CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 17:22:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

update analyzer pipeline

Browse Source
This commit is contained in:
reyesj2
2025-11-14 15:41:54 -06:00
parent 45b4b1d963
commit 7c73b4713f
1 changed files with 21 additions and 68 deletions
Download Patch File Download Diff File Expand all files Collapse all files

89
salt/elasticsearch/files/ingest/zeek.analyzer
View File

@@ -1,10 +1,10 @@
{
"description": "zeek.dpd",
"description": "zeek.analyzer",
"processors": [
{
"set": {
"field": "event.dataset",
"value": "dpd"
"value": "analyzer"
}
},
{
@@ -23,75 +23,28 @@
}
},
{
"dot_expander": {
"field": "id.orig_h",
"path": "message2",
"set": {
"field": "network.protocol",
"copy_from": "message2.analyzer_name",
"ignore_empty_value": true,
"if": "ctx?.message2?.analyzer_kind == 'protocol'"
}
},
{
"set": {
"field": "network.protocol",
"ignore_empty_value": true,
"if": "ctx?.message2?.analyzer_kind != 'protocol'",
"copy_from": "message2.proto"
}
},
{
"lowercase": {
"field": "network.protocol",
"ignore_missing": true,
"ignore_failure": true
}
},
{
"rename": {
"field": "message2.id.orig_h",
"target_field": "source.ip",
"ignore_missing": true
}
},
{
"dot_expander": {
"field": "id.orig_p",
"path": "message2",
"ignore_failure": true
}
},
{
"rename": {
"field": "message2.id.orig_p",
"target_field": "source.port",
"ignore_missing": true
}
},
{
"dot_expander": {
"field": "id.resp_h",
"path": "message2",
"ignore_failure": true
}
},
{
"rename": {
"field": "message2.id.resp_h",
"target_field": "destination.ip",
"ignore_missing": true
}
},
{
"dot_expander": {
"field": "id.resp_p",
"path": "message2",
"ignore_failure": true
}
},
{
"rename": {
"field": "message2.id.resp_p",
"target_field": "destination.port",
"ignore_missing": true
}
},
{
"rename": {
"field": "message2.proto",
"target_field": "network.protocol",
"ignore_missing": true
}
},
{
"rename": {
"field": "message2.analyzer",
"target_field": "observer.analyzer",
"ignore_missing": true
}
},
{
"rename": {
"field": "message2.failure_reason",