mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2025-12-06 17:22:49 +01:00
Merge pull request #389 from Security-Onion-Solutions/ecs_prep
ecs prep
This commit is contained in:
weslambert
GitHub
@@ -4,14 +4,14 @@
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.uid", "target_field": "uid", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_h", "target_field": "source_ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.orig_h", "target_field": "source.ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_p", "target_field": "source_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.orig_p", "target_field": "source.port", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_h", "target_field": "destination_ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.resp_h", "target_field": "destination.ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.proto", "target_field": "protocol", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination.port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.proto", "target_field": "network.protocol", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.service", "target_field": "service", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.duration", "target_field": "duration", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.orig_bytes", "target_field": "original_bytes", "ignore_missing": true } },
|
||||
|
||||
@@ -4,13 +4,13 @@
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.uid", "target_field": "uid", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_h", "target_field": "source_ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.orig_h", "target_field": "source.ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_p", "target_field": "source_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.orig_p", "target_field": "source.port", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_h", "target_field": "destination_ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.resp_h", "target_field": "destination.ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination.port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.rtt", "target_field": "rtt", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.named_pipe", "target_field": "named_pipe", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.endpoint", "target_field": "endpoint", "ignore_missing": true } },
|
||||
|
||||
@@ -8,8 +8,8 @@
|
||||
{ "rename": { "field": "message2.lease_time", "target_field": "lease_time", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.trans_id", "target_field": "transaction_id", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.assigned_addr", "target_field": "assigned_ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.client_addr", "target_field": "source_ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.server_addr", "target_field": "destination_ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.client_addr", "target_field": "source.ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.server_addr", "target_field": "destination.ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.requested_addr", "target_field": "requested_ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.domain", "target_field": "domain_name", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.host_name", "target_field": "hostname", "ignore_missing": true } },
|
||||
|
||||
@@ -4,13 +4,13 @@
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.uid", "target_field": "uid", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_h", "target_field": "source_ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.orig_h", "target_field": "source.ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_p", "target_field": "source_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.orig_p", "target_field": "source.port", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_h", "target_field": "destination_ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.resp_h", "target_field": "destination.ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination.port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.fc_request", "target_field": "fc_request", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.fc_reply", "target_field": "fc_reply", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.iin", "target_field": "iin", "ignore_missing": true } },
|
||||
|
||||
@@ -4,14 +4,14 @@
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.uid", "target_field": "uid", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_h", "target_field": "source_ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.orig_h", "target_field": "source.ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_p", "target_field": "source_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.orig_p", "target_field": "source.port", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_h", "target_field": "destination_ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.resp_h", "target_field": "destination.ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.proto", "target_field": "protocol", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination.port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.proto", "target_field": "network.protocol", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.trans_id", "target_field": "transaction_id", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.rtt", "target_field": "rtt", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.query", "target_field": "query", "ignore_missing": true } },
|
||||
|
||||
@@ -4,14 +4,14 @@
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.uid", "target_field": "uid", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_h", "target_field": "source_ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.orig_h", "target_field": "source.ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_p", "target_field": "source_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.orig_p", "target_field": "source.port", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_h", "target_field": "destination_ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.resp_h", "target_field": "destination.ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.proto", "target_field": "protocol", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination.port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.proto", "target_field": "network.protocol", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.analyzer", "target_field": "analyzer", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.failure_reason", "target_field": "failure_reason", "ignore_missing": true } },
|
||||
{ "pipeline": { "name": "bro_common" } }
|
||||
|
||||
@@ -4,11 +4,11 @@
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.fuid", "target_field": "fuid", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.tx_hosts", "target_field": "file_ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.rx_hosts.0", "target_field": "destination_ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.rx_hosts.0", "target_field": "destination.ip", "ignore_missing": true } },
|
||||
{ "remove": { "field": "message2.rx_hosts", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.conn_uids", "target_field": "uid", "ignore_missing": true } },
|
||||
{ "remove": { "field": "source", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.source", "target_field": "source", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.source", "target_field": "file_source", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.depth", "target_field": "depth", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.analyzers", "target_field": "analyzer", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.mime_type", "target_field": "mimetype", "ignore_missing": true } },
|
||||
|
||||
@@ -4,13 +4,13 @@
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.uid", "target_field": "uid", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_h", "target_field": "source_ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.orig_h", "target_field": "source.ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_p", "target_field": "source_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.orig_p", "target_field": "source.port", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_h", "target_field": "destination_ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.resp_h", "target_field": "destination.ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination.port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.user", "target_field": "username", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.password", "target_field": "password", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.command", "target_field": "ftp_command", "ignore_missing": true } },
|
||||
@@ -22,11 +22,11 @@
|
||||
{ "dot_expander": { "field": "data_channel.passive", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.data_channel.passive","target_field": "data_channel_passive", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "data_channel.orig_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.data_channel.orig_h","target_field": "data_channel_source_ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.data_channel.orig_h","target_field": "data_channel_source.ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "data_channel.resp_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.data_channel.resp_h","target_field": "data_channel_destination_ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.data_channel.resp_h","target_field": "data_channel_destination.ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "data_channel.resp_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.data_channel.resp_p","target_field": "data_channel_destination_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.data_channel.resp_p","target_field": "data_channel_destination.port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.fuid", "target_field": "fuid", "ignore_missing": true } },
|
||||
{ "pipeline": { "name": "bro_common" } }
|
||||
]
|
||||
|
||||
@@ -4,13 +4,13 @@
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.uid", "target_field": "uid", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_h", "target_field": "source_ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.orig_h", "target_field": "source.ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_p", "target_field": "source_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.orig_p", "target_field": "source.port", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_h", "target_field": "destination_ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.resp_h", "target_field": "destination.ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination.port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.trans_depth", "target_field": "trans_depth", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.method", "target_field": "method", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.host", "target_field": "virtual_host", "ignore_missing": true } },
|
||||
|
||||
@@ -4,13 +4,13 @@
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.uid", "target_field": "uid", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_h", "target_field": "source_ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.orig_h", "target_field": "source.ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_p", "target_field": "source_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.orig_p", "target_field": "source.port", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_h", "target_field": "destination_ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.resp_h", "target_field": "destination.ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination.port", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "seen.indicator", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.seen.indicator", "target_field": "indicator", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "seen.indicator_type", "path": "message2", "ignore_failure": true } },
|
||||
|
||||
@@ -4,13 +4,13 @@
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.uid", "target_field": "uid", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_h", "target_field": "source_ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.orig_h", "target_field": "source.ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_p", "target_field": "source_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.orig_p", "target_field": "source.port", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_h", "target_field": "destination_ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.resp_h", "target_field": "destination.ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination.port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.nick", "target_field": "nick", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.user", "target_field": "irc_username", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.command", "target_field": "irc_command", "ignore_missing": true } },
|
||||
|
||||
@@ -4,13 +4,13 @@
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.uid", "target_field": "uid", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_h", "target_field": "source_ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.orig_h", "target_field": "source.ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_p", "target_field": "source_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.orig_p", "target_field": "source.port", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_h", "target_field": "destination_ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.resp_h", "target_field": "destination.ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination.port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.request_type", "target_field": "request_type", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.client", "target_field": "client", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.service", "target_field": "service", "ignore_missing": true } },
|
||||
|
||||
@@ -4,13 +4,13 @@
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.uid", "target_field": "uid", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_h", "target_field": "source_ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.orig_h", "target_field": "source.ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_p", "target_field": "source_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.orig_p", "target_field": "source.port", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_h", "target_field": "destination_ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.resp_h", "target_field": "destination.ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination.port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.func", "target_field": "function", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.exception", "target_field": "exception", "ignore_missing": true } },
|
||||
{ "pipeline": { "name": "bro_common" } }
|
||||
|
||||
@@ -4,13 +4,13 @@
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.uid", "target_field": "uid", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_h", "target_field": "source_ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.orig_h", "target_field": "source.ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_p", "target_field": "source_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.orig_p", "target_field": "source.port", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_h", "target_field": "destination_ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.resp_h", "target_field": "destination.ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination.port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.cmd", "target_field": "mysql_command", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.arg", "target_field": "mysql_argument", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.success", "target_field": "mysql_success", "ignore_missing": true } },
|
||||
|
||||
@@ -6,17 +6,17 @@
|
||||
{ "remove": { "field": "message2.src", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.uid", "target_field": "uid", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_h", "target_field": "source_ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.orig_h", "target_field": "source.ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_p", "target_field": "source_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.orig_p", "target_field": "source.port", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_h", "target_field": "destination_ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.resp_h", "target_field": "destination.ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination.port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.fuid", "target_field": "fuid", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.mime", "target_field": "file_mime_type", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.desc", "target_field": "file_description", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.proto", "target_field": "protocol", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.proto", "target_field": "network.protocol", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.note", "target_field": "note", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.msg", "target_field": "msg", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.sub", "target_field": "sub_msg", "ignore_missing": true } },
|
||||
|
||||
@@ -4,13 +4,13 @@
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.uid", "target_field": "uid", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_h", "target_field": "source_ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.orig_h", "target_field": "source.ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_p", "target_field": "source_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.orig_p", "target_field": "source.port", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_h", "target_field": "destination_ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.resp_h", "target_field": "destination.ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination.port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.hostname", "target_field": "hostname", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.domainname", "target_field": "domain_name", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.success", "target_field": "ntlm_success", "ignore_missing": true } },
|
||||
|
||||
@@ -4,13 +4,13 @@
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.uid", "target_field": "uid", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_h", "target_field": "source_ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.orig_h", "target_field": "source.ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_p", "target_field": "source_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.orig_p", "target_field": "source.port", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_h", "target_field": "destination_ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.resp_h", "target_field": "destination.ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination.port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.username", "target_field": "username", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.mac", "target_field": "mac", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.framed_addr", "target_field": "framed_addr", "ignore_missing": true } },
|
||||
|
||||
@@ -4,13 +4,13 @@
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.uid", "target_field": "uid", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_h", "target_field": "source_ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.orig_h", "target_field": "source.ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_p", "target_field": "source_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.orig_p", "target_field": "source.port", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_h", "target_field": "destination_ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.resp_h", "target_field": "destination.ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination.port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.cookie", "target_field": "cookie", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.result", "target_field": "result", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.security_protocol","target_field": "security_protocol", "ignore_missing": true } },
|
||||
|
||||
@@ -4,13 +4,13 @@
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.uid", "target_field": "uid", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_h", "target_field": "source_ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.orig_h", "target_field": "source.ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_p", "target_field": "source_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.orig_p", "target_field": "source.port", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_h", "target_field": "destination_ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.resp_h", "target_field": "destination.ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination.port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.client_major_version", "target_field": "client_major_version", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.client_minor_version", "target_field": "client_minor_version", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.server_major_version", "target_field": "server_major_version", "ignore_missing": true } },
|
||||
|
||||
@@ -4,13 +4,13 @@
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.uid", "target_field": "uid", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_h", "target_field": "source_ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.orig_h", "target_field": "source.ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_p", "target_field": "source_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.orig_p", "target_field": "source.port", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_h", "target_field": "destination_ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.resp_h", "target_field": "destination.ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination.port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.note", "target_field": "note", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.sig_id", "target_field": "signature_id", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.event_msg", "target_field": "event_message", "ignore_missing": true } },
|
||||
|
||||
@@ -4,13 +4,13 @@
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.uid", "target_field": "uid", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_h", "target_field": "source_ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.orig_h", "target_field": "source.ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_p", "target_field": "source_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.orig_p", "target_field": "source.port", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_h", "target_field": "destination_ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.resp_h", "target_field": "destination.ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination.port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.trans_depth", "target_field": "trans_depth", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.method", "target_field": "method", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.uri", "target_field": "uri", "ignore_missing": true } },
|
||||
|
||||
@@ -4,13 +4,13 @@
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.uid", "target_field": "uid", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_h", "target_field": "source_ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.orig_h", "target_field": "source.ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_p", "target_field": "source_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.orig_p", "target_field": "source.port", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_h", "target_field": "destination_ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.resp_h", "target_field": "destination.ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination.port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.fuid", "target_field": "fuid", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.action", "target_field": "action", "ignore_missing": true } },
|
||||
{ "remove": { "field": "path", "ignore_failure": true } },
|
||||
|
||||
@@ -4,13 +4,13 @@
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.uid", "target_field": "uid", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_h", "target_field": "source_ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.orig_h", "target_field": "source.ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_p", "target_field": "source_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.orig_p", "target_field": "source.port", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_h", "target_field": "destination_ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.resp_h", "target_field": "destination.ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination.port", "ignore_missing": true } },
|
||||
{ "remove": { "field": "path", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.path", "target_field": "path", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.service", "target_field": "service", "ignore_missing": true } },
|
||||
|
||||
@@ -5,13 +5,13 @@
|
||||
{ "remove": { "field": "path", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.uid", "target_field": "uid", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_h", "target_field": "source_ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.orig_h", "target_field": "source.ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_p", "target_field": "source_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.orig_p", "target_field": "source.port", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_h", "target_field": "destination_ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.resp_h", "target_field": "destination.ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination.port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.trans_depth", "target_field": "trans_depth", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.helo", "target_field": "helo", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.mailfrom", "target_field": "mail_from", "ignore_missing": true } },
|
||||
|
||||
@@ -4,13 +4,13 @@
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.uid", "target_field": "uid", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_h", "target_field": "source_ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.orig_h", "target_field": "source.ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_p", "target_field": "source_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.orig_p", "target_field": "source.port", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_h", "target_field": "destination_ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.resp_h", "target_field": "destination.ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination.port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.duration", "target_field": "duration", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.version", "target_field": "version", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.community", "target_field": "community", "ignore_missing": true } },
|
||||
|
||||
@@ -4,13 +4,13 @@
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.uid", "target_field": "uid", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_h", "target_field": "source_ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.orig_h", "target_field": "source.ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_p", "target_field": "source_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.orig_p", "target_field": "source.port", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_h", "target_field": "destination_ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.resp_h", "target_field": "destination.ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination.port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.version", "target_field": "version", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.user", "target_field": "user", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.password", "target_field": "password", "ignore_missing": true } },
|
||||
|
||||
@@ -13,8 +13,8 @@
|
||||
{ "rename": { "field": "message2.version.minor3", "target_field": "version_minor3", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "version.addl", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.version.addl", "target_field": "version_additional_info", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.host", "target_field": "source_ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.host_p", "target_field": "source_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.host", "target_field": "source.ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.host_p", "target_field": "source.port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.software_type", "target_field": "software_type", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.name", "target_field": "name", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.unparsed_version", "target_field": "unparsed_version", "ignore_missing": true } },
|
||||
|
||||
@@ -3,13 +3,13 @@
|
||||
"processors" : [
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "dot_expander": { "field": "id.orig_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_h", "target_field": "source_ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.orig_h", "target_field": "source.ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_p", "target_field": "source_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.orig_p", "target_field": "source.port", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_h", "target_field": "destination_ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.resp_h", "target_field": "destination.ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination.port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.version", "target_field": "version", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.uid", "target_field": "uid", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.hassh", "target_field": "hassh", "ignore_missing": true } },
|
||||
|
||||
@@ -4,13 +4,13 @@
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.uid", "target_field": "uid", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_h", "target_field": "source_ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.orig_h", "target_field": "source.ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_p", "target_field": "source_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.orig_p", "target_field": "source.port", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_h", "target_field": "destination_ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.resp_h", "target_field": "destination.ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination.port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.version", "target_field": "version", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.cipher", "target_field": "cipher", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.curve", "target_field": "curve", "ignore_missing": true } },
|
||||
|
||||
@@ -4,14 +4,14 @@
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.uid", "target_field": "uid", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_h", "target_field": "source_ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.orig_h", "target_field": "source.ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_p", "target_field": "source_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.orig_p", "target_field": "source.port", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_h", "target_field": "destination_ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.resp_h", "target_field": "destination.ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.proto", "target_field": "protocol", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination.port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.proto", "target_field": "network.protocol", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.facility", "target_field": "facility", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.severity", "target_field": "severity", "ignore_missing": true } },
|
||||
{ "remove": { "field": "message", "ignore_failure": true } },
|
||||
|
||||
@@ -4,13 +4,13 @@
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.uid", "target_field": "uid", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_h", "target_field": "source_ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.orig_h", "target_field": "source.ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_p", "target_field": "source_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.orig_p", "target_field": "source.port", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_h", "target_field": "destination_ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.resp_h", "target_field": "destination.ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination.port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.tunnel_type", "target_field": "tunnel_type", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.action", "target_field": "action", "ignore_missing": true } },
|
||||
{ "pipeline": { "name": "bro_common" } }
|
||||
|
||||
@@ -4,13 +4,13 @@
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.uid", "target_field": "uid", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_h", "target_field": "source_ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.orig_h", "target_field": "source.ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_p", "target_field": "source_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.orig_p", "target_field": "source.port", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_h", "target_field": "destination_ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.resp_h", "target_field": "destination.ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination.port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.name", "target_field": "name", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.addl", "target_field": "additional_info", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.notice", "target_field": "notice", "ignore_missing": true } },
|
||||
|
||||
@@ -10,7 +10,7 @@
|
||||
},
|
||||
{
|
||||
"geoip": {
|
||||
"field": "destination_ip",
|
||||
"field": "destination.ip",
|
||||
"target_field": "destination_geo",
|
||||
"database_file": "GeoLite2-City.mmdb",
|
||||
"ignore_missing": true,
|
||||
@@ -19,7 +19,7 @@
|
||||
},
|
||||
{
|
||||
"geoip": {
|
||||
"field": "source_ip",
|
||||
"field": "source.ip",
|
||||
"target_field": "source_geo",
|
||||
"database_file": "GeoLite2-City.mmdb",
|
||||
"ignore_missing": true,
|
||||
|
||||
@@ -1,181 +1,125 @@
|
||||
# Author: Justin Henderson
|
||||
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
|
||||
# Updated by: Doug Burks
|
||||
# Last Update: 3/15/2018
|
||||
|
||||
filter {
|
||||
if [type] == "ids" {
|
||||
# This is the initial parsing of the log
|
||||
if [engine] == "suricata" {
|
||||
json {
|
||||
source => "message"
|
||||
if [engine] == "suricata" {
|
||||
json {
|
||||
source => "message"
|
||||
}
|
||||
mutate {
|
||||
# Make this compatible with event.id as a string
|
||||
convert => { "[flow_id]" => "string" }
|
||||
rename => {
|
||||
"proto" => "[network][transport]"
|
||||
"event_type" => "[event][dataset]"
|
||||
"flow_id" => "[event][id]"
|
||||
"community_id" => "[network][community_id]"
|
||||
}
|
||||
lowercase => [ "[network][transport]" ]
|
||||
merge => {"[event][id]" => "[related][id]" }
|
||||
add_field => {
|
||||
"[related][domain]" => []
|
||||
"[related][ip]" => []
|
||||
"[related][id]" => []
|
||||
"[event][module]" => "suricata"
|
||||
"[event][created]" => "%{[@timestamp]}"
|
||||
"[event][version]" => "1.0.0"
|
||||
"[event][category]" => "network"
|
||||
}
|
||||
}
|
||||
|
||||
# Set the timestamp from the event
|
||||
date {
|
||||
match => [ "timestamp", "ISO8601" ]
|
||||
tag_on_failure => [ "_dateparsefailure", "_parsefailure", "_suricata_dateparsefailure" ]
|
||||
remove_field => [ "timestamp" ]
|
||||
}
|
||||
|
||||
# Suricata uses top-level src/dest to track flow
|
||||
if [src_ip] {
|
||||
mutate {
|
||||
rename => {
|
||||
"[src_ip]" => "[source][ip]"
|
||||
"[src_port]" => "[source][port]"
|
||||
}
|
||||
merge => { "[related][ip]" => "[source][ip]" }
|
||||
}
|
||||
}
|
||||
if [dest_ip] {
|
||||
mutate {
|
||||
rename => {
|
||||
"[dest_ip]" => "[destination][ip]"
|
||||
"[dest_port]" => "[destination][port]"
|
||||
}
|
||||
merge => { "[related][ip]" => "[destination][ip]" }
|
||||
}
|
||||
}
|
||||
|
||||
if [vlan] {
|
||||
mutate {
|
||||
rename => { "[vlan]" => "[vlan][id]" }
|
||||
}
|
||||
}
|
||||
if [app_proto] {
|
||||
if [app_proto] == "failed" {
|
||||
# delete failed detections to be consistent with zeek
|
||||
mutate { rename => { "app_proto" => "[error][message]" } }
|
||||
}
|
||||
else {
|
||||
mutate { rename => {"app_proto" => "[network][protocol]"}}
|
||||
}
|
||||
}
|
||||
if [event_type] == "alert" {
|
||||
if [alert][severity] == 1 {
|
||||
mutate {
|
||||
rename => { "alert" => "orig_alert" }
|
||||
rename => { "[orig_alert][gid]" => "gid" }
|
||||
rename => { "[orig_alert][signature_id]" => "sid" }
|
||||
rename => { "[orig_alert][rev]" => "rev" }
|
||||
rename => { "[orig_alert][signature]" => "alert" }
|
||||
rename => { "[orig_alert][category]" => "classification" }
|
||||
rename => { "[orig_alert][severity]" => "priority" }
|
||||
rename => { "[orig_alert][rule]" => "rule_signature" }
|
||||
rename => { "app_proto" => "application_protocol" }
|
||||
rename => { "dest_ip" => "destination_ip" }
|
||||
rename => { "dest_port" => "destination_port" }
|
||||
rename => { "in_iface" => "interface" }
|
||||
rename => { "proto" => "protocol" }
|
||||
rename => { "src_ip" => "source_ip" }
|
||||
rename => { "src_port" => "source_port" }
|
||||
#rename => { "[fileinfo][filename]" => "filename" }
|
||||
#rename => { "[fileinfo][gaps]" => "gaps" }
|
||||
#rename => { "[fileinfo][size]" => "size" }
|
||||
#rename => { "[fileinfo][state]" => "state" }
|
||||
#rename => { "[fileinfo][stored]" => "stored" }
|
||||
#rename => { "[fileinfo][tx_id]" => "tx_id" }
|
||||
#rename => { "[flow][age]" => "duration" }
|
||||
#rename => { "[flow][alerted]" => "flow_alerted" }
|
||||
#rename => { "[flow][bytes_toclient]" => "bytes_to_client" }
|
||||
#rename => { "[flow][bytes_toserver]" => "bytes_to_server" }
|
||||
#rename => { "[flow][end]" => "flow_end" }
|
||||
#rename => { "[flow][pkts_toclient]" => "packets_to_client" }
|
||||
#rename => { "[flow][pkts_toserver]" => "packets_to_server" }
|
||||
#rename => { "[flow][reason]" => "reason" }
|
||||
#rename => { "[flow][start]" => "flow_start" }
|
||||
#rename => { "[flow][state]" => "state" }
|
||||
#rename => { "[netflow][age]" => "duration" }
|
||||
#rename => { "[netflow][bytes]" => "bytes" }
|
||||
#rename => { "[netflow][end]" => "netflow_end" }
|
||||
#rename => { "[netflow][start]" => "netflow_start" }
|
||||
#rename => { "[netflow][pkts]" => "packets" }
|
||||
rename => { "[alert][action]" => "action" }
|
||||
rename => { "[alert][category]" => "category" }
|
||||
rename => { "[alert][gid]" => "gid" }
|
||||
rename => { "[alert][rev]" => "rev" }
|
||||
rename => { "[alert][severity]" => "severity" }
|
||||
rename => { "[alert][signature]" => "signature" }
|
||||
rename => { "[alert][signature_id]" => "sid" }
|
||||
#rename => { "[dns][aa]" => "aa" }
|
||||
#rename => { "[dns][flags]" => "flags" }
|
||||
#rename => { "[dns][id]" => "id" }
|
||||
#rename => { "[dns][qr]" => "qr" }
|
||||
#rename => { "[dns][rcode]" => "rcode_name" }
|
||||
#rename => { "[dns][rrname]" => "rrname" }
|
||||
#rename => { "[dns][rrtype]" => "rrtype" }
|
||||
#rename => { "[dns][tx_id]" => "tx_id" }
|
||||
#rename => { "[dns][type]" => "record_type" }
|
||||
#rename => { "[dns][version]" => "version" }
|
||||
rename => { "[http][hostname]" => "virtual_host" }
|
||||
rename => { "[http][http_content_type]" => "content_type" }
|
||||
rename => { "[http][http_port]" => "http_port" }
|
||||
rename => { "[http][http_method]" => "method" }
|
||||
rename => { "[http][http_user_agent]" => "useragent" }
|
||||
#rename => { "[http][length]" => "payload_length" }
|
||||
#rename => { "[http][protocol]" => "http_version" }
|
||||
rename => { "[http][status]" => "status_message" }
|
||||
rename => { "[http][url]" => "url" }
|
||||
#rename => { "[metadata][flowbits]" => "flowbits" }
|
||||
rename => { "[tls][fingerprint]" => "certificate_serial_number" }
|
||||
rename => { "[tls][issuerdn]" => "issuer_distinguished_name" }
|
||||
rename => { "[tls][notafter]" => "certificate_not_valid_after" }
|
||||
rename => { "[tls][notbefore]" => "certificate_not_valid_before" }
|
||||
rename => { "[tls][subject]" => "certificate_common_name" }
|
||||
rename => { "[tls][version]" => "tls_version" }
|
||||
rename => { "event_type" => "ids_event_type" }
|
||||
remove_field => [ "offset", "orig_alert", "beat", "input", "prospector" ]
|
||||
remove_tag => [ "beats_input_codec_plain_applied" ]
|
||||
add_tag => [ "eve" ]
|
||||
|
||||
}
|
||||
} else {
|
||||
add_field => { "severity" => "High" }
|
||||
}
|
||||
}
|
||||
if [alert][severity] == 2 {
|
||||
mutate {
|
||||
add_field => { "severity" => "Medium" }
|
||||
}
|
||||
}
|
||||
if [alert][severity] == 3 {
|
||||
mutate {
|
||||
add_field => { "severity" => "Low" }
|
||||
}
|
||||
}
|
||||
# If the alert is a Snort GPL alert break it apart for easier reading and categorization
|
||||
if [alert][signature] =~ "GPL " {
|
||||
# This will parse out the category type from the alert
|
||||
grok {
|
||||
match => ["message", "\[%{INT:gid}:%{INT:sid}:%{INT:rev}\]\s%{DATA:alert}\[Classification:\s+%{DATA:classification}\]\s+\[Priority:\s+%{INT:priority}\]:\s+<%{DATA:interface}>\s+{%{DATA:protocol}}\s+(?:%{IPV4:source_ip}|%{IPV6:source_ip}):%{INT:source_port}\s+->\s+(?:%{IPV4:destination_ip}|%{IPV6:destination_ip}):%{INT:destination_port}",
|
||||
"message", "\[%{INT:gid}:%{INT:sid}:%{INT:rev}\]\s%{DATA:alert}\[Classification:\s+%{DATA:classification}\]\s+\[Priority:\s+%{INT:priority}\]:\s+<%{DATA:interface}>\s+{%{DATA:protocol}}\s(?:%{IPV4:source_ip}|%{IPV6:source_ip})\s+->\s+(?:%{IPV4:destination_ip}|%{IPV6:destination_ip})",
|
||||
"message", "\[%{INT:gid}:%{INT:sid}:%{INT:rev}\]\s%{DATA:alert}\[Classification:\s+%{DATA:classification}\]\s+\[Priority:\s+%{INT:priority}\]:\s+{%{DATA:protocol}}\s+(?:%{IPV4:source_ip}|%{IPV6:source_ip}):%{INT:source_port}\s+->\s+%{IPV4:destination_ip}:%{INT:destination_port}",
|
||||
"message", "\[%{INT:gid}:%{INT:sid}:%{INT:rev}\]\s%{DATA:alert}\[Classification:\s+%{DATA:classification}\]\s+\[Priority:\s+%{INT:priority}\]:\s+{%{DATA:protocol}}\s(?:%{IPV4:source_ip}|%{IPV6:source_ip})\s+->\s+(?:%{IPV4:destination_ip}|%{IPV6:destination_ip})",
|
||||
"message", "\[%{INT:gid}:%{INT:sid}:%{INT:rev}\]\s%{DATA:alert}\[Classification:\s+%{DATA:classification}\]\s+\[Priority:\s+%{INT:priority}\]:\s+{%{DATA:protocol}}\s+(?:%{IPV4:source_ip}|%{IPV6:source_ip}):%{INT:source_port}\s+->\s+(?:%{IPV4:destination_ip}|%{IPV6:destination_ip}):%{INT:destination_port}",
|
||||
"message", "\[%{INT:gid}:%{INT:sid}:%{INT:rev}\]\s%{DATA:alert}\[Classification:\s+%{DATA:classification}\]\s+\[Priority:\s+%{INT:priority}\]:\s+{%{DATA:protocol}}\s(?:%{IPV4:source_ip}|%{IPV6:source_ip})\s+->\s+(?:%{IPV4:source_ip}|%{IPV6:source_ip})",
|
||||
"message", "\[%{INT:gid}:%{INT:sid}:%{INT:rev}\]\s%{DATA:alert}\[Classification:\s+%{DATA:classification}\]\s+\[Priority:\s+%{INT:priority}\]:\s+{%{DATA:protocol}}",
|
||||
"message", "\A%{TIME} pid\(%{INT}\) Alert Received: %{INT} %{INT:priority} %{DATA:classification} %{DATA:interface} \{%{DATA:timestamp}} %{INT} %{INT} \{%{DATA:alert}} %{IP:source_ip} %{IP:destination_ip} %{INT:protocol} %{INT:source_port} %{INT:destination_port} %{INT:gid} %{INT:sid} %{INT:rev} %{INT} %{INT}\Z",
|
||||
"message", "%{GREEDYDATA:alert}"]
|
||||
match => { "[alert][signature]" => "GPL\s+%{DATA:category}\s" }
|
||||
}
|
||||
}
|
||||
if [timestamp] {
|
||||
# This will store the category
|
||||
mutate {
|
||||
add_field => { "logstash_timestamp" => "%{@timestamp}" }
|
||||
add_field => { "rule_type" => "Snort GPL" }
|
||||
lowercase => [ "category" ]
|
||||
}
|
||||
mutate {
|
||||
convert => { "logstash_timestamp" => "string" }
|
||||
}
|
||||
date {
|
||||
match => [ "timestamp", "ISO8601" ]
|
||||
}
|
||||
mutate {
|
||||
rename => { "logstash_timestamp" => "timestamp" }
|
||||
}
|
||||
}
|
||||
|
||||
# If the alert is a Snort GPL alert break it apart for easier reading and categorization
|
||||
if [alert] =~ "GPL " {
|
||||
# This will parse out the category type from the alert
|
||||
grok {
|
||||
match => { "alert" => "GPL\s+%{DATA:category}\s" }
|
||||
}
|
||||
# This will store the category
|
||||
mutate {
|
||||
add_field => { "rule_type" => "Snort GPL" }
|
||||
lowercase => [ "category"]
|
||||
# If the alert is an Emerging Threat alert break it apart for easier reading and categorization
|
||||
if [alert][signature] =~ "ET " {
|
||||
# This will parse out the category type from the alert
|
||||
grok {
|
||||
match => { "[alert][signature]" => "ET\s+%{DATA:category}\s" }
|
||||
}
|
||||
# This will store the category
|
||||
mutate {
|
||||
add_field => { "rule_type" => "Emerging Threats" }
|
||||
lowercase => [ "category" ]
|
||||
}
|
||||
}
|
||||
# If the alert is an Emerging Threat alert break it apart for easier reading and categorization
|
||||
if [alert] =~ "ET " {
|
||||
# This will parse out the category type from the alert
|
||||
grok {
|
||||
match => { "alert" => "ET\s+%{DATA:category}\s" }
|
||||
}
|
||||
# This will store the category
|
||||
mutate {
|
||||
add_field => { "rule_type" => "Emerging Threats" }
|
||||
lowercase => [ "category"]
|
||||
# This section adds URLs to lookup information about a rule online
|
||||
if [rule_type] == "Snort GPL" {
|
||||
mutate {
|
||||
add_field => [ "signature_info", "https://www.snort.org/search?query=%{[alert][gid]}-%{[alert][signature_id]}" ]
|
||||
}
|
||||
}
|
||||
if [rule_type] == "Emerging Threats" {
|
||||
mutate {
|
||||
add_field => [ "signature_info", "http://doc.emergingthreats.net/%{[alert][signature_id]}" ]
|
||||
}
|
||||
}
|
||||
}
|
||||
# I recommend changing the field types below to integer so searches can do greater than or less than
|
||||
# and also so math functions can be ran against them
|
||||
mutate {
|
||||
convert => [ "source_port", "integer" ]
|
||||
convert => [ "destination_port", "integer" ]
|
||||
convert => [ "gid", "integer" ]
|
||||
convert => [ "sid", "integer" ]
|
||||
# remove_field => [ "message"]
|
||||
remove_field => [ "alert" ]
|
||||
}
|
||||
# This will translate the priority field into a severity field of either High, Medium, or Low
|
||||
if [priority] == 1 {
|
||||
mutate {
|
||||
add_field => { "severity" => "High" }
|
||||
}
|
||||
}
|
||||
if [priority] == 2 {
|
||||
mutate {
|
||||
add_field => { "severity" => "Medium" }
|
||||
}
|
||||
}
|
||||
if [priority] == 3 {
|
||||
mutate {
|
||||
add_field => { "severity" => "Low" }
|
||||
}
|
||||
}
|
||||
# This section adds URLs to lookup information about a rule online
|
||||
if [sid] and [sid] > 0 and [sid] < 1000000 {
|
||||
mutate {
|
||||
add_field => [ "signature_info", "https://www.snort.org/search?query=%{gid}-%{sid}" ]
|
||||
}
|
||||
}
|
||||
if [sid] and [sid] > 1999999 and [sid] < 2999999 {
|
||||
mutate {
|
||||
add_field => [ "signature_info", "http://doc.emergingthreats.net/%{sid}" ]
|
||||
}
|
||||
}
|
||||
# mutate {
|
||||
#add_tag => [ "conf_file_1033"]
|
||||
# }
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user