "rename": { "field": "message2.RD", "target_field": "dns.recursion.desired", "ignore_missing": true } }, - { "rename": { "field": "message2.RA", "target_field": "dns.recursion.available", "ignore_missing": true } }, - { "rename": { "field": "message2.Z", "target_field": "dns.reserved", "ignore_missing": true } }, - { "rename": { "field": "message2.answers", "target_field": "dns.answers.name", "ignore_missing": true } }, - { "foreach": {"field": "dns.answers.name","processor": {"pipeline": {"name": "common.ip_validation"}},"if": "ctx.dns != null && ctx.dns.answers != null && ctx.dns.answers.name != null","ignore_failure": true}}, - { "foreach": {"field": "temp._valid_ips","processor": {"append": {"field": "dns.resolved_ip","allow_duplicates": false,"value": "{{{_ingest._value}}}","ignore_failure": true}},"ignore_failure": true}}, - { "script": { "source": "if (ctx.dns.resolved_ip != null && ctx.dns.resolved_ip instanceof List) {\n ctx.dns.resolved_ip.removeIf(item -> item == null || item.toString().trim().isEmpty());\n }","ignore_failure": true }}, - { "remove": {"field": ["temp"], "ignore_missing": true ,"ignore_failure": true } }, - { "rename": { "field": "message2.TTLs", "target_field": "dns.ttls", "ignore_missing": true } }, - { "rename": { "field": "message2.rejected", "target_field": "dns.query.rejected", "ignore_missing": true } }, - { "script": { "lang": "painless", "source": "ctx.dns.query.length = ctx.dns.query.name.length()", "ignore_failure": true } }, - { "set": { "if": "ctx._index == 'so-zeek'", "field": "_index", "value": "so-zeek_dns", "override": true } }, - { "pipeline": { "if": "ctx.dns?.query?.name != null && ctx.dns.query.name.contains('.')", "name": "dns.tld" } }, - { "pipeline": { "name": "zeek.common" } } - ] + "description": "zeek.dns", + "processors": [ + { + "set": { + "field": "event.dataset", + "value": "dns" + } + }, + { + "remove": { + "field": [ + "host" + ], + "ignore_failure": true + } + }, + { + "json": { + "field": "message", + "target_field": "message2", + "ignore_failure": true + } + }, + { + "dot_expander": { + "field": "id.orig_h", + "path": "message2", + "ignore_failure": true + } + }, + { + "rename": { + "field": "message2.proto", + "target_field": "network.transport", + "ignore_missing": true + } + }, + { + "rename": { + "field": "message2.trans_id", + "target_field": "dns.id", + "ignore_missing": true + } + }, + { + "rename": { + "field": "message2.rtt", + "target_field": "event.duration", + "ignore_missing": true + } + }, + { + "rename": { + "field": "message2.query", + "target_field": "dns.query.name", + "ignore_missing": true + } + }, + { + "rename": { + "field": "message2.qclass", + "target_field": "dns.query.class", + "ignore_missing": true + } + }, + { + "rename": { + "field": "message2.qclass_name", + "target_field": "dns.query.class_name", + "ignore_missing": true + } + }, + { + "rename": { + "field": "message2.qtype", + "target_field": "dns.query.type", + "ignore_missing": true + } + }, + { + "rename": { + "field": "message2.qtype_name", + "target_field": "dns.query.type_name", + "ignore_missing": true + } + }, + { + "rename": { + "field": "message2.rcode", + "target_field": "dns.response.code", + "ignore_missing": true + } + }, + { + "rename": { + "field": "message2.rcode_name", + "target_field": "dns.response.code_name", + "ignore_missing": true + } + }, + { + "rename": { + "field": "message2.AA", + "target_field": "dns.authoritative", + "ignore_missing": true + } + }, + { + "rename": { + "field": "message2.TC", + "target_field": "dns.truncated", + "ignore_missing": true + } + }, + { + "rename": { + "field": "message2.RD", + "target_field": "dns.recursion.desired", + "ignore_missing": true + } + }, + { + "rename": { + "field": "message2.RA", + "target_field": "dns.recursion.available", + "ignore_missing": true + } + }, + { + "rename": { + "field": "message2.Z", + "target_field": "dns.reserved", + "ignore_missing": true + } + }, + { + "rename": { + "field": "message2.answers", + "target_field": "dns.answers.name", + "ignore_missing": true + } + }, + { + "foreach": { + "field": "dns.answers.name", + "processor": { + "pipeline": { + "name": "common.ip_validation" + } + }, + "if": "ctx.dns != null && ctx.dns.answers != null && ctx.dns.answers.name != null", + "ignore_failure": true + } + }, + { + "foreach": { + "field": "temp._valid_ips", + "processor": { + "append": { + "field": "dns.resolved_ip", + "allow_duplicates": false, + "value": "{{{_ingest._value}}}", + "ignore_failure": true + } + }, + "ignore_failure": true + } + }, + { + "script": { + "source": "if (ctx.dns.resolved_ip != null && ctx.dns.resolved_ip instanceof List) {\n ctx.dns.resolved_ip.removeIf(item -> item == null || item.toString().trim().isEmpty());\n }", + "ignore_failure": true + } + }, + { + "remove": { + "field": [ + "temp" + ], + "ignore_missing": true, + "ignore_failure": true + } + }, + { + "rename": { + "field": "message2.TTLs", + "target_field": "dns.ttls", + "ignore_missing": true + } + }, + { + "rename": { + "field": "message2.rejected", + "target_field": "dns.query.rejected", + "ignore_missing": true + } + }, + { + "script": { + "lang": "painless", + "source": "ctx.dns.query.length = ctx.dns.query.name.length()", + "ignore_failure": true + } + }, + { + "set": { + "if": "ctx._index == 'so-zeek'", + "field": "_index", + "value": "so-zeek_dns", + "override": true + } + }, + { + "pipeline": { + "if": "ctx.dns?.query?.name != null && ctx.dns.query.name.contains('.')", + "name": "dns.tld" + } + }, + { + "pipeline": { + "name": "zeek.common" + } + } + ] } \ No newline at end of file