CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 17:22:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

Add files

Browse Source
This commit is contained in:
Wes
2023-05-30 02:56:23 +00:00
parent c835c523a9
commit 799e92e595
2 changed files with 65 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
salt/elasticfleet/files/integrations-dynamic/grid-nodes/import-zeek-logs.json Normal file
View File

@@ -0,0 +1,32 @@
{% set EXCLUDED_LOGS = salt['pillar.get']('zeek:logging:excluded', {}) %}
{%- raw -%}
{
"package": {
"name": "log",
"version": ""
},
"name": "import-zeek-logs",
"namespace": "so",
"description": "Zeek Import logs",
"policy_id": "so-grid-nodes",
"inputs": {
"logs-logfile": {
"enabled": true,
"streams": {
"log.log": {
"enabled": true,
"vars": {
"paths": [
"/nsm/import/*/zeek/logs/*.log"
],
"data_stream.dataset": "import",
"tags": [],
"processors": "- dissect:\n tokenizer: \"/nsm/import/%{import.id}/zeek/logs/%{import.file}\"\n field: \"log.file.path\"\n target_prefix: \"\"\n- script:\n lang: javascript\n source: >\n function process(event) {\n var pl = event.Get(\"import.file\").slice(0,-4);\n event.Put(\"@metadata.pipeline\", \"zeek.\" + pl);\n }\n- add_fields:\n target: event\n fields:\n category: network\n module: zeek\n imported: true\n- add_tags:\n tags: \"ics\"\n when:\n regexp:\n import.file: \"^bacnet*|^bsap*|^cip*|^cotp*|^dnp3*|^ecat*|^enip*|^modbus*|^opcua*|^profinet*|^s7comm*\"",
"custom": "exclude_files: [\"{%- endraw -%}{{ EXCLUDED_LOGS | join('|') }}{%- raw -%}$\"]\n"
}
}
}
}
}
}
{%- endraw -%}

33
salt/elasticfleet/files/integrations-dynamic/grid-nodes/zeek-logs.json Normal file
View File

@@ -0,0 +1,33 @@
{% set EXCLUDED_LOGS = salt['pillar.get']('zeek:logging:excluded', {}) %}
{%- raw -%}
{
"package": {
"name": "log",
"version": ""
},
"id": "zeek-logs",
"name": "zeek-logs",
"namespace": "so",
"description": "Zeek logs",
"policy_id": "so-grid-nodes",
"inputs": {
"logs-logfile": {
"enabled": true,
"streams": {
"log.log": {
"enabled": true,
"vars": {
"paths": [
"/nsm/zeek/logs/current/*.log"
],
"data_stream.dataset": "zeek",
"tags": [],
"processors": "- dissect:\n tokenizer: \"/nsm/zeek/logs/current/%{pipeline}.log\"\n field: \"log.file.path\"\n trim_chars: \".log\"\n target_prefix: \"\"\n- script:\n lang: javascript\n source: >\n function process(event) {\n var pl = event.Get(\"pipeline\");\n event.Put(\"@metadata.pipeline\", \"zeek.\" + pl);\n }\n- add_fields:\n target: event\n fields:\n category: network\n module: zeek\n- add_tags:\n tags: \"ics\"\n when:\n regexp:\n pipeline: \"^bacnet*|^bsap*|^cip*|^cotp*|^dnp3*|^ecat*|^enip*|^modbus*|^opcua*|^profinet*|^s7comm*\"",
"custom": "exclude_files: [\"{%- endraw -%}{{ EXCLUDED_LOGS | join('|') }}{%- raw -%}.log$\"]\n"
}
}
}
}
}
}
{%- endraw -%}