mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2025-12-06 09:12:45 +01:00
[fix] Remove files that are no longer in dev
This commit is contained in:
William Wernert
@@ -1,113 +0,0 @@
|
|||||||
<!DOCTYPE html>
|
|
||||||
<html lang="en">
|
|
||||||
<head>
|
|
||||||
<title>Security Onion - Hybrid Hunter</title>
|
|
||||||
<meta charset="utf-8">
|
|
||||||
<meta name="viewport" content="width=device-width, initial-scale=1">
|
|
||||||
<link rel="icon" type="image/png" href="favicon-32x32.png" sizes="32x32" />
|
|
||||||
<link rel="icon" type="image/png" href="favicon-16x16.png" sizes="16x16" />
|
|
||||||
<style>
|
|
||||||
* {
|
|
||||||
box-sizing: border-box;
|
|
||||||
font-family: Arial, Helvetica, sans-serif;
|
|
||||||
padding-left: 30px;
|
|
||||||
padding right: 30px;
|
|
||||||
}
|
|
||||||
|
|
||||||
body {
|
|
||||||
font-family: Arial, Helvetica, sans-serif;
|
|
||||||
background-color: #2a2a2a;
|
|
||||||
|
|
||||||
}
|
|
||||||
a {
|
|
||||||
color: #f2f2f2;
|
|
||||||
text-align: left;
|
|
||||||
padding: 0px;
|
|
||||||
}
|
|
||||||
/* Style the top navigation bar */
|
|
||||||
.topnav {
|
|
||||||
overflow: hidden;
|
|
||||||
background-color: #333;
|
|
||||||
width: 1080px;
|
|
||||||
}
|
|
||||||
|
|
||||||
/* Style the topnav links */
|
|
||||||
.topnav a {
|
|
||||||
float: left;
|
|
||||||
display: block;
|
|
||||||
color: #f2f2f2;
|
|
||||||
text-align: center;
|
|
||||||
padding: 14px 16px;
|
|
||||||
text-decoration: none;
|
|
||||||
}
|
|
||||||
|
|
||||||
/* Change color on hover */
|
|
||||||
.topnav a:hover {
|
|
||||||
background-color: #ddd;
|
|
||||||
color: black;
|
|
||||||
}
|
|
||||||
|
|
||||||
/* Style the content */
|
|
||||||
.content {
|
|
||||||
background-color: #2a2a2a;
|
|
||||||
padding: 10px;
|
|
||||||
padding-top: 20px;
|
|
||||||
padding-left: 60px;
|
|
||||||
color: #E3DBCC;
|
|
||||||
width: 1080px;
|
|
||||||
}
|
|
||||||
|
|
||||||
/* Style the footer */
|
|
||||||
.footer {
|
|
||||||
background-color: #2a2a2a;
|
|
||||||
padding: 60px;
|
|
||||||
color: #E3DBCC;
|
|
||||||
width: 1080px;
|
|
||||||
}
|
|
||||||
</style>
|
|
||||||
</head>
|
|
||||||
<body>
|
|
||||||
|
|
||||||
<div class="topnav">
|
|
||||||
<a href="/kibana/" target="_blank">Kibana</a>
|
|
||||||
<a href="/grafana/" target="_blank">Grafana</a>
|
|
||||||
<a href="/fleet/" target="_blank">Fleet</a>
|
|
||||||
<a href="/thehive/" target="_blank">TheHive</a>
|
|
||||||
<a href="/packages/" target="_blank">Osquery Binaries</a>
|
|
||||||
<a href="https://github.com/Security-Onion-Solutions/securityonion-saltstack/wiki/FAQ" target="_blank">FAQ</a>
|
|
||||||
<a href="https://www.securityonionsolutions.com" target="_blank">Security Onion Solutions</a>
|
|
||||||
<a href="https://blog.securityonion.net" target="_blank">Blog</a>
|
|
||||||
</div>
|
|
||||||
|
|
||||||
<div class="content">
|
|
||||||
|
|
||||||
<p><center><h1>Osquery Packages</h1></center><br>
|
|
||||||
|
|
||||||
<h2>Notes</h2>
|
|
||||||
<ul>
|
|
||||||
<li>These packages are customized for this specific Fleet install and will only be generated after the Fleet setup script has been run. If you want vanilla osquery packages, you can get them directly from <a href="https://osquery.io/downloads">osquery.io</a></li>
|
|
||||||
<li>Packages are not signed.</li>
|
|
||||||
</ul>
|
|
||||||
<BR> <h2>Downloads</h2>
|
|
||||||
<ul>
|
|
||||||
|
|
||||||
Generated: N/A
|
|
||||||
<BR><BR>Packages:
|
|
||||||
<li><a href="/packages/launcher.msi" download="msi-launcher.msi">MSI (Windows)</a></li>
|
|
||||||
<li><a href="/packages/launcher.deb" download="deb-launcher.deb">DEB (Debian)</a></li>
|
|
||||||
<li><a href="/packages/launcher.rpm" download="rpm-launcher.rpm">RPM (RPM)</a></li>
|
|
||||||
<BR><BR>Config Files:
|
|
||||||
<li><a href="/packages/launcher.flags" download="launcher.flags.txt">RPM & DEB Flag File</a></li>
|
|
||||||
<li><a href="/packages/launcher-msi.flags" download="launcher-msi.flags.txt">MSI Flag File</a></li>
|
|
||||||
</ul>
|
|
||||||
|
|
||||||
<BR><h2>Known Issues</h2>
|
|
||||||
<ul>
|
|
||||||
<li>None</li>
|
|
||||||
</ul>
|
|
||||||
</p>
|
|
||||||
</div>
|
|
||||||
|
|
||||||
|
|
||||||
</body>
|
|
||||||
</html>
|
|
||||||
@@ -1,13 +0,0 @@
|
|||||||
#!/bin/sh
|
|
||||||
echo "Applying Post Configuration for Osquery"
|
|
||||||
#fleetctl apply -f /packs/hh/osquery.conf
|
|
||||||
fleetctl apply -f /packs/palantir/Fleet/Endpoints/options.yaml
|
|
||||||
fleetctl apply -f /packs/palantir/Fleet/Endpoints/MacOS/osquery.yaml
|
|
||||||
fleetctl apply -f /packs/palantir/Fleet/Endpoints/Windows/osquery.yaml
|
|
||||||
fleetctl apply -f /packs/hh/hhdefault.yml
|
|
||||||
|
|
||||||
for pack in /packs/palantir/Fleet/Endpoints/packs/*.yaml;
|
|
||||||
do fleetctl apply -f "$pack"
|
|
||||||
done
|
|
||||||
echo ""
|
|
||||||
echo "You can now exit the container by typing exit"
|
|
||||||
@@ -1,28 +0,0 @@
|
|||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
name: users
|
|
||||||
description: Users on the system
|
|
||||||
query: select * from users;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
name: chrome-extensions
|
|
||||||
description: Chrome extensions for all users on the system
|
|
||||||
query: select users.username,chrome_extensions.*,chrome_extensions.path from users cross join chrome_extensions using (uid) where identifier not in ('aapocclcgogkmnckokdopfmhonfmgoek', 'aohghmighlieiainnegkcijnfilokake', 'apdfllckaahabafndbhieahigkjlhalf','felcaaldnbdncclmgdcncolpebgiejap','pjkljhegncpnkpknbcohdijeoejaedia','pkedcjkdefgpdelpbcmbmeomcjbeemfm','blpcfgokakmgnkcojhhkbfbldkacnbeo','ghbmnnjooekpmoecnnnilnnbdlolhkhi','nmmhkkegccagdldgiimedpiccmgmieda');
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: pack
|
|
||||||
spec:
|
|
||||||
name: examples
|
|
||||||
targets:
|
|
||||||
labels:
|
|
||||||
- All Hosts
|
|
||||||
queries:
|
|
||||||
- query: users
|
|
||||||
interval: 180
|
|
||||||
removed: false
|
|
||||||
- query: chrome-extensions
|
|
||||||
interval: 180
|
|
||||||
removed: false
|
|
||||||
@@ -1,29 +0,0 @@
|
|||||||
apiVersion: v1
|
|
||||||
kind: options
|
|
||||||
spec:
|
|
||||||
config:
|
|
||||||
decorators:
|
|
||||||
always:
|
|
||||||
- SELECT codename FROM os_version;
|
|
||||||
- SELECT uuid AS LiveQuery FROM system_info;
|
|
||||||
- SELECT address AS EndpointIP1 FROM interface_addresses where address not
|
|
||||||
like '%:%' and address not like '127%' and address not like '169%' order by
|
|
||||||
interface desc limit 1;
|
|
||||||
- SELECT address AS EndpointIP2 FROM interface_addresses where address not
|
|
||||||
like '%:%' and address not like '127%' and address not like '169%' order by
|
|
||||||
interface asc limit 1;
|
|
||||||
- SELECT hardware_serial FROM system_info;
|
|
||||||
- SELECT hostname AS hostname FROM system_info;
|
|
||||||
options:
|
|
||||||
decorations_top_level: true
|
|
||||||
disable_distributed: false
|
|
||||||
distributed_interval: 10
|
|
||||||
distributed_plugin: tls
|
|
||||||
distributed_tls_max_attempts: 3
|
|
||||||
distributed_tls_read_endpoint: /api/v1/osquery/distributed/read
|
|
||||||
distributed_tls_write_endpoint: /api/v1/osquery/distributed/write
|
|
||||||
logger_plugin: tls
|
|
||||||
logger_tls_endpoint: /api/v1/osquery/log
|
|
||||||
logger_tls_period: 10
|
|
||||||
pack_delimiter: _
|
|
||||||
overrides: {}
|
|
||||||
@@ -1,694 +0,0 @@
|
|||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: pack
|
|
||||||
spec:
|
|
||||||
name: mac-pack
|
|
||||||
queries:
|
|
||||||
- description: 'Query to monitor files for changes inside of /etc/emon.d/ or /private/var/db/emondClients/
|
|
||||||
which can be used for persistence: (https://www.xorrior.com/emond-persistence/)'
|
|
||||||
interval: 3600
|
|
||||||
name: emond
|
|
||||||
platform: darwin
|
|
||||||
query: emond
|
|
||||||
- description: 'Snapshot query to monitor files for changes inside of /etc/emon.d/
|
|
||||||
or /private/var/db/emondClients/ which can be used for persistence: (https://www.xorrior.com/emond-persistence/)'
|
|
||||||
interval: 28800
|
|
||||||
name: emond_snapshot
|
|
||||||
platform: darwin
|
|
||||||
query: emond_snapshot
|
|
||||||
snapshot: true
|
|
||||||
- description: Track time/action changes to files specified in configuration data.
|
|
||||||
interval: 300
|
|
||||||
name: file_events
|
|
||||||
platform: darwin
|
|
||||||
query: file_events
|
|
||||||
removed: false
|
|
||||||
- description: The installed homebrew package database.
|
|
||||||
interval: 28800
|
|
||||||
name: homebrew_packages_snapshot
|
|
||||||
platform: darwin
|
|
||||||
query: homebrew_packages_snapshot
|
|
||||||
snapshot: true
|
|
||||||
- description: List kernel extensions, their signing status, and their hashes (excluding
|
|
||||||
extensions signed by Apple)
|
|
||||||
interval: 3600
|
|
||||||
name: macosx_kextstat
|
|
||||||
platform: darwin
|
|
||||||
query: macosx_kextstat
|
|
||||||
- description: Checks the MD5 hash of /etc/rc.common and records the results if
|
|
||||||
the hash differs from the default value. /etc/rc.common can be used for persistence.
|
|
||||||
interval: 3600
|
|
||||||
name: rc.common
|
|
||||||
platform: darwin
|
|
||||||
query: rc.common
|
|
||||||
- description: Returns information about installed event taps. Can be used to detect
|
|
||||||
keyloggers
|
|
||||||
interval: 300
|
|
||||||
name: event_taps
|
|
||||||
platform: darwin
|
|
||||||
query: event_taps
|
|
||||||
- description: LaunchAgents and LaunchDaemons from default search paths.
|
|
||||||
interval: 3600
|
|
||||||
name: launchd
|
|
||||||
platform: darwin
|
|
||||||
query: launchd
|
|
||||||
- description: Snapshot query for launchd
|
|
||||||
interval: 28800
|
|
||||||
name: launchd_snapshot
|
|
||||||
platform: darwin
|
|
||||||
query: launchd_snapshot
|
|
||||||
snapshot: true
|
|
||||||
- description: Detect the presence of the LD_PRELOAD environment variable
|
|
||||||
interval: 60
|
|
||||||
name: ld_preload
|
|
||||||
platform: darwin
|
|
||||||
query: ld_preload
|
|
||||||
removed: false
|
|
||||||
- description: USB devices that are actively plugged into the host system.
|
|
||||||
interval: 300
|
|
||||||
name: usb_devices
|
|
||||||
platform: darwin
|
|
||||||
query: usb_devices
|
|
||||||
- description: System mounted devices and filesystems (not process specific).
|
|
||||||
interval: 3600
|
|
||||||
name: mounts
|
|
||||||
platform: darwin
|
|
||||||
query: mounts
|
|
||||||
removed: false
|
|
||||||
- description: Apple NVRAM variable listing.
|
|
||||||
interval: 3600
|
|
||||||
name: nvram
|
|
||||||
platform: darwin
|
|
||||||
query: nvram
|
|
||||||
removed: false
|
|
||||||
- description: Line parsed values from system and user cron/tab.
|
|
||||||
interval: 3600
|
|
||||||
name: crontab
|
|
||||||
platform: darwin
|
|
||||||
query: crontab
|
|
||||||
- description: Hardware (PCI/USB/HID) events from UDEV or IOKit.
|
|
||||||
interval: 300
|
|
||||||
name: hardware_events
|
|
||||||
platform: darwin
|
|
||||||
query: hardware_events
|
|
||||||
removed: false
|
|
||||||
- description: The installed homebrew package database.
|
|
||||||
interval: 3600
|
|
||||||
name: homebrew_packages
|
|
||||||
platform: darwin
|
|
||||||
query: homebrew_packages
|
|
||||||
- description: OS X applications installed in known search paths (e.g., /Applications).
|
|
||||||
interval: 3600
|
|
||||||
name: installed_applications
|
|
||||||
platform: darwin
|
|
||||||
query: installed_applications
|
|
||||||
- description: System logins and logouts.
|
|
||||||
interval: 3600
|
|
||||||
name: last
|
|
||||||
platform: darwin
|
|
||||||
query: last
|
|
||||||
removed: false
|
|
||||||
- description: Snapshot query for macosx_kextstat
|
|
||||||
interval: 28800
|
|
||||||
name: macosx_kextstat_snapshot
|
|
||||||
platform: darwin
|
|
||||||
query: macosx_kextstat_snapshot
|
|
||||||
snapshot: true
|
|
||||||
- description: Checks the MD5 hash of /etc/rc.common and records the results if
|
|
||||||
the hash differs from the default value. /etc/rc.common can be used for persistence.
|
|
||||||
interval: 28800
|
|
||||||
name: rc.common_snapshot
|
|
||||||
platform: darwin
|
|
||||||
query: rc.common_snapshot
|
|
||||||
snapshot: true
|
|
||||||
- description: Safari browser extension details for all users.
|
|
||||||
interval: 3600
|
|
||||||
name: safari_extensions
|
|
||||||
platform: darwin
|
|
||||||
query: safari_extensions
|
|
||||||
- description: suid binaries in common locations.
|
|
||||||
interval: 28800
|
|
||||||
name: suid_bin
|
|
||||||
platform: darwin
|
|
||||||
query: suid_bin
|
|
||||||
removed: false
|
|
||||||
- description: Local system users.
|
|
||||||
interval: 28800
|
|
||||||
name: users
|
|
||||||
platform: darwin
|
|
||||||
query: users
|
|
||||||
- description: List authorized_keys for each user on the system
|
|
||||||
interval: 28800
|
|
||||||
name: authorized_keys
|
|
||||||
platform: darwin
|
|
||||||
query: authorized_keys
|
|
||||||
- description: Application, System, and Mobile App crash logs.
|
|
||||||
interval: 3600
|
|
||||||
name: crashes
|
|
||||||
platform: darwin
|
|
||||||
query: crashes
|
|
||||||
removed: false
|
|
||||||
- description: Displays the percentage of free space available on the primary disk
|
|
||||||
partition
|
|
||||||
interval: 3600
|
|
||||||
name: disk_free_space_pct
|
|
||||||
platform: darwin
|
|
||||||
query: disk_free_space_pct
|
|
||||||
snapshot: true
|
|
||||||
- description: Retrieve the interface name, IP address, and MAC address for all
|
|
||||||
interfaces on the host.
|
|
||||||
interval: 600
|
|
||||||
name: network_interfaces_snapshot
|
|
||||||
platform: darwin
|
|
||||||
query: network_interfaces_snapshot
|
|
||||||
snapshot: true
|
|
||||||
- description: Information about EFI/UEFI/ROM and platform/boot.
|
|
||||||
interval: 28800
|
|
||||||
name: platform_info
|
|
||||||
platform: darwin
|
|
||||||
query: platform_info
|
|
||||||
removed: false
|
|
||||||
- description: System uptime
|
|
||||||
interval: 1800
|
|
||||||
name: uptime
|
|
||||||
platform: darwin
|
|
||||||
query: uptime
|
|
||||||
snapshot: true
|
|
||||||
- description: MD5 hash of boot.efi
|
|
||||||
interval: 28800
|
|
||||||
name: boot_efi_hash
|
|
||||||
platform: darwin
|
|
||||||
query: boot_efi_hash
|
|
||||||
- description: Snapshot query for Chrome extensions
|
|
||||||
interval: 28800
|
|
||||||
name: chrome_extensions_snapshot
|
|
||||||
platform: darwin
|
|
||||||
query: chrome_extensions_snapshot
|
|
||||||
- description: Snapshot query for installed_applications
|
|
||||||
interval: 28800
|
|
||||||
name: installed_applications_snapshot
|
|
||||||
platform: darwin
|
|
||||||
query: installed_applications_snapshot
|
|
||||||
snapshot: true
|
|
||||||
- description: NFS shares exported by the host.
|
|
||||||
interval: 3600
|
|
||||||
name: nfs_shares
|
|
||||||
platform: darwin
|
|
||||||
query: nfs_shares
|
|
||||||
removed: false
|
|
||||||
- description: List the version of the resident operating system
|
|
||||||
interval: 28800
|
|
||||||
name: os_version
|
|
||||||
platform: darwin
|
|
||||||
query: os_version
|
|
||||||
- description: Applications and binaries set as user/login startup items.
|
|
||||||
interval: 3600
|
|
||||||
name: startup_items
|
|
||||||
platform: darwin
|
|
||||||
query: startup_items
|
|
||||||
- description: All C/NPAPI browser plugin details for all users.
|
|
||||||
interval: 3600
|
|
||||||
name: browser_plugins
|
|
||||||
platform: darwin
|
|
||||||
query: browser_plugins
|
|
||||||
- description: List installed Firefox addons for all users
|
|
||||||
interval: 3600
|
|
||||||
name: firefox_addons
|
|
||||||
platform: darwin
|
|
||||||
query: firefox_addons
|
|
||||||
- description: Discover hosts that have IP forwarding enabled
|
|
||||||
interval: 28800
|
|
||||||
name: ip_forwarding_enabled
|
|
||||||
platform: darwin
|
|
||||||
query: ip_forwarding_enabled
|
|
||||||
removed: false
|
|
||||||
- description: Platform info snapshot query
|
|
||||||
interval: 28800
|
|
||||||
name: platform_info_snapshot
|
|
||||||
platform: darwin
|
|
||||||
query: platform_info_snapshot
|
|
||||||
- description: Python packages installed in a system.
|
|
||||||
interval: 3600
|
|
||||||
name: python_packages
|
|
||||||
platform: darwin
|
|
||||||
query: python_packages
|
|
||||||
- description: List installed Chrome Extensions for all users
|
|
||||||
interval: 3600
|
|
||||||
name: chrome_extensions
|
|
||||||
platform: darwin
|
|
||||||
query: chrome_extensions
|
|
||||||
- description: Disk encryption status and information.
|
|
||||||
interval: 3600
|
|
||||||
name: disk_encryption
|
|
||||||
platform: darwin
|
|
||||||
query: disk_encryption
|
|
||||||
- description: Local system users.
|
|
||||||
interval: 28800
|
|
||||||
name: users_snapshot
|
|
||||||
platform: darwin
|
|
||||||
query: users_snapshot
|
|
||||||
- description: OS X known/remembered Wi-Fi networks list.
|
|
||||||
interval: 28800
|
|
||||||
name: wireless_networks
|
|
||||||
platform: darwin
|
|
||||||
query: wireless_networks
|
|
||||||
removed: false
|
|
||||||
- description: Determine if the host is running the expected EFI firmware version
|
|
||||||
given their Mac hardware and OS build version (https://github.com/duo-labs/EFIgy)
|
|
||||||
interval: 28800
|
|
||||||
name: efigy
|
|
||||||
platform: darwin
|
|
||||||
query: efigy
|
|
||||||
snapshot: true
|
|
||||||
- description: List the contents of /etc/hosts
|
|
||||||
interval: 28800
|
|
||||||
name: etc_hosts
|
|
||||||
platform: darwin
|
|
||||||
query: etc_hosts
|
|
||||||
- description: Operating system version snapshot query
|
|
||||||
interval: 28800
|
|
||||||
name: os_version_snapshot
|
|
||||||
platform: darwin
|
|
||||||
query: os_version_snapshot
|
|
||||||
snapshot: true
|
|
||||||
- description: Information about the resident osquery process
|
|
||||||
interval: 28800
|
|
||||||
name: osquery_info
|
|
||||||
platform: darwin
|
|
||||||
query: osquery_info
|
|
||||||
snapshot: true
|
|
||||||
- description: Apple's System Integrity Protection (rootless) status.
|
|
||||||
interval: 3600
|
|
||||||
name: sip_config
|
|
||||||
platform: darwin
|
|
||||||
query: sip_config
|
|
||||||
- description: Returns the private keys in the users ~/.ssh directory and whether
|
|
||||||
or not they are encrypted.
|
|
||||||
interval: 3600
|
|
||||||
name: user_ssh_keys
|
|
||||||
platform: darwin
|
|
||||||
query: user_ssh_keys
|
|
||||||
removed: false
|
|
||||||
targets:
|
|
||||||
labels: null
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: 'Query to monitor files for changes inside of /etc/emon.d/ or /private/var/db/emondClients/
|
|
||||||
which can be used for persistence: (https://www.xorrior.com/emond-persistence/)'
|
|
||||||
name: emond
|
|
||||||
query: SELECT * FROM file JOIN hash USING (path) WHERE (path LIKE '/etc/emond.d/%%'
|
|
||||||
AND sha256!='f19f881084f599fa261243918d922373eab14623e78d23c41fcc031aa21ca7b6'
|
|
||||||
AND sha256!='20909c75c14c9f5360a48c889d06a0d6cfbfa28080348940fc077761744f2aa5'
|
|
||||||
AND sha256!='36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068'AND
|
|
||||||
sha256!='2aafb4238cbdd40c66591c01798da942f62c7f06bb84c9328a40581fc22c4af8'AND
|
|
||||||
sha256!='590192452963fdddc1990cd42c3bf77b3532b3e4a2c13e14e42c0d6a4c881ac4'AND
|
|
||||||
sha256!='69f416293592c0a96733498788b79d6516ed1ad5327ac7cafd6d12e8b231519f'AND
|
|
||||||
sha256!='') OR (path LIKE '/private/var/db/emondClients/%');
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: 'Snapshot query to monitor files for changes inside of /etc/emon.d/
|
|
||||||
or /private/var/db/emondClients/ which can be used for persistence: (https://www.xorrior.com/emond-persistence/)'
|
|
||||||
name: emond_snapshot
|
|
||||||
query: SELECT * FROM file JOIN hash USING (path) WHERE (path LIKE '/etc/emond.d/%%'
|
|
||||||
AND sha256!='f19f881084f599fa261243918d922373eab14623e78d23c41fcc031aa21ca7b6'
|
|
||||||
AND sha256!='20909c75c14c9f5360a48c889d06a0d6cfbfa28080348940fc077761744f2aa5'
|
|
||||||
AND sha256!='36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068'AND
|
|
||||||
sha256!='2aafb4238cbdd40c66591c01798da942f62c7f06bb84c9328a40581fc22c4af8'AND
|
|
||||||
sha256!='590192452963fdddc1990cd42c3bf77b3532b3e4a2c13e14e42c0d6a4c881ac4'AND
|
|
||||||
sha256!='69f416293592c0a96733498788b79d6516ed1ad5327ac7cafd6d12e8b231519f'AND
|
|
||||||
sha256!='') OR (path LIKE '/private/var/db/emondClients/%');
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Track time/action changes to files specified in configuration data.
|
|
||||||
name: file_events
|
|
||||||
query: SELECT * FROM file_events;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: The installed homebrew package database.
|
|
||||||
name: homebrew_packages_snapshot
|
|
||||||
query: SELECT name, version FROM homebrew_packages;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: List kernel extensions, their signing status, and their hashes (excluding
|
|
||||||
extensions signed by Apple)
|
|
||||||
name: macosx_kextstat
|
|
||||||
query: SELECT kernel_extensions.idx, kernel_extensions.refs, kernel_extensions.size,
|
|
||||||
kernel_extensions.name, kernel_extensions.version, kernel_extensions.linked_against,
|
|
||||||
kernel_extensions.path, signature.signed, signature.identifier, signature.cdhash,
|
|
||||||
signature.team_identifier, signature.authority, hash.md5 FROM hash JOIN kernel_extensions
|
|
||||||
ON hash.path LIKE printf('%s/Contents/MacOS/%', kernel_extensions.path) JOIN signature
|
|
||||||
ON signature.path LIKE printf('%s/Contents/MacOS/%', kernel_extensions.path) WHERE
|
|
||||||
signature.authority!='Software Signing';
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Checks the MD5 hash of /etc/rc.common and records the results if the
|
|
||||||
hash differs from the default value. /etc/rc.common can be used for persistence.
|
|
||||||
name: rc.common
|
|
||||||
query: SELECT * FROM hash WHERE path='/etc/rc.common' AND md5!='28ce428faefe6168618867f3ff5527f9'
|
|
||||||
and md5!='';
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Returns information about installed event taps. Can be used to detect
|
|
||||||
keyloggers
|
|
||||||
name: event_taps
|
|
||||||
query: SELECT * FROM event_taps INNER JOIN processes ON event_taps.tapping_process
|
|
||||||
= processes.pid WHERE event_tapped NOT LIKE '%mouse%' AND processes.path NOT LIKE
|
|
||||||
'%.app%' AND processes.path!='/Library/Application Support/org.pqrs/Karabiner-Elements/bin/karabiner_grabber'
|
|
||||||
AND processes.path NOT LIKE '/Users/%/bin/kwm' AND processes.path!='/Library/Rapport/bin/rooksd'
|
|
||||||
AND processes.path!='/usr/sbin/universalaccessd' AND processes.path NOT LIKE '/usr/local/Cellar/%'
|
|
||||||
AND processes.path NOT LIKE '/System/Library/%' AND processes.path NOT LIKE '%/steamapps/%'
|
|
||||||
AND event_taps.enabled=1;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: LaunchAgents and LaunchDaemons from default search paths.
|
|
||||||
name: launchd
|
|
||||||
query: SELECT * FROM launchd;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Snapshot query for launchd
|
|
||||||
name: launchd_snapshot
|
|
||||||
query: SELECT path, name, label, program, run_at_load, program_arguments FROM launchd
|
|
||||||
WHERE run_at_load=1;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Detect the presence of the LD_PRELOAD environment variable
|
|
||||||
name: ld_preload
|
|
||||||
query: SELECT process_envs.pid, process_envs.key, process_envs.value, processes.name,
|
|
||||||
processes.path, processes.cmdline, processes.cwd FROM process_envs join processes
|
|
||||||
USING (pid) WHERE key = 'LD_PRELOAD';
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: USB devices that are actively plugged into the host system.
|
|
||||||
name: usb_devices
|
|
||||||
query: SELECT * FROM usb_devices;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: System mounted devices and filesystems (not process specific).
|
|
||||||
name: mounts
|
|
||||||
query: SELECT device, device_alias, path, type, blocks_size FROM mounts;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Apple NVRAM variable listing.
|
|
||||||
name: nvram
|
|
||||||
query: SELECT * FROM nvram;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Line parsed values from system and user cron/tab.
|
|
||||||
name: crontab
|
|
||||||
query: SELECT * FROM crontab;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Hardware (PCI/USB/HID) events from UDEV or IOKit.
|
|
||||||
name: hardware_events
|
|
||||||
query: SELECT * FROM hardware_events;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: The installed homebrew package database.
|
|
||||||
name: homebrew_packages
|
|
||||||
query: SELECT * FROM homebrew_packages;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: OS X applications installed in known search paths (e.g., /Applications).
|
|
||||||
name: installed_applications
|
|
||||||
query: SELECT * FROM apps;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: System logins and logouts.
|
|
||||||
name: last
|
|
||||||
query: SELECT * FROM last;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Snapshot query for macosx_kextstat
|
|
||||||
name: macosx_kextstat_snapshot
|
|
||||||
query: SELECT kernel_extensions.name, kernel_extensions.version, kernel_extensions.path,
|
|
||||||
signature.signed, signature.identifier, signature.cdhash, signature.team_identifier,
|
|
||||||
signature.authority, hash.md5 FROM hash JOIN kernel_extensions ON hash.path LIKE
|
|
||||||
printf('%s/Contents/MacOS/%', kernel_extensions.path) JOIN signature ON signature.path
|
|
||||||
LIKE printf('%s/Contents/MacOS/%', kernel_extensions.path) WHERE signature.authority!='Software
|
|
||||||
Signing';
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Checks the MD5 hash of /etc/rc.common and records the results if the
|
|
||||||
hash differs from the default value. /etc/rc.common can be used for persistence.
|
|
||||||
name: rc.common_snapshot
|
|
||||||
query: SELECT * FROM hash WHERE path='/etc/rc.common' AND md5!='28ce428faefe6168618867f3ff5527f9'
|
|
||||||
and md5!='';
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Safari browser extension details for all users.
|
|
||||||
name: safari_extensions
|
|
||||||
query: SELECT * FROM users JOIN safari_extensions USING (uid);
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: suid binaries in common locations.
|
|
||||||
name: suid_bin
|
|
||||||
query: SELECT * FROM suid_bin;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Local system users.
|
|
||||||
name: users
|
|
||||||
query: SELECT * FROM users;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: List authorized_keys for each user on the system
|
|
||||||
name: authorized_keys
|
|
||||||
query: SELECT * FROM users JOIN authorized_keys USING (uid);
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Application, System, and Mobile App crash logs.
|
|
||||||
name: crashes
|
|
||||||
query: SELECT uid, datetime, responsible, exception_type, identifier, version, crash_path
|
|
||||||
FROM users JOIN crashes USING (uid);
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Displays the percentage of free space available on the primary disk
|
|
||||||
partition
|
|
||||||
name: disk_free_space_pct
|
|
||||||
query: SELECT (blocks_available * 100 / blocks) AS pct FROM mounts WHERE device='/dev/disk1';
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Retrieve the interface name, IP address, and MAC address for all interfaces
|
|
||||||
on the host.
|
|
||||||
name: network_interfaces_snapshot
|
|
||||||
query: SELECT a.interface, a.address, d.mac FROM interface_addresses a JOIN interface_details
|
|
||||||
d USING (interface);
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Information about EFI/UEFI/ROM and platform/boot.
|
|
||||||
name: platform_info
|
|
||||||
query: SELECT * FROM platform_info;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: System uptime
|
|
||||||
name: uptime
|
|
||||||
query: SELECT * FROM uptime;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: MD5 hash of boot.efi
|
|
||||||
name: boot_efi_hash
|
|
||||||
query: SELECT path, md5 FROM hash WHERE path='/System/Library/CoreServices/boot.efi';
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Snapshot query for Chrome extensions
|
|
||||||
name: chrome_extensions_snapshot
|
|
||||||
query: SELECT * FROM users JOIN chrome_extensions USING (uid);
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Snapshot query for installed_applications
|
|
||||||
name: installed_applications_snapshot
|
|
||||||
query: SELECT name, path, bundle_short_version, bundle_version, display_name FROM
|
|
||||||
apps;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: NFS shares exported by the host.
|
|
||||||
name: nfs_shares
|
|
||||||
query: SELECT * FROM nfs_shares;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: List the version of the resident operating system
|
|
||||||
name: os_version
|
|
||||||
query: SELECT * FROM os_version;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Applications and binaries set as user/login startup items.
|
|
||||||
name: startup_items
|
|
||||||
query: SELECT * FROM startup_items;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: All C/NPAPI browser plugin details for all users.
|
|
||||||
name: browser_plugins
|
|
||||||
query: SELECT * FROM users JOIN browser_plugins USING (uid);
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: List installed Firefox addons for all users
|
|
||||||
name: firefox_addons
|
|
||||||
query: SELECT * FROM users JOIN firefox_addons USING (uid);
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Discover hosts that have IP forwarding enabled
|
|
||||||
name: ip_forwarding_enabled
|
|
||||||
query: SELECT * FROM system_controls WHERE name LIKE '%forwarding%' AND name LIKE
|
|
||||||
'%ip%' AND current_value=1;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Platform info snapshot query
|
|
||||||
name: platform_info_snapshot
|
|
||||||
query: SELECT vendor, version, date, revision from platform_info;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Python packages installed in a system.
|
|
||||||
name: python_packages
|
|
||||||
query: SELECT * FROM python_packages;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: List installed Chrome Extensions for all users
|
|
||||||
name: chrome_extensions
|
|
||||||
query: SELECT * FROM users JOIN chrome_extensions USING (uid);
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Disk encryption status and information.
|
|
||||||
name: disk_encryption
|
|
||||||
query: SELECT * FROM disk_encryption;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Local system users.
|
|
||||||
name: users_snapshot
|
|
||||||
query: SELECT * FROM users;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: OS X known/remembered Wi-Fi networks list.
|
|
||||||
name: wireless_networks
|
|
||||||
query: SELECT ssid, network_name, security_type, last_connected, captive_portal,
|
|
||||||
possibly_hidden, roaming, roaming_profile FROM wifi_networks;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Determine if the host is running the expected EFI firmware version
|
|
||||||
given their Mac hardware and OS build version (https://github.com/duo-labs/EFIgy)
|
|
||||||
name: efigy
|
|
||||||
query: SELECT * FROM efigy;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: List the contents of /etc/hosts
|
|
||||||
name: etc_hosts
|
|
||||||
query: SELECT * FROM etc_hosts;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Operating system version snapshot query
|
|
||||||
name: os_version_snapshot
|
|
||||||
query: SELECT * FROM os_version;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Information about the resident osquery process
|
|
||||||
name: osquery_info
|
|
||||||
query: SELECT * FROM osquery_info;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Apple's System Integrity Protection (rootless) status.
|
|
||||||
name: sip_config
|
|
||||||
query: SELECT * FROM sip_config;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Returns the private keys in the users ~/.ssh directory and whether
|
|
||||||
or not they are encrypted.
|
|
||||||
name: user_ssh_keys
|
|
||||||
query: SELECT * FROM users JOIN user_ssh_keys USING (uid);
|
|
||||||
@@ -1,511 +0,0 @@
|
|||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: pack
|
|
||||||
spec:
|
|
||||||
name: windows-pack
|
|
||||||
queries:
|
|
||||||
- description: System info snapshot query
|
|
||||||
interval: 28800
|
|
||||||
name: system_info_snapshot
|
|
||||||
platform: windows
|
|
||||||
query: system_info_snapshot
|
|
||||||
snapshot: true
|
|
||||||
- description: List in-use Windows drivers
|
|
||||||
interval: 3600
|
|
||||||
name: drivers
|
|
||||||
platform: windows
|
|
||||||
query: drivers
|
|
||||||
- description: Displays shared resources on a computer system running Windows. This
|
|
||||||
may be a disk drive, printer, interprocess communication, or other sharable
|
|
||||||
device.
|
|
||||||
interval: 3600
|
|
||||||
name: shared_resources
|
|
||||||
platform: windows
|
|
||||||
query: shared_resources
|
|
||||||
- description: Lists all the patches applied
|
|
||||||
interval: 3600
|
|
||||||
name: patches
|
|
||||||
platform: windows
|
|
||||||
query: patches
|
|
||||||
removed: false
|
|
||||||
- description: Pipes snapshot query
|
|
||||||
interval: 28800
|
|
||||||
name: pipes_snapshot
|
|
||||||
platform: windows
|
|
||||||
query: pipes_snapshot
|
|
||||||
snapshot: true
|
|
||||||
- description: Programs snapshot query
|
|
||||||
interval: 28800
|
|
||||||
name: programs_snapshot
|
|
||||||
platform: windows
|
|
||||||
query: programs_snapshot
|
|
||||||
snapshot: true
|
|
||||||
- description: Services snapshot query
|
|
||||||
interval: 28800
|
|
||||||
name: services_snapshot
|
|
||||||
platform: windows
|
|
||||||
query: services_snapshot
|
|
||||||
snapshot: true
|
|
||||||
- description: WMI CommandLineEventConsumer, which can be used for persistence on
|
|
||||||
Windows. See https://www.blackhat.com/docs/us-15/materials/us-15-Graeber-Abusing-Windows-Management-Instrumentation-WMI-To-Build-A-Persistent%20Asynchronous-And-Fileless-Backdoor-wp.pdf
|
|
||||||
for more details.
|
|
||||||
interval: 3600
|
|
||||||
name: wmi_cli_event_consumers
|
|
||||||
platform: windows
|
|
||||||
query: wmi_cli_event_consumers
|
|
||||||
- description: Lists the relationship between event consumers and filters.
|
|
||||||
interval: 3600
|
|
||||||
name: wmi_filter_consumer_binding
|
|
||||||
platform: windows
|
|
||||||
query: wmi_filter_consumer_binding
|
|
||||||
- description: Snapshot query for Chrome extensions
|
|
||||||
interval: 3600
|
|
||||||
name: chrome_extensions_snapshot
|
|
||||||
platform: windows
|
|
||||||
query: chrome_extensions_snapshot
|
|
||||||
- description: Retrieve the interface name, IP address, and MAC address for all
|
|
||||||
interfaces on the host.
|
|
||||||
interval: 600
|
|
||||||
name: network_interfaces_snapshot
|
|
||||||
platform: windows
|
|
||||||
query: network_interfaces_snapshot
|
|
||||||
snapshot: true
|
|
||||||
- description: Local system users.
|
|
||||||
interval: 3600
|
|
||||||
name: users
|
|
||||||
platform: windows
|
|
||||||
query: users
|
|
||||||
- description: Snapshot query for WMI event consumers.
|
|
||||||
interval: 28800
|
|
||||||
name: wmi_cli_event_consumers_snapshot
|
|
||||||
platform: windows
|
|
||||||
query: wmi_cli_event_consumers_snapshot
|
|
||||||
snapshot: true
|
|
||||||
- description: List all certificates in the trust store
|
|
||||||
interval: 3600
|
|
||||||
name: certificates
|
|
||||||
platform: windows
|
|
||||||
query: certificates
|
|
||||||
removed: false
|
|
||||||
- description: Drivers snapshot query
|
|
||||||
interval: 28800
|
|
||||||
name: drivers_snapshot
|
|
||||||
platform: windows
|
|
||||||
query: drivers_snapshot
|
|
||||||
snapshot: true
|
|
||||||
- description: Lists WMI event filters.
|
|
||||||
interval: 3600
|
|
||||||
name: wmi_event_filters
|
|
||||||
platform: windows
|
|
||||||
query: wmi_event_filters
|
|
||||||
- description: List installed Internet Explorer extensions
|
|
||||||
interval: 3600
|
|
||||||
name: ie_extensions
|
|
||||||
platform: windows
|
|
||||||
query: ie_extensions
|
|
||||||
- description: List the kernel path, version, etc.
|
|
||||||
interval: 3600
|
|
||||||
name: kernel_info
|
|
||||||
platform: windows
|
|
||||||
query: kernel_info
|
|
||||||
- description: List the version of the resident operating system
|
|
||||||
interval: 3600
|
|
||||||
name: os_version
|
|
||||||
platform: windows
|
|
||||||
query: os_version
|
|
||||||
- description: Patches snapshot query
|
|
||||||
interval: 28800
|
|
||||||
name: patches_snapshot
|
|
||||||
platform: windows
|
|
||||||
query: patches_snapshot
|
|
||||||
snapshot: true
|
|
||||||
- description: Named and Anonymous pipes.
|
|
||||||
interval: 3600
|
|
||||||
name: pipes
|
|
||||||
platform: windows
|
|
||||||
query: pipes
|
|
||||||
removed: false
|
|
||||||
- description: Lists installed programs
|
|
||||||
interval: 0
|
|
||||||
name: programs
|
|
||||||
platform: windows
|
|
||||||
query: programs
|
|
||||||
- description: List all certificates in the trust store (snapshot query)
|
|
||||||
interval: 0
|
|
||||||
name: certificates_snapshot
|
|
||||||
platform: windows
|
|
||||||
query: certificates_snapshot
|
|
||||||
snapshot: true
|
|
||||||
- description: List the contents of the Windows hosts file
|
|
||||||
interval: 3600
|
|
||||||
name: etc_hosts
|
|
||||||
platform: windows
|
|
||||||
query: etc_hosts
|
|
||||||
- description: Lists all of the tasks in the Windows task scheduler
|
|
||||||
interval: 3600
|
|
||||||
name: scheduled_tasks
|
|
||||||
platform: windows
|
|
||||||
query: scheduled_tasks
|
|
||||||
- description: Extracted information from Windows crash logs (Minidumps).
|
|
||||||
interval: 3600
|
|
||||||
name: windows_crashes
|
|
||||||
platform: windows
|
|
||||||
query: windows_crashes
|
|
||||||
removed: false
|
|
||||||
- description: System uptime
|
|
||||||
interval: 3600
|
|
||||||
name: uptime
|
|
||||||
platform: windows
|
|
||||||
query: uptime
|
|
||||||
snapshot: true
|
|
||||||
- description: Snapshot query for WMI script event consumers.
|
|
||||||
interval: 3600
|
|
||||||
name: wmi_script_event_consumers
|
|
||||||
platform: windows
|
|
||||||
query: wmi_script_event_consumers
|
|
||||||
snapshot: true
|
|
||||||
- description: List installed Chocolatey packages
|
|
||||||
interval: 3600
|
|
||||||
name: chocolatey_packages
|
|
||||||
platform: windows
|
|
||||||
query: chocolatey_packages
|
|
||||||
- description: Shared resources snapshot query
|
|
||||||
interval: 28800
|
|
||||||
name: shared_resources_snapshot
|
|
||||||
platform: windows
|
|
||||||
query: shared_resources_snapshot
|
|
||||||
snapshot: true
|
|
||||||
- description: Lists all installed services configured to start automatically at
|
|
||||||
boot
|
|
||||||
interval: 3600
|
|
||||||
name: services
|
|
||||||
platform: windows
|
|
||||||
query: services
|
|
||||||
- description: Users snapshot query
|
|
||||||
interval: 28800
|
|
||||||
name: users_snapshot
|
|
||||||
platform: windows
|
|
||||||
query: users_snapshot
|
|
||||||
snapshot: true
|
|
||||||
- description: List installed Chrome Extensions for all users
|
|
||||||
interval: 3600
|
|
||||||
name: chrome_extensions
|
|
||||||
platform: windows
|
|
||||||
query: chrome_extensions
|
|
||||||
- description: Operating system version snapshot query
|
|
||||||
interval: 28800
|
|
||||||
name: os_version_snapshot
|
|
||||||
platform: windows
|
|
||||||
query: os_version_snapshot
|
|
||||||
snapshot: true
|
|
||||||
- description: System information for identification.
|
|
||||||
interval: 3600
|
|
||||||
name: system_info
|
|
||||||
platform: windows
|
|
||||||
query: system_info
|
|
||||||
- description: Snapshot query for WMI event filters.
|
|
||||||
interval: 28800
|
|
||||||
name: wmi_event_filters_snapshot
|
|
||||||
platform: windows
|
|
||||||
query: wmi_event_filters_snapshot
|
|
||||||
snapshot: true
|
|
||||||
- description: Snapshot query for WMI filter consumer bindings.
|
|
||||||
interval: 28800
|
|
||||||
name: wmi_filter_consumer_binding_snapshot
|
|
||||||
platform: windows
|
|
||||||
query: wmi_filter_consumer_binding_snapshot
|
|
||||||
snapshot: true
|
|
||||||
- description: Information about the resident osquery process
|
|
||||||
interval: 28800
|
|
||||||
name: osquery_info
|
|
||||||
platform: windows
|
|
||||||
query: osquery_info
|
|
||||||
snapshot: true
|
|
||||||
- description: Scheduled Tasks snapshot query
|
|
||||||
interval: 28800
|
|
||||||
name: scheduled_tasks_snapshot
|
|
||||||
platform: windows
|
|
||||||
query: scheduled_tasks_snapshot
|
|
||||||
snapshot: true
|
|
||||||
targets:
|
|
||||||
labels: null
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: System info snapshot query
|
|
||||||
name: system_info_snapshot
|
|
||||||
query: SELECT * FROM system_info;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: List in-use Windows drivers
|
|
||||||
name: drivers
|
|
||||||
query: SELECT * FROM drivers;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Displays shared resources on a computer system running Windows. This
|
|
||||||
may be a disk drive, printer, interprocess communication, or other sharable device.
|
|
||||||
name: shared_resources
|
|
||||||
query: SELECT * FROM shared_resources;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Lists all the patches applied
|
|
||||||
name: patches
|
|
||||||
query: SELECT * FROM patches;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Pipes snapshot query
|
|
||||||
name: pipes_snapshot
|
|
||||||
query: SELECT processes.path, processes.cmdline, processes.uid, processes.on_disk,
|
|
||||||
pipes.name, pid FROM pipes JOIN processes USING (pid);
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Programs snapshot query
|
|
||||||
name: programs_snapshot
|
|
||||||
query: SELECT * FROM programs;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Services snapshot query
|
|
||||||
name: services_snapshot
|
|
||||||
query: SELECT * FROM services;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: WMI CommandLineEventConsumer, which can be used for persistence on
|
|
||||||
Windows. See https://www.blackhat.com/docs/us-15/materials/us-15-Graeber-Abusing-Windows-Management-Instrumentation-WMI-To-Build-A-Persistent%20Asynchronous-And-Fileless-Backdoor-wp.pdf
|
|
||||||
for more details.
|
|
||||||
name: wmi_cli_event_consumers
|
|
||||||
query: SELECT * FROM wmi_cli_event_consumers;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Lists the relationship between event consumers and filters.
|
|
||||||
name: wmi_filter_consumer_binding
|
|
||||||
query: SELECT * FROM wmi_filter_consumer_binding;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Snapshot query for Chrome extensions
|
|
||||||
name: chrome_extensions_snapshot
|
|
||||||
query: SELECT * FROM users JOIN chrome_extensions USING (uid);
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Retrieve the interface name, IP address, and MAC address for all interfaces
|
|
||||||
on the host.
|
|
||||||
name: network_interfaces_snapshot
|
|
||||||
query: SELECT a.interface, a.address, d.mac FROM interface_addresses a JOIN interface_details
|
|
||||||
d USING (interface);
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Local system users.
|
|
||||||
name: users
|
|
||||||
query: SELECT * FROM users;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Snapshot query for WMI event consumers.
|
|
||||||
name: wmi_cli_event_consumers_snapshot
|
|
||||||
query: SELECT * FROM wmi_cli_event_consumers;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: List all certificates in the trust store
|
|
||||||
name: certificates
|
|
||||||
query: SELECT * FROM certificates WHERE path != 'Other People';
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Drivers snapshot query
|
|
||||||
name: drivers_snapshot
|
|
||||||
query: SELECT * FROM drivers;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Lists WMI event filters.
|
|
||||||
name: wmi_event_filters
|
|
||||||
query: SELECT * FROM wmi_event_filters;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: List installed Internet Explorer extensions
|
|
||||||
name: ie_extensions
|
|
||||||
query: SELECT * FROM ie_extensions;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: List the kernel path, version, etc.
|
|
||||||
name: kernel_info
|
|
||||||
query: SELECT * FROM kernel_info;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: List the version of the resident operating system
|
|
||||||
name: os_version
|
|
||||||
query: SELECT * FROM os_version;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Patches snapshot query
|
|
||||||
name: patches_snapshot
|
|
||||||
query: SELECT * FROM patches;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Named and Anonymous pipes.
|
|
||||||
name: pipes
|
|
||||||
query: SELECT processes.path, processes.cmdline, processes.uid, processes.on_disk,
|
|
||||||
pipes.name, pid FROM pipes JOIN processes USING (pid);
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Lists installed programs
|
|
||||||
name: programs
|
|
||||||
query: SELECT * FROM programs;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: List all certificates in the trust store (snapshot query)
|
|
||||||
name: certificates_snapshot
|
|
||||||
query: SELECT * FROM certificates WHERE path != 'Other People';
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: List the contents of the Windows hosts file
|
|
||||||
name: etc_hosts
|
|
||||||
query: SELECT * FROM etc_hosts;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Lists all of the tasks in the Windows task scheduler
|
|
||||||
name: scheduled_tasks
|
|
||||||
query: SELECT * FROM scheduled_tasks;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Extracted information from Windows crash logs (Minidumps).
|
|
||||||
name: windows_crashes
|
|
||||||
query: SELECT * FROM windows_crashes;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: System uptime
|
|
||||||
name: uptime
|
|
||||||
query: SELECT * FROM uptime;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Snapshot query for WMI script event consumers.
|
|
||||||
name: wmi_script_event_consumers
|
|
||||||
query: SELECT * FROM wmi_script_event_consumers;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: List installed Chocolatey packages
|
|
||||||
name: chocolatey_packages
|
|
||||||
query: SELECT * FROM chocolatey_packages;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Shared resources snapshot query
|
|
||||||
name: shared_resources_snapshot
|
|
||||||
query: SELECT * FROM shared_resources;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Lists all installed services configured to start automatically at boot
|
|
||||||
name: services
|
|
||||||
query: SELECT * FROM services WHERE start_type='DEMAND_START' OR start_type='AUTO_START';
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Users snapshot query
|
|
||||||
name: users_snapshot
|
|
||||||
query: SELECT * FROM users;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: List installed Chrome Extensions for all users
|
|
||||||
name: chrome_extensions
|
|
||||||
query: SELECT * FROM users JOIN chrome_extensions USING (uid);
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Operating system version snapshot query
|
|
||||||
name: os_version_snapshot
|
|
||||||
query: SELECT * FROM os_version;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: System information for identification.
|
|
||||||
name: system_info
|
|
||||||
query: SELECT * FROM system_info;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Snapshot query for WMI event filters.
|
|
||||||
name: wmi_event_filters_snapshot
|
|
||||||
query: SELECT * FROM wmi_event_filters;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Snapshot query for WMI filter consumer bindings.
|
|
||||||
name: wmi_filter_consumer_binding_snapshot
|
|
||||||
query: SELECT * FROM wmi_filter_consumer_binding;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Information about the resident osquery process
|
|
||||||
name: osquery_info
|
|
||||||
query: SELECT * FROM osquery_info;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Scheduled Tasks snapshot query
|
|
||||||
name: scheduled_tasks_snapshot
|
|
||||||
query: SELECT * FROM scheduled_tasks;
|
|
||||||
@@ -1,46 +0,0 @@
|
|||||||
apiVersion: v1
|
|
||||||
kind: options
|
|
||||||
spec:
|
|
||||||
config:
|
|
||||||
decorators:
|
|
||||||
always:
|
|
||||||
- SELECT hostname AS hostname FROM system_info;
|
|
||||||
- SELECT codename FROM os_version;
|
|
||||||
- SELECT uuid AS LiveQuery FROM system_info;
|
|
||||||
- SELECT address AS EndpointIP1 FROM interface_addresses where address not
|
|
||||||
like '%:%' and address not like '127%' and address not like '169%' order by
|
|
||||||
interface desc limit 1;
|
|
||||||
- SELECT address AS EndpointIP2 FROM interface_addresses where address not
|
|
||||||
like '%:%' and address not like '127%' and address not like '169%' order by
|
|
||||||
interface asc limit 1;
|
|
||||||
- SELECT hardware_serial FROM system_info;
|
|
||||||
file_paths:
|
|
||||||
binaries:
|
|
||||||
- /usr/bin/%%
|
|
||||||
- /usr/sbin/%%
|
|
||||||
- /bin/%%
|
|
||||||
- /sbin/%%
|
|
||||||
- /usr/local/bin/%%
|
|
||||||
- /usr/local/sbin/%%
|
|
||||||
- /opt/bin/%%
|
|
||||||
- /opt/sbin/%%
|
|
||||||
configuration:
|
|
||||||
- /etc/%%
|
|
||||||
efi:
|
|
||||||
- /System/Library/CoreServices/boot.efi
|
|
||||||
options:
|
|
||||||
decorations_top_level: true
|
|
||||||
disable_distributed: false
|
|
||||||
disable_tables: windows_events
|
|
||||||
distributed_interval: 10
|
|
||||||
distributed_plugin: tls
|
|
||||||
distributed_tls_max_attempts: 3
|
|
||||||
distributed_tls_read_endpoint: /api/v1/osquery/distributed/read
|
|
||||||
distributed_tls_write_endpoint: /api/v1/osquery/distributed/write
|
|
||||||
logger_plugin: tls
|
|
||||||
logger_snapshot_event_type: true
|
|
||||||
logger_tls_endpoint: /api/v1/osquery/log
|
|
||||||
logger_tls_period: 10
|
|
||||||
pack_delimiter: /
|
|
||||||
schedule_splay_percent: 10
|
|
||||||
overrides: {}
|
|
||||||
@@ -1,69 +0,0 @@
|
|||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: pack
|
|
||||||
spec:
|
|
||||||
name: performance-metrics
|
|
||||||
queries:
|
|
||||||
- description: Records the CPU time and memory usage for each individual query.
|
|
||||||
Helpful for identifying queries that may impact performance.
|
|
||||||
interval: 1800
|
|
||||||
name: per_query_perf
|
|
||||||
query: per_query_perf
|
|
||||||
snapshot: true
|
|
||||||
- description: Track the amount of CPU time used by osquery.
|
|
||||||
interval: 1800
|
|
||||||
name: runtime_perf
|
|
||||||
query: runtime_perf
|
|
||||||
snapshot: true
|
|
||||||
- description: Track the percentage of total CPU time utilized by $endpoint_security_tool
|
|
||||||
interval: 1800
|
|
||||||
name: endpoint_security_tool_perf
|
|
||||||
query: endpoint_security_tool_perf
|
|
||||||
snapshot: true
|
|
||||||
- description: Track the percentage of total CPU time utilized by $backup_tool
|
|
||||||
interval: 1800
|
|
||||||
name: backup_tool_perf
|
|
||||||
query: backup_tool_perf
|
|
||||||
snapshot: true
|
|
||||||
targets:
|
|
||||||
labels: null
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Records the CPU time and memory usage for each individual query. Helpful
|
|
||||||
for identifying queries that may impact performance.
|
|
||||||
name: per_query_perf
|
|
||||||
query: SELECT name, interval, executions, output_size, wall_time, (user_time/executions)
|
|
||||||
AS avg_user_time, (system_time/executions) AS avg_system_time, average_memory
|
|
||||||
FROM osquery_schedule;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Track the amount of CPU time used by osquery.
|
|
||||||
name: runtime_perf
|
|
||||||
query: SELECT ov.version AS os_version, ov.platform AS os_platform, ov.codename
|
|
||||||
AS os_codename, i.*, p.resident_size, p.user_time, p.system_time, time.minutes
|
|
||||||
AS counter, db.db_size_mb AS database_size FROM osquery_info i, os_version ov,
|
|
||||||
processes p, time, (SELECT (sum(size) / 1024) / 1024.0 AS db_size_mb FROM (SELECT
|
|
||||||
value FROM osquery_flags WHERE name = 'database_path' LIMIT 1) flags, file WHERE
|
|
||||||
path LIKE flags.value || '%%' AND type = 'regular') db WHERE p.pid = i.pid;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Track the percentage of total CPU time utilized by $endpoint_security_tool
|
|
||||||
name: endpoint_security_tool_perf
|
|
||||||
query: SELECT ((tool_time*100)/(SUM(system_time) + SUM(user_time))) AS pct FROM
|
|
||||||
processes, (SELECT (SUM(processes.system_time)+SUM(processes.user_time)) AS tool_time
|
|
||||||
FROM processes WHERE name='endpoint_security_tool');
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Track the percentage of total CPU time utilized by $backup_tool
|
|
||||||
name: backup_tool_perf
|
|
||||||
query: SELECT ((backuptool_time*100)/(SUM(system_time) + SUM(user_time))) AS pct
|
|
||||||
FROM processes, (SELECT (SUM(processes.system_time)+SUM(processes.user_time))
|
|
||||||
AS backuptool_time FROM processes WHERE name='backup_tool');
|
|
||||||
@@ -1,59 +0,0 @@
|
|||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: pack
|
|
||||||
spec:
|
|
||||||
name: security-tooling-checks
|
|
||||||
queries:
|
|
||||||
- description: Returns an event if a EndpointSecurityTool process is not found running
|
|
||||||
from /Applications/EndpointSecurityTool' (OSX) or 'c:\endpointsecuritytool.exe'
|
|
||||||
(Windows)
|
|
||||||
interval: 28800
|
|
||||||
name: endpoint_security_tool_not_running
|
|
||||||
platform: windows,darwin
|
|
||||||
query: endpoint_security_tool_not_running
|
|
||||||
snapshot: true
|
|
||||||
- description: "Returns an event if a BackupTool process is not found running from
|
|
||||||
'/Applications/BackupTool' (OSX) or 'c:\backuptool.exe' (Windows)"
|
|
||||||
interval: 28800
|
|
||||||
name: backup_tool_not_running
|
|
||||||
platform: windows,darwin
|
|
||||||
query: backup_tool_not_running
|
|
||||||
snapshot: true
|
|
||||||
- description: Returns the content of the key if the backend server does not match
|
|
||||||
the expected value
|
|
||||||
interval: 3600
|
|
||||||
name: endpoint_security_tool_backend_server_registry_misconfigured
|
|
||||||
platform: windows
|
|
||||||
query: endpoint_security_tool_backend_server_registry_misconfigured
|
|
||||||
targets:
|
|
||||||
labels: null
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Returns an event if a EndpointSecurityTool process is not found running
|
|
||||||
from /Applications/EndpointSecurityTool' (OSX) or 'c:\endpointsecuritytool.exe'
|
|
||||||
(Windows)
|
|
||||||
name: endpoint_security_tool_not_running
|
|
||||||
query: SELECT IFNULL(process_count,0) as process_exists FROM (SELECT count(*) as
|
|
||||||
process_count from processes where path='/Applications/EndpointSecurityTool' OR
|
|
||||||
lower(path)='c:\endpointsecuritytool.exe') where process_exists!=1;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: "Returns an event if a BackupTool process is not found running from
|
|
||||||
'/Applications/BackupTool' (OSX) or 'c:\backuptool.exe' (Windows)"
|
|
||||||
name: backup_tool_not_running
|
|
||||||
query: SELECT IFNULL(process_count,0) as process_exists FROM (SELECT count(*) as
|
|
||||||
process_count from processes where path='/Applications/BackupTool' OR lower(path)
|
|
||||||
LIKE 'c:\backuptool.exe') where process_exists!=1;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Returns the content of the key if the backend server does not match
|
|
||||||
the expected value
|
|
||||||
name: endpoint_security_tool_backend_server_registry_misconfigured
|
|
||||||
query: SELECT * FROM registry WHERE path='HKEY_LOCAL_MACHINE\Software\EndpointSecurityTool\BackendServerLocation'
|
|
||||||
AND data!='https://expected_endpoint.local';
|
|
||||||
@@ -1,93 +0,0 @@
|
|||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: pack
|
|
||||||
spec:
|
|
||||||
name: windows-application-security
|
|
||||||
queries:
|
|
||||||
- description: Controls Bitlocker full-disk encryption settings.
|
|
||||||
interval: 3600
|
|
||||||
name: bitlocker_autoencrypt_settings_registry
|
|
||||||
platform: windows
|
|
||||||
query: bitlocker_autoencrypt_settings_registry
|
|
||||||
- description: Controls Bitlocker full-disk encryption settings.
|
|
||||||
interval: 3600
|
|
||||||
name: bitlocker_fde_settings_registry
|
|
||||||
platform: windows
|
|
||||||
query: bitlocker_fde_settings_registry
|
|
||||||
- description: Controls Google Chrome plugins that are forcibly installed.
|
|
||||||
interval: 3600
|
|
||||||
name: chrome_extension_force_list_registry
|
|
||||||
platform: windows
|
|
||||||
query: chrome_extension_force_list_registry
|
|
||||||
- description: Controls EMET-protected applications and system settings.
|
|
||||||
interval: 3600
|
|
||||||
name: emet_settings_registry
|
|
||||||
platform: windows
|
|
||||||
query: emet_settings_registry
|
|
||||||
- description: Controls Local Administrative Password Solution (LAPS) settings.
|
|
||||||
interval: 3600
|
|
||||||
name: microsoft_laps_settings_registry
|
|
||||||
platform: windows
|
|
||||||
query: microsoft_laps_settings_registry
|
|
||||||
- description: Controls Windows Passport for Work (Hello) settings.
|
|
||||||
interval: 3600
|
|
||||||
name: passport_for_work_settings_registry
|
|
||||||
platform: windows
|
|
||||||
query: passport_for_work_settings_registry
|
|
||||||
- description: Controls UAC. A setting of 0 indicates that UAC is disabled.
|
|
||||||
interval: 3600
|
|
||||||
name: uac_settings_registry
|
|
||||||
platform: windows
|
|
||||||
query: uac_settings_registry
|
|
||||||
targets:
|
|
||||||
labels: null
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Controls Bitlocker full-disk encryption settings.
|
|
||||||
name: bitlocker_autoencrypt_settings_registry
|
|
||||||
query: SELECT * FROM registry WHERE key LIKE 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Bitlocker\%%';
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Controls Bitlocker full-disk encryption settings.
|
|
||||||
name: bitlocker_fde_settings_registry
|
|
||||||
query: SELECT * FROM registry WHERE key LIKE 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\FVE\%%';
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Controls Google Chrome plugins that are forcibly installed.
|
|
||||||
name: chrome_extension_force_list_registry
|
|
||||||
query: SELECT * FROM registry WHERE key='HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\ExtensionInstallForcelist';
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Controls EMET-protected applications and system settings.
|
|
||||||
name: emet_settings_registry
|
|
||||||
query: SELECT * FROM registry WHERE key LIKE 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\%%';
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Controls Local Administrative Password Solution (LAPS) settings.
|
|
||||||
name: microsoft_laps_settings_registry
|
|
||||||
query: SELECT * FROM registry WHERE key='HKEY_LOCAL_MACHINE\Software\Policies\Microsoft
|
|
||||||
Services\AdmPwd';
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Controls Windows Passport for Work (Hello) settings.
|
|
||||||
name: passport_for_work_settings_registry
|
|
||||||
query: SELECT * FROM registry WHERE path LIKE 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\PassportForWork\%%';
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Controls UAC. A setting of 0 indicates that UAC is disabled.
|
|
||||||
name: uac_settings_registry
|
|
||||||
query: SELECT * FROM registry WHERE path='HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA';
|
|
||||||
@@ -1,321 +0,0 @@
|
|||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: pack
|
|
||||||
spec:
|
|
||||||
name: windows-compliance
|
|
||||||
queries:
|
|
||||||
- description: 'This key does not exist by default and controls enabling/disabling
|
|
||||||
error reporting display. Some malware creates this key and sets the value to
|
|
||||||
0. See: https://www.documentcloud.org/documents/3477047-Document-07-Neel-Mehta-Billy-Leonard-and-Shane.html'
|
|
||||||
interval: 3600
|
|
||||||
name: error_display_ui_registry
|
|
||||||
platform: windows
|
|
||||||
query: error_display_ui_registry
|
|
||||||
- description: Entries for the FileRenameOperation support the MoveFileEx delayed-rename
|
|
||||||
and delayed-delete capabilities. Sometimes used as a self-deletion technique
|
|
||||||
for malware.
|
|
||||||
interval: 3600
|
|
||||||
name: filerenameoperations_registry
|
|
||||||
platform: windows
|
|
||||||
query: filerenameoperations_registry
|
|
||||||
- description: Controls which security packages store credentials in LSA memory,
|
|
||||||
secure boot, etc.
|
|
||||||
interval: 3600
|
|
||||||
name: local_security_authority_registry
|
|
||||||
platform: windows
|
|
||||||
query: local_security_authority_registry
|
|
||||||
- description: 'This key exists by default and has a default value of 1. Setting
|
|
||||||
this key to 0 disables logging errors/crashes to the System event channel. Some
|
|
||||||
malware sets this value to 0. See: https://www.documentcloud.org/documents/3477047-Document-07-Neel-Mehta-Billy-Leonard-and-Shane.html'
|
|
||||||
interval: 3600
|
|
||||||
name: log_errors_registry
|
|
||||||
platform: windows
|
|
||||||
query: log_errors_registry
|
|
||||||
- description: Controls Windows security provider configurations
|
|
||||||
interval: 3600
|
|
||||||
name: security_providers_registry
|
|
||||||
platform: windows
|
|
||||||
query: security_providers_registry
|
|
||||||
- description: Controls Windows Update server location and installation behavior.
|
|
||||||
interval: 3600
|
|
||||||
name: windows_update_settings_registry
|
|
||||||
platform: windows
|
|
||||||
query: windows_update_settings_registry
|
|
||||||
- description: 'Controls enabling/disabling crash dumps. This key has a default
|
|
||||||
value of 7, but some malware sets this value to 0. See: https://www.documentcloud.org/documents/3477047-Document-07-Neel-Mehta-Billy-Leonard-and-Shane.html'
|
|
||||||
interval: 3600
|
|
||||||
name: crash_dump_registry
|
|
||||||
platform: windows
|
|
||||||
query: crash_dump_registry
|
|
||||||
- description: 'This registry key specifies the path to a DLL to be loaded by a
|
|
||||||
Windows DNS server. This key does not exist by default. Can allow privesc: https://medium.com/@esnesenon/feature-not-bug-dnsadmin-to-dc-compromise-in-one-line-a0f779b8dc83'
|
|
||||||
interval: 3600
|
|
||||||
name: dns_plugin_dll_registry
|
|
||||||
platform: windows
|
|
||||||
query: dns_plugin_dll_registry
|
|
||||||
- description: The KnownDlls key defines the set of DLLs that are first searched
|
|
||||||
during system startup.
|
|
||||||
interval: 3600
|
|
||||||
name: knowndlls_registry
|
|
||||||
platform: windows
|
|
||||||
query: knowndlls_registry
|
|
||||||
- description: This key exists by default and has a default value of 1. Terminal
|
|
||||||
service connections are allowed to the host when the key value is set to 0
|
|
||||||
interval: 3600
|
|
||||||
name: terminal_service_deny_registry
|
|
||||||
platform: windows
|
|
||||||
query: terminal_service_deny_registry
|
|
||||||
- description: Controls Windows command-line auditing
|
|
||||||
interval: 3600
|
|
||||||
name: command_line_auditing_registry
|
|
||||||
platform: windows
|
|
||||||
query: command_line_auditing_registry
|
|
||||||
- description: 'This key (and subkeys) exist by default and are required to allow
|
|
||||||
post-mortem debuggers like Dr. Watson. Some malware deletes this key. See: https://www.documentcloud.org/documents/3477047-Document-07-Neel-Mehta-Billy-Leonard-and-Shane.html'
|
|
||||||
interval: 3600
|
|
||||||
name: dr_watson_registry
|
|
||||||
platform: windows
|
|
||||||
query: dr_watson_registry
|
|
||||||
- description: Controls how many simultaneous terminal services sessions can use
|
|
||||||
the same account
|
|
||||||
interval: 3600
|
|
||||||
name: per_user_ts_session_registry
|
|
||||||
platform: windows
|
|
||||||
query: per_user_ts_session_registry
|
|
||||||
- description: Controls Powershell execution policy, script execution, logging,
|
|
||||||
and more.
|
|
||||||
interval: 3600
|
|
||||||
name: powershell_settings_registry
|
|
||||||
platform: windows
|
|
||||||
query: powershell_settings_registry
|
|
||||||
- description: Controls enabling/disabling SMBv1. Setting this key to 0 disables
|
|
||||||
the SMBv1 protocol on the host.
|
|
||||||
interval: 3600
|
|
||||||
name: smbv1_registry
|
|
||||||
platform: windows
|
|
||||||
query: smbv1_registry
|
|
||||||
- description: Lists information about SecureBoot status.
|
|
||||||
interval: 3600
|
|
||||||
name: secure_boot_registry
|
|
||||||
platform: windows
|
|
||||||
query: secure_boot_registry
|
|
||||||
- description: This key does not exist by default and controls enabling/disabling
|
|
||||||
error reporting. Some malware creates this key sets the value to 0 (disables
|
|
||||||
error reports). See https://msdn.microsoft.com/en-us/library/aa939342(v=winembedded.5).aspx
|
|
||||||
and https://www.documentcloud.org/documents/3477047-Document-07-Neel-Mehta-Billy-Leonard-and-Shane.html
|
|
||||||
interval: 3600
|
|
||||||
name: error_report_registry
|
|
||||||
platform: windows
|
|
||||||
query: error_report_registry
|
|
||||||
- description: Controls behavior, size, and rotation strategy for primary windows
|
|
||||||
event log files.
|
|
||||||
interval: 3600
|
|
||||||
name: event_log_settings_registry
|
|
||||||
platform: windows
|
|
||||||
query: event_log_settings_registry
|
|
||||||
- description: Controls system TPM settings
|
|
||||||
interval: 3600
|
|
||||||
name: tpm_registry
|
|
||||||
platform: windows
|
|
||||||
query: tpm_registry
|
|
||||||
- description: Controls local WinRM client configuration and security.
|
|
||||||
interval: 3600
|
|
||||||
name: winrm_settings_registry
|
|
||||||
platform: windows
|
|
||||||
query: winrm_settings_registry
|
|
||||||
- description: 'Controls the suppression of error dialog boxes. The default value
|
|
||||||
is 0 (all messages are visible), but some malware sets this value to 2 (all
|
|
||||||
messages are invisible). See: https://www.documentcloud.org/documents/3477047-Document-07-Neel-Mehta-Billy-Leonard-and-Shane.html'
|
|
||||||
interval: 3600
|
|
||||||
name: error_mode_registry
|
|
||||||
platform: windows
|
|
||||||
query: error_mode_registry
|
|
||||||
- description: Controls sending administrative notifications after a crash. Some
|
|
||||||
malware sets this value to 0
|
|
||||||
interval: 3600
|
|
||||||
name: send_error_alert_registry
|
|
||||||
platform: windows
|
|
||||||
query: send_error_alert_registry
|
|
||||||
targets:
|
|
||||||
labels: null
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: 'This key does not exist by default and controls enabling/disabling
|
|
||||||
error reporting display. Some malware creates this key and sets the value to 0.
|
|
||||||
See: https://www.documentcloud.org/documents/3477047-Document-07-Neel-Mehta-Billy-Leonard-and-Shane.html'
|
|
||||||
name: error_display_ui_registry
|
|
||||||
query: SELECT * FROM registry WHERE path='HKEY_LOCAL_MACHINE\Software\Microsoft\PCHealth\ErrorReporting\ShowUI';
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Entries for the FileRenameOperation support the MoveFileEx delayed-rename
|
|
||||||
and delayed-delete capabilities. Sometimes used as a self-deletion technique for
|
|
||||||
malware.
|
|
||||||
name: filerenameoperations_registry
|
|
||||||
query: SELECT * FROM registry WHERE path='HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session
|
|
||||||
Manager\FileRenameOperations';
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Controls which security packages store credentials in LSA memory, secure
|
|
||||||
boot, etc.
|
|
||||||
name: local_security_authority_registry
|
|
||||||
query: SELECT * FROM registry WHERE key LIKE 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\%%';
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: 'This key exists by default and has a default value of 1. Setting this
|
|
||||||
key to 0 disables logging errors/crashes to the System event channel. Some malware
|
|
||||||
sets this value to 0. See: https://www.documentcloud.org/documents/3477047-Document-07-Neel-Mehta-Billy-Leonard-and-Shane.html'
|
|
||||||
name: log_errors_registry
|
|
||||||
query: SELECT * FROM registry WHERE path='HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\CrashControl\LogEvent';
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Controls Windows security provider configurations
|
|
||||||
name: security_providers_registry
|
|
||||||
query: SELECT * FROM registry WHERE key LIKE 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\%%';
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Controls Windows Update server location and installation behavior.
|
|
||||||
name: windows_update_settings_registry
|
|
||||||
query: SELECT * FROM registry WHERE key LIKE 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\%%';
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: 'Controls enabling/disabling crash dumps. This key has a default value
|
|
||||||
of 7, but some malware sets this value to 0. See: https://www.documentcloud.org/documents/3477047-Document-07-Neel-Mehta-Billy-Leonard-and-Shane.html'
|
|
||||||
name: crash_dump_registry
|
|
||||||
query: SELECT * FROM registry WHERE path='HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\CrashControl\CrashDumpEnabled';
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: 'This registry key specifies the path to a DLL to be loaded by a Windows
|
|
||||||
DNS server. This key does not exist by default. Can allow privesc: https://medium.com/@esnesenon/feature-not-bug-dnsadmin-to-dc-compromise-in-one-line-a0f779b8dc83'
|
|
||||||
name: dns_plugin_dll_registry
|
|
||||||
query: SELECT * FROM registry WHERE key='HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\DNS\Parameters\ServerLevelPluginDll';
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: The KnownDlls key defines the set of DLLs that are first searched during
|
|
||||||
system startup.
|
|
||||||
name: knowndlls_registry
|
|
||||||
query: SELECT * FROM registry WHERE path LIKE 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session
|
|
||||||
Manager\KnownDLLs\%%';
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: This key exists by default and has a default value of 1. Terminal service
|
|
||||||
connections are allowed to the host when the key value is set to 0
|
|
||||||
name: terminal_service_deny_registry
|
|
||||||
query: SELECT * FROM registry WHERE path='HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal
|
|
||||||
Server\fDenyTSConnections';
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Controls Windows command-line auditing
|
|
||||||
name: command_line_auditing_registry
|
|
||||||
query: SELECT * FROM registry WHERE key='HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\Audit';
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: 'This key (and subkeys) exist by default and are required to allow
|
|
||||||
post-mortem debuggers like Dr. Watson. Some malware deletes this key. See: https://www.documentcloud.org/documents/3477047-Document-07-Neel-Mehta-Billy-Leonard-and-Shane.html'
|
|
||||||
name: dr_watson_registry
|
|
||||||
query: SELECT * FROM registry WHERE key='HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
|
|
||||||
NT\CurrentVersion\AeDebug';
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Controls how many simultaneous terminal services sessions can use the
|
|
||||||
same account
|
|
||||||
name: per_user_ts_session_registry
|
|
||||||
query: SELECT * FROM registry WHERE path='HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal
|
|
||||||
Server\fSingleSessionPerUser';
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Controls Powershell execution policy, script execution, logging, and
|
|
||||||
more.
|
|
||||||
name: powershell_settings_registry
|
|
||||||
query: SELECT * FROM registry WHERE key LIKE 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Powershell\%%';
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Controls enabling/disabling SMBv1. Setting this key to 0 disables the
|
|
||||||
SMBv1 protocol on the host.
|
|
||||||
name: smbv1_registry
|
|
||||||
query: SELECT * FROM registry WHERE path='HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\SMB1';
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Lists information about SecureBoot status.
|
|
||||||
name: secure_boot_registry
|
|
||||||
query: SELECT * FROM registry WHERE key='HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecureBoot';
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: This key does not exist by default and controls enabling/disabling
|
|
||||||
error reporting. Some malware creates this key sets the value to 0 (disables error
|
|
||||||
reports). See https://msdn.microsoft.com/en-us/library/aa939342(v=winembedded.5).aspx
|
|
||||||
and https://www.documentcloud.org/documents/3477047-Document-07-Neel-Mehta-Billy-Leonard-and-Shane.html
|
|
||||||
name: error_report_registry
|
|
||||||
query: SELECT * FROM registry WHERE path='HKEY_LOCAL_MACHINE\Software\Microsoft\PCHealth\ErrorReporting\DoReport';
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Controls behavior, size, and rotation strategy for primary windows
|
|
||||||
event log files.
|
|
||||||
name: event_log_settings_registry
|
|
||||||
query: SELECT * FROM registry WHERE key LIKE 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\EventLog\%%';
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Controls system TPM settings
|
|
||||||
name: tpm_registry
|
|
||||||
query: SELECT * FROM registry WHERE key='HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\TPM';
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Controls local WinRM client configuration and security.
|
|
||||||
name: winrm_settings_registry
|
|
||||||
query: SELECT * FROM registry WHERE key LIKE 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRM\%%';
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: 'Controls the suppression of error dialog boxes. The default value
|
|
||||||
is 0 (all messages are visible), but some malware sets this value to 2 (all messages
|
|
||||||
are invisible). See: https://www.documentcloud.org/documents/3477047-Document-07-Neel-Mehta-Billy-Leonard-and-Shane.html'
|
|
||||||
name: error_mode_registry
|
|
||||||
query: SELECT * FROM registry WHERE path='HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Windows\ErrorMode';
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Controls sending administrative notifications after a crash. Some malware
|
|
||||||
sets this value to 0
|
|
||||||
name: send_error_alert_registry
|
|
||||||
query: SELECT * FROM registry WHERE path='HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\CrashControl\SendAlert';
|
|
||||||
@@ -1,475 +0,0 @@
|
|||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: pack
|
|
||||||
spec:
|
|
||||||
name: windows-registry-monitoring
|
|
||||||
queries:
|
|
||||||
- description: Technique used by attackers to prevent computer accounts from changing
|
|
||||||
their password, thus extending the life of Kerberos silver tickets (https://adsecurity.org/?p=2011)
|
|
||||||
interval: 3600
|
|
||||||
name: computer_password_change_disabled_registry
|
|
||||||
platform: windows
|
|
||||||
query: computer_password_change_disabled_registry
|
|
||||||
- description: Returns 0 as a result if the registry key does not exist
|
|
||||||
interval: 3600
|
|
||||||
name: error_mode_registry_missing
|
|
||||||
platform: windows
|
|
||||||
query: error_mode_registry_missing
|
|
||||||
- description: Returns 0 as a result if the registry key does not exist
|
|
||||||
interval: 3600
|
|
||||||
name: per_user_ts_session_registry_missing
|
|
||||||
platform: windows
|
|
||||||
query: per_user_ts_session_registry_missing
|
|
||||||
- description: Returns 0 as a result if the registry key does not exist
|
|
||||||
interval: 3600
|
|
||||||
name: powershell_invocationheader_registry_missing
|
|
||||||
platform: windows
|
|
||||||
query: powershell_invocationheader_registry_missing
|
|
||||||
- description: Returns the content of the key if it does not match the expected
|
|
||||||
value
|
|
||||||
interval: 3600
|
|
||||||
name: bitlocker_encryption_settings_registry_misconfigured
|
|
||||||
platform: windows
|
|
||||||
query: bitlocker_encryption_settings_registry_misconfigured
|
|
||||||
- description: Returns the content of the key if it does not match the expected
|
|
||||||
value
|
|
||||||
interval: 3600
|
|
||||||
name: bitlocker_mbam_registry_misconfigured
|
|
||||||
platform: windows
|
|
||||||
query: bitlocker_mbam_registry_misconfigured
|
|
||||||
- description: Returns the content of this key if it exists, which it shouldn't
|
|
||||||
by default
|
|
||||||
interval: 3600
|
|
||||||
name: dns_plugin_dll_registry_exists
|
|
||||||
platform: windows
|
|
||||||
query: dns_plugin_dll_registry_exists
|
|
||||||
- description: Returns the content of this key if it exists, which it shouldn't
|
|
||||||
by default
|
|
||||||
interval: 3600
|
|
||||||
name: error_display_ui_registry_exists
|
|
||||||
platform: windows
|
|
||||||
query: error_display_ui_registry_exists
|
|
||||||
- description: Returns the content of the key if it does not match the expected
|
|
||||||
value
|
|
||||||
interval: 3600
|
|
||||||
name: log_errors_registry_misconfigured
|
|
||||||
platform: windows
|
|
||||||
query: log_errors_registry_misconfigured
|
|
||||||
- description: Returns the content of the key if it does not match the expected
|
|
||||||
value
|
|
||||||
interval: 3600
|
|
||||||
name: subscription_manager_registry_misconfigured
|
|
||||||
platform: windows
|
|
||||||
query: subscription_manager_registry_misconfigured
|
|
||||||
- description: Returns 0 as a result if the registry key does not exist
|
|
||||||
interval: 3600
|
|
||||||
name: subscription_manager_registry_missing
|
|
||||||
platform: windows
|
|
||||||
query: subscription_manager_registry_missing
|
|
||||||
- description: Returns the content of the key if it does not match the expected
|
|
||||||
value
|
|
||||||
interval: 3600
|
|
||||||
name: command_line_auditing_registry_misconfigured
|
|
||||||
platform: windows
|
|
||||||
query: command_line_auditing_registry_misconfigured
|
|
||||||
- description: Returns 0 as a result if the registry key does not exist
|
|
||||||
interval: 3600
|
|
||||||
name: crash_dump_registry_missing
|
|
||||||
platform: windows
|
|
||||||
query: crash_dump_registry_missing
|
|
||||||
- description: Returns the content of the key if it does not match the expected
|
|
||||||
value
|
|
||||||
interval: 3600
|
|
||||||
name: error_mode_registry_misconfigured
|
|
||||||
platform: windows
|
|
||||||
query: error_mode_registry_misconfigured
|
|
||||||
- description: Returns 0 as a result if the registry key does not exist
|
|
||||||
interval: 3600
|
|
||||||
name: log_errors_registry_missing
|
|
||||||
platform: windows
|
|
||||||
query: log_errors_registry_missing
|
|
||||||
- description: Returns the content of the key if it does not match the expected
|
|
||||||
value
|
|
||||||
interval: 3600
|
|
||||||
name: winrm_settings_registry_misconfigured
|
|
||||||
platform: windows
|
|
||||||
query: winrm_settings_registry_misconfigured
|
|
||||||
- description: Returns the content of the key if it does not match the expected
|
|
||||||
value
|
|
||||||
interval: 3600
|
|
||||||
name: crash_dump_registry_misconfigured
|
|
||||||
platform: windows
|
|
||||||
query: crash_dump_registry_misconfigured
|
|
||||||
- description: Detect a registry based persistence mechanism that allows an attacker
|
|
||||||
to specify a DLL to be loaded when cryptographic libraries are called (https://twitter.com/PsiDragon/status/978367732793135105)
|
|
||||||
interval: 3600
|
|
||||||
name: physicalstore_dll_registry_persistence
|
|
||||||
platform: windows
|
|
||||||
query: physicalstore_dll_registry_persistence
|
|
||||||
- description: Returns the content of the key if it does not match the expected
|
|
||||||
value
|
|
||||||
interval: 3600
|
|
||||||
name: powershell_logging_registry_misconfigured
|
|
||||||
platform: windows
|
|
||||||
query: powershell_logging_registry_misconfigured
|
|
||||||
- description: 'A registry key can be created to disable AMSI on Windows: (https://twitter.com/Moriarty_Meng/status/1011568060883333120)'
|
|
||||||
interval: 3600
|
|
||||||
name: amsi_disabled_registry
|
|
||||||
platform: windows
|
|
||||||
query: amsi_disabled_registry
|
|
||||||
- description: Controls how often to rotate the local computer password (defaults
|
|
||||||
to 30 days). A modification of this value may be an indicator of attacker activity.
|
|
||||||
interval: 3600
|
|
||||||
name: computer_maximum_password_age_changed_registry
|
|
||||||
platform: windows
|
|
||||||
query: computer_maximum_password_age_changed_registry
|
|
||||||
- description: Returns 0 as a result if the registry key does not exist
|
|
||||||
interval: 3600
|
|
||||||
name: dr_watson_registry_missing
|
|
||||||
platform: windows
|
|
||||||
query: dr_watson_registry_missing
|
|
||||||
- description: Returns the content of the key if it does not match the expected
|
|
||||||
value
|
|
||||||
interval: 3600
|
|
||||||
name: per_user_ts_session_registry_misconfigured
|
|
||||||
platform: windows
|
|
||||||
query: per_user_ts_session_registry_misconfigured
|
|
||||||
- description: Registry based persistence mechanism to load DLLs at reboot time
|
|
||||||
and avoids detection by Autoruns (https://oddvar.moe/2018/03/21/persistence-using-runonceex-hidden-from-autoruns-exe/).
|
|
||||||
Subkeys will be deleted after they run, thus (RunOnce). The RunOnceEx key will
|
|
||||||
remain.
|
|
||||||
interval: 3600
|
|
||||||
name: runonceex_persistence_registry
|
|
||||||
platform: windows
|
|
||||||
query: runonceex_persistence_registry
|
|
||||||
- description: Returns 0 as a result if the registry key does not exist
|
|
||||||
interval: 3600
|
|
||||||
name: smbv1_registry_missing
|
|
||||||
platform: windows
|
|
||||||
query: smbv1_registry_missing
|
|
||||||
- description: Returns 0 as a result if the registry key does not exist
|
|
||||||
interval: 3600
|
|
||||||
name: powershell_transcription_logging_registry_missing
|
|
||||||
platform: windows
|
|
||||||
query: powershell_transcription_logging_registry_missing
|
|
||||||
- description: Returns 0 as a result if the registry key does not exist
|
|
||||||
interval: 3600
|
|
||||||
name: powershell_module_logging_registry_missing
|
|
||||||
platform: windows
|
|
||||||
query: powershell_module_logging_registry_missing
|
|
||||||
- description: Returns 0 as a result if the registry key does not exist
|
|
||||||
interval: 3600
|
|
||||||
name: powershell_scriptblock_logging_registry_missing
|
|
||||||
platform: windows
|
|
||||||
query: powershell_scriptblock_logging_registry_missing
|
|
||||||
- description: Returns the content of the key if it does not match the expected
|
|
||||||
value
|
|
||||||
interval: 3600
|
|
||||||
name: bitlocker_mbam_endpoint_registry_misconfigured
|
|
||||||
platform: windows
|
|
||||||
query: bitlocker_mbam_endpoint_registry_misconfigured
|
|
||||||
- description: Returns 0 as a result if the registry key does not exist
|
|
||||||
interval: 3600
|
|
||||||
name: command_line_auditing_registry_missing
|
|
||||||
platform: windows
|
|
||||||
query: command_line_auditing_registry_missing
|
|
||||||
- description: ""
|
|
||||||
interval: 3600
|
|
||||||
name: smbv1_registry_misconfigured
|
|
||||||
platform: windows
|
|
||||||
query: smbv1_registry_misconfigured
|
|
||||||
- description: Returns the content of this key if it exists, which it shouldn't
|
|
||||||
by default
|
|
||||||
interval: 3600
|
|
||||||
name: send_error_alert_registry_exists
|
|
||||||
platform: windows
|
|
||||||
query: send_error_alert_registry_exists
|
|
||||||
targets:
|
|
||||||
labels: null
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Technique used by attackers to prevent computer accounts from changing
|
|
||||||
their password, thus extending the life of Kerberos silver tickets (https://adsecurity.org/?p=2011)
|
|
||||||
name: computer_password_change_disabled_registry
|
|
||||||
query: SELECT * FROM registry WHERE path='HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\DisablePasswordChange'
|
|
||||||
AND data!=0;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Returns 0 as a result if the registry key does not exist
|
|
||||||
name: error_mode_registry_missing
|
|
||||||
query: SELECT IFNULL(key_count,0) AS key_exists FROM (SELECT COUNT(*) AS key_count
|
|
||||||
FROM registry WHERE path='HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Windows\ErrorMode')
|
|
||||||
WHERE key_exists!=1;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Returns 0 as a result if the registry key does not exist
|
|
||||||
name: per_user_ts_session_registry_missing
|
|
||||||
query: SELECT IFNULL(key_count,0) AS key_exists FROM (SELECT COUNT(*) AS key_count
|
|
||||||
FROM registry WHERE path='HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal
|
|
||||||
Server\fSingleSessionPerUser') WHERE key_exists!=1;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Returns 0 as a result if the registry key does not exist
|
|
||||||
name: powershell_invocationheader_registry_missing
|
|
||||||
query: SELECT IFNULL(key_count,0) AS key_exists FROM (SELECT COUNT(*) AS key_count
|
|
||||||
FROM registry WHERE path='HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Powershell\Transcription\EnableInvocationHeader')
|
|
||||||
WHERE key_exists!=1;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Returns the content of the key if it does not match the expected value
|
|
||||||
name: bitlocker_encryption_settings_registry_misconfigured
|
|
||||||
query: SELECT * FROM registry WHERE (path='HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\FVE\MDOPBitLockerManagement\ShouldEncryptOSDrive'
|
|
||||||
OR path='HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\FVE\MDOPBitLockerManagement\OSDriveProtector')
|
|
||||||
AND data!=1;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Returns the content of the key if it does not match the expected value
|
|
||||||
name: bitlocker_mbam_registry_misconfigured
|
|
||||||
query: SELECT * FROM registry WHERE path='HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\FVE\MDOPBitLockerManagement\UseMBAMServices'
|
|
||||||
AND data!=1;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Returns the content of this key if it exists, which it shouldn't by
|
|
||||||
default
|
|
||||||
name: dns_plugin_dll_registry_exists
|
|
||||||
query: SELECT * FROM registry WHERE key='HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\DNS\Parameters\ServerLevelPluginDll';
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Returns the content of this key if it exists, which it shouldn't by
|
|
||||||
default
|
|
||||||
name: error_display_ui_registry_exists
|
|
||||||
query: SELECT * FROM registry WHERE path='HKEY_LOCAL_MACHINE\Software\Microsoft\PCHealth\ErrorReporting\ShowUI';
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Returns the content of the key if it does not match the expected value
|
|
||||||
name: log_errors_registry_misconfigured
|
|
||||||
query: SELECT * FROM registry WHERE path='HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\CrashControl\LogEvent'
|
|
||||||
AND data!=1;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Returns the content of the key if it does not match the expected value
|
|
||||||
name: subscription_manager_registry_misconfigured
|
|
||||||
query: SELECT * FROM registry WHERE path='HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\EventLog\EventForwarding\SubscriptionManager\1'
|
|
||||||
AND (data!='Server=http://subdomain.domain.com:5985/wsman/SubscriptionManager/WEC'
|
|
||||||
AND data!='Server=http://subdomain.domain.com:5985/wsman/SubscriptionManager/WEC');
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Returns 0 as a result if the registry key does not exist
|
|
||||||
name: subscription_manager_registry_missing
|
|
||||||
query: SELECT IFNULL(key_count,0) AS key_exists FROM (SELECT COUNT(*) AS key_count
|
|
||||||
FROM registry WHERE path='HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\EventLog\EventForwarding\SubscriptionManager\1')
|
|
||||||
WHERE key_exists!=1;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Returns the content of the key if it does not match the expected value
|
|
||||||
name: command_line_auditing_registry_misconfigured
|
|
||||||
query: SELECT * FROM registry WHERE path='HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\Audit\ProcessCreationIncludeCmdLine_Enabled'
|
|
||||||
AND data!=1;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Returns 0 as a result if the registry key does not exist
|
|
||||||
name: crash_dump_registry_missing
|
|
||||||
query: SELECT IFNULL(key_count,0) AS key_exists FROM (SELECT COUNT(*) AS key_count
|
|
||||||
FROM registry WHERE path='HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\CrashControl\CrashDumpEnabled')
|
|
||||||
WHERE key_exists!=1;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Returns the content of the key if it does not match the expected value
|
|
||||||
name: error_mode_registry_misconfigured
|
|
||||||
query: SELECT * FROM registry WHERE path='HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Windows\ErrorMode'
|
|
||||||
AND data=2;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Returns 0 as a result if the registry key does not exist
|
|
||||||
name: log_errors_registry_missing
|
|
||||||
query: SELECT IFNULL(key_count,0) AS key_exists FROM (SELECT COUNT(*) AS key_count
|
|
||||||
FROM registry WHERE path='HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\CrashControl\LogEvent')
|
|
||||||
WHERE key_exists!=1;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Returns the content of the key if it does not match the expected value
|
|
||||||
name: winrm_settings_registry_misconfigured
|
|
||||||
query: 'SELECT * FROM registry WHERE (path=''HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRM\Client\AllowBasic''
|
|
||||||
OR path=''HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRM\Client\AllowCredSSP''
|
|
||||||
OR path=''HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRM\Client\AllowUnencryptedTraffic''
|
|
||||||
OR path=''HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRM\Client\AllowDigest''
|
|
||||||
OR path=''HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRM\Service\AllowBasic''
|
|
||||||
OR path=''HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRM\Service\AllowCredSSP''
|
|
||||||
OR path=''HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRM\Service\AllowUnencryptedTraffic''
|
|
||||||
OR path=''HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRM\Service\WinRS\AllowRemoteShellAccess'')
|
|
||||||
AND data!=0; '
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Returns the content of the key if it does not match the expected value
|
|
||||||
name: crash_dump_registry_misconfigured
|
|
||||||
query: SELECT * FROM registry WHERE path='HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\CrashControl\CrashDumpEnabled'
|
|
||||||
AND data=0;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Detect a registry based persistence mechanism that allows an attacker
|
|
||||||
to specify a DLL to be loaded when cryptographic libraries are called (https://twitter.com/PsiDragon/status/978367732793135105)
|
|
||||||
name: physicalstore_dll_registry_persistence
|
|
||||||
query: SELECT key, path, name, mtime, username FROM registry r, users WHERE path
|
|
||||||
LIKE 'HKEY_USERS\'||uuid||'\Software\Microsoft\SystemCertificates\CA\PhysicalStores\%%'
|
|
||||||
OR path LIKE 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType
|
|
||||||
0\CertDllOpenStoreProv\%%' AND name!='#16' AND name!='Ldap';
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Returns the content of the key if it does not match the expected value
|
|
||||||
name: powershell_logging_registry_misconfigured
|
|
||||||
query: SELECT * FROM registry WHERE (path='HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Powershell\ModuleLogging\EnableModuleLogging'
|
|
||||||
OR path='HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Powershell\ScriptBlockLogging\EnableScriptBlockLogging'
|
|
||||||
OR path='HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Powershell\Transcription\EnableTranscripting'
|
|
||||||
OR path='HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Powershell\Transcription\EnableInvocationHeader')
|
|
||||||
AND data!=1;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: 'A registry key can be created to disable AMSI on Windows: (https://twitter.com/Moriarty_Meng/status/1011568060883333120)'
|
|
||||||
name: amsi_disabled_registry
|
|
||||||
query: SELECT key, r.path, r.name, r.mtime, r.data, username from registry r, users
|
|
||||||
WHERE path = 'HKEY_USERS\'||uuid||'\Software\Microsoft\Windows Script\Settings\AmsiEnable'
|
|
||||||
AND data=0;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Controls how often to rotate the local computer password (defaults
|
|
||||||
to 30 days). A modification of this value may be an indicator of attacker activity.
|
|
||||||
name: computer_maximum_password_age_changed_registry
|
|
||||||
query: SELECT * FROM registry WHERE path='HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\MaximumPasswordAge'
|
|
||||||
and data!=30;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Returns 0 as a result if the registry key does not exist
|
|
||||||
name: dr_watson_registry_missing
|
|
||||||
query: SELECT IFNULL(key_count,0) AS key_exists FROM (SELECT COUNT(*) AS key_count
|
|
||||||
FROM registry where key='HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug')
|
|
||||||
WHERE key_exists!=2;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Returns the content of the key if it does not match the expected value
|
|
||||||
name: per_user_ts_session_registry_misconfigured
|
|
||||||
query: SELECT * FROM registry WHERE path='HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal
|
|
||||||
Server\fSingleSessionPerUser' AND data!=1;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Registry based persistence mechanism to load DLLs at reboot time and
|
|
||||||
avoids detection by Autoruns (https://oddvar.moe/2018/03/21/persistence-using-runonceex-hidden-from-autoruns-exe/).
|
|
||||||
Subkeys will be deleted after they run, thus (RunOnce). The RunOnceEx key will
|
|
||||||
remain.
|
|
||||||
name: runonceex_persistence_registry
|
|
||||||
query: SELECT * FROM registry WHERE path = 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx';
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Returns 0 as a result if the registry key does not exist
|
|
||||||
name: smbv1_registry_missing
|
|
||||||
query: SELECT IFNULL(key_count,0) AS key_exists FROM (SELECT COUNT(*) AS key_count
|
|
||||||
FROM registry WHERE path='HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\SMB1')
|
|
||||||
WHERE key_exists!=1;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Returns 0 as a result if the registry key does not exist
|
|
||||||
name: powershell_transcription_logging_registry_missing
|
|
||||||
query: SELECT IFNULL(key_count,0) AS key_exists FROM (SELECT COUNT(*) AS key_count
|
|
||||||
FROM registry WHERE path='HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Powershell\Transcription\EnableTranscripting')
|
|
||||||
WHERE key_exists!=1;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Returns 0 as a result if the registry key does not exist
|
|
||||||
name: powershell_module_logging_registry_missing
|
|
||||||
query: SELECT IFNULL(key_count,0) AS key_exists FROM (SELECT COUNT(*) AS key_count
|
|
||||||
FROM registry WHERE path='HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Powershell\ModuleLogging\EnableModuleLogging')
|
|
||||||
WHERE key_exists!=1;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Returns 0 as a result if the registry key does not exist
|
|
||||||
name: powershell_scriptblock_logging_registry_missing
|
|
||||||
query: SELECT IFNULL(key_count,0) AS key_exists FROM (SELECT COUNT(*) AS key_count
|
|
||||||
FROM registry WHERE path='HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Powershell\ScriptBlockLogging\EnableScriptBlockLogging')
|
|
||||||
WHERE key_exists!=1;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Returns the content of the key if it does not match the expected value
|
|
||||||
name: bitlocker_mbam_endpoint_registry_misconfigured
|
|
||||||
query: SELECT * FROM registry WHERE path='HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\FVE\MDOPBitLockerManagement\KeyRecoveryServiceEndPoint'
|
|
||||||
AND data!='https://mbam.server.com/MBAMRecoveryAndHardwareService/CoreService.svc';
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Returns 0 as a result if the registry key does not exist
|
|
||||||
name: command_line_auditing_registry_missing
|
|
||||||
query: SELECT IFNULL(key_count,0) AS key_exists FROM (SELECT COUNT(*) AS key_count
|
|
||||||
FROM registry WHERE path='HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\Audit\ProcessCreationIncludeCmdLine_Enabled')
|
|
||||||
WHERE key_exists!=1;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
name: smbv1_registry_misconfigured
|
|
||||||
query: SELECT * FROM registry WHERE path='HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\SMB1'
|
|
||||||
AND data!=0;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Returns the content of this key if it exists, which it shouldn't by
|
|
||||||
default
|
|
||||||
name: send_error_alert_registry_exists
|
|
||||||
query: SELECT * FROM registry WHERE key='HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\CrashControl\SendAlert';
|
|
||||||
@@ -1,596 +0,0 @@
|
|||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: pack
|
|
||||||
spec:
|
|
||||||
name: LinuxPack
|
|
||||||
queries:
|
|
||||||
- description: Retrieves all the jobs scheduled in crontab in the target system.
|
|
||||||
interval: 0
|
|
||||||
name: crontab_snapshot
|
|
||||||
platform: linux
|
|
||||||
query: crontab_snapshot
|
|
||||||
snapshot: true
|
|
||||||
- description: Various Linux kernel integrity checked attributes.
|
|
||||||
interval: 0
|
|
||||||
name: kernel_integrity
|
|
||||||
platform: linux
|
|
||||||
query: kernel_integrity
|
|
||||||
- description: Linux kernel modules both loaded and within the load search path.
|
|
||||||
interval: 0
|
|
||||||
name: kernel_modules
|
|
||||||
platform: linux
|
|
||||||
query: kernel_modules
|
|
||||||
- description: Retrieves the current list of mounted drives in the target system.
|
|
||||||
interval: 0
|
|
||||||
name: mounts
|
|
||||||
platform: linux
|
|
||||||
query: mounts
|
|
||||||
- description: The percentage of total CPU time (system+user) consumed by osqueryd
|
|
||||||
interval: 0
|
|
||||||
name: osquery_cpu_pct
|
|
||||||
platform: linux
|
|
||||||
query: osquery_cpu_pct
|
|
||||||
snapshot: true
|
|
||||||
- description: Socket events collected from the audit framework
|
|
||||||
interval: 0
|
|
||||||
name: socket_events
|
|
||||||
platform: linux
|
|
||||||
query: socket_events
|
|
||||||
- description: Record the network interfaces and their associated IP and MAC addresses
|
|
||||||
interval: 0
|
|
||||||
name: network_interfaces_snapshot
|
|
||||||
platform: linux
|
|
||||||
query: network_interfaces_snapshot
|
|
||||||
snapshot: true
|
|
||||||
version: 1.4.5
|
|
||||||
- description: Information about the running osquery configuration
|
|
||||||
interval: 0
|
|
||||||
name: osquery_info
|
|
||||||
platform: linux
|
|
||||||
query: osquery_info
|
|
||||||
snapshot: true
|
|
||||||
- description: Display all installed RPM packages
|
|
||||||
interval: 0
|
|
||||||
name: rpm_packages
|
|
||||||
platform: centos
|
|
||||||
query: rpm_packages
|
|
||||||
snapshot: true
|
|
||||||
- description: Record shell history for all users on system (instead of just root)
|
|
||||||
interval: 0
|
|
||||||
name: shell_history
|
|
||||||
platform: linux
|
|
||||||
query: shell_history
|
|
||||||
- description: File events collected from file integrity monitoring
|
|
||||||
interval: 0
|
|
||||||
name: file_events
|
|
||||||
platform: linux
|
|
||||||
query: file_events
|
|
||||||
removed: false
|
|
||||||
- description: Retrieve the EC2 metadata for this endpoint
|
|
||||||
interval: 0
|
|
||||||
name: ec2_instance_metadata
|
|
||||||
platform: linux
|
|
||||||
query: ec2_instance_metadata
|
|
||||||
- description: Retrieve the EC2 tags for this endpoint
|
|
||||||
interval: 0
|
|
||||||
name: ec2_instance_tags
|
|
||||||
platform: linux
|
|
||||||
query: ec2_instance_tags
|
|
||||||
- description: Snapshot query to retrieve the EC2 tags for this instance
|
|
||||||
interval: 0
|
|
||||||
name: ec2_instance_tags_snapshot
|
|
||||||
platform: linux
|
|
||||||
query: ec2_instance_tags_snapshot
|
|
||||||
snapshot: true
|
|
||||||
- description: Retrieves the current filters and chains per filter in the target
|
|
||||||
system.
|
|
||||||
interval: 0
|
|
||||||
name: iptables
|
|
||||||
platform: linux
|
|
||||||
query: iptables
|
|
||||||
- description: Display any SUID binaries that are owned by root
|
|
||||||
interval: 0
|
|
||||||
name: suid_bin
|
|
||||||
platform: linux
|
|
||||||
query: suid_bin
|
|
||||||
- description: Display all installed DEB packages
|
|
||||||
interval: 0
|
|
||||||
name: deb_packages
|
|
||||||
platform: ubuntu
|
|
||||||
query: deb_packages
|
|
||||||
snapshot: true
|
|
||||||
- description: Find shell processes that have open sockets
|
|
||||||
interval: 0
|
|
||||||
name: behavioral_reverse_shell
|
|
||||||
platform: linux
|
|
||||||
query: behavioral_reverse_shell
|
|
||||||
- description: Retrieves all the jobs scheduled in crontab in the target system.
|
|
||||||
interval: 0
|
|
||||||
name: crontab
|
|
||||||
platform: linux
|
|
||||||
query: crontab
|
|
||||||
- description: Records the system resources used by each query
|
|
||||||
interval: 0
|
|
||||||
name: per_query_perf
|
|
||||||
platform: linux
|
|
||||||
query: per_query_perf
|
|
||||||
- description: Records avg rate of socket events since daemon started
|
|
||||||
interval: 0
|
|
||||||
name: socket_rates
|
|
||||||
platform: linux
|
|
||||||
query: socket_rates
|
|
||||||
snapshot: true
|
|
||||||
- description: Local system users.
|
|
||||||
interval: 0
|
|
||||||
name: users
|
|
||||||
platform: linux
|
|
||||||
query: users
|
|
||||||
- description: Process events collected from the audit framework
|
|
||||||
interval: 0
|
|
||||||
name: process_events
|
|
||||||
platform: linux
|
|
||||||
query: process_events
|
|
||||||
- description: Retrieves the list of the latest logins with PID, username and timestamp.
|
|
||||||
interval: 0
|
|
||||||
name: last
|
|
||||||
platform: linux
|
|
||||||
query: last
|
|
||||||
- description: Any processes that run with an LD_PRELOAD environment variable
|
|
||||||
interval: 0
|
|
||||||
name: ld_preload
|
|
||||||
platform: linux
|
|
||||||
query: ld_preload
|
|
||||||
- description: Records avg rate of process events since daemon started
|
|
||||||
interval: 0
|
|
||||||
name: process_rates
|
|
||||||
platform: linux
|
|
||||||
query: process_rates
|
|
||||||
snapshot: true
|
|
||||||
- description: Information about the system hardware and name
|
|
||||||
interval: 0
|
|
||||||
name: system_info
|
|
||||||
platform: linux
|
|
||||||
query: system_info
|
|
||||||
snapshot: true
|
|
||||||
- description: Returns the private keys in the users ~/.ssh directory and whether
|
|
||||||
or not they are encrypted
|
|
||||||
interval: 0
|
|
||||||
name: user_ssh_keys
|
|
||||||
platform: linux
|
|
||||||
query: user_ssh_keys
|
|
||||||
- description: Local system users.
|
|
||||||
interval: 0
|
|
||||||
name: users_snapshot
|
|
||||||
platform: linux
|
|
||||||
query: users_snapshot
|
|
||||||
snapshot: true
|
|
||||||
- description: DNS resolvers used by the host
|
|
||||||
interval: 0
|
|
||||||
name: dns_resolvers
|
|
||||||
platform: linux
|
|
||||||
query: dns_resolvers
|
|
||||||
- description: Retrieves information from the current kernel in the target system.
|
|
||||||
interval: 0
|
|
||||||
name: kernel_info
|
|
||||||
platform: linux
|
|
||||||
query: kernel_info
|
|
||||||
snapshot: true
|
|
||||||
- description: Linux kernel modules both loaded and within the load search path.
|
|
||||||
interval: 0
|
|
||||||
name: kernel_modules_snapshot
|
|
||||||
platform: linux
|
|
||||||
query: kernel_modules_snapshot
|
|
||||||
snapshot: true
|
|
||||||
- description: Generates an event if ld.so.preload is present - used by rootkits
|
|
||||||
such as Jynx
|
|
||||||
interval: 0
|
|
||||||
name: ld_so_preload_exists
|
|
||||||
platform: linux
|
|
||||||
query: ld_so_preload_exists
|
|
||||||
snapshot: true
|
|
||||||
- description: Records system/user time, db size, and many other system metrics
|
|
||||||
interval: 0
|
|
||||||
name: runtime_perf
|
|
||||||
platform: linux
|
|
||||||
query: runtime_perf
|
|
||||||
- description: Retrieves all the entries in the target system /etc/hosts file.
|
|
||||||
interval: 0
|
|
||||||
name: etc_hosts_snapshot
|
|
||||||
platform: linux
|
|
||||||
query: etc_hosts_snapshot
|
|
||||||
snapshot: true
|
|
||||||
- description: Snapshot query to retrieve the EC2 metadata for this endpoint
|
|
||||||
interval: 0
|
|
||||||
name: ec2_instance_metadata_snapshot
|
|
||||||
platform: linux
|
|
||||||
query: ec2_instance_metadata_snapshot
|
|
||||||
snapshot: true
|
|
||||||
- description: ""
|
|
||||||
interval: 0
|
|
||||||
name: hardware_events
|
|
||||||
platform: linux
|
|
||||||
query: hardware_events
|
|
||||||
removed: false
|
|
||||||
- description: Information about memory usage on the system
|
|
||||||
interval: 0
|
|
||||||
name: memory_info
|
|
||||||
platform: linux
|
|
||||||
query: memory_info
|
|
||||||
- description: Displays information from /proc/stat file about the time the CPU
|
|
||||||
cores spent in different parts of the system
|
|
||||||
interval: 0
|
|
||||||
name: cpu_time
|
|
||||||
platform: linux
|
|
||||||
query: cpu_time
|
|
||||||
- description: Retrieves all the entries in the target system /etc/hosts file.
|
|
||||||
interval: 0
|
|
||||||
name: etc_hosts
|
|
||||||
platform: linux
|
|
||||||
query: etc_hosts
|
|
||||||
- description: Retrieves information from the Operating System where osquery is
|
|
||||||
currently running.
|
|
||||||
interval: 0
|
|
||||||
name: os_version
|
|
||||||
platform: linux
|
|
||||||
query: os_version
|
|
||||||
snapshot: true
|
|
||||||
- description: A snapshot of all processes running on the host. Useful for outlier
|
|
||||||
analysis.
|
|
||||||
interval: 0
|
|
||||||
name: processes_snapshot
|
|
||||||
platform: linux
|
|
||||||
query: processes_snapshot
|
|
||||||
snapshot: true
|
|
||||||
- description: Retrieves the current list of USB devices in the target system.
|
|
||||||
interval: 0
|
|
||||||
name: usb_devices
|
|
||||||
platform: linux
|
|
||||||
query: usb_devices
|
|
||||||
- description: A line-delimited authorized_keys table.
|
|
||||||
interval: 0
|
|
||||||
name: authorized_keys
|
|
||||||
platform: linux
|
|
||||||
query: authorized_keys
|
|
||||||
targets:
|
|
||||||
labels: null
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Retrieves all the jobs scheduled in crontab in the target system.
|
|
||||||
name: crontab_snapshot
|
|
||||||
query: SELECT * FROM crontab;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Various Linux kernel integrity checked attributes.
|
|
||||||
name: kernel_integrity
|
|
||||||
query: SELECT * FROM kernel_integrity;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Linux kernel modules both loaded and within the load search path.
|
|
||||||
name: kernel_modules
|
|
||||||
query: SELECT * FROM kernel_modules;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Retrieves the current list of mounted drives in the target system.
|
|
||||||
name: mounts
|
|
||||||
query: SELECT device, device_alias, path, type, blocks_size, flags FROM mounts;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: The percentage of total CPU time (system+user) consumed by osqueryd
|
|
||||||
name: osquery_cpu_pct
|
|
||||||
query: SELECT ((osqueryd_time*100)/(SUM(system_time) + SUM(user_time))) AS pct FROM
|
|
||||||
processes, (SELECT (SUM(processes.system_time)+SUM(processes.user_time)) AS osqueryd_time
|
|
||||||
FROM processes WHERE name='osqueryd');
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Socket events collected from the audit framework
|
|
||||||
name: socket_events
|
|
||||||
query: SELECT action, auid, family, local_address, local_port, path, pid, remote_address,
|
|
||||||
remote_port, success, time FROM socket_events WHERE success=1 AND path NOT IN
|
|
||||||
('/usr/bin/hostname') AND remote_address NOT IN ('127.0.0.1', '169.254.169.254',
|
|
||||||
'', '0000:0000:0000:0000:0000:0000:0000:0001', '::1', '0000:0000:0000:0000:0000:ffff:7f00:0001',
|
|
||||||
'unknown', '0.0.0.0', '0000:0000:0000:0000:0000:0000:0000:0000');
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Record the network interfaces and their associated IP and MAC addresses
|
|
||||||
name: network_interfaces_snapshot
|
|
||||||
query: SELECT a.interface, a.address, d.mac FROM interface_addresses a JOIN interface_details
|
|
||||||
d USING (interface);
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Information about the running osquery configuration
|
|
||||||
name: osquery_info
|
|
||||||
query: SELECT * FROM osquery_info;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Display all installed RPM packages
|
|
||||||
name: rpm_packages
|
|
||||||
query: SELECT name, version, release, arch FROM rpm_packages;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Record shell history for all users on system (instead of just root)
|
|
||||||
name: shell_history
|
|
||||||
query: SELECT * FROM users JOIN shell_history USING (uid);
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: File events collected from file integrity monitoring
|
|
||||||
name: file_events
|
|
||||||
query: SELECT * FROM file_events;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Retrieve the EC2 metadata for this endpoint
|
|
||||||
name: ec2_instance_metadata
|
|
||||||
query: SELECT * FROM ec2_instance_metadata;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Retrieve the EC2 tags for this endpoint
|
|
||||||
name: ec2_instance_tags
|
|
||||||
query: SELECT * FROM ec2_instance_tags;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Snapshot query to retrieve the EC2 tags for this instance
|
|
||||||
name: ec2_instance_tags_snapshot
|
|
||||||
query: SELECT * FROM ec2_instance_tags;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Retrieves the current filters and chains per filter in the target system.
|
|
||||||
name: iptables
|
|
||||||
query: SELECT * FROM iptables;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Display any SUID binaries that are owned by root
|
|
||||||
name: suid_bin
|
|
||||||
query: SELECT * FROM suid_bin;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Display all installed DEB packages
|
|
||||||
name: deb_packages
|
|
||||||
query: SELECT * FROM deb_packages;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Find shell processes that have open sockets
|
|
||||||
name: behavioral_reverse_shell
|
|
||||||
query: SELECT DISTINCT(processes.pid), processes.parent, processes.name, processes.path,
|
|
||||||
processes.cmdline, processes.cwd, processes.root, processes.uid, processes.gid,
|
|
||||||
processes.start_time, process_open_sockets.remote_address, process_open_sockets.remote_port,
|
|
||||||
(SELECT cmdline FROM processes AS parent_cmdline WHERE pid=processes.parent) AS
|
|
||||||
parent_cmdline FROM processes JOIN process_open_sockets USING (pid) LEFT OUTER
|
|
||||||
JOIN process_open_files ON processes.pid = process_open_files.pid WHERE (name='sh'
|
|
||||||
OR name='bash') AND remote_address NOT IN ('0.0.0.0', '::', '') AND remote_address
|
|
||||||
NOT LIKE '10.%' AND remote_address NOT LIKE '192.168.%';
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Retrieves all the jobs scheduled in crontab in the target system.
|
|
||||||
name: crontab
|
|
||||||
query: SELECT * FROM crontab;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Records the system resources used by each query
|
|
||||||
name: per_query_perf
|
|
||||||
query: SELECT name, interval, executions, output_size, wall_time, (user_time/executions)
|
|
||||||
AS avg_user_time, (system_time/executions) AS avg_system_time, average_memory
|
|
||||||
FROM osquery_schedule;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Records avg rate of socket events since daemon started
|
|
||||||
name: socket_rates
|
|
||||||
query: SELECT COUNT(1) AS num, count(1)/s AS rate FROM socket_events, (SELECT (julianday('now')
|
|
||||||
- 2440587.5)*86400.0 - start_time AS s FROM osquery_info LIMIT 1);
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Local system users.
|
|
||||||
name: users
|
|
||||||
query: SELECT * FROM users;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Process events collected from the audit framework
|
|
||||||
name: process_events
|
|
||||||
query: SELECT auid, cmdline, ctime, cwd, egid, euid, gid, parent, path, pid, time,
|
|
||||||
uid FROM process_events WHERE path NOT IN ('/bin/sed', '/usr/bin/tr', '/bin/gawk',
|
|
||||||
'/bin/date', '/bin/mktemp', '/usr/bin/dirname', '/usr/bin/head', '/usr/bin/jq',
|
|
||||||
'/bin/cut', '/bin/uname', '/bin/basename') and cmdline NOT LIKE '%_key%' AND cmdline
|
|
||||||
NOT LIKE '%secret%';
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Retrieves the list of the latest logins with PID, username and timestamp.
|
|
||||||
name: last
|
|
||||||
query: SELECT * FROM last;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Any processes that run with an LD_PRELOAD environment variable
|
|
||||||
name: ld_preload
|
|
||||||
query: SELECT process_envs.pid, process_envs.key, process_envs.value, processes.name,
|
|
||||||
processes.path, processes.cmdline, processes.cwd FROM process_envs join processes
|
|
||||||
USING (pid) WHERE key = 'LD_PRELOAD';
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Records avg rate of process events since daemon started
|
|
||||||
name: process_rates
|
|
||||||
query: SELECT COUNT(1) AS num, count(1)/s AS rate FROM process_events, (SELECT (julianday('now')
|
|
||||||
- 2440587.5)*86400.0 - start_time AS s FROM osquery_info LIMIT 1);
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Information about the system hardware and name
|
|
||||||
name: system_info
|
|
||||||
query: SELECT * FROM system_info;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Returns the private keys in the users ~/.ssh directory and whether
|
|
||||||
or not they are encrypted
|
|
||||||
name: user_ssh_keys
|
|
||||||
query: SELECT * FROM users JOIN user_ssh_keys USING (uid);
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Local system users.
|
|
||||||
name: users_snapshot
|
|
||||||
query: SELECT * FROM users;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: DNS resolvers used by the host
|
|
||||||
name: dns_resolvers
|
|
||||||
query: SELECT * FROM dns_resolvers;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Retrieves information from the current kernel in the target system.
|
|
||||||
name: kernel_info
|
|
||||||
query: SELECT * FROM kernel_info;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Linux kernel modules both loaded and within the load search path.
|
|
||||||
name: kernel_modules_snapshot
|
|
||||||
query: SELECT * FROM kernel_modules;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Generates an event if ld.so.preload is present - used by rootkits such
|
|
||||||
as Jynx
|
|
||||||
name: ld_so_preload_exists
|
|
||||||
query: SELECT * FROM file WHERE path='/etc/ld.so.preload' AND path!='';
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Records system/user time, db size, and many other system metrics
|
|
||||||
name: runtime_perf
|
|
||||||
query: SELECT ov.version AS os_version, ov.platform AS os_platform, ov.codename
|
|
||||||
AS os_codename, i.*, p.resident_size, p.user_time, p.system_time, time.minutes
|
|
||||||
AS counter, db.db_size_mb AS database_size from osquery_info i, os_version ov,
|
|
||||||
processes p, time, (SELECT (SUM(size) / 1024) / 1024.0 AS db_size_mb FROM (SELECT
|
|
||||||
value FROM osquery_flags WHERE name = 'database_path' LIMIT 1) flags, file WHERE
|
|
||||||
path LIKE flags.value || '%%' AND type = 'regular') db WHERE p.pid = i.pid;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Retrieves all the entries in the target system /etc/hosts file.
|
|
||||||
name: etc_hosts_snapshot
|
|
||||||
query: SELECT * FROM etc_hosts;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Snapshot query to retrieve the EC2 metadata for this endpoint
|
|
||||||
name: ec2_instance_metadata_snapshot
|
|
||||||
query: SELECT * FROM ec2_instance_metadata;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
name: hardware_events
|
|
||||||
query: SELECT * FROM hardware_events;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Information about memory usage on the system
|
|
||||||
name: memory_info
|
|
||||||
query: SELECT * FROM memory_info;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Displays information from /proc/stat file about the time the CPU cores
|
|
||||||
spent in different parts of the system
|
|
||||||
name: cpu_time
|
|
||||||
query: SELECT * FROM cpu_time;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Retrieves all the entries in the target system /etc/hosts file.
|
|
||||||
name: etc_hosts
|
|
||||||
query: SELECT * FROM etc_hosts;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Retrieves information from the Operating System where osquery is currently
|
|
||||||
running.
|
|
||||||
name: os_version
|
|
||||||
query: SELECT * FROM os_version;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: A snapshot of all processes running on the host. Useful for outlier
|
|
||||||
analysis.
|
|
||||||
name: processes_snapshot
|
|
||||||
query: select name, path, cmdline, cwd, on_disk from processes;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: Retrieves the current list of USB devices in the target system.
|
|
||||||
name: usb_devices
|
|
||||||
query: SELECT * FROM usb_devices;
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: query
|
|
||||||
spec:
|
|
||||||
description: A line-delimited authorized_keys table.
|
|
||||||
name: authorized_keys
|
|
||||||
query: SELECT * FROM users JOIN authorized_keys USING (uid);
|
|
||||||
@@ -1,57 +0,0 @@
|
|||||||
apiVersion: v1
|
|
||||||
kind: options
|
|
||||||
spec:
|
|
||||||
config:
|
|
||||||
decorators:
|
|
||||||
load:
|
|
||||||
- SELECT uuid AS host_uuid FROM system_info;
|
|
||||||
- SELECT hostname AS hostname FROM system_info;
|
|
||||||
file_paths:
|
|
||||||
binaries:
|
|
||||||
- /usr/bin/%%
|
|
||||||
- /usr/sbin/%%
|
|
||||||
- /bin/%%
|
|
||||||
- /sbin/%%
|
|
||||||
- /usr/local/bin/%%
|
|
||||||
- /usr/local/sbin/%%
|
|
||||||
configuration:
|
|
||||||
- /etc/passwd
|
|
||||||
- /etc/shadow
|
|
||||||
- /etc/ld.so.conf
|
|
||||||
- /etc/ld.so.conf.d/%%
|
|
||||||
- /etc/pam.d/%%
|
|
||||||
- /etc/resolv.conf
|
|
||||||
- /etc/rc%/%%
|
|
||||||
- /etc/my.cnf
|
|
||||||
- /etc/modules
|
|
||||||
- /etc/hosts
|
|
||||||
- /etc/hostname
|
|
||||||
- /etc/fstab
|
|
||||||
- /etc/crontab
|
|
||||||
- /etc/cron%/%%
|
|
||||||
- /etc/init/%%
|
|
||||||
- /etc/rsyslog.conf
|
|
||||||
options:
|
|
||||||
audit_allow_config: true
|
|
||||||
audit_allow_sockets: true
|
|
||||||
audit_persist: true
|
|
||||||
disable_audit: false
|
|
||||||
events_expiry: 1
|
|
||||||
events_max: 500000
|
|
||||||
disable_distributed: false
|
|
||||||
disable_subscribers: user_events
|
|
||||||
distributed_interval: 10
|
|
||||||
distributed_plugin: tls
|
|
||||||
distributed_tls_max_attempts: 3
|
|
||||||
distributed_tls_read_endpoint: /api/v1/osquery/distributed/read
|
|
||||||
distributed_tls_write_endpoint: /api/v1/osquery/distributed/write
|
|
||||||
logger_min_status: 1
|
|
||||||
logger_plugin: tls
|
|
||||||
logger_snapshot_event_type: true
|
|
||||||
logger_tls_endpoint: /api/v1/osquery/log
|
|
||||||
logger_tls_period: 10
|
|
||||||
pack_delimiter: /
|
|
||||||
schedule_splay_percent: 10
|
|
||||||
watchdog_memory_limit: 350
|
|
||||||
watchdog_utilization_limit: 130
|
|
||||||
overrides: {}
|
|
||||||
@@ -1,22 +0,0 @@
|
|||||||
# License
|
|
||||||
MIT License
|
|
||||||
|
|
||||||
Copyright (c) 2017 Palantir Technologies Inc.
|
|
||||||
|
|
||||||
Permission is hereby granted, free of charge, to any person obtaining a copy
|
|
||||||
of this software and associated documentation files (the "Software"), to deal
|
|
||||||
in the Software without restriction, including without limitation the rights
|
|
||||||
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
|
||||||
copies of the Software, and to permit persons to whom the Software is
|
|
||||||
furnished to do so, subject to the following conditions:
|
|
||||||
|
|
||||||
The above copyright notice and this permission notice shall be included in all
|
|
||||||
copies or substantial portions of the Software.
|
|
||||||
|
|
||||||
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
||||||
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
||||||
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
|
||||||
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
||||||
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
||||||
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
|
||||||
SOFTWARE.
|
|
||||||
@@ -1,164 +0,0 @@
|
|||||||
# Palantir osquery Configuration
|
|
||||||
|
|
||||||
## About This Repository
|
|
||||||
This repository is the companion to the [osquery Across the Enterprise](https://medium.com/@palantir/osquery-across-the-enterprise-3c3c9d13ec55) blog post.
|
|
||||||
|
|
||||||
The goal of this project is to provide a baseline template for any organization considering a deployment of osquery in a production environment. It is
|
|
||||||
our belief that queries which are likely to have a high level of utility for a large percentage of users should be committed directly to the osquery project, which is
|
|
||||||
exactly what we have done with our [unwanted-chrome-extensions](https://github.com/facebook/osquery/pull/3889) query pack and [additions](https://github.com/facebook/osquery/pull/3922) to the windows-attacks pack.
|
|
||||||
|
|
||||||
However, we have included additional query packs
|
|
||||||
that are more tailored to our specific environment that may be useful to some or at least serve as a reference to other organizations. osquery operates best when
|
|
||||||
operators have carefully considered the datasets to be collected and the potential use-cases for that data.
|
|
||||||
* [performance-metrics.conf](https://github.com/palantir/osquery-configuration/blob/master/Endpoints/packs/performance-metrics.conf)
|
|
||||||
* [security-tooling-checks.conf](https://github.com/palantir/osquery-configuration/blob/master/Endpoints/packs/security-tooling-checks.conf)
|
|
||||||
* [windows-application-security.conf](https://github.com/palantir/osquery-configuration/blob/master/Endpoints/packs/windows-application-security.conf)
|
|
||||||
* [windows-compliance.conf](https://github.com/palantir/osquery-configuration/blob/master/Endpoints/packs/windows-compliance.conf)
|
|
||||||
* [windows-registry-monitoring.conf](https://github.com/palantir/osquery-configuration/blob/master/Endpoints/packs/windows-registry-monitoring.conf)
|
|
||||||
|
|
||||||
|
|
||||||
**Note**: We also utilize packs that are maintained in the official osquery project. In order to ensure you receive the most up to date version of the pack, please view them using the links below:
|
|
||||||
* [ossec-rootkit.conf](https://github.com/facebook/osquery/blob/master/packs/ossec-rootkit.conf)
|
|
||||||
* [osx-attacks.conf](https://github.com/facebook/osquery/blob/master/packs/osx-attacks.conf)
|
|
||||||
* [unwanted-chrome-extensions.conf](https://github.com/facebook/osquery/blob/master/packs/unwanted-chrome-extensions.conf)
|
|
||||||
* [windows-attacks.conf](https://github.com/facebook/osquery/blob/master/packs/windows-attacks.conf)
|
|
||||||
|
|
||||||
## Repository Layout
|
|
||||||
This repository is organized as follows:
|
|
||||||
* At the top level, there are two directories titled "Classic" and "Fleet"
|
|
||||||
* The [Classic](./Classic/) directory contains configuration files for a standard osquery deployment
|
|
||||||
* The [Fleet](./Fleet/) directory contains YAML files to be imported into Kolide's [Fleet](https://github.com/kolide/fleet) osquery management tool
|
|
||||||
|
|
||||||
Within each of those folders, you will find the following subdirectories:
|
|
||||||
* **Endpoints**: The contents of this folder are tailored towards monitoring MacOS and Windows endpoints that are not expected to be online at all times. You may notice the interval of many queries in this folder set to 28800. We purposely set the interval to this value because the interval timer only moves forward when a host is online and we would only expect an endpoint to be online for about 8 hours, or 28800 seconds, per day.
|
|
||||||
* **Servers**: The contents of this folder are tailored towards monitoring Linux servers. This configuration has process and network auditing enabled, so expect an exponentially higher volume of logs to be returned from the agent.
|
|
||||||
|
|
||||||
|
|
||||||
## Using This Repository
|
|
||||||
**Note**: We recommend that you spin up a lab environment before deploying any of these configurations to a production
|
|
||||||
environment.
|
|
||||||
|
|
||||||
**Endpoints Configuration Overview**
|
|
||||||
* The configurations in this folder are meant for MacOS and Windows and the interval timings assume that these hosts are only online for ~8 hours per day
|
|
||||||
* The flags included in this configuration enable TLS client mode in osquery and assume it will be connected to a TLS server. We have also included non-TLS flagfiles for local testing.
|
|
||||||
* File integrity monitoring on MacOS is enabled for specific files and directories defined in [osquery.conf](./Endpoints/MacOS/osquery.conf)
|
|
||||||
* Events are disabled on Windows via the `--disable_events` flag in [osquery.flags](./Endpoints/Windows/osquery.flags). We use [Windows Event Forwarding](https://github.com/palantir/windows-event-forwarding) and don't have a need for osquery to process Windows event logs.
|
|
||||||
* These configuration files utilize packs within the [packs](./Endpoints/packs) folder and may generate errors if started without them
|
|
||||||
|
|
||||||
**Servers Configuration Overview**
|
|
||||||
* This configuration assumes the destination operating system is Linux-based and that the hosts are online at all times
|
|
||||||
* Auditing mode is enabled for processes and network events. Ensure auditd is disabled or removed from the system where this will be running as it may conflict with osqueryd.
|
|
||||||
* File integrity monitoring is enabled for specific files and directories defined in [osquery.conf](./Servers/Linux/osquery.conf)
|
|
||||||
* Requires the [ossec-rootkit.conf](./Servers/Linux/packs/ossec-rootkit.conf) pack found to be located at `/etc/osquery/packs/ossec-rootkit.conf`
|
|
||||||
* The subscriber for `user_events` is disabled
|
|
||||||
|
|
||||||
## Quickstart - Classic
|
|
||||||
1. [Install osquery](https://osquery.io/downloads/)
|
|
||||||
2. Copy the osquery.conf and osquery.flags files from this repository onto the system and match the directory structure shown below
|
|
||||||
3. Start osquery via `sudo osqueryctl start` on Linux/MacOS or `Start-Process osqueryd` on Windows
|
|
||||||
4. Logs are located in `/var/log/osquery` (Linux/MacOS) and `c:\ProgramData\osquery\logs` (Windows)
|
|
||||||
|
|
||||||
## Quickstart - Fleet
|
|
||||||
1. Install Fleet version 2.0.0 or higher
|
|
||||||
2. [Enroll hosts to your Fleet server](https://github.com/kolide/fleet/blob/master/docs/infrastructure/adding-hosts-to-fleet.md) by configuring the appropriate [flags](https://github.com/kolide/fleet/blob/master/tools/osquery/example_osquery.flags)
|
|
||||||
2. [Configure the fleetctl utility](https://github.com/kolide/fleet/blob/master/docs/cli/setup-guide.md#fleetctl-setup) to communicate with your Fleet server
|
|
||||||
3. Assuming you'd like to use the endpoint configs, you can use the commands below to apply them:
|
|
||||||
|
|
||||||
```
|
|
||||||
git clone https://github.com/palantir/osquery-configuration.git
|
|
||||||
fleetctl apply -f osquery-configuration/Fleet/Endpoints/options.yaml
|
|
||||||
fleetctl apply -f osquery-configuration/Fleet/Endpoints/MacOS/osquery.yaml
|
|
||||||
fleetctl apply -f osquery-configuration/Fleet/Endpoints/Windows/osquery.yaml
|
|
||||||
for pack in osquery-configuration/Fleet/Endpoints/packs/*.yaml;
|
|
||||||
do fleetctl apply -f "$pack"
|
|
||||||
done
|
|
||||||
```
|
|
||||||
|
|
||||||
The desired osquery directory structure for Linux, MacOS, and Windows is outlined below:
|
|
||||||
|
|
||||||
**Linux**
|
|
||||||
```
|
|
||||||
$ git clone https://github.com/palantir/osquery-configuration.git
|
|
||||||
$ cp -R osquery-configuration/Servers/Linux/* /etc/osquery
|
|
||||||
$ sudo osqueryctl start
|
|
||||||
|
|
||||||
/etc/osquery
|
|
||||||
├── osquery.conf
|
|
||||||
├── osquery.db
|
|
||||||
├── osquery.flags
|
|
||||||
└── packs
|
|
||||||
└── ossec-rootkit.conf
|
|
||||||
|
|
||||||
```
|
|
||||||
**MacOS**
|
|
||||||
```
|
|
||||||
$ git clone https://github.com/palantir/osquery-configuration.git
|
|
||||||
$ cp osquery-configuration/Endpoints/MacOS/* /var/osquery
|
|
||||||
$ cp osquery-configuration/Endpoints/packs/* /var/osquery/packs
|
|
||||||
$ mv /var/osquery/osquery_no_tls.flags /var/osquery/osquery.flags ## Non-TLS server testing
|
|
||||||
$ sudo osqueryctl start
|
|
||||||
|
|
||||||
/var/osquery
|
|
||||||
├── certfile.crt [if using TLS endpoint]
|
|
||||||
├── osquery.conf
|
|
||||||
├── osquery.db
|
|
||||||
├── osquery.flags
|
|
||||||
└── packs
|
|
||||||
├── performance-metrics.conf
|
|
||||||
├── security-tooling-checks.conf
|
|
||||||
├── unwanted-chrome-extensions.conf
|
|
||||||
└── osx-attacks.conf
|
|
||||||
```
|
|
||||||
|
|
||||||
**Windows**
|
|
||||||
```
|
|
||||||
PS> git clone https://github.com/palantir/osquery-configuration.git
|
|
||||||
PS> copy-item osquery-configuration/Endpoints/Windows/* c:\ProgramData\osquery
|
|
||||||
PS> copy-item osquery-configuration/Endpoints/packs/* c:\ProgramData\osquery\packs
|
|
||||||
PS> copy-item c:\ProgramData\osquery\osquery_no_tls.flags c:\ProgramData\osquery\osquery.flags -force ## Non-TLS server testing
|
|
||||||
PS> start-service osqueryd
|
|
||||||
|
|
||||||
c:\ProgramData\osquery
|
|
||||||
├── certfile.crt [if using TLS endpoint]
|
|
||||||
├── log
|
|
||||||
├── osquery.conf
|
|
||||||
├── osquery.db
|
|
||||||
├── osquery.flags
|
|
||||||
├── osqueryi.exe
|
|
||||||
├─── osqueryd
|
|
||||||
| └── osqueryd.exe
|
|
||||||
└── packs
|
|
||||||
├── performance-metrics.conf
|
|
||||||
├── security-tooling-checks.conf
|
|
||||||
├── unwanted-chrome-extensions.conf
|
|
||||||
├── windows-application-security.conf
|
|
||||||
├── windows-compliance.conf
|
|
||||||
├── windows-registry-monitoring.conf
|
|
||||||
└── windows-attacks.conf
|
|
||||||
```
|
|
||||||
|
|
||||||
## Contributing
|
|
||||||
Contributions, fixes, and improvements can be submitted directly against this project as a GitHub issue or pull request.
|
|
||||||
|
|
||||||
## License
|
|
||||||
MIT License
|
|
||||||
|
|
||||||
Copyright (c) 2017 Palantir Technologies Inc.
|
|
||||||
|
|
||||||
Permission is hereby granted, free of charge, to any person obtaining a copy
|
|
||||||
of this software and associated documentation files (the "Software"), to deal
|
|
||||||
in the Software without restriction, including without limitation the rights
|
|
||||||
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
|
||||||
copies of the Software, and to permit persons to whom the Software is
|
|
||||||
furnished to do so, subject to the following conditions:
|
|
||||||
|
|
||||||
The above copyright notice and this permission notice shall be included in all
|
|
||||||
copies or substantial portions of the Software.
|
|
||||||
|
|
||||||
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
||||||
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
||||||
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
|
||||||
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
||||||
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
||||||
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
|
||||||
SOFTWARE.
|
|
||||||
@@ -1,53 +0,0 @@
|
|||||||
#!/bin/bash
|
|
||||||
|
|
||||||
#so-fleet-setup.sh $MasterIP $FleetEmail
|
|
||||||
|
|
||||||
if [ ! "$(docker ps -q -f name=so-fleet)" ]; then
|
|
||||||
echo "so-fleet container not running... Exiting..."
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
initpw=$(date +%s | sha256sum | base64 | head -c 16 ; echo)
|
|
||||||
|
|
||||||
docker exec so-fleet fleetctl config set --address https://$1:443 --tls-skip-verify --url-prefix /fleet
|
|
||||||
docker exec so-fleet fleetctl setup --email $2 --password $initpw
|
|
||||||
|
|
||||||
docker exec so-fleet fleetctl apply -f /packs/palantir/Fleet/Endpoints/options.yaml
|
|
||||||
docker exec so-fleet fleetctl apply -f /packs/palantir/Fleet/Endpoints/MacOS/osquery.yaml
|
|
||||||
docker exec so-fleet fleetctl apply -f /packs/palantir/Fleet/Endpoints/Windows/osquery.yaml
|
|
||||||
docker exec so-fleet fleetctl apply -f /packs/hh/hhdefault.yml
|
|
||||||
docker exec so-fleet /bin/sh -c 'for pack in /packs/palantir/Fleet/Endpoints/packs/*.yaml; do fleetctl apply -f "$pack"; done'
|
|
||||||
|
|
||||||
esecret=$(docker exec so-fleet fleetctl get enroll-secret)
|
|
||||||
|
|
||||||
#Concat fleet.crt & ca.crt - this is required for launcher connectivity
|
|
||||||
cat /etc/pki/fleet.crt /etc/pki/ca.crt > /etc/pki/launcher.crt
|
|
||||||
|
|
||||||
#Create the output directory
|
|
||||||
mkdir /opt/so/conf/fleet/packages
|
|
||||||
|
|
||||||
#At some point we should version launcher `latest` to avoid hard pinning here
|
|
||||||
docker run \
|
|
||||||
--rm \
|
|
||||||
--mount type=bind,source=/opt/so/conf/fleet/packages,target=/output \
|
|
||||||
--mount type=bind,source=/etc/pki/launcher.crt,target=/var/launcher/launcher.crt \
|
|
||||||
docker.io/soshybridhunter/so-fleet-launcher:HH1.1.0 "$esecret" "$1":8080
|
|
||||||
|
|
||||||
cp /opt/so/conf/fleet/packages/launcher.* /opt/so/saltstack/salt/launcher/packages/
|
|
||||||
#Update timestamp on packages webpage
|
|
||||||
sed -i "s@.*Generated.*@Generated: $(date '+%m%d%Y')@g" /opt/so/conf/fleet/packages/index.html
|
|
||||||
sed -i "s@.*Generated.*@Generated: $(date '+%m%d%Y')@g" /opt/so/saltstack/salt/fleet/osquery-packages.html
|
|
||||||
|
|
||||||
# Enable Fleet on all the other parts of the infrastructure
|
|
||||||
sed -i 's/fleetsetup: 0/fleetsetup: 1/g' /opt/so/saltstack/pillar/static.sls
|
|
||||||
|
|
||||||
# Install osquery locally
|
|
||||||
#if cat /etc/os-release | grep -q 'debian'; then
|
|
||||||
# dpkg -i /opt/so/conf/fleet/packages/launcher.deb
|
|
||||||
#else
|
|
||||||
# rpm -i /opt/so/conf/fleet/packages/launcher.rpm
|
|
||||||
#fi
|
|
||||||
echo "Installing launcher via salt"
|
|
||||||
salt-call state.apply launcher queue=True > /root/launcher.log
|
|
||||||
echo "Fleet Setup Complete - Login here: https://$1"
|
|
||||||
echo "Your username is $2 and your password is $initpw"
|
|
||||||
@@ -447,13 +447,6 @@
|
|||||||
]
|
]
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
<<<<<<<< HEAD:salt/common/grafana/grafana_dashboards/forward_nodes/sensor.json
|
|
||||||
"thresholds": "5,10",
|
|
||||||
"title": "{{ SERVERNAME }} -Zeek Packet Loss",
|
|
||||||
"type": "singlestat",
|
|
||||||
"valueFontSize": "80%",
|
|
||||||
"valueMaps": [
|
|
||||||
========
|
|
||||||
"thresholds": [],
|
"thresholds": [],
|
||||||
"timeFrom": null,
|
"timeFrom": null,
|
||||||
"timeRegions": [],
|
"timeRegions": [],
|
||||||
@@ -481,7 +474,6 @@
|
|||||||
"min": null,
|
"min": null,
|
||||||
"show": true
|
"show": true
|
||||||
},
|
},
|
||||||
>>>>>>>> dev:salt/grafana/dashboards/sensor_nodes/sensor.json
|
|
||||||
{
|
{
|
||||||
"format": "short",
|
"format": "short",
|
||||||
"label": null,
|
"label": null,
|
||||||
@@ -2068,8 +2060,6 @@
|
|||||||
}
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
<<<<<<<< HEAD:salt/common/grafana/grafana_dashboards/forward_nodes/sensor.json
|
|
||||||
========
|
|
||||||
"aliasColors": {},
|
"aliasColors": {},
|
||||||
"bars": false,
|
"bars": false,
|
||||||
"cacheTimeout": null,
|
"cacheTimeout": null,
|
||||||
@@ -2203,7 +2193,6 @@
|
|||||||
}
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
>>>>>>>> dev:salt/grafana/dashboards/sensor_nodes/sensor.json
|
|
||||||
"aliasColors": {
|
"aliasColors": {
|
||||||
"Buffered": "#6ED0E0",
|
"Buffered": "#6ED0E0",
|
||||||
"Cached": "#F9934E",
|
"Cached": "#F9934E",
|
||||||
|
|||||||
@@ -1,17 +0,0 @@
|
|||||||
# This is where can specify which LogStash configs get loaded.
|
|
||||||
#
|
|
||||||
# The custom folder on the master gets automatically synced to each logstash
|
|
||||||
# node.
|
|
||||||
#
|
|
||||||
# To enable a custom configuration see the following example and uncomment:
|
|
||||||
# /usr/share/logstash/pipeline.custom/1234_input_custom.conf
|
|
||||||
##
|
|
||||||
# All of the defaults are loaded.
|
|
||||||
/usr/share/logstash/pipeline.so/0000_input_syslogng.conf
|
|
||||||
/usr/share/logstash/pipeline.so/0001_input_json.conf
|
|
||||||
/usr/share/logstash/pipeline.so/0002_input_windows_json.conf
|
|
||||||
/usr/share/logstash/pipeline.so/0003_input_syslog.conf
|
|
||||||
/usr/share/logstash/pipeline.so/0005_input_suricata.conf
|
|
||||||
/usr/share/logstash/pipeline.so/0006_input_beats.conf
|
|
||||||
/usr/share/logstash/pipeline.so/0007_input_import.conf
|
|
||||||
/usr/share/logstash/pipeline.dynamic/9999_output_redis.conf
|
|
||||||
@@ -1,17 +0,0 @@
|
|||||||
# This is where can specify which LogStash configs get loaded.
|
|
||||||
#
|
|
||||||
# The custom folder on the master gets automatically synced to each logstash
|
|
||||||
# node.
|
|
||||||
#
|
|
||||||
# To enable a custom configuration see the following example and uncomment:
|
|
||||||
# /usr/share/logstash/pipeline.custom/1234_input_custom.conf
|
|
||||||
##
|
|
||||||
# All of the defaults are loaded.
|
|
||||||
/usr/share/logstash/pipeline.so/0000_input_syslogng.conf
|
|
||||||
/usr/share/logstash/pipeline.so/0001_input_json.conf
|
|
||||||
/usr/share/logstash/pipeline.so/0002_input_windows_json.conf
|
|
||||||
/usr/share/logstash/pipeline.so/0003_input_syslog.conf
|
|
||||||
/usr/share/logstash/pipeline.so/0005_input_suricata.conf
|
|
||||||
/usr/share/logstash/pipeline.so/0006_input_beats.conf
|
|
||||||
/usr/share/logstash/pipeline.so/0007_input_import.conf
|
|
||||||
/usr/share/logstash/pipeline.dynamic/9999_output_redis.conf
|
|
||||||
@@ -1,85 +0,0 @@
|
|||||||
# This is where can specify which LogStash configs get loaded.
|
|
||||||
#
|
|
||||||
# The custom folder on the master gets automatically synced to each logstash
|
|
||||||
# node.
|
|
||||||
#
|
|
||||||
# To enable a custom configuration see the following example and uncomment:
|
|
||||||
# /usr/share/logstash/pipeline.custom/1234_input_custom.conf
|
|
||||||
##
|
|
||||||
# All of the defaults are loaded.
|
|
||||||
# Please note that Bro config is commented out because we're moving that parsing to Elasticsearch ingest.
|
|
||||||
/usr/share/logstash/pipeline.dynamic/0900_input_redis.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1000_preprocess_log_elapsed.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1001_preprocess_syslogng.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1002_preprocess_json.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1003_preprocess_bro.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1004_preprocess_syslog_types.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1026_preprocess_dhcp.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1029_preprocess_esxi.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1030_preprocess_greensql.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1031_preprocess_iis.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1032_preprocess_mcafee.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1033_preprocess_snort.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1034_preprocess_syslog.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1100_preprocess_bro_conn.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1101_preprocess_bro_dhcp.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1102_preprocess_bro_dns.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1103_preprocess_bro_dpd.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1104_preprocess_bro_files.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1105_preprocess_bro_ftp.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1106_preprocess_bro_http.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1107_preprocess_bro_irc.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1108_preprocess_bro_kerberos.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1109_preprocess_bro_notice.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1110_preprocess_bro_rdp.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1111_preprocess_bro_signatures.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1112_preprocess_bro_smtp.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1113_preprocess_bro_snmp.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1114_preprocess_bro_software.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1115_preprocess_bro_ssh.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1116_preprocess_bro_ssl.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1117_preprocess_bro_syslog.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1118_preprocess_bro_tunnel.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1119_preprocess_bro_weird.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1121_preprocess_bro_mysql.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1122_preprocess_bro_socks.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1123_preprocess_bro_x509.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1124_preprocess_bro_intel.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1125_preprocess_bro_modbus.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1126_preprocess_bro_sip.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1127_preprocess_bro_radius.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1128_preprocess_bro_pe.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1129_preprocess_bro_rfb.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1130_preprocess_bro_dnp3.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1131_preprocess_bro_smb_files.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1132_preprocess_bro_smb_mapping.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1133_preprocess_bro_ntlm.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1134_preprocess_bro_dce_rpc.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1998_test_data.conf
|
|
||||||
/usr/share/logstash/pipeline.so/2000_network_flow.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/6000_bro.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/6001_bro_import.conf
|
|
||||||
/usr/share/logstash/pipeline.so/6002_syslog.conf
|
|
||||||
/usr/share/logstash/pipeline.so/6101_switch_brocade.conf
|
|
||||||
/usr/share/logstash/pipeline.so/6200_firewall_fortinet.conf
|
|
||||||
/usr/share/logstash/pipeline.so/6201_firewall_pfsense.conf
|
|
||||||
/usr/share/logstash/pipeline.so/6300_windows.conf
|
|
||||||
/usr/share/logstash/pipeline.so/6301_dns_windows.conf
|
|
||||||
/usr/share/logstash/pipeline.so/6400_suricata.conf
|
|
||||||
/usr/share/logstash/pipeline.so/6500_ossec.conf
|
|
||||||
/usr/share/logstash/pipeline.so/6501_ossec_sysmon.conf
|
|
||||||
/usr/share/logstash/pipeline.so/6502_ossec_autoruns.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/8000_postprocess_bro_cleanup.conf
|
|
||||||
/usr/share/logstash/pipeline.so/8001_postprocess_common_ip_augmentation.conf
|
|
||||||
/usr/share/logstash/pipeline.so/8006_postprocess_dns.conf
|
|
||||||
/usr/share/logstash/pipeline.so/8007_postprocess_dns_top1m_tagging.conf
|
|
||||||
/usr/share/logstash/pipeline.so/8007_postprocess_http.conf
|
|
||||||
/usr/share/logstash/pipeline.so/8008_postprocess_dns_whois_age.conf
|
|
||||||
/usr/share/logstash/pipeline.so/8200_postprocess_tagging.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/8502_postprocess_freq_analysis_bro_dns.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/8503_postprocess_freq_analysis_bro_http.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/8504_postprocess_freq_analysis_bro_ssl.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/8505_postprocess_freq_analysis_bro_x509.conf
|
|
||||||
/usr/share/logstash/pipeline.so/8998_postprocess_log_elapsed.conf
|
|
||||||
/usr/share/logstash/pipeline.so/8999_postprocess_rename_type.conf
|
|
||||||
/usr/share/logstash/pipeline.dynamic/9999_output_redis.conf
|
|
||||||
@@ -1,106 +0,0 @@
|
|||||||
# This is where can specify which LogStash configs get loaded.
|
|
||||||
#
|
|
||||||
# The custom folder on the master gets automatically synced to each logstash
|
|
||||||
# node.
|
|
||||||
#
|
|
||||||
# To enable a custom configuration see the following example and uncomment:
|
|
||||||
# /usr/share/logstash/pipeline.custom/1234_input_custom.conf
|
|
||||||
##
|
|
||||||
# All of the defaults are loaded.
|
|
||||||
# Please note that Bro config is commented out because we're moving that parsing to Elasticsearch ingest.
|
|
||||||
/usr/share/logstash/pipeline.dynamic/0900_input_redis.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1000_preprocess_log_elapsed.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1001_preprocess_syslogng.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1002_preprocess_json.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1003_preprocess_bro.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1004_preprocess_syslog_types.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1026_preprocess_dhcp.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1029_preprocess_esxi.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1030_preprocess_greensql.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1031_preprocess_iis.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1032_preprocess_mcafee.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1033_preprocess_snort.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1034_preprocess_syslog.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1100_preprocess_bro_conn.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1101_preprocess_bro_dhcp.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1102_preprocess_bro_dns.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1103_preprocess_bro_dpd.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1104_preprocess_bro_files.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1105_preprocess_bro_ftp.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1106_preprocess_bro_http.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1107_preprocess_bro_irc.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1108_preprocess_bro_kerberos.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1109_preprocess_bro_notice.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1110_preprocess_bro_rdp.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1111_preprocess_bro_signatures.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1112_preprocess_bro_smtp.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1113_preprocess_bro_snmp.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1114_preprocess_bro_software.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1115_preprocess_bro_ssh.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1116_preprocess_bro_ssl.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1117_preprocess_bro_syslog.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1118_preprocess_bro_tunnel.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1119_preprocess_bro_weird.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1121_preprocess_bro_mysql.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1122_preprocess_bro_socks.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1123_preprocess_bro_x509.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1124_preprocess_bro_intel.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1125_preprocess_bro_modbus.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1126_preprocess_bro_sip.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1127_preprocess_bro_radius.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1128_preprocess_bro_pe.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1129_preprocess_bro_rfb.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1130_preprocess_bro_dnp3.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1131_preprocess_bro_smb_files.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1132_preprocess_bro_smb_mapping.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1133_preprocess_bro_ntlm.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1134_preprocess_bro_dce_rpc.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1998_test_data.conf
|
|
||||||
/usr/share/logstash/pipeline.so/2000_network_flow.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/6000_bro.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/6001_bro_import.conf
|
|
||||||
/usr/share/logstash/pipeline.so/6002_syslog.conf
|
|
||||||
/usr/share/logstash/pipeline.so/6101_switch_brocade.conf
|
|
||||||
/usr/share/logstash/pipeline.so/6200_firewall_fortinet.conf
|
|
||||||
/usr/share/logstash/pipeline.so/6201_firewall_pfsense.conf
|
|
||||||
/usr/share/logstash/pipeline.so/6300_windows.conf
|
|
||||||
/usr/share/logstash/pipeline.so/6301_dns_windows.conf
|
|
||||||
/usr/share/logstash/pipeline.so/6400_suricata.conf
|
|
||||||
/usr/share/logstash/pipeline.so/6500_ossec.conf
|
|
||||||
/usr/share/logstash/pipeline.so/6501_ossec_sysmon.conf
|
|
||||||
/usr/share/logstash/pipeline.so/6502_ossec_autoruns.conf
|
|
||||||
/usr/share/logstash/pipeline.so/6600_winlogbeat_sysmon.conf
|
|
||||||
/usr/share/logstash/pipeline.so/6700_winlogbeat.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/8000_postprocess_bro_cleanup.conf
|
|
||||||
/usr/share/logstash/pipeline.so/8001_postprocess_common_ip_augmentation.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/8006_postprocess_dns.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/8007_postprocess_dns_top1m_tagging.conf
|
|
||||||
/usr/share/logstash/pipeline.so/8007_postprocess_http.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/8008_postprocess_dns_whois_age.conf
|
|
||||||
/usr/share/logstash/pipeline.so/8200_postprocess_tagging.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/8502_postprocess_freq_analysis_bro_dns.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/8503_postprocess_freq_analysis_bro_http.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/8504_postprocess_freq_analysis_bro_ssl.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/8505_postprocess_freq_analysis_bro_x509.conf
|
|
||||||
/usr/share/logstash/pipeline.so/8998_postprocess_log_elapsed.conf
|
|
||||||
/usr/share/logstash/pipeline.so/8999_postprocess_rename_type.conf
|
|
||||||
/usr/share/logstash/pipeline.dynamic/9000_output_bro.conf
|
|
||||||
/usr/share/logstash/pipeline.dynamic/9001_output_switch.conf
|
|
||||||
/usr/share/logstash/pipeline.dynamic/9002_output_import.conf
|
|
||||||
/usr/share/logstash/pipeline.dynamic/9004_output_flow.conf
|
|
||||||
/usr/share/logstash/pipeline.dynamic/9026_output_dhcp.conf
|
|
||||||
/usr/share/logstash/pipeline.dynamic/9029_output_esxi.conf
|
|
||||||
/usr/share/logstash/pipeline.dynamic/9030_output_greensql.conf
|
|
||||||
/usr/share/logstash/pipeline.dynamic/9031_output_iis.conf
|
|
||||||
/usr/share/logstash/pipeline.dynamic/9032_output_mcafee.conf
|
|
||||||
/usr/share/logstash/pipeline.dynamic/9033_output_snort.conf
|
|
||||||
/usr/share/logstash/pipeline.dynamic/9034_output_syslog.conf
|
|
||||||
/usr/share/logstash/pipeline.dynamic/9200_output_firewall.conf
|
|
||||||
/usr/share/logstash/pipeline.dynamic/9300_output_windows.conf
|
|
||||||
/usr/share/logstash/pipeline.dynamic/9301_output_dns_windows.conf
|
|
||||||
/usr/share/logstash/pipeline.dynamic/9400_output_suricata.conf
|
|
||||||
/usr/share/logstash/pipeline.dynamic/9500_output_beats.conf
|
|
||||||
/usr/share/logstash/pipeline.dynamic/9600_output_ossec.conf
|
|
||||||
/usr/share/logstash/pipeline.dynamic/9998_output_test_data.conf
|
|
||||||
/usr/share/logstash/pipeline.dynamic/7100_osquery_wel.conf
|
|
||||||
/usr/share/logstash/pipeline.dynamic/9100_output_osquery.conf
|
|
||||||
@@ -1,113 +0,0 @@
|
|||||||
# This is where can specify which LogStash configs get loaded.
|
|
||||||
#
|
|
||||||
# The custom folder on the master gets automatically synced to each logstash
|
|
||||||
# node.
|
|
||||||
#
|
|
||||||
# To enable a custom configuration see the following example and uncomment:
|
|
||||||
# /usr/share/logstash/pipeline.custom/1234_input_custom.conf
|
|
||||||
##
|
|
||||||
# All of the defaults are loaded.
|
|
||||||
# Please note that Bro config is commented out because we're moving that parsing to Elasticsearch ingest.
|
|
||||||
#/usr/share/logstash/pipeline.so/0000_input_syslogng.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/0001_input_json.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/0002_input_windows_json.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/0003_input_syslog.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/0005_input_suricata.conf
|
|
||||||
#/usr/share/logstash/pipeline.dynamic/0006_input_beats.conf
|
|
||||||
/usr/share/logstash/pipeline.so/0007_input_import.conf
|
|
||||||
/usr/share/logstash/pipeline.dynamic/0010_input_hhbeats.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1000_preprocess_log_elapsed.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1001_preprocess_syslogng.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1002_preprocess_json.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1003_preprocess_bro.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1004_preprocess_syslog_types.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1026_preprocess_dhcp.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1029_preprocess_esxi.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1030_preprocess_greensql.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1031_preprocess_iis.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1032_preprocess_mcafee.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1033_preprocess_snort.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1034_preprocess_syslog.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1100_preprocess_bro_conn.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1101_preprocess_bro_dhcp.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1102_preprocess_bro_dns.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1103_preprocess_bro_dpd.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1104_preprocess_bro_files.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1105_preprocess_bro_ftp.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1106_preprocess_bro_http.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1107_preprocess_bro_irc.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1108_preprocess_bro_kerberos.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1109_preprocess_bro_notice.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1110_preprocess_bro_rdp.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1111_preprocess_bro_signatures.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1112_preprocess_bro_smtp.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1113_preprocess_bro_snmp.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1114_preprocess_bro_software.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1115_preprocess_bro_ssh.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1116_preprocess_bro_ssl.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1117_preprocess_bro_syslog.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1118_preprocess_bro_tunnel.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1119_preprocess_bro_weird.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1121_preprocess_bro_mysql.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1122_preprocess_bro_socks.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1123_preprocess_bro_x509.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1124_preprocess_bro_intel.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1125_preprocess_bro_modbus.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1126_preprocess_bro_sip.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1127_preprocess_bro_radius.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1128_preprocess_bro_pe.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1129_preprocess_bro_rfb.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1130_preprocess_bro_dnp3.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1131_preprocess_bro_smb_files.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1132_preprocess_bro_smb_mapping.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1133_preprocess_bro_ntlm.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1134_preprocess_bro_dce_rpc.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/1998_test_data.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/2000_network_flow.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/6000_bro.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/6001_bro_import.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/6002_syslog.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/6101_switch_brocade.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/6200_firewall_fortinet.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/6201_firewall_pfsense.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/6300_windows.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/6301_dns_windows.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/6400_suricata.conf
|
|
||||||
/usr/share/logstash/pipeline.so/6500_ossec.conf
|
|
||||||
/usr/share/logstash/pipeline.so/6501_ossec_sysmon.conf
|
|
||||||
/usr/share/logstash/pipeline.so/6502_ossec_autoruns.conf
|
|
||||||
/usr/share/logstash/pipeline.so/6600_winlogbeat_sysmon.conf
|
|
||||||
/usr/share/logstash/pipeline.so/6700_winlogbeat.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/8000_postprocess_bro_cleanup.conf
|
|
||||||
/usr/share/logstash/pipeline.so/8001_postprocess_common_ip_augmentation.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/8006_postprocess_dns.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/8007_postprocess_dns_top1m_tagging.conf
|
|
||||||
/usr/share/logstash/pipeline.so/8007_postprocess_http.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/8008_postprocess_dns_whois_age.conf
|
|
||||||
/usr/share/logstash/pipeline.so/8200_postprocess_tagging.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/8502_postprocess_freq_analysis_bro_dns.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/8503_postprocess_freq_analysis_bro_http.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/8504_postprocess_freq_analysis_bro_ssl.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/8505_postprocess_freq_analysis_bro_x509.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/8998_postprocess_log_elapsed.conf
|
|
||||||
/usr/share/logstash/pipeline.so/8999_postprocess_rename_type.conf
|
|
||||||
/usr/share/logstash/pipeline.dynamic/9000_output_bro.conf
|
|
||||||
#/usr/share/logstash/pipeline.dynamic/9001_output_switch.conf
|
|
||||||
/usr/share/logstash/pipeline.dynamic/9002_output_import.conf
|
|
||||||
#/usr/share/logstash/pipeline.dynamic/9004_output_flow.conf
|
|
||||||
#/usr/share/logstash/pipeline.dynamic/9026_output_dhcp.conf
|
|
||||||
#/usr/share/logstash/pipeline.dynamic/9029_output_esxi.conf
|
|
||||||
#/usr/share/logstash/pipeline.dynamic/9030_output_greensql.conf
|
|
||||||
#/usr/share/logstash/pipeline.dynamic/9031_output_iis.conf
|
|
||||||
#/usr/share/logstash/pipeline.dynamic/9032_output_mcafee.conf
|
|
||||||
/usr/share/logstash/pipeline.dynamic/9033_output_snort.conf
|
|
||||||
#/usr/share/logstash/pipeline.dynamic/9034_output_syslog.conf
|
|
||||||
#/usr/share/logstash/pipeline.dynamic/9200_output_firewall.conf
|
|
||||||
#/usr/share/logstash/pipeline.dynamic/9300_output_windows.conf
|
|
||||||
#/usr/share/logstash/pipeline.dynamic/9301_output_dns_windows.conf
|
|
||||||
/usr/share/logstash/pipeline.dynamic/9400_output_suricata.conf
|
|
||||||
/usr/share/logstash/pipeline.dynamic/9500_output_beats.conf
|
|
||||||
/usr/share/logstash/pipeline.dynamic/9600_output_ossec.conf
|
|
||||||
#/usr/share/logstash/pipeline.dynamic/9998_output_test_data.conf
|
|
||||||
/usr/share/logstash/pipeline.dynamic/7100_osquery_wel.conf
|
|
||||||
/usr/share/logstash/pipeline.dynamic/9100_output_osquery.conf
|
|
||||||
@@ -1,109 +0,0 @@
|
|||||||
# This is where can specify which LogStash configs get loaded.
|
|
||||||
#
|
|
||||||
# The custom folder on the master gets automatically synced to each logstash
|
|
||||||
# node.
|
|
||||||
#
|
|
||||||
# To enable a custom configuration see the following example and uncomment:
|
|
||||||
# /usr/share/logstash/pipeline.custom/1234_input_custom.conf
|
|
||||||
##
|
|
||||||
# All of the defaults are loaded.
|
|
||||||
/usr/share/logstash/pipeline.so/0000_input_syslogng.conf
|
|
||||||
/usr/share/logstash/pipeline.so/0001_input_json.conf
|
|
||||||
/usr/share/logstash/pipeline.so/0002_input_windows_json.conf
|
|
||||||
/usr/share/logstash/pipeline.so/0003_input_syslog.conf
|
|
||||||
/usr/share/logstash/pipeline.so/0005_input_suricata.conf
|
|
||||||
/usr/share/logstash/pipeline.so/0007_input_import.conf
|
|
||||||
/usr/share/logstash/pipeline.so/0008_input_eval.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1000_preprocess_log_elapsed.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1001_preprocess_syslogng.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1002_preprocess_json.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1003_preprocess_bro.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1004_preprocess_syslog_types.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1026_preprocess_dhcp.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1029_preprocess_esxi.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1030_preprocess_greensql.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1031_preprocess_iis.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1032_preprocess_mcafee.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1033_preprocess_snort.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1034_preprocess_syslog.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1100_preprocess_bro_conn.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1101_preprocess_bro_dhcp.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1102_preprocess_bro_dns.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1103_preprocess_bro_dpd.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1104_preprocess_bro_files.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1105_preprocess_bro_ftp.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1106_preprocess_bro_http.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1107_preprocess_bro_irc.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1108_preprocess_bro_kerberos.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1109_preprocess_bro_notice.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1110_preprocess_bro_rdp.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1111_preprocess_bro_signatures.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1112_preprocess_bro_smtp.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1113_preprocess_bro_snmp.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1114_preprocess_bro_software.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1115_preprocess_bro_ssh.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1116_preprocess_bro_ssl.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1117_preprocess_bro_syslog.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1118_preprocess_bro_tunnel.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1119_preprocess_bro_weird.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1121_preprocess_bro_mysql.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1122_preprocess_bro_socks.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1123_preprocess_bro_x509.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1124_preprocess_bro_intel.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1125_preprocess_bro_modbus.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1126_preprocess_bro_sip.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1127_preprocess_bro_radius.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1128_preprocess_bro_pe.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1129_preprocess_bro_rfb.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1130_preprocess_bro_dnp3.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1131_preprocess_bro_smb_files.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1132_preprocess_bro_smb_mapping.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1133_preprocess_bro_ntlm.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1134_preprocess_bro_dce_rpc.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1998_test_data.conf
|
|
||||||
/usr/share/logstash/pipeline.so/2000_network_flow.conf
|
|
||||||
/usr/share/logstash/pipeline.so/6000_bro.conf
|
|
||||||
/usr/share/logstash/pipeline.so/6001_bro_import.conf
|
|
||||||
/usr/share/logstash/pipeline.so/6002_syslog.conf
|
|
||||||
/usr/share/logstash/pipeline.so/6101_switch_brocade.conf
|
|
||||||
/usr/share/logstash/pipeline.so/6200_firewall_fortinet.conf
|
|
||||||
/usr/share/logstash/pipeline.so/6201_firewall_pfsense.conf
|
|
||||||
/usr/share/logstash/pipeline.so/6300_windows.conf
|
|
||||||
/usr/share/logstash/pipeline.so/6301_dns_windows.conf
|
|
||||||
/usr/share/logstash/pipeline.so/6400_suricata.conf
|
|
||||||
/usr/share/logstash/pipeline.so/6500_ossec.conf
|
|
||||||
/usr/share/logstash/pipeline.so/6501_ossec_sysmon.conf
|
|
||||||
/usr/share/logstash/pipeline.so/6502_ossec_autoruns.conf
|
|
||||||
/usr/share/logstash/pipeline.so/6600_winlogbeat_sysmon.conf
|
|
||||||
/usr/share/logstash/pipeline.so/6700_winlogbeat.conf
|
|
||||||
/usr/share/logstash/pipeline.so/8000_postprocess_bro_cleanup.conf
|
|
||||||
/usr/share/logstash/pipeline.so/8001_postprocess_common_ip_augmentation.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/8006_postprocess_dns.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/8007_postprocess_dns_top1m_tagging.conf
|
|
||||||
/usr/share/logstash/pipeline.so/8007_postprocess_http.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/8008_postprocess_dns_whois_age.conf
|
|
||||||
/usr/share/logstash/pipeline.so/8200_postprocess_tagging.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/8502_postprocess_freq_analysis_bro_dns.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/8503_postprocess_freq_analysis_bro_http.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/8504_postprocess_freq_analysis_bro_ssl.conf
|
|
||||||
#/usr/share/logstash/pipeline.so/8505_postprocess_freq_analysis_bro_x509.conf
|
|
||||||
/usr/share/logstash/pipeline.so/8998_postprocess_log_elapsed.conf
|
|
||||||
/usr/share/logstash/pipeline.so/8999_postprocess_rename_type.conf
|
|
||||||
/usr/share/logstash/pipeline.dynamic/9000_output_bro.conf
|
|
||||||
/usr/share/logstash/pipeline.dynamic/9001_output_switch.conf
|
|
||||||
/usr/share/logstash/pipeline.dynamic/9002_output_import.conf
|
|
||||||
/usr/share/logstash/pipeline.dynamic/9004_output_flow.conf
|
|
||||||
/usr/share/logstash/pipeline.dynamic/9026_output_dhcp.conf
|
|
||||||
/usr/share/logstash/pipeline.dynamic/9029_output_esxi.conf
|
|
||||||
/usr/share/logstash/pipeline.dynamic/9030_output_greensql.conf
|
|
||||||
/usr/share/logstash/pipeline.dynamic/9031_output_iis.conf
|
|
||||||
/usr/share/logstash/pipeline.dynamic/9032_output_mcafee.conf
|
|
||||||
/usr/share/logstash/pipeline.dynamic/9033_output_snort.conf
|
|
||||||
/usr/share/logstash/pipeline.dynamic/9034_output_syslog.conf
|
|
||||||
/usr/share/logstash/pipeline.dynamic/9200_output_firewall.conf
|
|
||||||
/usr/share/logstash/pipeline.dynamic/9300_output_windows.conf
|
|
||||||
/usr/share/logstash/pipeline.dynamic/9301_output_dns_windows.conf
|
|
||||||
/usr/share/logstash/pipeline.dynamic/9400_output_suricata.conf
|
|
||||||
/usr/share/logstash/pipeline.dynamic/9500_output_beats.conf
|
|
||||||
/usr/share/logstash/pipeline.dynamic/9600_output_ossec.conf
|
|
||||||
/usr/share/logstash/pipeline.dynamic/9998_output_test_data.conf
|
|
||||||
@@ -1,47 +0,0 @@
|
|||||||
# This is where can specify which LogStash configs get loaded.
|
|
||||||
#
|
|
||||||
# The custom folder on the master gets automatically synced to each logstash
|
|
||||||
# node.
|
|
||||||
#
|
|
||||||
# To enable a custom configuration see the following example and uncomment:
|
|
||||||
# /usr/share/logstash/pipeline.custom/1234_input_custom.conf
|
|
||||||
##
|
|
||||||
# All of the defaults are loaded.
|
|
||||||
/usr/share/logstash/pipeline.dynamic/0010_input_hhbeats.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1033_preprocess_snort.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1100_preprocess_bro_conn.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1101_preprocess_bro_dhcp.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1102_preprocess_bro_dns.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1103_preprocess_bro_dpd.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1104_preprocess_bro_files.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1105_preprocess_bro_ftp.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1106_preprocess_bro_http.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1107_preprocess_bro_irc.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1108_preprocess_bro_kerberos.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1109_preprocess_bro_notice.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1110_preprocess_bro_rdp.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1111_preprocess_bro_signatures.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1112_preprocess_bro_smtp.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1113_preprocess_bro_snmp.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1114_preprocess_bro_software.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1115_preprocess_bro_ssh.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1116_preprocess_bro_ssl.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1117_preprocess_bro_syslog.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1118_preprocess_bro_tunnel.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1119_preprocess_bro_weird.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1121_preprocess_bro_mysql.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1122_preprocess_bro_socks.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1123_preprocess_bro_x509.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1124_preprocess_bro_intel.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1125_preprocess_bro_modbus.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1126_preprocess_bro_sip.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1127_preprocess_bro_radius.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1128_preprocess_bro_pe.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1129_preprocess_bro_rfb.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1130_preprocess_bro_dnp3.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1131_preprocess_bro_smb_files.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1132_preprocess_bro_smb_mapping.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1133_preprocess_bro_ntlm.conf
|
|
||||||
/usr/share/logstash/pipeline.so/1134_preprocess_bro_dce_rpc.conf
|
|
||||||
/usr/share/logstash/pipeline.so/8001_postprocess_common_ip_augmentation.conf
|
|
||||||
/usr/share/logstash/pipeline.dynamic/9997_output_helix.conf
|
|
||||||
@@ -1,18 +0,0 @@
|
|||||||
# This is where can specify which LogStash configs get loaded.
|
|
||||||
#
|
|
||||||
# The custom folder on the master gets automatically synced to each logstash
|
|
||||||
# node.
|
|
||||||
#
|
|
||||||
# To enable a custom configuration see the following example and uncomment:
|
|
||||||
# /usr/share/logstash/pipeline.custom/1234_input_custom.conf
|
|
||||||
##
|
|
||||||
# All of the defaults are loaded.
|
|
||||||
/usr/share/logstash/pipeline.so/0000_input_syslogng.conf
|
|
||||||
/usr/share/logstash/pipeline.so/0001_input_json.conf
|
|
||||||
/usr/share/logstash/pipeline.so/0002_input_windows_json.conf
|
|
||||||
/usr/share/logstash/pipeline.so/0003_input_syslog.conf
|
|
||||||
/usr/share/logstash/pipeline.so/0005_input_suricata.conf
|
|
||||||
#/usr/share/logstash/pipeline.dynamic/0006_input_beats.conf
|
|
||||||
/usr/share/logstash/pipeline.dynamic/0010_input_hhbeats.conf
|
|
||||||
/usr/share/logstash/pipeline.so/0007_input_import.conf
|
|
||||||
/usr/share/logstash/pipeline.dynamic/9999_output_redis.conf
|
|
||||||
@@ -1,18 +0,0 @@
|
|||||||
# This is where can specify which LogStash configs get loaded.
|
|
||||||
#
|
|
||||||
# The custom folder on the master gets automatically synced to each logstash
|
|
||||||
# node.
|
|
||||||
#
|
|
||||||
# To enable a custom configuration see the following example and uncomment:
|
|
||||||
# /usr/share/logstash/pipeline.custom/1234_input_custom.conf
|
|
||||||
##
|
|
||||||
# All of the defaults are loaded.
|
|
||||||
/usr/share/logstash/pipeline.so/0000_input_syslogng.conf
|
|
||||||
/usr/share/logstash/pipeline.so/0001_input_json.conf
|
|
||||||
/usr/share/logstash/pipeline.so/0002_input_windows_json.conf
|
|
||||||
/usr/share/logstash/pipeline.so/0003_input_syslog.conf
|
|
||||||
/usr/share/logstash/pipeline.so/0005_input_suricata.conf
|
|
||||||
#/usr/share/logstash/pipeline.dynamic/0006_input_beats.conf
|
|
||||||
/usr/share/logstash/pipeline.dynamic/0010_input_hhbeats.conf
|
|
||||||
/usr/share/logstash/pipeline.so/0007_input_import.conf
|
|
||||||
/usr/share/logstash/pipeline.dynamic/9999_output_redis.conf
|
|
||||||
@@ -1,228 +0,0 @@
|
|||||||
# Original Author: Justin Henderson
|
|
||||||
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
|
|
||||||
# Updated by: Doug Burks
|
|
||||||
# Last Update: 2/10/2018
|
|
||||||
#
|
|
||||||
filter {
|
|
||||||
if "bro" in [tags] {
|
|
||||||
|
|
||||||
# Bro logs have a high quality timestamp, so let's copy that to @timestamp.
|
|
||||||
# Before we do, let's copy the existing logstash @timestamp to timestamp.
|
|
||||||
mutate {
|
|
||||||
add_field => { "logstash_timestamp" => "%{@timestamp}" }
|
|
||||||
}
|
|
||||||
mutate {
|
|
||||||
convert => { "logstash_timestamp" => "string" }
|
|
||||||
}
|
|
||||||
mutate {
|
|
||||||
convert => { "timestamp" => "string" }
|
|
||||||
}
|
|
||||||
# New Bro JSON logs use ISO8601 timestamps.
|
|
||||||
# Old Bro TSV logs use UNIX timestamps.
|
|
||||||
date {
|
|
||||||
match => [ "timestamp", "ISO8601", "UNIX" ]
|
|
||||||
}
|
|
||||||
mutate {
|
|
||||||
rename => { "logstash_timestamp" => "timestamp" }
|
|
||||||
}
|
|
||||||
|
|
||||||
if [duration] == "-" {
|
|
||||||
mutate {
|
|
||||||
replace => [ "duration", "0" ]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [original_bytes] == "-" {
|
|
||||||
mutate {
|
|
||||||
replace => [ "original_bytes", "0" ]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
# If MissedBytes is unspecified set it to zero so it is an integer
|
|
||||||
if [missed_bytes] == "-" {
|
|
||||||
mutate {
|
|
||||||
replace => [ "missed_bytes", "0" ]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
# If OriginalIPBytes is unspecified set it to zero so it is an integer
|
|
||||||
if [original_ip_bytes] == "-" {
|
|
||||||
mutate {
|
|
||||||
replace => [ "original_ip_bytes", "0" ]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
# If RespondBytes is unspecified set it to zero so it is an integer
|
|
||||||
if [respond_bytes] == "-" {
|
|
||||||
mutate {
|
|
||||||
replace => [ "respond_bytes", "0" ]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
# If RespondIPBytes is unspecified set it to zero so it is an integer
|
|
||||||
if [respond_ip_bytes] == "-" {
|
|
||||||
mutate {
|
|
||||||
replace => [ "respond_ip_bytes", "0" ]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [request_body_length] == "-" {
|
|
||||||
mutate {
|
|
||||||
replace => [ "request_body_length", "0" ]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [response_body_length] == "-" {
|
|
||||||
mutate {
|
|
||||||
replace => [ "response_body_length", "0" ]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [source_port] == "-" {
|
|
||||||
mutate {
|
|
||||||
remove_field => ["source_port"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [destination_port] == "-" {
|
|
||||||
mutate {
|
|
||||||
remove_field => ["destination_port"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [virtual_host] == "-" {
|
|
||||||
mutate {
|
|
||||||
remove_field => ["virtual_host"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [x_originating_ip] == "-" {
|
|
||||||
mutate {
|
|
||||||
remove_field => ["x_originating_ip"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [basic_constraints_path_length] == "-" {
|
|
||||||
mutate {
|
|
||||||
remove_field => ["basic_constraints_path_length"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [data_channel_source_ip] == "-" {
|
|
||||||
mutate {
|
|
||||||
remove_field => ["data_channel_source_ip"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [data_channel_destination_ip] == "-" {
|
|
||||||
mutate {
|
|
||||||
remove_field => ["data_channel_destination_ip"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [desktop_width] == "-" {
|
|
||||||
mutate {
|
|
||||||
remove_field => ["desktop_width"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [desktop_height] == "-" {
|
|
||||||
mutate {
|
|
||||||
remove_field => ["desktop_height"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [height] == "-" {
|
|
||||||
mutate {
|
|
||||||
remove_field => ["height"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
|
|
||||||
# I renamed conn_uids to uid so that it is easy to pivot to all things tied to a connection
|
|
||||||
mutate {
|
|
||||||
rename => [ "connection_uids", "uid" ]
|
|
||||||
}
|
|
||||||
# If total_bytes is set to "-" change it to 0 so it is an integer
|
|
||||||
if [total_bytes] == "-" {
|
|
||||||
mutate {
|
|
||||||
replace => [ "total_bytes", "0" ]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
# If seen_bytes is set to "-" change it to 0 so it is an integer
|
|
||||||
if [seen_bytes] == "-" {
|
|
||||||
mutate {
|
|
||||||
replace => [ "seen_bytes", "0" ]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
# If missing_bytes is set to "-" change it to 0 so it is an integer
|
|
||||||
if [missing_bytes] == "-" {
|
|
||||||
mutate {
|
|
||||||
replace => [ "missing_bytes", "0" ]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
# If overflow_bytes is set to "-" change it to 0 so it is an integer
|
|
||||||
if [overflow_bytes] == "-" {
|
|
||||||
mutate {
|
|
||||||
replace => [ "overflow_bytes", "0" ]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [dcc_file_size] == "-" {
|
|
||||||
mutate {
|
|
||||||
replace => [ "dcc_file_size", "0" ]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [authentication_attempts] == "-" {
|
|
||||||
mutate {
|
|
||||||
replace => [ "authentication_attempts", "0" ]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [file_size] == "-" {
|
|
||||||
mutate {
|
|
||||||
replace => [ "file_size", "0" ]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [original_ip_bytes] == "-" {
|
|
||||||
mutate {
|
|
||||||
replace => [ "original_ip_bytes", "0" ]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
# I recommend changing the field types below to integer or floats so searches can do greater than or less than
|
|
||||||
# and also so math functions can be ran against them
|
|
||||||
mutate {
|
|
||||||
convert => [ "bound_port", "integer" ]
|
|
||||||
convert => [ "data_channel_destination_port", "integer" ]
|
|
||||||
convert => [ "destination_port", "integer" ]
|
|
||||||
convert => [ "depth", "integer" ]
|
|
||||||
#convert => [ "duration", "float" ]
|
|
||||||
convert => [ "info_code", "integer" ]
|
|
||||||
convert => [ "missed_bytes", "integer" ]
|
|
||||||
convert => [ "missing_bytes", "integer" ]
|
|
||||||
convert => [ "n", "integer" ]
|
|
||||||
convert => [ "original_bytes", "integer" ]
|
|
||||||
convert => [ "original_packets", "integer" ]
|
|
||||||
convert => [ "original_ip_bytes", "integer" ]
|
|
||||||
convert => [ "overflow_bytes", "integer" ]
|
|
||||||
convert => [ "p", "integer" ]
|
|
||||||
convert => [ "query_class", "integer" ]
|
|
||||||
convert => [ "query_type", "integer" ]
|
|
||||||
convert => [ "rcode", "integer" ]
|
|
||||||
convert => [ "request_body_length", "integer" ]
|
|
||||||
convert => [ "request_port", "integer" ]
|
|
||||||
convert => [ "respond_bytes", "integer" ]
|
|
||||||
convert => [ "respond_packets", "integer" ]
|
|
||||||
convert => [ "respond_ip_bytes", "integer" ]
|
|
||||||
convert => [ "response_body_length", "integer" ]
|
|
||||||
convert => [ "seen_bytes", "integer" ]
|
|
||||||
convert => [ "source_port", "integer" ]
|
|
||||||
convert => [ "status_code", "integer" ]
|
|
||||||
#convert => [ "suppress_for", "float" ]
|
|
||||||
convert => [ "total_bytes", "integer" ]
|
|
||||||
convert => [ "trans_depth", "integer" ]
|
|
||||||
convert => [ "transaction_id", "integer" ]
|
|
||||||
# convert the following boolean to text for now
|
|
||||||
convert => [ "local_respond", "string" ]
|
|
||||||
convert => [ "tc", "string" ]
|
|
||||||
convert => [ "is_orig", "string" ]
|
|
||||||
convert => [ "local_orig", "string" ]
|
|
||||||
lowercase => [ "query" ]
|
|
||||||
#remove_field => [ "timestamp" ]
|
|
||||||
}
|
|
||||||
|
|
||||||
# Combine OriginalBytes and RespondBytes and save the value to total_bytes
|
|
||||||
if [original_bytes] {
|
|
||||||
if [respond_bytes] {
|
|
||||||
ruby {
|
|
||||||
code => "event.set('total_bytes', event.get('original_bytes') + event.get('respond_bytes'))"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
mutate {
|
|
||||||
#add_tag => [ "conf_file_6000"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,16 +0,0 @@
|
|||||||
# Updated by: Doug Burks
|
|
||||||
# Last Update: 2/10/2018
|
|
||||||
#
|
|
||||||
filter {
|
|
||||||
if "import" in [tags] and "bro" in [tags] {
|
|
||||||
|
|
||||||
# we're setting timestamp in 6000 now
|
|
||||||
#date {
|
|
||||||
# match => [ "timestamp", "UNIX" ]
|
|
||||||
#}
|
|
||||||
|
|
||||||
mutate {
|
|
||||||
#add_tag => [ "conf_file_6001"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,17 +0,0 @@
|
|||||||
# Author: Justin Henderson
|
|
||||||
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
|
|
||||||
# Email: justin@hasecuritysolution.com
|
|
||||||
# Last Update: 12/9/2016
|
|
||||||
|
|
||||||
filter {
|
|
||||||
if "bro" in [tags] {
|
|
||||||
if "_grokparsefailure" not in [tags] and "_csvparsefailure" not in [tags] and "_jsonparsefailure" not in [tags] {
|
|
||||||
#mutate {
|
|
||||||
# remove_field => [ "message" ]
|
|
||||||
#}
|
|
||||||
}
|
|
||||||
mutate {
|
|
||||||
#add_tag => [ "conf_file_8000"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,47 +0,0 @@
|
|||||||
# Original Author: Justin Henderson
|
|
||||||
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
|
|
||||||
# Updated by: Doug Burks
|
|
||||||
# Last Update: 5/13/2017
|
|
||||||
|
|
||||||
filter {
|
|
||||||
if [type] == "bro_dns" or "dns" in [tags] {
|
|
||||||
# Used for whois lookups - can create log loop
|
|
||||||
if [query] =~ "^whois\." {
|
|
||||||
drop { }
|
|
||||||
}
|
|
||||||
# REPLACE test.int with your internal domain
|
|
||||||
if [query] and [query] !~ "\.test\.int$" {
|
|
||||||
mutate {
|
|
||||||
lowercase => [ "query" ]
|
|
||||||
}
|
|
||||||
if [query_type_name] != "NB" and [query_type_name] != "TKEY" and [query_type_name] != "NBSTAT" and [query_type_name] != "PTR" {
|
|
||||||
tld {
|
|
||||||
source => "query"
|
|
||||||
}
|
|
||||||
ruby {
|
|
||||||
code => "event.set('query_length', event.get('query').length)"
|
|
||||||
}
|
|
||||||
mutate {
|
|
||||||
rename => { "[SubLog][sessionid]" => "sub_session_id" }
|
|
||||||
rename => { "[tld][domain]" => "highest_registered_domain" }
|
|
||||||
rename => { "[tld][trd]" => "subdomain" }
|
|
||||||
rename => { "[tld][tld]" => "top_level_domain" }
|
|
||||||
rename => { "[tld][sld]" => "parent_domain" }
|
|
||||||
}
|
|
||||||
if [parent_domain] {
|
|
||||||
ruby {
|
|
||||||
code => "event.set('parent_domain_length', event.get('parent_domain').length)"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [subdomain] {
|
|
||||||
ruby {
|
|
||||||
code => "event.set('subdomain_length', event.get('subdomain').length)"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
mutate {
|
|
||||||
#add_tag => [ "conf_file_8006"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,204 +0,0 @@
|
|||||||
# Updated by: Mike Reeves
|
|
||||||
# Last Update: 11/1/2018
|
|
||||||
|
|
||||||
input {
|
|
||||||
file {
|
|
||||||
path => "/suricata/eve.json"
|
|
||||||
type => "ids"
|
|
||||||
add_field => { "engine" => "suricata" }
|
|
||||||
}
|
|
||||||
file {
|
|
||||||
path => "/nsm/zeek/logs/current/conn*.log"
|
|
||||||
type => "bro_conn"
|
|
||||||
tags => ["bro"]
|
|
||||||
}
|
|
||||||
file {
|
|
||||||
path => "/nsm/zeek/logs/current/dce_rpc*.log"
|
|
||||||
type => "bro_dce_rpc"
|
|
||||||
tags => ["bro"]
|
|
||||||
}
|
|
||||||
file {
|
|
||||||
path => "/nsm/zeek/logs/current/dhcp*.log"
|
|
||||||
type => "bro_dhcp"
|
|
||||||
tags => ["bro"]
|
|
||||||
}
|
|
||||||
file {
|
|
||||||
path => "/nsm/zeek/logs/current/dnp3*.log"
|
|
||||||
type => "bro_dnp3"
|
|
||||||
tags => ["bro"]
|
|
||||||
}
|
|
||||||
file {
|
|
||||||
path => "/nsm/zeek/logs/current/dns*.log"
|
|
||||||
type => "bro_dns"
|
|
||||||
tags => ["bro"]
|
|
||||||
}
|
|
||||||
file {
|
|
||||||
path => "/nsm/zeek/logs/current/dpd*.log"
|
|
||||||
type => "bro_dpd"
|
|
||||||
tags => ["bro"]
|
|
||||||
}
|
|
||||||
file {
|
|
||||||
path => "/nsm/zeek/logs/current/files*.log"
|
|
||||||
type => "bro_files"
|
|
||||||
tags => ["bro"]
|
|
||||||
}
|
|
||||||
file {
|
|
||||||
path => "/nsm/zeek/logs/current/ftp*.log"
|
|
||||||
type => "bro_ftp"
|
|
||||||
tags => ["bro"]
|
|
||||||
}
|
|
||||||
file {
|
|
||||||
path => "/nsm/zeek/logs/current/http*.log"
|
|
||||||
type => "bro_http"
|
|
||||||
tags => ["bro"]
|
|
||||||
}
|
|
||||||
file {
|
|
||||||
path => "/nsm/zeek/logs/current/intel*.log"
|
|
||||||
type => "bro_intel"
|
|
||||||
tags => ["bro"]
|
|
||||||
}
|
|
||||||
file {
|
|
||||||
path => "/nsm/zeek/logs/current/irc*.log"
|
|
||||||
type => "bro_irc"
|
|
||||||
tags => ["bro"]
|
|
||||||
}
|
|
||||||
file {
|
|
||||||
path => "/nsm/zeek/logs/current/kerberos*.log"
|
|
||||||
type => "bro_kerberos"
|
|
||||||
tags => ["bro"]
|
|
||||||
}
|
|
||||||
file {
|
|
||||||
path => "/nsm/zeek/logs/current/modbus*.log"
|
|
||||||
type => "bro_modbus"
|
|
||||||
tags => ["bro"]
|
|
||||||
}
|
|
||||||
file {
|
|
||||||
path => "/nsm/zeek/logs/current/mysql*.log"
|
|
||||||
type => "bro_mysql"
|
|
||||||
tags => ["bro"]
|
|
||||||
}
|
|
||||||
file {
|
|
||||||
path => "/nsm/zeek/logs/current/notice*.log"
|
|
||||||
type => "bro_notice"
|
|
||||||
tags => ["bro"]
|
|
||||||
}
|
|
||||||
file {
|
|
||||||
path => "/nsm/zeek/logs/current/ntlm*.log"
|
|
||||||
type => "bro_ntlm"
|
|
||||||
tags => ["bro"]
|
|
||||||
}
|
|
||||||
file {
|
|
||||||
path => "/nsm/zeek/logs/current/pe*.log"
|
|
||||||
type => "bro_pe"
|
|
||||||
tags => ["bro"]
|
|
||||||
}
|
|
||||||
file {
|
|
||||||
path => "/nsm/zeek/logs/current/radius*.log"
|
|
||||||
type => "bro_radius"
|
|
||||||
tags => ["bro"]
|
|
||||||
}
|
|
||||||
file {
|
|
||||||
path => "/nsm/zeek/logs/current/rdp*.log"
|
|
||||||
type => "bro_rdp"
|
|
||||||
tags => ["bro"]
|
|
||||||
}
|
|
||||||
file {
|
|
||||||
path => "/nsm/zeek/logs/current/rfb*.log"
|
|
||||||
type => "bro_rfb"
|
|
||||||
tags => ["bro"]
|
|
||||||
}
|
|
||||||
file {
|
|
||||||
path => "/nsm/zeek/logs/current/signatures*.log"
|
|
||||||
type => "bro_signatures"
|
|
||||||
tags => ["bro"]
|
|
||||||
}
|
|
||||||
file {
|
|
||||||
path => "/nsm/zeek/logs/current/sip*.log"
|
|
||||||
type => "bro_sip"
|
|
||||||
tags => ["bro"]
|
|
||||||
}
|
|
||||||
file {
|
|
||||||
path => "/nsm/zeek/logs/current/smb_files*.log"
|
|
||||||
type => "bro_smb_files"
|
|
||||||
tags => ["bro"]
|
|
||||||
}
|
|
||||||
file {
|
|
||||||
path => "/nsm/zeek/logs/current/smb_mapping*.log"
|
|
||||||
type => "bro_smb_mapping"
|
|
||||||
tags => ["bro"]
|
|
||||||
}
|
|
||||||
file {
|
|
||||||
path => "/nsm/zeek/logs/current/smtp*.log"
|
|
||||||
type => "bro_smtp"
|
|
||||||
tags => ["bro"]
|
|
||||||
}
|
|
||||||
file {
|
|
||||||
path => "/nsm/zeek/logs/current/snmp*.log"
|
|
||||||
type => "bro_snmp"
|
|
||||||
tags => ["bro"]
|
|
||||||
}
|
|
||||||
file {
|
|
||||||
path => "/nsm/zeek/logs/current/socks*.log"
|
|
||||||
type => "bro_socks"
|
|
||||||
tags => ["bro"]
|
|
||||||
}
|
|
||||||
file {
|
|
||||||
path => "/nsm/zeek/logs/current/software*.log"
|
|
||||||
type => "bro_software"
|
|
||||||
tags => ["bro"]
|
|
||||||
}
|
|
||||||
file {
|
|
||||||
path => "/nsm/zeek/logs/current/ssh*.log"
|
|
||||||
type => "bro_ssh"
|
|
||||||
tags => ["bro"]
|
|
||||||
}
|
|
||||||
file {
|
|
||||||
path => "/nsm/zeek/logs/current/ssl*.log"
|
|
||||||
type => "bro_ssl"
|
|
||||||
tags => ["bro"]
|
|
||||||
}
|
|
||||||
file {
|
|
||||||
path => "/nsm/zeek/logs/current/syslog*.log"
|
|
||||||
type => "bro_syslog"
|
|
||||||
tags => ["bro"]
|
|
||||||
}
|
|
||||||
file {
|
|
||||||
path => "/nsm/zeek/logs/current/tunnel*.log"
|
|
||||||
type => "bro_tunnels"
|
|
||||||
tags => ["bro"]
|
|
||||||
}
|
|
||||||
file {
|
|
||||||
path => "/nsm/zeek/logs/current/weird*.log"
|
|
||||||
type => "bro_weird"
|
|
||||||
tags => ["bro"]
|
|
||||||
}
|
|
||||||
file {
|
|
||||||
path => "/nsm/zeek/logs/current/x509*.log"
|
|
||||||
type => "bro_x509"
|
|
||||||
tags => ["bro"]
|
|
||||||
}
|
|
||||||
file {
|
|
||||||
path => "/wazuh/alerts/alerts.json"
|
|
||||||
type => "ossec"
|
|
||||||
}
|
|
||||||
file {
|
|
||||||
path => "/wazuh/archives/archives.json"
|
|
||||||
type => "ossec_archive"
|
|
||||||
}
|
|
||||||
file {
|
|
||||||
path => "/osquery/logs/result.log"
|
|
||||||
type => "osquery"
|
|
||||||
tags => ["osquery"]
|
|
||||||
}
|
|
||||||
file {
|
|
||||||
path => "/strelka/strelka.log"
|
|
||||||
type => "strelka"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
filter {
|
|
||||||
if "import" in [tags] {
|
|
||||||
mutate {
|
|
||||||
#add_tag => [ "conf_file_0007"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,13 +0,0 @@
|
|||||||
# Author: Justin Henderson
|
|
||||||
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
|
|
||||||
# Email: justin@hasecuritysolution.com
|
|
||||||
# Last Update: 12/9/2016
|
|
||||||
|
|
||||||
filter {
|
|
||||||
ruby {
|
|
||||||
code => "event.set('task_start', Time.now.to_f)"
|
|
||||||
}
|
|
||||||
mutate {
|
|
||||||
#add_tag => [ "conf_file_1000"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,33 +0,0 @@
|
|||||||
# Updated by: Doug Burks and Wes Lambert
|
|
||||||
# Last Update: 10/30/2018
|
|
||||||
|
|
||||||
filter {
|
|
||||||
if "syslogng" in [tags] {
|
|
||||||
mutate {
|
|
||||||
rename => { "MESSAGE" => "message" }
|
|
||||||
rename => { "PROGRAM" => "type" }
|
|
||||||
rename => { "FACILITY" => "syslog-facility" }
|
|
||||||
rename => { "FILE_NAME" => "syslog-file_name" }
|
|
||||||
rename => { "HOST" => "syslog-host" }
|
|
||||||
rename => { "HOST_FROM" => "syslog-host_from" }
|
|
||||||
rename => { "LEGACY_MSGHDR" => "syslog-legacy_msghdr" }
|
|
||||||
rename => { "PID" => "syslog-pid" }
|
|
||||||
rename => { "PRIORITY" => "syslog-priority" }
|
|
||||||
rename => { "SOURCEIP" => "syslog-sourceip" }
|
|
||||||
rename => { "TAGS" => "syslog-tags" }
|
|
||||||
lowercase => [ "syslog-host_from" ]
|
|
||||||
remove_field => [ "ISODATE" ]
|
|
||||||
remove_field => [ "SEQNUM" ]
|
|
||||||
#add_tag => [ "conf_file_1001"]
|
|
||||||
}
|
|
||||||
if "bro_" in [type] {
|
|
||||||
mutate {
|
|
||||||
add_tag => [ "bro" ]
|
|
||||||
}
|
|
||||||
} else if [type] !~ /ossec.*|snort/ and "firewall" not in [tags] {
|
|
||||||
mutate {
|
|
||||||
add_tag => [ "syslog" ]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,18 +0,0 @@
|
|||||||
# Author: Justin Henderson
|
|
||||||
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
|
|
||||||
# Email: justin@hasecuritysolution.com
|
|
||||||
# Last Update: 12/9/2016
|
|
||||||
|
|
||||||
filter {
|
|
||||||
if "json" in [tags]{
|
|
||||||
json {
|
|
||||||
source => "message"
|
|
||||||
}
|
|
||||||
mutate {
|
|
||||||
remove_tag => [ "json" ]
|
|
||||||
}
|
|
||||||
mutate {
|
|
||||||
#add_tag => [ "conf_file_1002"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,19 +0,0 @@
|
|||||||
filter {
|
|
||||||
if "syslog" in [tags] {
|
|
||||||
if [host] == "172.16.1.1" {
|
|
||||||
mutate {
|
|
||||||
add_field => { "type" => "fortinet" }
|
|
||||||
add_tag => [ "firewall" ]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [host] == "10.0.0.101" {
|
|
||||||
mutate {
|
|
||||||
add_field => { "type" => "brocade" }
|
|
||||||
add_tag => [ "switch" ]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
mutate {
|
|
||||||
#add_tag => [ "conf_file_1004"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,140 +0,0 @@
|
|||||||
# Author: Justin Henderson
|
|
||||||
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
|
|
||||||
# Email: justin@hasecuritysolutions.com
|
|
||||||
# Last Update: 12/9/2016
|
|
||||||
# This conf file is based on accepting logs for DHCP. It is currently based on Windows DHCP only.
|
|
||||||
filter {
|
|
||||||
if [type] == "dhcp" {
|
|
||||||
mutate {
|
|
||||||
add_field => { "Hostname" => "%{host}" }
|
|
||||||
}
|
|
||||||
mutate {
|
|
||||||
strip => "message"
|
|
||||||
}
|
|
||||||
# This is the initial parsing of the log
|
|
||||||
grok {
|
|
||||||
# Server 2008+
|
|
||||||
match => { "message" => "%{DATA:id},%{DATE_US:date},(?<time>%{HOUR}:%{MINUTE}:%{SECOND}),%{DATA:description},%{IPV4:ip},%{DATA:Hostname},%{DATA:mac},%{DATA:Username},%{INT:TransactionID},%{INT:QResult},%{DATA:ProbationTime},%{DATA:CorrelationID}"}
|
|
||||||
# Server 2003
|
|
||||||
match => { "message" => "%{DATA:id},%{DATE_US:date},(?<time>%{HOUR}:%{MINUTE}:%{SECOND}),%{DATA:description},%{IPV4:ip},%{DATA:Hostname},%{DATA:mac},"}
|
|
||||||
match => { "message" => "%{DATA:id},%{DATA:date},(?<time>%{HOUR}:%{MINUTE}:%{SECOND}),%{DATA:description},%{DATA:ip},%{DATA:Hostname},%{DATA:mac},"}
|
|
||||||
}
|
|
||||||
# This section below translates the message ID into something humans can understand.
|
|
||||||
if [id] == "00" {
|
|
||||||
mutate {
|
|
||||||
add_field => [ "event", "The log was started"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [id] == "01" {
|
|
||||||
mutate {
|
|
||||||
add_field => [ "event", "The log was stopped"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [id] == "02" {
|
|
||||||
mutate {
|
|
||||||
add_field => [ "event", "The log was temporarily paused due to low disk space"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [id] == "10" {
|
|
||||||
mutate {
|
|
||||||
add_field => [ "event", "A new IP address was leased to a client"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [id] == "11" {
|
|
||||||
mutate {
|
|
||||||
add_field => [ "event", "A lease was renewed by a client"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [id] == "12" {
|
|
||||||
mutate {
|
|
||||||
add_field => [ "event", "A lease was released by a client"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [id] == "13" {
|
|
||||||
mutate {
|
|
||||||
add_field => [ "event", "An IP address was found to be in use on the network"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [id] == "14" {
|
|
||||||
mutate {
|
|
||||||
add_field => [ "event", "A lease request could not be satisfied because the scope's address pool was exhausted"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [id] == "15" {
|
|
||||||
mutate {
|
|
||||||
add_field => [ "event", "A lease was denied"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [id] == "16" {
|
|
||||||
mutate {
|
|
||||||
add_field => [ "event", "A lease was deleted"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [id] == "17" {
|
|
||||||
mutate {
|
|
||||||
add_field => [ "event", "A lease was expired and DNS records for an expired leases have not been deleted"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [id] == "18" {
|
|
||||||
mutate {
|
|
||||||
add_field => [ "event", "A lease was expired and DNS records were deleted"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [id] == "20" {
|
|
||||||
mutate {
|
|
||||||
add_field => [ "event", "A BOOTP address was leased to a client"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [id] == "21" {
|
|
||||||
mutate {
|
|
||||||
add_field => [ "event", "A dynamic BOOTP address was leased to a client"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [id] == "22" {
|
|
||||||
mutate {
|
|
||||||
add_field => [ "event", "A BOOTP request could not be satisfied because the scope's address pool for BOOTP was exhausted"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [id] == "23" {
|
|
||||||
mutate {
|
|
||||||
add_field => [ "event", "A BOOTP IP address was deleted after checking to see it was not in use"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [id] == "24" {
|
|
||||||
mutate {
|
|
||||||
add_field => [ "event", "IP address cleanup operation has began"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [id] == "25" {
|
|
||||||
mutate {
|
|
||||||
add_field => [ "event", "IP address cleanup statistics"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [id] == "30" {
|
|
||||||
mutate {
|
|
||||||
add_field => [ "event", "DNS update request to the named DNS server"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [id] == "31" {
|
|
||||||
mutate {
|
|
||||||
add_field => [ "event", "DNS update failed"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [id] == "32" {
|
|
||||||
mutate {
|
|
||||||
add_field => [ "event", "DNS update successful"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [id] == "33" {
|
|
||||||
mutate {
|
|
||||||
add_field => [ "event", "Packet dropped due to NAP policy"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
# If the message failed to parse correctly keep the message for debugging. Otherwise, drop it.
|
|
||||||
#if "_grokparsefailure" not in [tags] {
|
|
||||||
# mutate {
|
|
||||||
# remove_field => [ "message"]
|
|
||||||
# }
|
|
||||||
#}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,31 +0,0 @@
|
|||||||
# Author: Justin Henderson
|
|
||||||
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
|
|
||||||
# Email: justin@hasecuritysolution.com
|
|
||||||
# Last Update: 12/9/2016
|
|
||||||
#
|
|
||||||
# This configuration file takes ESXi syslog messages and filters them. There is no input as the logs would have came in via syslog
|
|
||||||
filter {
|
|
||||||
# This is an example of using an IP address range to classify a syslog message to a specific type of log
|
|
||||||
# This is helpful as so many devices only send logs via syslog
|
|
||||||
if [host] =~ "10\.[0-1]\.9\." {
|
|
||||||
mutate {
|
|
||||||
replace => ["type", "esxi"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [host] =~ "\.234$" {
|
|
||||||
mutate {
|
|
||||||
replace => ["type", "esxi"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [type] == "esxi" {
|
|
||||||
grok {
|
|
||||||
match => { "message" => "(?:%{SYSLOGTIMESTAMP:timestamp}|%{TIMESTAMP_ISO8601:timestamp8601}) (?:%{SYSLOGHOST:logsource}) (?:%{SYSLOGPROG}): (?<messagebody>(?:\[(?<esxi_thread_id>[0-9A-Z]{8,8}) %{DATA:esxi_loglevel} \'%{DATA:esxi_service}\'\] %{GREEDYDATA:esxi_message}|%{GREEDYDATA}))"}
|
|
||||||
|
|
||||||
# pattern => ['(?:%{SYSLOGTIMESTAMP:timestamp}|%{TIMESTAMP_ISO8601:timestamp8601}) (?:%{SYSLOGHOST:logsource}) (?:%{SYSLOGPROG}): (?<messagebody>(?:\[(?<esxi_thread_id>[0-9A-Z]{8,8}) %{DATA:esxi_loglevel} \'%{DATA:esxi_service}\'\] %{GREEDYDATA:esxi_message}|%{GREEDYDATA}))']
|
|
||||||
}
|
|
||||||
mutate {
|
|
||||||
#add_tag => [ "conf_file_1029"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
@@ -1,21 +0,0 @@
|
|||||||
# Author: Justin Henderson
|
|
||||||
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
|
|
||||||
# Email: justin@hasecuritysolution.com
|
|
||||||
# Last Update: 12/9/2016
|
|
||||||
|
|
||||||
filter {
|
|
||||||
if [type] == "greensql" {
|
|
||||||
# This section is parsing out the fields for GreenSQL syslog data
|
|
||||||
grok {
|
|
||||||
match => { "message" => "<%{INT:Code}>%{DATA:Category}\[%{INT:Transcation}\]:\s*Database=%{DATA:Database}\sUser=%{DATA:UserName}\sApplication Name=%{DATA:Application}\sSource IP=%{IPV4:SrcIp}\sSource Port=%{INT:SrcPort}\sTarget IP=?%{IPV4:DstIp}\sTarget Port=%{DATA:DstPort}\sQuery=%{GREEDYDATA:Query}"}
|
|
||||||
match => { "message" => "<%{INT:Code}>%{DATA:Category}\[%{INT:Transcation}\]:\sAdmin_Name=%{DATA:UserName}\sIP_Address=%{IPV4:SrcIp}\sUser_Agent=%{DATA:UserAgent}\sMessage=%{DATA:StatusMessage}\sDescription=%{DATA:Description}\sSeverity=%{GREEDYDATA:Severity}"}
|
|
||||||
}
|
|
||||||
# Remove the message field as it is unnecessary
|
|
||||||
#mutate {
|
|
||||||
# remove_field => [ "message"]
|
|
||||||
#}
|
|
||||||
mutate {
|
|
||||||
#add_tag => [ "conf_file_1030"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,21 +0,0 @@
|
|||||||
# Author: Justin Henderson
|
|
||||||
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
|
|
||||||
# Email: justin@hasecuritysolution.com
|
|
||||||
# Last Update: 12/9/2016
|
|
||||||
|
|
||||||
filter {
|
|
||||||
if [type] == "iis" {
|
|
||||||
# The log is expected to have come from NXLog and in JSON format. This allows for automatic parsing of fields
|
|
||||||
json {
|
|
||||||
source => "message"
|
|
||||||
}
|
|
||||||
# This removes the message field as it is unneccesary and tags the packet as web
|
|
||||||
mutate {
|
|
||||||
# remove_field => [ "message"]
|
|
||||||
add_tag => [ "web" ]
|
|
||||||
}
|
|
||||||
mutate {
|
|
||||||
#add_tag => [ "conf_file_1031"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,26 +0,0 @@
|
|||||||
# Author: Justin Henderson
|
|
||||||
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
|
|
||||||
# Email: justin@hasecuritysolution.com
|
|
||||||
# Last Update: 12/9/2016
|
|
||||||
#
|
|
||||||
# This file looks for McAfee EPO logs
|
|
||||||
filter {
|
|
||||||
if [type] == "mcafee" {
|
|
||||||
# NXLog should be sending the logs in JSON format so they auto parse
|
|
||||||
json {
|
|
||||||
source => "message"
|
|
||||||
}
|
|
||||||
# This section converts the UTC fields to the proper time format
|
|
||||||
date {
|
|
||||||
match => [ "ReceivedUTC", "YYYY-MM-dd HH:mm:ss" ]
|
|
||||||
target => [ "ReceivedUTC" ]
|
|
||||||
}
|
|
||||||
date {
|
|
||||||
match => [ "DetectedUTC", "YYYY-MM-dd HH:mm:ss" ]
|
|
||||||
target => [ "DetectedUTC" ]
|
|
||||||
}
|
|
||||||
mutate {
|
|
||||||
#add_tag => [ "conf_file_1032"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,181 +0,0 @@
|
|||||||
# Author: Justin Henderson
|
|
||||||
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
|
|
||||||
# Updated by: Doug Burks
|
|
||||||
# Last Update: 3/15/2018
|
|
||||||
|
|
||||||
filter {
|
|
||||||
if [type] == "ids" {
|
|
||||||
# This is the initial parsing of the log
|
|
||||||
if [engine] == "suricata" {
|
|
||||||
json {
|
|
||||||
source => "message"
|
|
||||||
}
|
|
||||||
mutate {
|
|
||||||
rename => { "alert" => "orig_alert" }
|
|
||||||
rename => { "[orig_alert][gid]" => "gid" }
|
|
||||||
rename => { "[orig_alert][signature_id]" => "sid" }
|
|
||||||
rename => { "[orig_alert][rev]" => "rev" }
|
|
||||||
rename => { "[orig_alert][signature]" => "alert" }
|
|
||||||
rename => { "[orig_alert][category]" => "classification" }
|
|
||||||
rename => { "[orig_alert][severity]" => "priority" }
|
|
||||||
rename => { "[orig_alert][rule]" => "rule_signature" }
|
|
||||||
rename => { "app_proto" => "application_protocol" }
|
|
||||||
rename => { "dest_ip" => "destination_ip" }
|
|
||||||
rename => { "dest_port" => "destination_port" }
|
|
||||||
rename => { "in_iface" => "interface" }
|
|
||||||
rename => { "proto" => "protocol" }
|
|
||||||
rename => { "src_ip" => "source_ip" }
|
|
||||||
rename => { "src_port" => "source_port" }
|
|
||||||
#rename => { "[fileinfo][filename]" => "filename" }
|
|
||||||
#rename => { "[fileinfo][gaps]" => "gaps" }
|
|
||||||
#rename => { "[fileinfo][size]" => "size" }
|
|
||||||
#rename => { "[fileinfo][state]" => "state" }
|
|
||||||
#rename => { "[fileinfo][stored]" => "stored" }
|
|
||||||
#rename => { "[fileinfo][tx_id]" => "tx_id" }
|
|
||||||
#rename => { "[flow][age]" => "duration" }
|
|
||||||
#rename => { "[flow][alerted]" => "flow_alerted" }
|
|
||||||
#rename => { "[flow][bytes_toclient]" => "bytes_to_client" }
|
|
||||||
#rename => { "[flow][bytes_toserver]" => "bytes_to_server" }
|
|
||||||
#rename => { "[flow][end]" => "flow_end" }
|
|
||||||
#rename => { "[flow][pkts_toclient]" => "packets_to_client" }
|
|
||||||
#rename => { "[flow][pkts_toserver]" => "packets_to_server" }
|
|
||||||
#rename => { "[flow][reason]" => "reason" }
|
|
||||||
#rename => { "[flow][start]" => "flow_start" }
|
|
||||||
#rename => { "[flow][state]" => "state" }
|
|
||||||
#rename => { "[netflow][age]" => "duration" }
|
|
||||||
#rename => { "[netflow][bytes]" => "bytes" }
|
|
||||||
#rename => { "[netflow][end]" => "netflow_end" }
|
|
||||||
#rename => { "[netflow][start]" => "netflow_start" }
|
|
||||||
#rename => { "[netflow][pkts]" => "packets" }
|
|
||||||
rename => { "[alert][action]" => "action" }
|
|
||||||
rename => { "[alert][category]" => "category" }
|
|
||||||
rename => { "[alert][gid]" => "gid" }
|
|
||||||
rename => { "[alert][rev]" => "rev" }
|
|
||||||
rename => { "[alert][severity]" => "severity" }
|
|
||||||
rename => { "[alert][signature]" => "signature" }
|
|
||||||
rename => { "[alert][signature_id]" => "sid" }
|
|
||||||
#rename => { "[dns][aa]" => "aa" }
|
|
||||||
#rename => { "[dns][flags]" => "flags" }
|
|
||||||
#rename => { "[dns][id]" => "id" }
|
|
||||||
#rename => { "[dns][qr]" => "qr" }
|
|
||||||
#rename => { "[dns][rcode]" => "rcode_name" }
|
|
||||||
#rename => { "[dns][rrname]" => "rrname" }
|
|
||||||
#rename => { "[dns][rrtype]" => "rrtype" }
|
|
||||||
#rename => { "[dns][tx_id]" => "tx_id" }
|
|
||||||
#rename => { "[dns][type]" => "record_type" }
|
|
||||||
#rename => { "[dns][version]" => "version" }
|
|
||||||
rename => { "[http][hostname]" => "virtual_host" }
|
|
||||||
rename => { "[http][http_content_type]" => "content_type" }
|
|
||||||
rename => { "[http][http_port]" => "http_port" }
|
|
||||||
rename => { "[http][http_method]" => "method" }
|
|
||||||
rename => { "[http][http_user_agent]" => "useragent" }
|
|
||||||
#rename => { "[http][length]" => "payload_length" }
|
|
||||||
#rename => { "[http][protocol]" => "http_version" }
|
|
||||||
rename => { "[http][status]" => "status_message" }
|
|
||||||
rename => { "[http][url]" => "url" }
|
|
||||||
#rename => { "[metadata][flowbits]" => "flowbits" }
|
|
||||||
rename => { "[tls][fingerprint]" => "certificate_serial_number" }
|
|
||||||
rename => { "[tls][issuerdn]" => "issuer_distinguished_name" }
|
|
||||||
rename => { "[tls][notafter]" => "certificate_not_valid_after" }
|
|
||||||
rename => { "[tls][notbefore]" => "certificate_not_valid_before" }
|
|
||||||
rename => { "[tls][subject]" => "certificate_common_name" }
|
|
||||||
rename => { "[tls][version]" => "tls_version" }
|
|
||||||
rename => { "event_type" => "ids_event_type" }
|
|
||||||
remove_field => [ "offset", "orig_alert", "beat", "input", "prospector" ]
|
|
||||||
remove_tag => [ "beats_input_codec_plain_applied" ]
|
|
||||||
add_tag => [ "eve" ]
|
|
||||||
|
|
||||||
}
|
|
||||||
} else {
|
|
||||||
grok {
|
|
||||||
match => ["message", "\[%{INT:gid}:%{INT:sid}:%{INT:rev}\]\s%{DATA:alert}\[Classification:\s+%{DATA:classification}\]\s+\[Priority:\s+%{INT:priority}\]:\s+<%{DATA:interface}>\s+{%{DATA:protocol}}\s+(?:%{IPV4:source_ip}|%{IPV6:source_ip}):%{INT:source_port}\s+->\s+(?:%{IPV4:destination_ip}|%{IPV6:destination_ip}):%{INT:destination_port}",
|
|
||||||
"message", "\[%{INT:gid}:%{INT:sid}:%{INT:rev}\]\s%{DATA:alert}\[Classification:\s+%{DATA:classification}\]\s+\[Priority:\s+%{INT:priority}\]:\s+<%{DATA:interface}>\s+{%{DATA:protocol}}\s(?:%{IPV4:source_ip}|%{IPV6:source_ip})\s+->\s+(?:%{IPV4:destination_ip}|%{IPV6:destination_ip})",
|
|
||||||
"message", "\[%{INT:gid}:%{INT:sid}:%{INT:rev}\]\s%{DATA:alert}\[Classification:\s+%{DATA:classification}\]\s+\[Priority:\s+%{INT:priority}\]:\s+{%{DATA:protocol}}\s+(?:%{IPV4:source_ip}|%{IPV6:source_ip}):%{INT:source_port}\s+->\s+%{IPV4:destination_ip}:%{INT:destination_port}",
|
|
||||||
"message", "\[%{INT:gid}:%{INT:sid}:%{INT:rev}\]\s%{DATA:alert}\[Classification:\s+%{DATA:classification}\]\s+\[Priority:\s+%{INT:priority}\]:\s+{%{DATA:protocol}}\s(?:%{IPV4:source_ip}|%{IPV6:source_ip})\s+->\s+(?:%{IPV4:destination_ip}|%{IPV6:destination_ip})",
|
|
||||||
"message", "\[%{INT:gid}:%{INT:sid}:%{INT:rev}\]\s%{DATA:alert}\[Classification:\s+%{DATA:classification}\]\s+\[Priority:\s+%{INT:priority}\]:\s+{%{DATA:protocol}}\s+(?:%{IPV4:source_ip}|%{IPV6:source_ip}):%{INT:source_port}\s+->\s+(?:%{IPV4:destination_ip}|%{IPV6:destination_ip}):%{INT:destination_port}",
|
|
||||||
"message", "\[%{INT:gid}:%{INT:sid}:%{INT:rev}\]\s%{DATA:alert}\[Classification:\s+%{DATA:classification}\]\s+\[Priority:\s+%{INT:priority}\]:\s+{%{DATA:protocol}}\s(?:%{IPV4:source_ip}|%{IPV6:source_ip})\s+->\s+(?:%{IPV4:source_ip}|%{IPV6:source_ip})",
|
|
||||||
"message", "\[%{INT:gid}:%{INT:sid}:%{INT:rev}\]\s%{DATA:alert}\[Classification:\s+%{DATA:classification}\]\s+\[Priority:\s+%{INT:priority}\]:\s+{%{DATA:protocol}}",
|
|
||||||
"message", "\A%{TIME} pid\(%{INT}\) Alert Received: %{INT} %{INT:priority} %{DATA:classification} %{DATA:interface} \{%{DATA:timestamp}} %{INT} %{INT} \{%{DATA:alert}} %{IP:source_ip} %{IP:destination_ip} %{INT:protocol} %{INT:source_port} %{INT:destination_port} %{INT:gid} %{INT:sid} %{INT:rev} %{INT} %{INT}\Z",
|
|
||||||
"message", "%{GREEDYDATA:alert}"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [timestamp] {
|
|
||||||
mutate {
|
|
||||||
add_field => { "logstash_timestamp" => "%{@timestamp}" }
|
|
||||||
}
|
|
||||||
mutate {
|
|
||||||
convert => { "logstash_timestamp" => "string" }
|
|
||||||
}
|
|
||||||
date {
|
|
||||||
match => [ "timestamp", "ISO8601" ]
|
|
||||||
}
|
|
||||||
mutate {
|
|
||||||
rename => { "logstash_timestamp" => "timestamp" }
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
# If the alert is a Snort GPL alert break it apart for easier reading and categorization
|
|
||||||
if [alert] =~ "GPL " {
|
|
||||||
# This will parse out the category type from the alert
|
|
||||||
grok {
|
|
||||||
match => { "alert" => "GPL\s+%{DATA:category}\s" }
|
|
||||||
}
|
|
||||||
# This will store the category
|
|
||||||
mutate {
|
|
||||||
add_field => { "rule_type" => "Snort GPL" }
|
|
||||||
lowercase => [ "category"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
# If the alert is an Emerging Threat alert break it apart for easier reading and categorization
|
|
||||||
if [alert] =~ "ET " {
|
|
||||||
# This will parse out the category type from the alert
|
|
||||||
grok {
|
|
||||||
match => { "alert" => "ET\s+%{DATA:category}\s" }
|
|
||||||
}
|
|
||||||
# This will store the category
|
|
||||||
mutate {
|
|
||||||
add_field => { "rule_type" => "Emerging Threats" }
|
|
||||||
lowercase => [ "category"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
# I recommend changing the field types below to integer so searches can do greater than or less than
|
|
||||||
# and also so math functions can be ran against them
|
|
||||||
mutate {
|
|
||||||
convert => [ "source_port", "integer" ]
|
|
||||||
convert => [ "destination_port", "integer" ]
|
|
||||||
convert => [ "gid", "integer" ]
|
|
||||||
convert => [ "sid", "integer" ]
|
|
||||||
# remove_field => [ "message"]
|
|
||||||
}
|
|
||||||
# This will translate the priority field into a severity field of either High, Medium, or Low
|
|
||||||
if [priority] == 1 {
|
|
||||||
mutate {
|
|
||||||
add_field => { "severity" => "High" }
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [priority] == 2 {
|
|
||||||
mutate {
|
|
||||||
add_field => { "severity" => "Medium" }
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [priority] == 3 {
|
|
||||||
mutate {
|
|
||||||
add_field => { "severity" => "Low" }
|
|
||||||
}
|
|
||||||
}
|
|
||||||
# This section adds URLs to lookup information about a rule online
|
|
||||||
if [sid] and [sid] > 0 and [sid] < 1000000 {
|
|
||||||
mutate {
|
|
||||||
add_field => [ "signature_info", "https://www.snort.org/search?query=%{gid}-%{sid}" ]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [sid] and [sid] > 1999999 and [sid] < 2999999 {
|
|
||||||
mutate {
|
|
||||||
add_field => [ "signature_info", "http://doc.emergingthreats.net/%{sid}" ]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
# mutate {
|
|
||||||
#add_tag => [ "conf_file_1033"]
|
|
||||||
# }
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,16 +0,0 @@
|
|||||||
# Author: Justin Henderson
|
|
||||||
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
|
|
||||||
# Updated by: Doug Burks
|
|
||||||
# Last Update: 5/22/2017
|
|
||||||
|
|
||||||
filter {
|
|
||||||
if [type] == "syslog" {
|
|
||||||
# This drops syslog messages regarding license messages. You may want to comment it out.
|
|
||||||
#if [message] =~ "license" {
|
|
||||||
# drop { }
|
|
||||||
#}
|
|
||||||
mutate {
|
|
||||||
#convert => [ "status_code", "integer" ]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,59 +0,0 @@
|
|||||||
# Author: Justin Henderson
|
|
||||||
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
|
|
||||||
# Email: justin@hasecuritysolution.com
|
|
||||||
# Last Update: 12/9/2016
|
|
||||||
|
|
||||||
filter {
|
|
||||||
if [type] == "sflow" {
|
|
||||||
if [message] =~ /CNTR/ {
|
|
||||||
drop { }
|
|
||||||
}
|
|
||||||
|
|
||||||
grok {
|
|
||||||
match => { "message" => "%{WORD:sample_type},%{IP:sflow_source_ip},%{WORD:in_port:int},%{WORD:out_port:int},%{WORD:source_mac},%{WORD:destination_mac},%{WORD:ether_type},%{NUMBER:in_vlan:int},%{NUMBER:out_vlan:int},%{IP:source_ip},%{IP:destination_ip},%{NUMBER:protocol:int},%{WORD:type_of_service},%{WORD:ttl:int},%{NUMBER:source_port:int},%{NUMBER:destination_port:int},%{DATA:tcp_flags},%{NUMBER:packet_size:int},%{NUMBER:ip_size:int},%{NUMBER:sample_rate:int}" }
|
|
||||||
}
|
|
||||||
|
|
||||||
if "_grokparsefailure" in [tags] {
|
|
||||||
drop { }
|
|
||||||
}
|
|
||||||
|
|
||||||
mutate {
|
|
||||||
add_field => {
|
|
||||||
"[source_hostname]" => "%{source_ip}"
|
|
||||||
"[destination_hostname]" => "%{destination_ip}"
|
|
||||||
"[sflow_source_hostname]" => "%{sflow_source_ip}"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
translate {
|
|
||||||
field => "[source_port]"
|
|
||||||
destination => "[source_service]"
|
|
||||||
dictionary_path => "/lib/dictionaries/iana_services.yaml"
|
|
||||||
}
|
|
||||||
|
|
||||||
translate {
|
|
||||||
field => "[destination_port]"
|
|
||||||
destination => "[destination_service]"
|
|
||||||
dictionary_path => "/lib/dictionaries/iana_services.yaml"
|
|
||||||
}
|
|
||||||
|
|
||||||
translate {
|
|
||||||
field => "[protocol]"
|
|
||||||
destination => "[protocol_name]"
|
|
||||||
dictionary_path => "/lib/dictionaries/iana_protocols.yaml"
|
|
||||||
}
|
|
||||||
|
|
||||||
translate {
|
|
||||||
field => "[tcp_flags]"
|
|
||||||
destination => "[tcp_flag]"
|
|
||||||
dictionary_path => "/lib/dictionaries/tcp_flags.yaml"
|
|
||||||
}
|
|
||||||
|
|
||||||
mutate {
|
|
||||||
add_field => { "ips" => [ "%{sflow_source_ip}" ] }
|
|
||||||
}
|
|
||||||
mutate {
|
|
||||||
#add_tag => [ "conf_file_2000"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,11 +0,0 @@
|
|||||||
# Updated by: Doug Burks
|
|
||||||
# Last Update: 5/16/2017
|
|
||||||
#
|
|
||||||
filter {
|
|
||||||
if "syslog" in [tags] {
|
|
||||||
mutate {
|
|
||||||
#convert => [ "status_code", "integer" ]
|
|
||||||
#add_tag => [ "conf_file_6002"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,33 +0,0 @@
|
|||||||
# Author: Justin Henderson
|
|
||||||
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
|
|
||||||
# Email: justin@hasecuritysolution.com
|
|
||||||
# Last Update: 12/9/2016
|
|
||||||
|
|
||||||
filter {
|
|
||||||
if [type] == "brocade" {
|
|
||||||
grok {
|
|
||||||
match => ["message", "<%{DATA}>%{GREEDYDATA:sys_message}"]
|
|
||||||
}
|
|
||||||
grok {
|
|
||||||
match => { "sys_message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid:int}\])?: %{GREEDYDATA:syslog_message}" }
|
|
||||||
add_field => [ "received_at", "%{@timestamp}" ]
|
|
||||||
}
|
|
||||||
if [syslog_message] =~ "Interface ethernet" or [syslog_program] == "PORT" {
|
|
||||||
grok {
|
|
||||||
match => { "syslog_message" => "%{DATA}%{INT:unit}\/%{INT:interface_type}\/%{INT:interface:int}" }
|
|
||||||
}
|
|
||||||
mutate {
|
|
||||||
add_field => { "interface_port" => "%{unit}/%{interface_type}/%{interface}" }
|
|
||||||
}
|
|
||||||
}
|
|
||||||
date {
|
|
||||||
match => [ "syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss" ]
|
|
||||||
timezone => "America/Chicago"
|
|
||||||
remove_field => "syslog_timestamp"
|
|
||||||
remove_field => "received_at"
|
|
||||||
}
|
|
||||||
mutate {
|
|
||||||
#add_tag => [ "conf_file_6101"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,281 +0,0 @@
|
|||||||
# Author: Justin Henderson
|
|
||||||
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
|
|
||||||
# Email: justin@hasecuritysolution.com
|
|
||||||
# Last Update: 12/9/2016
|
|
||||||
|
|
||||||
filter {
|
|
||||||
if [type] == "fortinet" {
|
|
||||||
mutate {
|
|
||||||
gsub => [ "message", "= ", "=NA " ]
|
|
||||||
}
|
|
||||||
|
|
||||||
grok {
|
|
||||||
match => ["message", "type=%{DATA:event_type}\s+"]
|
|
||||||
tag_on_failure => []
|
|
||||||
}
|
|
||||||
grok {
|
|
||||||
match => ["message", "<%{DATA}>%{GREEDYDATA:kv}"]
|
|
||||||
tag_on_failure => []
|
|
||||||
}
|
|
||||||
kv {
|
|
||||||
source => "kv"
|
|
||||||
exclude_keys => [ "type" ]
|
|
||||||
}
|
|
||||||
mutate {
|
|
||||||
gsub => [ "log", "= ", "=NA " ]
|
|
||||||
}
|
|
||||||
kv {
|
|
||||||
source => "log"
|
|
||||||
target => "SubLog"
|
|
||||||
}
|
|
||||||
grok {
|
|
||||||
match => ["message", "custom: DOM-ALL, dns_query=%{DATA:dns_query};"]
|
|
||||||
tag_on_failure => [ "" ]
|
|
||||||
}
|
|
||||||
mutate {
|
|
||||||
rename => { "action" => "action" }
|
|
||||||
rename => { "addr" => "addr_ip" }
|
|
||||||
rename => { "age" => "age" }
|
|
||||||
rename => { "assigned" => "assigned_ip" }
|
|
||||||
rename => { "assignip" => "assign_ip" }
|
|
||||||
rename => { "ap" => "access_point" }
|
|
||||||
rename => { "app" => "application" }
|
|
||||||
rename => { "appcat" => "application_category" }
|
|
||||||
rename => { "applist" => "application_list" }
|
|
||||||
rename => { "apprisk" => "application_risk" }
|
|
||||||
rename => { "approfile" => "accessPoint_profile" }
|
|
||||||
rename => { "apscan" => "access_point_scan" }
|
|
||||||
rename => { "apstatus" => "acces_point_status" }
|
|
||||||
rename => { "aptype" => "access_point_type" }
|
|
||||||
rename => { "authproto" => "authentication_protocol" }
|
|
||||||
rename => { "bandwidth" => "bandwidth" }
|
|
||||||
rename => { "banned_src" => "banned_source" }
|
|
||||||
rename => { "cat" => "category" }
|
|
||||||
rename => { "catdesc" => "category_description" }
|
|
||||||
rename => { "cfgattr" => "configuration_attribute" }
|
|
||||||
rename => { "cfgobj" => "configuration_object" }
|
|
||||||
rename => { "cfgpath" => "configuration_path" }
|
|
||||||
rename => { "cfgtid" => "configuration_transaction_id" }
|
|
||||||
rename => { "channel" => "channel" }
|
|
||||||
rename => { "community" => "community" }
|
|
||||||
rename => { "cookies" => "cookies" }
|
|
||||||
rename => { "craction" => "cr_action" }
|
|
||||||
rename => { "crlevel" => "cr_level" }
|
|
||||||
rename => { "crscore" => "cr_score" }
|
|
||||||
rename => { "datarange" => "data_range" }
|
|
||||||
rename => { "desc" => "description" }
|
|
||||||
rename => { "detectionmethod" => "detection_method" }
|
|
||||||
rename => { "devid" => "device_id" }
|
|
||||||
rename => { "devname" => "device_name" }
|
|
||||||
rename => { "devtype" => "device_type" }
|
|
||||||
rename => { "dhcp_msg" => "dhcp_message" }
|
|
||||||
rename => { "disklograte" => "disk_lograte" }
|
|
||||||
rename => { "dstcountry" => "destination_country" }
|
|
||||||
rename => { "dstintf" => "destination_interface" }
|
|
||||||
rename => { "dstip" => "destination_ip" }
|
|
||||||
rename => { "dstport" => "destination_port" }
|
|
||||||
rename => { "duration" => "elapsed_time" }
|
|
||||||
rename => { "error_num" => "error_number" }
|
|
||||||
rename => { "espauth" => "esp_authentication" }
|
|
||||||
rename => { "esptransform" => "esp_transform" }
|
|
||||||
rename => { "eventid" => "event_id" }
|
|
||||||
rename => { "eventtype" => "event_type" }
|
|
||||||
rename => { "fazlograte" => "faz_lograte" }
|
|
||||||
rename => { "filename" => "file_name" }
|
|
||||||
rename => { "filesize" => "file_size" }
|
|
||||||
rename => { "filetype" => "file_type" }
|
|
||||||
rename => { "hostname" => "hostname" }
|
|
||||||
rename => { "ip" => "source_ip" }
|
|
||||||
rename => { "localip" => "source_ip" }
|
|
||||||
rename => { "locip" => "local_ip" }
|
|
||||||
rename => { "locport" => "source_port" }
|
|
||||||
rename => { "logid" => "log_id" }
|
|
||||||
rename => { "logver" => "log_version" }
|
|
||||||
rename => { "manuf" => "manufacturer" }
|
|
||||||
rename => { "mem" => "memory" }
|
|
||||||
rename => { "meshmode" => "mesh_mode" }
|
|
||||||
rename => { "msg" => "message" }
|
|
||||||
rename => { "nextstat" => "next_stat" }
|
|
||||||
rename => { "onwire" => "on_wire" }
|
|
||||||
rename => { "osname" => "os_name" }
|
|
||||||
rename => { "osversion" => "unauthenticated_user" }
|
|
||||||
rename => { "outintf" => "outbound_interface" }
|
|
||||||
rename => { "peer_notif" => "peer_notification" }
|
|
||||||
rename => { "phase2_name" => "phase2_name" }
|
|
||||||
rename => { "policyid" => "policy_id" }
|
|
||||||
rename => { "policytype" => "policy_type" }
|
|
||||||
rename => { "port" => "port" }
|
|
||||||
rename => { "probeproto" => "probe_protocol" }
|
|
||||||
rename => { "proto" => "protocol_number" }
|
|
||||||
rename => { "radioband" => "radio_band" }
|
|
||||||
rename => { "radioidclosest" => "radio_id_closest" }
|
|
||||||
rename => { "radioiddetected" => "radio_id_detected" }
|
|
||||||
rename => { "rcvd" => "bytes_received" }
|
|
||||||
rename => { "rcvdbyte" => "bytes_received" }
|
|
||||||
rename => { "rcvdpkt" => "packets_received" }
|
|
||||||
rename => { "remip" => "destination_ip" }
|
|
||||||
rename => { "remport" => "remote_port" }
|
|
||||||
rename => { "reqtype" => "request_type" }
|
|
||||||
rename => { "scantime" => "scan_time" }
|
|
||||||
rename => { "securitymode" => "security_mode" }
|
|
||||||
rename => { "sent" => "bytes_sent" }
|
|
||||||
rename => { "sentbyte" => "bytes_sent" }
|
|
||||||
rename => { "sentpkt" => "packets_sent" }
|
|
||||||
rename => { "session_id" => "session_id" }
|
|
||||||
rename => { "setuprate" => "setup_rate" }
|
|
||||||
rename => { "sn" => "serial" }
|
|
||||||
rename => { "snclosest" => "serial_closest_access_point" }
|
|
||||||
rename => { "sndetected" => "serial_access_point_that_detected_rogue_ap" }
|
|
||||||
rename => { "snmeshparent" => "serial_mesh_parent" }
|
|
||||||
rename => { "srccountry" => "source_country" }
|
|
||||||
rename => { "srcip" => "source_ip" }
|
|
||||||
rename => { "srcmac" => "source_mac" }
|
|
||||||
rename => { "srcname" => "source_name" }
|
|
||||||
rename => { "srcintf" => "source_interface" }
|
|
||||||
rename => { "srcport" => "source_port" }
|
|
||||||
rename => { "stacount" => "station_count" }
|
|
||||||
rename => { "stamac" => "static_mac" }
|
|
||||||
rename => { "srccountry" => "source_country" }
|
|
||||||
rename => { "srcip" => "source_ip" }
|
|
||||||
rename => { "srcmac" => "source_mac" }
|
|
||||||
rename => { "srcname" => "source_name" }
|
|
||||||
rename => { "sn" => "serial" }
|
|
||||||
rename => { "srcintf" => "source_interface" }
|
|
||||||
rename => { "srcport" => "source_port" }
|
|
||||||
rename => { "total" => "total_bytes" }
|
|
||||||
rename => { "totalsession" => "total_sessions" }
|
|
||||||
rename => { "trandisp" => "nat_translation_type" }
|
|
||||||
rename => { "tranip" => "nat_destination_ip" }
|
|
||||||
rename => { "tranport" => "nat_destination_port" }
|
|
||||||
rename => { "transip" => "nat_source_ip" }
|
|
||||||
rename => { "transport" => "nat_source_port" }
|
|
||||||
rename => { "tunnelid" => "tunnel_id" }
|
|
||||||
rename => { "tunnelip" => "tunnel_ip" }
|
|
||||||
rename => { "tunneltype" => "tunnel_type" }
|
|
||||||
rename => { "unauthuser" => "unauthenticated_user_source" }
|
|
||||||
rename => { "unauthusersource" => "os_version" }
|
|
||||||
rename => { "vendorurl" => "vendor_url" }
|
|
||||||
rename => { "vpntunnel" => "vpn_tunnel" }
|
|
||||||
rename => { "vulncat" => "vulnerability_category" }
|
|
||||||
rename => { "vulncmt" => "vulnerability_count" }
|
|
||||||
rename => { "vulnid" => "vulnerability_id" }
|
|
||||||
rename => { "vulnname" => "vulnerability_name" }
|
|
||||||
rename => { "vulnref" => "vulnerability_reference" }
|
|
||||||
rename => { "vulnscore" => "vulnerability_score" }
|
|
||||||
rename => { "xauthgroup" => "x_authentication_group" }
|
|
||||||
rename => { "xauthuser" => "x_authentication_user" }
|
|
||||||
rename => { "[SubLog][appid]" => "sub_application_id" }
|
|
||||||
rename => { "[SubLog][devid]" => "sub_device_id" }
|
|
||||||
rename => { "[SubLog][dstip]" => "sub_destination_ip" }
|
|
||||||
rename => { "[SubLog][srcip]" => "sub_source_ip" }
|
|
||||||
rename => { "[SubLog][dstport]" => "sub_destination_port" }
|
|
||||||
rename => { "[SubLog][eventtype]" => "sub_event_type" }
|
|
||||||
rename => { "[SubLog][proto]" => "sub_protocol_number" }
|
|
||||||
rename => { "[SubLog][date]" => "sub_date" }
|
|
||||||
rename => { "[SubLog][time]" => "sub_time" }
|
|
||||||
rename => { "[SubLog][srcport]" => "sub_source_port" }
|
|
||||||
rename => { "[SubLog][subtype]" => "sub_subtype" }
|
|
||||||
rename => { "[SubLog][devname]" => "sub_device_name" }
|
|
||||||
rename => { "[SubLog][itime]" => "sub_itime" }
|
|
||||||
rename => { "[SubLog][level]" => "sub_level" }
|
|
||||||
rename => { "[SubLog][logid]" => "sub_log_id" }
|
|
||||||
rename => { "[SubLog][logver]" => "sub_log_version" }
|
|
||||||
rename => { "[SubLog][type]" => "sub_event_type" }
|
|
||||||
rename => { "[SubLog][vd]" => "sub_vd" }
|
|
||||||
rename => { "[SubLog][action]" => "sub_action" }
|
|
||||||
rename => { "[SubLog][logdesc]" => "sub_destination_ip" }
|
|
||||||
rename => { "[SubLog][policyid]" => "sub_olicy_id" }
|
|
||||||
rename => { "[SubLog][reason]" => "sub_reason" }
|
|
||||||
rename => { "[SubLog][service]" => "sub_service" }
|
|
||||||
rename => { "[SubLog][sessionid]" => "sub_session_id" }
|
|
||||||
rename => { "[SubLog][src]" => "sub_source_ip" }
|
|
||||||
rename => { "[SubLog][status]" => "sub_status" }
|
|
||||||
rename => { "[SubLog][ui]" => "sub_ui" }
|
|
||||||
rename => { "[SubLog][urlfilteridx]" => "sub_url_filter_idx" }
|
|
||||||
strip => [ "bytes_sent", "bytes_received" ]
|
|
||||||
convert => [ "bytes_sent", "integer" ]
|
|
||||||
convert => [ "bytes_received", "integer" ]
|
|
||||||
convert => [ "cr_score", "integer" ]
|
|
||||||
convert => [ "cr_action", "integer" ]
|
|
||||||
convert => [ "elapsed_time", "integer" ]
|
|
||||||
convert => [ "destination_port", "integer" ]
|
|
||||||
convert => [ "source_port", "integer" ]
|
|
||||||
convert => [ "local_port", "integer" ]
|
|
||||||
convert => [ "remote_port", "integer" ]
|
|
||||||
convert => [ "packets_sent", "integer" ]
|
|
||||||
convert => [ "packets_received", "integer" ]
|
|
||||||
convert => [ "port", "integer" ]
|
|
||||||
convert => [ "ProtocolNumber", "integer" ]
|
|
||||||
convert => [ "XAuthUser", "string" ]
|
|
||||||
remove_field => [ "kv", "log" ]
|
|
||||||
}
|
|
||||||
if [tunnel_ip] == "N/A" {
|
|
||||||
mutate {
|
|
||||||
remove_field => [ "tunnel_ip" ]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [nat_destination_ip] {
|
|
||||||
mutate {
|
|
||||||
add_field => { "ips" => [ "%{nat_destination_ip}" ] }
|
|
||||||
add_field => { "destination_ips" => [ "%{nat_destination_ip}" ] }
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [sub_destination_ip] {
|
|
||||||
mutate {
|
|
||||||
add_field => { "ips" => [ "%{sub_destination_ip}" ] }
|
|
||||||
add_field => { "destination_ips" => [ "%{sub_destination_ip}" ] }
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [nat_source_ip] {
|
|
||||||
mutate {
|
|
||||||
add_field => { "ips" => [ "%{nat_source_ip}" ] }
|
|
||||||
add_field => { "source_ips" => [ "%{nat_source_ip}" ] }
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [sub_source_ip] {
|
|
||||||
mutate {
|
|
||||||
add_field => { "ips" => [ "%{sub_source_ip}" ] }
|
|
||||||
add_field => { "source_ips" => [ "%{sub_source_ip}" ] }
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [addr_ip] {
|
|
||||||
mutate {
|
|
||||||
add_field => { "ips" => [ "%{addr_ip}" ] }
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [assign_ip] {
|
|
||||||
mutate {
|
|
||||||
add_field => { "ips" => [ "%{assign_ip}" ] }
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [assigned_ip] {
|
|
||||||
mutate {
|
|
||||||
add_field => { "ips" => [ "%{assigned_ip}" ] }
|
|
||||||
}
|
|
||||||
}
|
|
||||||
grok {
|
|
||||||
match => ["message", "type=%{DATA:event_type}\s+"]
|
|
||||||
}
|
|
||||||
if [date] and [time] {
|
|
||||||
mutate {
|
|
||||||
add_field => { "receive_time" => "%{date} %{time}" }
|
|
||||||
remove_field => [ "date", "time" ]
|
|
||||||
}
|
|
||||||
date {
|
|
||||||
timezone => "America/Chicago"
|
|
||||||
match => [ "receive_time", "YYYY-MM-dd HH:mm:ss" ]
|
|
||||||
target => "receive_time"
|
|
||||||
}
|
|
||||||
mutate {
|
|
||||||
rename => { "receive_time" => "@timestamp" }
|
|
||||||
}
|
|
||||||
} else {
|
|
||||||
mutate {
|
|
||||||
add_tag => [ "missing_date" ]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
mutate {
|
|
||||||
#add_tag => [ "conf_file_6200"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,56 +0,0 @@
|
|||||||
# Author: Wes Lambert
|
|
||||||
# Updated by: Doug Burks
|
|
||||||
|
|
||||||
filter {
|
|
||||||
if [type] == "filterlog" {
|
|
||||||
dissect {
|
|
||||||
mapping => {
|
|
||||||
"message" => "%{rule_number},%{sub_rule_number},%{anchor},%{tracker_id},%{interface},%{reason},%{action},%{direction},%{ip_version},%{sub_msg}"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [ip_version] == "4" {
|
|
||||||
dissect {
|
|
||||||
mapping => {
|
|
||||||
"sub_msg" => "%{ipv4_tos},%{ipv4_ecn},%{ipv4_ttl},%{ipv4_id},%{ipv4_offset},%{ipv4_flags},%{protocol_id},%{protocol},%{protocol_length},%{source_ip},%{destination_ip},%{ip_sub_msg}"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [ip_version] == "6" {
|
|
||||||
dissect {
|
|
||||||
mapping => {
|
|
||||||
"sub_msg" => "%{class},%{flow_label},%{hop_limit},%{protocol},%{protocol_id},%{length},%{source_ip},%{destination_ip},%{ip_sub_msg}"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [protocol] == "tcp" {
|
|
||||||
dissect {
|
|
||||||
mapping => {
|
|
||||||
"ip_sub_msg" => "%{source_port},%{destination_port},%{data_length},%{tcp_flags},"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [protocol] == "udp" {
|
|
||||||
dissect {
|
|
||||||
mapping => {
|
|
||||||
"ip_sub_msg" => "%{source_port},%{destination_port},%{data_length}"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [protocol] == "Options" {
|
|
||||||
mutate {
|
|
||||||
copy => { "ip_sub_msg" => "options" }
|
|
||||||
}
|
|
||||||
mutate {
|
|
||||||
split => { "options" => "," }
|
|
||||||
}
|
|
||||||
}
|
|
||||||
mutate {
|
|
||||||
convert => [ "destination_port", "integer" ]
|
|
||||||
convert => [ "source_port", "integer" ]
|
|
||||||
convert => [ "ip_version", "integer" ]
|
|
||||||
replace => { "type" => "firewall" }
|
|
||||||
add_tag => [ "pfsense","firewall" ]
|
|
||||||
remove_field => [ "sub_msg", "ip_sub_msg" ]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,161 +0,0 @@
|
|||||||
# Author: Justin Henderson
|
|
||||||
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
|
|
||||||
# Email: justin@hasecuritysolution.com
|
|
||||||
# Last Update: 12/9/2016
|
|
||||||
|
|
||||||
filter {
|
|
||||||
if [type] == "windows" {
|
|
||||||
# json {
|
|
||||||
# source => "message"
|
|
||||||
# }
|
|
||||||
date {
|
|
||||||
match => ["EventTime", "YYYY-MM-dd HH:mm:ss"]
|
|
||||||
remove_field => [ "EventTime" ]
|
|
||||||
}
|
|
||||||
if [EventID] == 4634 {
|
|
||||||
mutate {
|
|
||||||
add_tag => [ "logoff" ]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [EventID] == 4624 or [EventID] == 528 or [EventID] == 540 or [EventID] == 552 or [EventID] == 682 or [EventID] == 4648 or [EventID] == 4778 {
|
|
||||||
mutate {
|
|
||||||
add_tag => [ "logon" ]
|
|
||||||
add_tag => [ "alert_data" ]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [EventID] == 529 or [EventID] == 4625 or [EventID] == 530 or [EventID] == 531 or [EventID] == 532 or [EventID] == 533 or [EventID] == 534 or [EventID] == 535 or [EventID] == 536 or [EventID] == 536 or [EventID] == 537 or [EventID] == 538 or [EventID] == 539 or [EventID] == 4625 or [EventID] == 4771 {
|
|
||||||
mutate {
|
|
||||||
add_tag => [ "logon_failure" ]
|
|
||||||
add_tag => [ "alert_data" ]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
# Critical event IDs to monitor
|
|
||||||
if [EventID] == 7030 or [EventID] == 4720 or [EventID] == 4722 or [EventID] == 4724 or [EventID] == 4738 or [EventID] == 4732 or [EventID] == 1102 or [EventID] == 1056 or [EventID] == 2003 or [EventID] == 2005 or [EventID] == 8003 or [EventID] == 8004 or [EventID] == 8006 or [EventID] == 8007 {
|
|
||||||
mutate {
|
|
||||||
add_tag => [ "alert_data" ]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
# Critical event IDs to monitor
|
|
||||||
if [EventID] == 5152 { drop {} }
|
|
||||||
if [EventID] == 4688 { drop {} }
|
|
||||||
if [EventID] == 4689 { drop {} } # Process Termination:Not needed due to Sysmon
|
|
||||||
if [Channel] == "Microsoft-Windows-Known Folders API Service" { drop {} }
|
|
||||||
if [EventID] == 3 and [SourceIp] =~ "255$" { drop {} }
|
|
||||||
if [EventID] == 3 and [DestinationIp] =~ "255$" { drop {} }
|
|
||||||
# Whitelist/Blacklist check
|
|
||||||
if [EventID] == 7045 {
|
|
||||||
translate {
|
|
||||||
field => "ServiceName"
|
|
||||||
destination => "ServiceCheck"
|
|
||||||
dictionary_path => "/lib/dictionaries/services.yaml"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [EventID] == 7045 and !([ServiceCheck]) {
|
|
||||||
mutate {
|
|
||||||
add_tag => [ "alert_data","new_service" ]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [ServiceCheck] == 'whitelist' {
|
|
||||||
mutate {
|
|
||||||
remove_field => [ "ServiceCheck" ]
|
|
||||||
add_tag => [ "whitelist" ]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [ServiceCheck] == 'blacklist' {
|
|
||||||
mutate {
|
|
||||||
remove_field => [ "ServiceCheck" ]
|
|
||||||
add_tag => [ "blacklist" ]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [EventID] == 5158 {
|
|
||||||
if [Application] == "System" { drop {} }
|
|
||||||
if [Application] =~ "\\windows\\system32\\spoolsv\.exe" { drop {} }
|
|
||||||
if [Application] =~ "\\windows\\system32\\wbem\\wmiprvse\.exe" { drop {} }
|
|
||||||
if [Application] =~ "mcafee" { drop {} }
|
|
||||||
if [Application] =~ "carestream" { drop {} }
|
|
||||||
if [Application] =~ "Softdent" { drop {} }
|
|
||||||
}
|
|
||||||
if [ProcessName] == "C:\\Windows\\System32\\wbem\\WmiPrvSE\.exe" and [SubjectUserName] == "SolarwindsHO" { drop {} }
|
|
||||||
if [EventID] == 4690 { drop {} }
|
|
||||||
if [EventID] == 861 and [AccountName] == "ntp" { drop {} }
|
|
||||||
if [EventID] == 5158 and [Application] =~ "\\windows\\system32\\lsass\.exe$" { drop {} }
|
|
||||||
if [EventID] == 5158 and [Application] =~ "\\windows\\system32\\svchost\.exe$" { drop {} }
|
|
||||||
if [EventID] == 5158 and [Application] =~ "\\windows\\system32\\dfsrs\.exe$" { drop {} }
|
|
||||||
if [EventID] == 5447 { drop {} }
|
|
||||||
|
|
||||||
mutate {
|
|
||||||
rename => [ "AccountName", "user" ]
|
|
||||||
rename => [ "AccountType", "account_type" ]
|
|
||||||
rename => [ "ActivityID", "activity_id" ]
|
|
||||||
rename => [ "Category", "category" ]
|
|
||||||
rename => [ "ClientAddress", "client_ip" ]
|
|
||||||
rename => [ "Channel", "channel" ]
|
|
||||||
rename => [ "DCIPAddress", "domain_controller_ip" ]
|
|
||||||
rename => [ "DCName", "domain_controller_name" ]
|
|
||||||
rename => [ "EventID", "event_id" ]
|
|
||||||
rename => [ "EventReceivedTime", "event_received_time" ]
|
|
||||||
rename => [ "EventType", "event_type" ]
|
|
||||||
rename => [ "GatewayIPAddress", "gateway_ip" ]
|
|
||||||
rename => [ "IPAddress", "client_ip" ]
|
|
||||||
rename => [ "Ipaddress", "client_ip" ]
|
|
||||||
rename => [ "IpAddress", "client_ip" ]
|
|
||||||
rename => [ "IPPort", "source_port" ]
|
|
||||||
rename => [ "OpcodeValue", "opcode_value" ]
|
|
||||||
rename => [ "PreAuthType", "preauthentication_type" ]
|
|
||||||
rename => [ "PrincipleSAMName", "user" ]
|
|
||||||
rename => [ "ProcessID", "process_id" ]
|
|
||||||
rename => [ "ProviderGUID", "providerguid" ]
|
|
||||||
rename => [ "RecordNumber", "record_number" ]
|
|
||||||
rename => [ "RemoteAddress", "destination_ip" ]
|
|
||||||
rename => [ "ServiceName", "service_name" ]
|
|
||||||
rename => [ "ServiceID", "service_id" ]
|
|
||||||
rename => [ "SeverityValue", "severity_value" ]
|
|
||||||
rename => [ "SourceAddress", "client_ip" ]
|
|
||||||
rename => [ "SourceModuleName", "source_module_name" ]
|
|
||||||
rename => [ "SourceModuleType", "source_module_type" ]
|
|
||||||
rename => [ "SourceName", "source_name" ]
|
|
||||||
rename => [ "SubjectUserName", "user" ]
|
|
||||||
rename => [ "TaskName", "task_name" ]
|
|
||||||
rename => [ "TargetDomainName", "target_domain_name" ]
|
|
||||||
rename => [ "TargetUserName", "user" ]
|
|
||||||
rename => [ "ThreadID", "thread_id" ]
|
|
||||||
rename => [ "User_ID", "user" ]
|
|
||||||
rename => [ "UserID", "user" ]
|
|
||||||
rename => [ "username", "user" ]
|
|
||||||
}
|
|
||||||
# For any accounts that are service accounts or special accounts add the tag of service_account
|
|
||||||
# This example applies the tag to any username that starts with SVC_. If you use a different
|
|
||||||
# standard change this.
|
|
||||||
if [user] =~ "^DWM-*" or [user] == "SYSTEM" or [user] == "NETWORK SERVICE" or [user] == "LOCAL SERVICE" or [user] =~ "^SVC_*" {
|
|
||||||
mutate {
|
|
||||||
add_tag => [ "service_account" ]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
# This looks for events that are typically noisy but may be of use for deep dive investigations
|
|
||||||
# A tag of noise is added to quickly filter out noise
|
|
||||||
if [event_id] == 7036 or [source_name] == "Desktop Window Manager" or [category] == "Engine Lifecycle" or [category] == "Provider Lifecycle" {
|
|
||||||
mutate {
|
|
||||||
add_tag => [ "noise" ]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
#Identify machine accounts
|
|
||||||
if [user] =~ /\$/ {
|
|
||||||
mutate {
|
|
||||||
add_tag => [ "machine", "noise" ]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
# Lower case all field names
|
|
||||||
ruby {
|
|
||||||
code => "
|
|
||||||
event_hash = event.to_hash
|
|
||||||
new_event = {}
|
|
||||||
event_hash.keys.each do |key|
|
|
||||||
new_event[key.downcase] = event[key]
|
|
||||||
end
|
|
||||||
event.instance_variable_set(:@data, new_event)"
|
|
||||||
}
|
|
||||||
mutate {
|
|
||||||
#add_tag => [ "conf_file_6300"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,49 +0,0 @@
|
|||||||
# Author: Justin Henderson
|
|
||||||
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
|
|
||||||
# Email: justin@hasecuritysolution.com
|
|
||||||
# Last Update: 12/9/2016
|
|
||||||
|
|
||||||
filter {
|
|
||||||
if [type] == "dns" and "bro" not in [tags] {
|
|
||||||
json {
|
|
||||||
source => "message"
|
|
||||||
}
|
|
||||||
# strip whitespace from message field
|
|
||||||
mutate {
|
|
||||||
strip => "message"
|
|
||||||
}
|
|
||||||
# If the message is blank, drop the log
|
|
||||||
if [Message] =~ /^$/ {
|
|
||||||
drop { }
|
|
||||||
} else {
|
|
||||||
if [type] == "dns" {
|
|
||||||
# This section is lookup for a match against the log and parsing out the fields
|
|
||||||
grok {
|
|
||||||
match => { "Message" => "(?<timestamp>%{DATE_US} %{TIME} (?:AM|PM))\s+%{DATA:thread_id}\s+%{WORD:dns_type}\s+ %{BASE16NUM:packet_id}\s+%{WORD:dns_protocol}\s+%{WORD:dns_direction}\s+%{IP:dns_ip}\s+ %{BASE16NUM:xid}\s+%{DATA:response}\s+%{WORD:dns_query_type}\s+\[%{BASE16NUM:hex_flags}\s+%{WORD:flags}\s+ %{WORD:rcode_name}\]\s+%{WORD:query_type_name}\s+%{GREEDYDATA:dns_domain}"}
|
|
||||||
match => { "Message" => "(?<timestamp>%{DATE_US} %{TIME} (?:AM|PM))\s+%{DATA:thread_id}\s+%{WORD:dns_type}\s+ %{BASE16NUM:packet_id}\s+%{WORD:dns_protocol}\s+%{WORD:dns_direction}\s+%{IP:dns_ip}\s+ %{BASE16NUM:xid}\s+%{DATA:response}\s+%{WORD:dns_query_type}\s+\[%{BASE16NUM:hex_flags}\s+%{WORD:flags}\s+%{WORD:recursion}\s+%{WORD:rcode_name}\]\s+%{WORD:query_type_name}\s+%{GREEDYDATA:dns_domain}"}
|
|
||||||
match => { "Message" => "(?<timestamp>%{DATE_US} %{TIME} (?:AM|PM))\s+%{DATA:thread_id}\s+%{WORD:dns_type}\s+ %{BASE16NUM:packet_id}\s+%{WORD:dns_protocol}\s+%{WORD:dns_direction}\s+%{IP:dns_ip}\s+ %{BASE16NUM:xid}\s+%{DATA:response}\s+%{WORD:dns_query_type}\s+\[%{BASE16NUM:hex_flags}\s+%{WORD:recursion}\s+%{WORD:rcode_name}\]\s+%{WORD:query_type_name}\s+%{GREEDYDATA:dns_domain}"}
|
|
||||||
match => { "Message" => "(?<timestamp>%{DATE_US} %{TIME} (?:AM|PM))\s+%{DATA:thread_id}\s+%{WORD:dns_type}\s+ %{BASE16NUM:packet_id}\s+%{WORD:dns_protocol}\s+%{WORD:dns_direction}\s+%{IP:dns_ip}\s+ %{BASE16NUM:xid}\s+%{DATA:response}\s+%{WORD:dns_query_type}\s+\[%{BASE16NUM:hex_flags}\s+%{WORD:rcode_name}\]\s+%{WORD:query_type_name}\s+%{GREEDYDATA:dns_domain}"}
|
|
||||||
match => { "Message" => "(?<timestamp>%{DATE_US} %{TIME} (?:AM|PM))\s+%{DATA:thread_id}\s+%{WORD:dns_type}\s+ %{BASE16NUM:packet_id}\s+%{WORD:dns_protocol}\s+%{WORD:dns_direction}\s+%{IP:dns_ip}\s+ %{BASE16NUM:xid}\s+%{WORD:dns_query_type}\s+\[%{BASE16NUM:hex_flags}\s+%{WORD:flags}\s+ %{WORD:rcode_name}\]\s+%{WORD:query_type_name}\s+%{GREEDYDATA:dns_domain}"}
|
|
||||||
# Server 2003 DNS logs do not include slashes or AM/PM in timestamp
|
|
||||||
match => { "Message" => "(?<timestamp>%{YEAR}%{MONTHNUM}%{MONTHDAY} %{TIME})\s+%{DATA:thread_id}\s+%{WORD:dns_type}\s+ %{BASE16NUM:packet_id}\s+%{WORD:dns_protocol}\s+%{WORD:dns_direction}\s+%{IP:dns_ip}\s+ %{BASE16NUM:xid}\s+%{DATA:response}\s+%{WORD:dns_query_type}\s+\[%{BASE16NUM:hex_flags}\s+%{WORD:flags}\s+ %{WORD:rcode_name}\]\s+%{WORD:query_type_name}\s+%{GREEDYDATA:dns_domain}"}
|
|
||||||
match => { "Message" => "(?<timestamp>%{YEAR}%{MONTHNUM}%{MONTHDAY} %{TIME})\s+%{DATA:thread_id}\s+%{WORD:dns_type}\s+ %{BASE16NUM:packet_id}\s+%{WORD:dns_protocol}\s+%{WORD:dns_direction}\s+%{IP:dns_ip}\s+ %{BASE16NUM:xid}\s+%{DATA:response}\s+%{WORD:dns_query_type}\s+\[%{BASE16NUM:hex_flags}\s+%{WORD:flags}\s+%{WORD:recursion}\s+%{WORD:rcode_name}\]\s+%{WORD:query_type_name}\s+%{GREEDYDATA:dns_domain}"}
|
|
||||||
match => { "Message" => "(?<timestamp>%{YEAR}%{MONTHNUM}%{MONTHDAY} %{TIME})\s+%{DATA:thread_id}\s+%{WORD:dns_type}\s+ %{BASE16NUM:packet_id}\s+%{WORD:dns_protocol}\s+%{WORD:dns_direction}\s+%{IP:dns_ip}\s+ %{BASE16NUM:xid}\s+%{DATA:response}\s+%{WORD:dns_query_type}\s+\[%{BASE16NUM:hex_flags}\s+%{WORD:recursion}\s+%{WORD:rcode_name}\]\s+%{WORD:query_type_name}\s+%{GREEDYDATA:dns_domain}"}
|
|
||||||
match => { "Message" => "(?<timestamp>%{YEAR}%{MONTHNUM}%{MONTHDAY} %{TIME})\s+%{DATA:thread_id}\s+%{WORD:dns_type}\s+ %{BASE16NUM:packet_id}\s+%{WORD:dns_protocol}\s+%{WORD:dns_direction}\s+%{IP:dns_ip}\s+ %{BASE16NUM:xid}\s+%{DATA:response}\s+%{WORD:dns_query_type}\s+\[%{BASE16NUM:hex_flags}\s+%{WORD:rcode_name}\]\s+%{WORD:query_type_name}\s+%{GREEDYDATA:dns_domain}"}
|
|
||||||
match => { "Message" => "(?<timestamp>%{YEAR}%{MONTHNUM}%{MONTHDAY} %{TIME})\s+%{DATA:thread_id}\s+%{WORD:dns_type}\s+ %{BASE16NUM:packet_id}\s+%{WORD:dns_protocol}\s+%{WORD:dns_direction}\s+%{IP:dns_ip}\s+ %{BASE16NUM:xid}\s+%{WORD:dns_query_type}\s+\[%{BASE16NUM:hex_flags}\s+%{WORD:flags}\s+ %{WORD:rcode_name}\]\s+%{WORD:query_type_name}\s+%{GREEDYDATA:dns_domain}"}
|
|
||||||
remove_field => [ "Message" ]
|
|
||||||
}
|
|
||||||
# This section attempts to convert the dns_domain into the traditional domain.com format
|
|
||||||
mutate {
|
|
||||||
gsub => [ "dns_domain", "(\(\d+\))", "." ]
|
|
||||||
}
|
|
||||||
grok {
|
|
||||||
match => { "dns_domain" => "\.%{DATA:query}\.$" }
|
|
||||||
remove_field => [ "dns_domain" ]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
mutate {
|
|
||||||
#add_tag => [ "conf_file_6301"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,92 +0,0 @@
|
|||||||
# Author: Justin Henderson
|
|
||||||
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
|
|
||||||
# Email: justin@hasecuritysolution.com
|
|
||||||
# Last Update: 12/9/2016
|
|
||||||
#
|
|
||||||
# This conf file is based on accepting logs for suricata json events
|
|
||||||
filter {
|
|
||||||
if [type] == "suricata" {
|
|
||||||
if "test_data" not in [tags] {
|
|
||||||
date {
|
|
||||||
match => [ "timestamp", "ISO8601" ]
|
|
||||||
}
|
|
||||||
} else {
|
|
||||||
mutate {
|
|
||||||
remove_field => [ "netflow.start","netflow.end","timestamp" ]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [event_type] == "fileinfo" {
|
|
||||||
ruby {
|
|
||||||
code => "if event['event_type'] == 'fileinfo'; event['fileinfo']['type']=event['fileinfo']['magic'].to_s.split(',')[0]; end;"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
# I recommend renaming the fields below to be consistent with other log sources. This makes it easy to "pivot" between logs
|
|
||||||
mutate {
|
|
||||||
rename => [ "src_ip", "source_ip" ]
|
|
||||||
rename => [ "dest_ip", "destination_ip" ]
|
|
||||||
rename => [ "src_port", "source_port" ]
|
|
||||||
rename => [ "dest_port", "destination_port" ]
|
|
||||||
}
|
|
||||||
# This will translate the alert.severity field into a severity field of either High, Medium, or Low
|
|
||||||
if [event_type] == "alert" {
|
|
||||||
if [alert][severity] == 1 {
|
|
||||||
mutate {
|
|
||||||
add_field => { "severity" => "High" }
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [alert][severity] == 2 {
|
|
||||||
mutate {
|
|
||||||
add_field => { "severity" => "Medium" }
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [alert][severity] == 3 {
|
|
||||||
mutate {
|
|
||||||
add_field => { "severity" => "Low" }
|
|
||||||
}
|
|
||||||
}
|
|
||||||
# If the alert is a Snort GPL alert break it apart for easier reading and categorization
|
|
||||||
if [alert][signature] =~ "GPL " {
|
|
||||||
# This will parse out the category type from the alert
|
|
||||||
grok {
|
|
||||||
match => { "[alert][signature]" => "GPL\s+%{DATA:category}\s" }
|
|
||||||
}
|
|
||||||
# This will store the category
|
|
||||||
mutate {
|
|
||||||
add_field => { "rule_type" => "Snort GPL" }
|
|
||||||
lowercase => [ "category" ]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
# If the alert is an Emerging Threat alert break it apart for easier reading and categorization
|
|
||||||
if [alert][signature] =~ "ET " {
|
|
||||||
# This will parse out the category type from the alert
|
|
||||||
grok {
|
|
||||||
match => { "[alert][signature]" => "ET\s+%{DATA:category}\s" }
|
|
||||||
}
|
|
||||||
# This will store the category
|
|
||||||
mutate {
|
|
||||||
add_field => { "rule_type" => "Emerging Threats" }
|
|
||||||
lowercase => [ "category" ]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
# This section adds URLs to lookup information about a rule online
|
|
||||||
if [rule_type] == "Snort GPL" {
|
|
||||||
mutate {
|
|
||||||
add_field => [ "signature_info", "https://www.snort.org/search?query=%{[alert][gid]}-%{[alert][signature_id]}" ]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [rule_type] == "Emerging Threats" {
|
|
||||||
mutate {
|
|
||||||
add_field => [ "signature_info", "http://doc.emergingthreats.net/%{[alert][signature_id]}" ]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if "_grokparsefailure" not in [tags] and "_csvparsefailure" not in [tags] and "_jsonparsefailure" not in [tags] {
|
|
||||||
# mutate {
|
|
||||||
# remove_field => [ "message" ]
|
|
||||||
# }
|
|
||||||
}
|
|
||||||
mutate {
|
|
||||||
#add_tag => [ "conf_file_6400"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,160 +0,0 @@
|
|||||||
# Author: Wes Lambert
|
|
||||||
#
|
|
||||||
# Last Update: 09/19/2018
|
|
||||||
#
|
|
||||||
# This conf file is based on accepting logs from OSSEC
|
|
||||||
|
|
||||||
filter {
|
|
||||||
# OSSEC Alerts
|
|
||||||
if [type] == "ossec" {
|
|
||||||
|
|
||||||
# Sysmon/Autoruns logs transported by OSSEC
|
|
||||||
if [message] =~ "Microsoft-Windows-Sysmon" {
|
|
||||||
mutate {
|
|
||||||
replace => { "type" => "sysmon" }
|
|
||||||
add_tag => [ "ossec" ]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [message] =~ "AR-LOG" {
|
|
||||||
mutate {
|
|
||||||
replace => { "type" => "autoruns" }
|
|
||||||
add_tag => [ "ossec" ]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
# If message looks like json, try to parse it as such. Otherwise, grok.
|
|
||||||
if [message] =~ /^{.*}$/ {
|
|
||||||
json {
|
|
||||||
source => "message"
|
|
||||||
}
|
|
||||||
mutate {
|
|
||||||
rename => { "rule" => "wazuh-rule" }
|
|
||||||
rename => { "[wazuh-rule][level]" => "alert_level" }
|
|
||||||
rename => { "[wazuh-rule][description]" => "description" }
|
|
||||||
rename => { "[data][srcuser]" => "username" }
|
|
||||||
rename => { "[data][dstuser]" => "escalated_user" }
|
|
||||||
rename => { "[data][command]" => "command" }
|
|
||||||
rename => { "[predecoder][program_name]" => "process" }
|
|
||||||
|
|
||||||
}
|
|
||||||
# Wazuh 3.8.2
|
|
||||||
if [data][EventChannel] {
|
|
||||||
mutate {
|
|
||||||
rename => { "[data][EventChannel][EventData][User]" => "username" }
|
|
||||||
rename => { "[data][EventChannel][System][EventID]" => "event_id" }
|
|
||||||
rename => { "[data][EventChannel][EventData][DestinationPort]" => "destination_port" }
|
|
||||||
rename => { "[data][EventChannel][EventData][DestinationIp]" => "destination_ip" }
|
|
||||||
rename => { "[data][EventChannel][EventData][SourcePort]" => "source_port" }
|
|
||||||
rename => { "[data][EventChannel][EventData][SourceIp]" => "source_ip" }
|
|
||||||
rename => { "[data][EventChannel][EventData][SourceHostname]" => "source_hostname" }
|
|
||||||
rename => { "[data][EventChannel][EventData][DestinationHostname]" => "destination_hostname" }
|
|
||||||
}
|
|
||||||
}
|
|
||||||
# Wazuh 3.9.2
|
|
||||||
if [data][win] {
|
|
||||||
mutate {
|
|
||||||
rename => { "[data][win][eventdata][user]" => "username" }
|
|
||||||
rename => { "[data][win][system][eventID]" => "event_id" }
|
|
||||||
rename => { "[data][win][eventdata][destinationPort]" => "destination_port" }
|
|
||||||
rename => { "[data][win][eventdata][destinationIp]" => "destination_ip" }
|
|
||||||
rename => { "[data][win][eventdata][sourcePort]" => "source_port" }
|
|
||||||
rename => { "[data][win][eventdata][sourceIp]" => "source_ip" }
|
|
||||||
rename => { "[data][win][eventdata][sourceHostname]" => "source_hostname" }
|
|
||||||
rename => { "[data][win][eventdata][destinationHostname]" => "destination_hostname" }
|
|
||||||
}
|
|
||||||
}
|
|
||||||
} else {
|
|
||||||
grok {
|
|
||||||
match => ["message", "Alert Level: %{NONNEGINT;alert_level}; Rule: %{NONNEGINT:rule} - %{DATA:description}; Location: %{DATA:location}; user: +%{DATA:username}; %{SYSLOGTIMESTAMP} %{DATA:host} %{DATA:process}\[%{INT:pid}]: %{GREEDYDATA:details}",
|
|
||||||
"message", "Alert Level: %{NONNEGINT:alert_level}; Rule: %{NONNEGINT:rule} - %{DATA:description}; Location: %{DATA:location}; %{SYSLOGTIMESTAMP:timestamp} %{DATA:host} %{DATA:process}\[%{NONNEGINT:pid}]: %{GREEDYDATA:details}",
|
|
||||||
"message", "Alert Level: %{NONNEGINT:alert_level}; Rule: %{NONNEGINT:rule} - %{DATA:description}; Location: %{DATA:location}; %{SYSLOGTIMESTAMP} %{DATA:host} %{DATA:process}\[%{NONNEGINT:pid}]: %{GREEDYDATA:details}",
|
|
||||||
"message", "Alert Level: %{NONNEGINT:alert_level}; Rule: %{NONNEGINT:rule} - %{DATA:description}; Location: %{DATA:location}; %{SYSLOGTIMESTAMP:timestamp} %{DATA:host} %{DATA:program}: +%{DATA:username} : TTY=%{DATA:tty} ; PWD=%{DATA:dir} ; USER=%{DATA:escalated_user} ; COMMAND=%{GREEDYDATA:command}",
|
|
||||||
"message", "Alert Level: %{NONNEGINT:alert_level}; Rule: %{NONNEGINT:rule} - %{DATA:description}; Location: %{DATA:location}; %{SYSLOGTIMESTAMP:timestamp} %{DATA:host} %{DATA:program}: %{GREEDYDATA:details}",
|
|
||||||
"message", "Alert Level: %{NONNEGINT:alert_level}; Rule: %{NONNEGINT:rule} - %{DATA:description}; Location: %{DATA:location}; %{SYSLOGTIMESTAMP:timestamp} %{DATA:host} %{DATA:program}: +%{DATA:username} : %{GREEDYDATA:details}",
|
|
||||||
"message", "Alert Level: %{NONNEGINT:alert_level}; Rule: %{NONNEGINT:rule} - %{DATA:description}; Location: %{DATA:location}; srcip: %{IP:source_ip};%{GREEDYDATA:details}",
|
|
||||||
"message", "Alert Level: %{NONNEGINT:alert_level}; Rule: %{NONNEGINT:rule} - %{DATA:description}; Location: %{DATA:location}; %{DATA:username}: %{DATA}: \'%{DATA}': %{DATA:interface}: %{INT:num_packets}",
|
|
||||||
"message", "Alert Level: %{NONNEGINT:alert_level}; Rule: %{NONNEGINT:rule} - %{DATA:description}; Location: %{DATA:location}; %{DATA:username}: %{GREEDYDATA:details}.",
|
|
||||||
"message", "Alert Level: %{NONNEGINT:alert_Level}; Rule: %{NONNEGINT:Rule} - %{DATA:Description}; Location: %{DATA:location}; user: +%{DATA:username};",
|
|
||||||
"message", "Alert Level: %{NONNEGINT:alert_level}; Rule: %{NONNEGINT:rule} - %{DATA:description}; Location: %{DATA:location}; %{DATA}: %{DATA}: \'%{DATA}': %{DATA:interface}: %{NONNEGINT:num_packets}",
|
|
||||||
"message", "Alert Level: %{NONNEGINT:alert_level}; Rule: %{NONNEGINT:rule} - %{DATA:description}; Location: %{DATA:location}; %{GREEDYDATA:details}"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
# Add tag for OSSEC alerts
|
|
||||||
if [alert_level] {
|
|
||||||
mutate {
|
|
||||||
add_tag => [ "alert" ]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
translate {
|
|
||||||
field => "alert_level"
|
|
||||||
|
|
||||||
destination => "classification"
|
|
||||||
|
|
||||||
dictionary => [
|
|
||||||
"1", "None",
|
|
||||||
"2", "System low priority notification",
|
|
||||||
"3", "Successful/authorized event",
|
|
||||||
"4", "System low priority error",
|
|
||||||
"5", "User generated error",
|
|
||||||
"6", "Low relevance attack",
|
|
||||||
"7", '"Bad word" matching',
|
|
||||||
"8", "First time seen",
|
|
||||||
"9", "Error from invalid source",
|
|
||||||
"10", "Multiple user generated errors",
|
|
||||||
"11", "Integrity checking warning",
|
|
||||||
"12", "High importance event",
|
|
||||||
"13", "Unusal error (high importance)",
|
|
||||||
"14", "High importance security event",
|
|
||||||
"15", "Severe attack"
|
|
||||||
]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
# OSSEC Archive Logs
|
|
||||||
if [type] == "ossec_archive" {
|
|
||||||
|
|
||||||
# Sysmon/Autoruns logs transported by OSSEC
|
|
||||||
if [message] =~ "Microsoft-Windows-Sysmon" {
|
|
||||||
mutate {
|
|
||||||
replace => { "type" => "sysmon" }
|
|
||||||
add_tag => [ "ossec" ]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [message] =~ "AR-LOG" {
|
|
||||||
mutate {
|
|
||||||
replace => { "type" => "autoruns" }
|
|
||||||
add_tag => [ "ossec" ]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
# If message looks like json, try to parse it as such. Otherwise, grok.
|
|
||||||
if [message] =~ /^{.*}$/ {
|
|
||||||
json {
|
|
||||||
source => "message"
|
|
||||||
}
|
|
||||||
mutate {
|
|
||||||
rename => [ "rule", "wazuh-rule" ]
|
|
||||||
rename => [ "[wazuh-rule][level]", "alert_level" ]
|
|
||||||
rename => [ "[wazuh-rule][description]", "description" ]
|
|
||||||
rename => [ "[data][srcuser]", "username" ]
|
|
||||||
rename => [ "[data][dstuser]", "escalated_user" ]
|
|
||||||
rename => [ "[data][command]", "command" ]
|
|
||||||
rename => [ "[predecoder][program_name]", "process" ]
|
|
||||||
}
|
|
||||||
} else {
|
|
||||||
grok {
|
|
||||||
match => ["message",'%{YEAR:year} %{SYSLOGTIMESTAMP:timestamp} %{DATA:location} %{IP:source_ip} - %{DATA:username} \[%{DATA:request_timestamp}] "%{DATA:method} %{DATA:requested_resource} %{DATA:protocol}\/%{DATA:protocol_version}" %{NONNEGINT:status_code} %{NONNEGINT:object_size} "%{DATA:referrer}" "%{DATA:user_agent}"',
|
|
||||||
"message","%{YEAR:year} %{SYSLOGTIMESTAMP:timestamp} %{DATA:location} %{SYSLOGTIMESTAMP:ossec_timestamp} %{DATA:host} %{DATA:process}\[%{NONNEGINT:pid}]: \(%{DATA:username}\) CMD \(%{DATA:command}\)",
|
|
||||||
"message", "%{YEAR:year} %{SYSLOGTIMESTAMP:timestamp} %{DATA:location} %{GREEDYDATA:details}","message","%{YEAR:year} %{SYSLOGTIMESTAMP:timestamp} %{DATA:location} %{SYSLOGTIMESTAMP:ossec_timestamp} %{DATA:ossec_host} %{DATA:process}\[%{NONNEGINT:pid}]: %{GREEDYDATA:details}",
|
|
||||||
"message","%{DATA:age} %{DATA:program} %{DATA} '%{DATA:checksum}'",
|
|
||||||
"message", "%{DATA:username} : TTY=%{DATA:tty} ; PWD=%{DATA:dir} ; USER=%{DATA:escalated_user} ; COMMAND=%{GREEDYDATA:command}"]
|
|
||||||
remove_field => [ "ossec_timestamp" ]
|
|
||||||
}
|
|
||||||
mutate {
|
|
||||||
convert => [ "status_code", "integer" ]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,118 +0,0 @@
|
|||||||
# Author: Wes Lambert
|
|
||||||
# wlambertts@gmail.com
|
|
||||||
#
|
|
||||||
# This conf file is based on accepting Sysmon logs from OSSEC
|
|
||||||
#
|
|
||||||
# Parse using grok
|
|
||||||
filter {
|
|
||||||
# OSSEC Logs and Alerts
|
|
||||||
if [type] == "sysmon" or "sysmon" in [tags] {
|
|
||||||
if [message] !~ /^{.*}$/ {
|
|
||||||
#mutate { replace => { "type" => "sysmon" } }
|
|
||||||
grok {
|
|
||||||
# match => ["message","%{YEAR:year} %{SYSLOGTIMESTAMP:timestamp} %{DATA:location} %{IP:source_ip}->WinEvtLog %{YEAR:year} %{SYSLOGTIMESTAMP:ossec_timestamp} WinEvtLog: Microsoft-Windows-Sysmon/Operational: INFORMATION\(%{INT:sysmon_event_id}\):"]
|
|
||||||
match => ["message", "%{YEAR:year}%{SPACE}%{SYSLOGTIMESTAMP:timestamp}%{SPACE}%{DATA:location}%{SPACE}(any|%{IP:source_ip})->WinEvtLog%{SPACE}%{YEAR:year}%{SPACE}%{SYSLOGTIMESTAMP:ossec_timestamp}%{SPACE}WinEvtLog:%{SPACE}Microsoft-Windows-Sysmon/Operational:%{SPACE}INFORMATION\(%{INT:event_id}\):%{SPACE}%{GREEDYDATA:rest_of_msg}"]
|
|
||||||
}
|
|
||||||
mutate {
|
|
||||||
convert => ["event_id", "integer"]
|
|
||||||
remove_field => ["timestamp"]
|
|
||||||
remove_field => ["year"]
|
|
||||||
}
|
|
||||||
if [event_id] == 1 {
|
|
||||||
grok {
|
|
||||||
match => ["rest_of_msg", "Microsoft-Windows-Sysmon:%{SPACE}SYSTEM:%{SPACE}NT%{SPACE}AUTHORITY:%{SPACE}%{DATA:hostname}:%{SPACE}%{DATA:event_type}:%{SPACE}UtcTime:%{SPACE}%{DATA:sysmon_timestamp}%{SPACE}ProcessGuid:%{SPACE}\{%{DATA:process_guid}\}%{SPACE}ProcessId:%{SPACE}%{INT:process_id}%{SPACE}Image:%{SPACE}%{DATA:image_path}%{SPACE}CommandLine:%{SPACE}%{DATA:process_name} %{DATA:process_arguments}%{SPACE}CurrentDirectory:%{SPACE}%{DATA:current_directory}%{SPACE}User:%{SPACE}%{DATA:username}%{SPACE}LogonGuid:%{SPACE}\{%{DATA:logon_guid}\}%{SPACE}LogonId:%{SPACE}%{DATA:logon_id}%{SPACE}TerminalSessionId:%{SPACE}%{INT:terminal_id}%{SPACE}IntegrityLevel:%{SPACE}%{DATA:integrity_level}%{SPACE}Hashes:%{SPACE}MD5=%{DATA:md5},SHA256=%{DATA:sha256}%{SPACE}ParentProcessGuid:%{SPACE}\{%{DATA:parent_process_guid}\}%{SPACE}ParentProcessId:%{SPACE}%{NONNEGINT:parent_process_id}%{SPACE}ParentImage:%{SPACE}%{DATA:parent_image_path}%{SPACE}ParentCommandLine:%{SPACE}%{GREEDYDATA:parent_process_name}",
|
|
||||||
"rest_of_msg", 'Microsoft-Windows-Sysmon:%{SPACE}SYSTEM:%{SPACE}NT%{SPACE}AUTHORITY:%{SPACE}%{DATA:hostname}:%{SPACE}%{DATA:event_type}:%{SPACE}UtcTime:%{SPACE}%{DATA:sysmon_timestamp}%{SPACE}ProcessGuid:%{SPACE}\{%{DATA:process_guid}\}%{SPACE}ProcessId:%{SPACE}%{INT:process_id}%{SPACE}Image:%{SPACE}%{DATA:image_path}%{SPACE}CommandLine:%{SPACE}"%{DATA:process_name}"%{SPACE}%{DATA:process_arguments}%{SPACE}CurrentDirectory:%{SPACE}%{DATA:current_directory}%{SPACE}User:%{SPACE}%{DATA:username}%{SPACE}LogonGuid:%{SPACE}\{%{DATA:logon_guid}\}%{SPACE}LogonId:%{SPACE}%{DATA:logon_id}%{SPACE}TerminalSessionId:%{SPACE}%{INT:terminal_id}%{SPACE}IntegrityLevel:%{DATA:integrity_level}',
|
|
||||||
"rest_of_msg", "Microsoft-Windows-Sysmon/Operational:%{SPACE}INFORMATION(%{INT:event_id}):%{SPACE}Microsoft-Windows-Sysmon:%{SPACE}SYSTEM:%{SPACE}NT AUTHORITY:%{SPACE}%{DATA:hostname}:%{SPACE}%{DATA:event_type}:%{SPACE}UtcTime:%{SPACE}%{DATA:sysmon_timestamp}%{SPACE}ProcessGuid:%{SPACE}{%{DATA:process_guid}}%{SPACE}ProcessId:%{SPACE}%{INT:process_id}%{SPACE}Image:%{SPACE}%{DATA:image_path}%{SPACE}CommandLine:%{SPACE}%{DATA:process_name}%{SPACE}%{DATA:process_arguments}CurrentDirectory:%{SPACE}%{DATA:current_directory}%{SPACE}User:%{SPACE}%{DATA:username}%{SPACE}LogonGuid:%{SPACE}{%{DATA:logon_guid}}%{SPACE}LogonId:%{SPACE}%{DATA:logon_id}%{SPACE}TerminalSessionId:%{SPACE}%{INT:terminal_id}%{SPACE}IntegrityLevel:%{SPACE}%{DATA:integrity_level}%{SPACE}Hashes:%{SPACE}MD5=%{DATA:md5},SHA256=%{DATA:sha256}%{SPACE}ParentProcessGuid:%{SPACE}{%{DATA:parent_process_guid}}%{SPACE}ParentProcessId:%{SPACE}%{NONNEGINT:parent_process_id}%{SPACE}ParentImage:%{SPACE}%{DATA:parent_image_path}%{SPACE}ParentCommandLine:%{SPACE}%{GREEDYDATA:parent_process_name}"]
|
|
||||||
}
|
|
||||||
mutate {
|
|
||||||
convert => ["process_guid", "integer"]
|
|
||||||
convert => ["process_id", "integer"]
|
|
||||||
add_tag => ["process_creation"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [event_id] == 3 {
|
|
||||||
mutate {
|
|
||||||
remove_field => ["source_ip"]
|
|
||||||
}
|
|
||||||
grok {
|
|
||||||
match => ["rest_of_msg", "Microsoft-Windows-Sysmon:%{SPACE}SYSTEM:%{SPACE}NT%{SPACE}AUTHORITY:%{SPACE}%{DATA:hostname}:%{SPACE}%{DATA:event_type}:%{SPACE}UtcTime:%{SPACE}%{DATA:sysmon_timestamp}%{SPACE}ProcessGuid:%{SPACE}\{%{DATA:process_guid}\}%{SPACE}ProcessId:%{SPACE}%{NONNEGINT:process_id}%{SPACE}Image:%{SPACE}%{DATA:image_path}%{SPACE}User:%{SPACE}%{DATA:username}%{SPACE}Protocol:%{SPACE}%{DATA:protocol}%{SPACE}Initiated:%{SPACE}%{DATA:initiated}%{SPACE}SourceIsIpv6:%{SPACE}%{DATA:is_source_ipv6}%{SPACE}SourceIp:%{SPACE}%{IP:source_ip}%{SPACE}SourceHostname:%{SPACE}%{DATA:source_hostname}%{SPACE}SourcePort:%{SPACE}%{NONNEGINT:source_port}%{SPACE}SourcePortName:%{SPACE}%{DATA:source_port_name}%{SPACE}DestinationIsIpv6:%{SPACE}%{DATA:dest_is_ipv6}%{SPACE}DestinationIp:%{SPACE}%{IP:destination_ip}%{SPACE}DestinationHostname:%{SPACE}%{DATA:destination_hostname}%{SPACE}DestinationPort:%{SPACE}%{NONNEGINT:destination_port}%{SPACE}DestinationPortName:%{SPACE}%{GREEDYDATA:destination_port_name}"]
|
|
||||||
}
|
|
||||||
mutate {
|
|
||||||
convert => ["process_guid", "integer"]
|
|
||||||
convert => ["process_id", "integer"]
|
|
||||||
convert => ["source_port", "integer"]
|
|
||||||
convert => ["destination_port", "integer"]
|
|
||||||
add_tag => ["network_connection"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [event_id] == 5 {
|
|
||||||
grok {
|
|
||||||
match => ["rest_of_msg", "Microsoft-Windows-Sysmon:%{SPACE}SYSTEM:%{SPACE}NT%{SPACE}AUTHORITY:%{SPACE}%{DATA:hostname}:%{SPACE}%{DATA:event_type}:%{SPACE}UtcTime:%{SPACE}%{DATA:sysmon_timestamp}%{SPACE}ProcessGuid:%{SPACE}\{%{DATA:process_guid}\}%{SPACE}ProcessId:%{SPACE}%{NONNEGINT:process_id}%{SPACE}Image:%{SPACE}%{GREEDYDATA:image_path}"]
|
|
||||||
}
|
|
||||||
mutate {
|
|
||||||
convert => ["process_guid", "integer"]
|
|
||||||
convert => ["process_id", "integer"]
|
|
||||||
add_tag => ["process_termination"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [event_id] == 11 {
|
|
||||||
grok {
|
|
||||||
match => ["rest_of_msg","Microsoft-Windows-Sysmon:%{SPACE}SYSTEM:%{SPACE}NT%{SPACE}AUTHORITY:%{SPACE}%{DATA:hostname}:%{SPACE}%{DATA:event_type}:%{SPACE}UtcTime:%{SPACE}%{DATA:sysmon_timestamp}%{SPACE}ProcessGuid:%{SPACE}\{%{DATA:process_guid}\}%{SPACE}ProcessId:%{SPACE}%{NONNEGINT:process_id}%{SPACE}Image:%{SPACE}%{DATA:image_path}%{SPACE}TargetFilename:%{SPACE}%{DATA:target_filename}%{SPACE}CreationUtcTime:%{SPACE}%{DATA:creation_time}%{SPACE}"]
|
|
||||||
}
|
|
||||||
mutate {
|
|
||||||
convert => ["process_guid", "integer"]
|
|
||||||
convert => ["process_id", "integer"]
|
|
||||||
add_tag => ["file_created"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
mutate {
|
|
||||||
remove_field => ["rest_of_msg"]
|
|
||||||
}
|
|
||||||
} else {
|
|
||||||
mutate {
|
|
||||||
rename => { "[data][srcuser]" => "username" }
|
|
||||||
rename => { "[data][id]" => "event_id" }
|
|
||||||
rename => { "[data][dstport]" => "destination_port" }
|
|
||||||
rename => { "[data][dstip]" => "destination_ip" }
|
|
||||||
rename => { "[data][srcip]" => "source_ip" }
|
|
||||||
rename => { "[data][sysmon][image]" => "image_path" }
|
|
||||||
rename => { "[data][sysmon][parentImage]" => "parent_image_path" }
|
|
||||||
rename => { "[data][sysmon][targetfilename]" => "target_filename" }
|
|
||||||
rename => { "[data][sysmon][sourceHostname]" => "source_hostname" }
|
|
||||||
rename => { "[data][sysmon][destinationHostname]" => "destination_hostname" }
|
|
||||||
}
|
|
||||||
# Wazuh 3.8.2
|
|
||||||
if [data][EventChannel] {
|
|
||||||
mutate {
|
|
||||||
rename => { "[data][EventChannel][EventData][User]" => "username" }
|
|
||||||
rename => { "[data][EventChannel][System][EventID]" => "event_id" }
|
|
||||||
rename => { "[data][EventChannel][EventData][DestinationPort]" => "destination_port" }
|
|
||||||
rename => { "[data][EventChannel][EventData][DestinationIp]" => "destination_ip" }
|
|
||||||
rename => { "[data][EventChannel][EventData][SourcePort]" => "source_port" }
|
|
||||||
rename => { "[data][EventChannel][EventData][SourceIp]" => "source_ip" }
|
|
||||||
rename => { "[data][EventChannel][EventData][Image]" => "image_path" }
|
|
||||||
rename => { "[data][EventChannel][EventData][ParentImage]" => "parent_image_path" }
|
|
||||||
rename => { "[data][EventChannel][EventData][TargetFilename]" => "target_filename" }
|
|
||||||
rename => { "[data][EventChannel][EventData][SourceHostname]" => "source_hostname" }
|
|
||||||
rename => { "[data][EventChannel][EventData][DestinationHostname]" => "destination_hostname" }
|
|
||||||
}
|
|
||||||
}
|
|
||||||
# Wazuh 3.9.2
|
|
||||||
if [data][win] {
|
|
||||||
mutate {
|
|
||||||
rename => { "[data][win][eventdata][user]" => "username" }
|
|
||||||
rename => { "[data][win][system][eventID]" => "event_id" }
|
|
||||||
rename => { "[data][win][eventdata][destinationPort]" => "destination_port" }
|
|
||||||
rename => { "[data][win][eventdata][destinationIp]" => "destination_ip" }
|
|
||||||
rename => { "[data][win][eventdata][sourcePort]" => "source_port" }
|
|
||||||
rename => { "[data][win][eventdata][sourceIp]" => "source_ip" }
|
|
||||||
rename => { "[data][win][eventdata][image]" => "image_path" }
|
|
||||||
rename => { "[data][win][eventdata][parentImage]" => "parent_image_path" }
|
|
||||||
rename => { "[data][win][eventdata][targetFilename]" => "target_filename" }
|
|
||||||
rename => { "[data][win][eventdata][sourceHostname]" => "source_hostname" }
|
|
||||||
rename => { "[data][win][eventdata][destinationHostname]" => "destination_hostname" }
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,43 +0,0 @@
|
|||||||
# Author: Wes Lambert
|
|
||||||
# wlambertts@gmail.com
|
|
||||||
#
|
|
||||||
# Updated by: Dustin Lee
|
|
||||||
# Last Update: 06/13/2019
|
|
||||||
#
|
|
||||||
# This conf file is based on accepting Autoruns logs from OSSEC
|
|
||||||
#
|
|
||||||
# Parse using grok
|
|
||||||
filter {
|
|
||||||
if [type] == "autoruns" or "autoruns" in [tags] {
|
|
||||||
if [message] !~ /^{.*}$/ {
|
|
||||||
grok {
|
|
||||||
match => [
|
|
||||||
"message", "%{YEAR:year} %{SYSLOGTIMESTAMP:ossec_timestamp} \(%{DATA:ossec_agent_name}\) %{IP:source_ip}->%{DATA:location} %{DATA:log_name}\|%{DATA:hostname}\|%{DATESTAMP:log_timestamp}\|%{DATA:event_timestamp}\|%{DATA:image_timestamp}\|%{DATA:entry_location}\|%{DATA:entry}\|%{DATA:enabled}\|%{DATA:category}\|%{DATA:profile}\|%{DATA:description}\|%{DATA:signer}\|%{DATA:company}\|%{DATA:image_path}\|%{DATA:version}\|%{DATA:launch_string}\|%{DATA:md5}\|%{DATA:sha1}\|%{DATA:pesha1}\|%{DATA:pesha256}\|%{DATA:sha256}\|%{DATA:imphash}",
|
|
||||||
"message", "%{YEAR:year} %{SYSLOGTIMESTAMP:ossec_timestamp} \(%{DATA:ossec_agent_name}\) %{IP:source_ip}->%{DATA:location} %{DATA:log_name}\|%{DATA:hostname}\|%{DATESTAMP:log_timestamp}\|%{DATA:event_timestamp}\|%{DATA:entry_location}\|%{DATA:entry}\|%{DATA:enabled}\|%{DATA:category}\|%{DATA:profile}\|%{DATA:description}\|%{DATA:signer}\|%{DATA:company}\|%{DATA:image_path}\|%{DATA:version}\|%{DATA:launch_string}\|%{DATA:md5}\|%{DATA:sha1}\|%{DATA:pesha1}\|%{DATA:pesha256}\|%{DATA:sha256}\|%{DATA:imphash}"
|
|
||||||
]
|
|
||||||
}
|
|
||||||
#csv {
|
|
||||||
# columns => ["log_name","entry_location","entry","enabled","category","autoruns_description","signer","company","image_path","version","launch_string","md5","sha1","pesha1","pesha256","sha256","imphash"]
|
|
||||||
# separator => "|"
|
|
||||||
# }
|
|
||||||
mutate {
|
|
||||||
remove_field => [ "year" ]
|
|
||||||
remove_field => [ "timestamp" ]
|
|
||||||
}
|
|
||||||
} else {
|
|
||||||
grok {
|
|
||||||
match => [
|
|
||||||
"full_log", "AR-LOG\|%{DATA:hostname}\|%{DATA:event_timestamp}\|%{DATA:image_timestamp}\|%{DATA:entry_location}\|%{DATA:entry}\|%{DATA:enabled}\|%{DATA:category}\|%{DATA:profile}\|%{DATA:description}\|%{DATA:signer}\|%{DATA:company}\|%{DATA:image_path}\|%{DATA:version}\|%{DATA:launch_string}\|%{DATA:md5}\|%{DATA:sha1}\|%{DATA:pesha1}\|%{DATA:pesha256}\|%{DATA:sha256}\|%{DATA:imphash}",
|
|
||||||
"full_log", "AR-LOG\|%{DATA:hostname}\|%{DATA:event_timestamp}\|%{DATA:entry_location}\|%{DATA:entry}\|%{DATA:enabled}\|%{DATA:category}\|%{DATA:profile}\|%{DATA:description}\|%{DATA:signer}\|%{DATA:company}\|%{DATA:image_path}\|%{DATA:version}\|%{DATA:launch_string}\|%{DATA:md5}\|%{DATA:sha1}\|%{DATA:pesha1}\|%{DATA:pesha256}\|%{DATA:sha256}\|%{DATA:imphash}"
|
|
||||||
]
|
|
||||||
}
|
|
||||||
mutate {
|
|
||||||
# Rename fields
|
|
||||||
}
|
|
||||||
}
|
|
||||||
date {
|
|
||||||
match => [ "image_timestamp", "yyyyMMdd-HHmmss" ]
|
|
||||||
target => "image_timestamp"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,23 +0,0 @@
|
|||||||
# Author: Wes Lambert
|
|
||||||
#
|
|
||||||
# Last Update: 09/24/2018
|
|
||||||
#
|
|
||||||
# This conf file is based on accepting Sysmon logs from winlogbeat
|
|
||||||
|
|
||||||
filter {
|
|
||||||
if "beat" in [tags] and [source_name] =~ "Microsoft-Windows-Sysmon" {
|
|
||||||
mutate {
|
|
||||||
replace => { "type" => "sysmon" }
|
|
||||||
rename => { "[event_data][User]" => "username" }
|
|
||||||
rename => { "[event_data][DestinationPort]" => "destination_port" }
|
|
||||||
rename => { "[event_data][DestinationIp]" => "destination_ip" }
|
|
||||||
rename => { "[event_data][SourceIp]" => "source_ip" }
|
|
||||||
rename => { "[event_data][Image]" => "image_path" }
|
|
||||||
rename => { "[event_data][ParentImage]" => "parent_image_path" }
|
|
||||||
rename => { "[data][sysmon][targetfilename]" => "target_filename" }
|
|
||||||
rename => { "[event_data][SourceHostname]" => "source_hostname" }
|
|
||||||
rename => { "[event_data][DestinationHostname]" => "destination_hostname" }
|
|
||||||
rename => { "[event_data][TargetFilename]" => "target_filename" }
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,17 +0,0 @@
|
|||||||
# Author: Doug Burks
|
|
||||||
#
|
|
||||||
# Last Update: 09/24/2018
|
|
||||||
#
|
|
||||||
# This conf file is for beat data
|
|
||||||
|
|
||||||
filter {
|
|
||||||
if "beat" in [tags] {
|
|
||||||
mutate {
|
|
||||||
# As of beats 6.3.0, host is now an object:
|
|
||||||
# https://www.elastic.co/guide/en/beats/libbeat/current/release-notes-6.3.0.html
|
|
||||||
# This creates a conflict with our existing host string.
|
|
||||||
# So let's rename the host object to beat_host.
|
|
||||||
rename => { "host" => "beat_host" }
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,23 +0,0 @@
|
|||||||
# Author: Josh Brower
|
|
||||||
# Last Update: 12/28/2018
|
|
||||||
# If log is tagged osquery and there is an eventid column - then cleanup and parse out the EventData column
|
|
||||||
|
|
||||||
filter {
|
|
||||||
if "osquery" in [tags] and [osquery][columns][eventid] {
|
|
||||||
|
|
||||||
mutate {
|
|
||||||
gsub => ["[osquery][columns][data]", "\\x0A", ""]
|
|
||||||
}
|
|
||||||
|
|
||||||
json {
|
|
||||||
source => "[osquery][columns][data]"
|
|
||||||
target => "[osquery][columns][data]"
|
|
||||||
}
|
|
||||||
|
|
||||||
mutate {
|
|
||||||
merge => { "[osquery][columns]" => "[osquery][columns][data]" }
|
|
||||||
remove_field => ["[osquery][columns][data]"]
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,58 +0,0 @@
|
|||||||
# Author: Justin Henderson
|
|
||||||
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
|
|
||||||
# Updated by: Doug Burks
|
|
||||||
# Last Update: 5/20/2017
|
|
||||||
|
|
||||||
filter {
|
|
||||||
if [source_ip] {
|
|
||||||
if [source_ip] == "-" {
|
|
||||||
mutate {
|
|
||||||
replace => { "source_ip" => "0.0.0.0" }
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [source_ip] =~ "10\." or [source_ip] =~ "192\.168\." or [source_ip] =~ "172\.(1[6-9]|2[0-9]|3[0-1])\." or [source_ip] =~ "fe80::20c:29ff:fe19:f7d" or [source_ip] =~ "::1" {
|
|
||||||
mutate {
|
|
||||||
}
|
|
||||||
} else {
|
|
||||||
geoip {
|
|
||||||
source => "[source_ip]"
|
|
||||||
target => "source_geo"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [source_ip] {
|
|
||||||
mutate {
|
|
||||||
add_field => { "ips" => "%{source_ip}" }
|
|
||||||
add_field => { "source_ips" => [ "%{source_ip}" ] }
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [destination_ip] {
|
|
||||||
if [destination_ip] == "-" {
|
|
||||||
mutate {
|
|
||||||
replace => { "destination_ip" => "0.0.0.0" }
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [destination_ip] =~ "10\." or [destination_ip] =~ "192\.168\." or [destination_ip] =~ "172\.(1[6-9]|2[0-9]|3[0-1])\." or [destination_ip] =~ "239.255.255.250" or [destination_ip] =~ "224\.0\.0\." or [destination_ip] =~ "255.255.255.255" or [destination_ip] =~ "ff02::fb" or [destination_ip] =~ "fe80::20c:29ff:fe19:f7d" or [destination_ip] =~ "224\.0\.1\." {
|
|
||||||
mutate {
|
|
||||||
}
|
|
||||||
}
|
|
||||||
else {
|
|
||||||
geoip {
|
|
||||||
source => "[destination_ip]"
|
|
||||||
target => "destination_geo"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [destination_ip] {
|
|
||||||
mutate {
|
|
||||||
add_field => { "ips" => "%{destination_ip}" }
|
|
||||||
add_field => { "destination_ips" => [ "%{destination_ip}" ] }
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
#if [source_ip] or [destination_ip] {
|
|
||||||
# mutate {
|
|
||||||
#add_tag => [ "conf_file_8001"]
|
|
||||||
# }
|
|
||||||
#}
|
|
||||||
|
|
||||||
@@ -1,27 +0,0 @@
|
|||||||
# Original Author: Justin Henderson
|
|
||||||
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
|
|
||||||
# Updated by: Doug Burks
|
|
||||||
# Last Update: 5/13/2017
|
|
||||||
|
|
||||||
filter {
|
|
||||||
if [type] == "bro_http" {
|
|
||||||
if [uri] {
|
|
||||||
ruby {
|
|
||||||
code => "event.set('uri_length', event.get('uri').length)"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [virtual_host] {
|
|
||||||
ruby {
|
|
||||||
code => "event.set('virtual_host_length', event.get('virtual_host').length)"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [useragent] {
|
|
||||||
ruby {
|
|
||||||
code => "event.set('useragent_length', event.get('useragent').length)"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
mutate {
|
|
||||||
##add_tag => [ "conf_file_8007"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,63 +0,0 @@
|
|||||||
# Author: Justin Henderson
|
|
||||||
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
|
|
||||||
# Email: justin@hasecuritysolution.com
|
|
||||||
# Last Update: 12/9/2016
|
|
||||||
|
|
||||||
filter {
|
|
||||||
if [destination_ip] {
|
|
||||||
if [destination_ip] =~ "10\." or [destination_ip] =~ "192\.168\." or [destination_ip] =~ "172\.(1[6-9]|2[0-9]|3[0-1])\." {
|
|
||||||
mutate {
|
|
||||||
add_tag => [ "internal_destination" ]
|
|
||||||
}
|
|
||||||
} else {
|
|
||||||
mutate {
|
|
||||||
add_tag => [ "external_destination" ]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if "internal_destination" not in [tags] {
|
|
||||||
if [destination_ip] == "198.41.0.4" or [destination_ip] == "192.228.79.201" or [destination_ip] == "192.33.4.12" or [destination_ip] == "199.7.91.13" or [destination_ip] == "192.203.230.10" or [destination_ip] == "192.5.5.241" or [destination_ip] == "192.112.36.4" or [destination_ip] == "198.97.190.53" or [destination_ip] == "192.36.148.17" or [destination_ip] == "192.58.128.30" or [destination_ip] == "193.0.14.129" or [destination_ip] == "199.7.83.42" or [destination_ip] == "202.12.27.33" {
|
|
||||||
mutate {
|
|
||||||
add_tag => [ "root_dns_server" ]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
# Customize this section to your environment
|
|
||||||
if [destination_ip] == "74.40.74.40" or [destination_ip] == "74.40.74.41" {
|
|
||||||
mutate {
|
|
||||||
add_tag => [ "authorized_dns_server" ]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [source_ip] {
|
|
||||||
if [source_ip] =~ "10\." or [source_ip] =~ "192\.168\." or [source_ip] =~ "172\.(1[6-9]|2[0-9]|3[0-1])\." {
|
|
||||||
mutate {
|
|
||||||
add_tag => [ "internal_source" ]
|
|
||||||
}
|
|
||||||
} else {
|
|
||||||
mutate {
|
|
||||||
add_tag => [ "external_source" ]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if "internal_source" not in [tags] {
|
|
||||||
if [source_ip] == "198.41.0.4" or [source_ip] == "192.228.79.201" or [source_ip] == "192.33.4.12" or [source_ip] == "199.7.91.13" or [source_ip] == "192.203.230.10" or [source_ip] == "192.5.5.241" or [source_ip] == "192.112.36.4" or [source_ip] == "198.97.190.53" or [source_ip] == "192.36.148.17" or [source_ip] == "192.58.128.30" or [source_ip] == "193.0.14.129" or [source_ip] == "199.7.83.42" or [source_ip] == "202.12.27.33" {
|
|
||||||
mutate {
|
|
||||||
add_tag => [ "root_dns_server" ]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
# Customize this section to your environment
|
|
||||||
if [destination_ip] == "74.40.74.40" and "authorized_dns_server" not in [tags] or [destination_ip] == "74.40.74.41" and "authorized_dns_server" not in [tags] {
|
|
||||||
mutate {
|
|
||||||
add_tag => [ "authorized_dns_server" ]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
mutate {
|
|
||||||
##add_tag => [ "conf_file_8200"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [type] =~ /ossec|snort|firewall/ or "firewall" in [tags] {
|
|
||||||
mutate {
|
|
||||||
remove_tag => [ "syslog" ]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,19 +0,0 @@
|
|||||||
# Author: Justin Henderson
|
|
||||||
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
|
|
||||||
# Email: justin@hasecuritysolution.com
|
|
||||||
# Last Update: 12/9/2016
|
|
||||||
|
|
||||||
filter {
|
|
||||||
ruby {
|
|
||||||
code => "event.set('task_end', Time.now.to_f)"
|
|
||||||
}
|
|
||||||
ruby {
|
|
||||||
code => "event.set('logstash_time', event.get('task_end') - event.get('task_start'))"
|
|
||||||
}
|
|
||||||
mutate {
|
|
||||||
remove_field => [ 'task_start', 'task_end' ]
|
|
||||||
}
|
|
||||||
mutate {
|
|
||||||
#add_tag => [ "conf_file_8998"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,8 +0,0 @@
|
|||||||
# Author: Doug Burks
|
|
||||||
# Last Update: 12/10/2017
|
|
||||||
|
|
||||||
filter {
|
|
||||||
mutate {
|
|
||||||
rename => [ "type", "event_type" ]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,32 +0,0 @@
|
|||||||
{%- if grains['role'] == 'so-eval' -%}
|
|
||||||
{%- set ES = salt['pillar.get']('master:mainip', '') -%}
|
|
||||||
{%- set NAME = grains.host -%}
|
|
||||||
{%- else %}
|
|
||||||
{%- set ES = salt['pillar.get']('node:mainip', '') -%}
|
|
||||||
{%- endif %}
|
|
||||||
# Author: Justin Henderson
|
|
||||||
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
|
|
||||||
# Email: justin@hasecuritysolution.com
|
|
||||||
# Last Update: 12/9/2016
|
|
||||||
|
|
||||||
|
|
||||||
filter {
|
|
||||||
if "bro" in [tags] and "test_data" not in [tags] and "import" not in [tags] {
|
|
||||||
mutate {
|
|
||||||
add_field => { "sensor_name" => "{{ NAME }}" }
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
output {
|
|
||||||
if "bro" in [tags] and "test_data" not in [tags] and "import" not in [tags] {
|
|
||||||
# stdout { codec => rubydebug }
|
|
||||||
elasticsearch {
|
|
||||||
pipeline => "%{event_type}"
|
|
||||||
hosts => "{{ ES }}"
|
|
||||||
index => "logstash-bro-%{+YYYY.MM.dd}"
|
|
||||||
template_name => "logstash"
|
|
||||||
template => "/logstash-template.json"
|
|
||||||
template_overwrite => true
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,27 +0,0 @@
|
|||||||
{%- if grains['role'] == 'so-eval' -%}
|
|
||||||
{%- set ES = salt['pillar.get']('master:mainip', '') -%}
|
|
||||||
{%- else %}
|
|
||||||
{%- set ES = salt['pillar.get']('node:mainip', '') -%}
|
|
||||||
{%- endif %}
|
|
||||||
# Author: Justin Henderson
|
|
||||||
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
|
|
||||||
# Email: justin@hasecuritysolution.com
|
|
||||||
# Last Update: 12/9/2016
|
|
||||||
|
|
||||||
filter {
|
|
||||||
if "switch" in [tags] and "test_data" not in [tags] {
|
|
||||||
mutate {
|
|
||||||
##add_tag => [ "conf_file_9001"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
output {
|
|
||||||
if "switch" in [tags] and "test_data" not in [tags] {
|
|
||||||
#stdout { codec => rubydebug }
|
|
||||||
elasticsearch {
|
|
||||||
hosts => "{{ ES }}"
|
|
||||||
index => "logstash-switch-%{+YYYY.MM.dd}"
|
|
||||||
template => "/logstash-template.json"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,27 +0,0 @@
|
|||||||
{%- if grains['role'] == 'so-eval' -%}
|
|
||||||
{%- set ES = salt['pillar.get']('master:mainip', '') -%}
|
|
||||||
{%- else %}
|
|
||||||
{%- set ES = salt['pillar.get']('node:mainip', '') -%}
|
|
||||||
{%- endif %}
|
|
||||||
# Updated by: Doug Burks
|
|
||||||
# Last Update: 5/16/2017
|
|
||||||
|
|
||||||
filter {
|
|
||||||
if "import" in [tags] and "test_data" not in [tags] {
|
|
||||||
mutate {
|
|
||||||
##add_tag => [ "conf_file_9002"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
output {
|
|
||||||
if "import" in [tags] and "test_data" not in [tags] {
|
|
||||||
# stdout { codec => rubydebug }
|
|
||||||
elasticsearch {
|
|
||||||
hosts => "{{ ES }}"
|
|
||||||
index => "logstash-import-%{+YYYY.MM.dd}"
|
|
||||||
template_name => "logstash-*"
|
|
||||||
template => "/logstash-template.json"
|
|
||||||
template_overwrite => true
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,27 +0,0 @@
|
|||||||
{%- if grains['role'] == 'so-eval' -%}
|
|
||||||
{%- set ES = salt['pillar.get']('master:mainip', '') -%}
|
|
||||||
{%- else %}
|
|
||||||
{%- set ES = salt['pillar.get']('node:mainip', '') -%}
|
|
||||||
{%- endif %}
|
|
||||||
# Author: Justin Henderson
|
|
||||||
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
|
|
||||||
# Email: justin@hasecuritysolution.com
|
|
||||||
# Last Update: 12/9/2016
|
|
||||||
|
|
||||||
filter {
|
|
||||||
if [event_type] == "sflow" and "test_data" not in [tags] {
|
|
||||||
mutate {
|
|
||||||
##add_tag => [ "conf_file_9004"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
output {
|
|
||||||
if [event_type] == "sflow" and "test_data" not in [tags] {
|
|
||||||
#stdout { codec => rubydebug }
|
|
||||||
elasticsearch {
|
|
||||||
hosts => "{{ ES }}"
|
|
||||||
index => "logstash-flow-%{+YYYY.MM.dd}"
|
|
||||||
template => "/logstash-template.json"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,26 +0,0 @@
|
|||||||
{%- if grains['role'] == 'so-eval' -%}
|
|
||||||
{%- set ES = salt['pillar.get']('master:mainip', '') -%}
|
|
||||||
{%- else %}
|
|
||||||
{%- set ES = salt['pillar.get']('node:mainip', '') -%}
|
|
||||||
{%- endif %}
|
|
||||||
# Author: Justin Henderson
|
|
||||||
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
|
|
||||||
# Email: justin@hasecuritysolution.com
|
|
||||||
# Last Update: 12/9/2016
|
|
||||||
|
|
||||||
filter {
|
|
||||||
if [event_type] == "dhcp" and "test_data" not in [tags] {
|
|
||||||
mutate {
|
|
||||||
##add_tag => [ "conf_file_9026"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
output {
|
|
||||||
if [event_type] == "dhcp" and "test_data" not in [tags] {
|
|
||||||
#stdout { codec => rubydebug }
|
|
||||||
elasticsearch {
|
|
||||||
hosts => "{{ ES }}"
|
|
||||||
template => "/logstash-template.json"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,25 +0,0 @@
|
|||||||
{%- if grains['role'] == 'so-eval' -%}
|
|
||||||
{%- set ES = salt['pillar.get']('master:mainip', '') -%}
|
|
||||||
{%- else %}
|
|
||||||
{%- set ES = salt['pillar.get']('node:mainip', '') -%}
|
|
||||||
{%- endif %}
|
|
||||||
# Author: Justin Henderson
|
|
||||||
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
|
|
||||||
# Email: justin@hasecuritysolution.com
|
|
||||||
# Last Update: 12/9/2016
|
|
||||||
|
|
||||||
filter {
|
|
||||||
if [event_type] == "esxi" and "test_data" not in [tags] {
|
|
||||||
mutate {
|
|
||||||
##add_tag => [ "conf_file_9029"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
output {
|
|
||||||
if [event_type] == "esxi" and "test_data" not in [tags] {
|
|
||||||
elasticsearch {
|
|
||||||
hosts => "{{ ES }}"
|
|
||||||
template => "/logstash-template.json"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,25 +0,0 @@
|
|||||||
{%- if grains['role'] == 'so-eval' -%}
|
|
||||||
{%- set ES = salt['pillar.get']('master:mainip', '') -%}
|
|
||||||
{%- else %}
|
|
||||||
{%- set ES = salt['pillar.get']('node:mainip', '') -%}
|
|
||||||
{%- endif %}
|
|
||||||
# Author: Justin Henderson
|
|
||||||
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
|
|
||||||
# Email: justin@hasecuritysolution.com
|
|
||||||
# Last Update: 12/9/2016
|
|
||||||
|
|
||||||
filter {
|
|
||||||
if [event_type] == "greensql" and "test_data" not in [tags] {
|
|
||||||
mutate {
|
|
||||||
##add_tag => [ "conf_file_9030"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
output {
|
|
||||||
if [event_type] == "greensql" and "test_data" not in [tags] {
|
|
||||||
elasticsearch {
|
|
||||||
hosts => "{{ ES }}"
|
|
||||||
template => "/logstash-template.json"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,26 +0,0 @@
|
|||||||
{%- if grains['role'] == 'so-eval' -%}
|
|
||||||
{%- set ES = salt['pillar.get']('master:mainip', '') -%}
|
|
||||||
{%- else %}
|
|
||||||
{%- set ES = salt['pillar.get']('node:mainip', '') -%}
|
|
||||||
{%- endif %}
|
|
||||||
# Author: Justin Henderson
|
|
||||||
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
|
|
||||||
# Email: justin@hasecuritysolution.com
|
|
||||||
# Last Update: 12/9/2016
|
|
||||||
|
|
||||||
filter {
|
|
||||||
if [event_type] == "iis" and "test_data" not in [tags] {
|
|
||||||
mutate {
|
|
||||||
##add_tag => [ "conf_file_9031"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
output {
|
|
||||||
if [event_type] == "iis" and "test_data" not in [tags] {
|
|
||||||
#stdout { codec => rubydebug }
|
|
||||||
elasticsearch {
|
|
||||||
hosts => "{{ ES }}"
|
|
||||||
template => "/logstash-template.json"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,26 +0,0 @@
|
|||||||
{%- if grains['role'] == 'so-eval' -%}
|
|
||||||
{%- set ES = salt['pillar.get']('master:mainip', '') -%}
|
|
||||||
{%- else %}
|
|
||||||
{%- set ES = salt['pillar.get']('node:mainip', '') -%}
|
|
||||||
{%- endif %}
|
|
||||||
# Author: Justin Henderson
|
|
||||||
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
|
|
||||||
# Email: justin@hasecuritysolution.com
|
|
||||||
# Last Update: 12/9/2016
|
|
||||||
|
|
||||||
filter {
|
|
||||||
if [event_type] == "mcafee" and "test_data" not in [tags] {
|
|
||||||
mutate {
|
|
||||||
##add_tag => [ "conf_file_9032"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
output {
|
|
||||||
if [event_type] == "mcafee" and "test_data" not in [tags] {
|
|
||||||
#stdout { codec => rubydebug }
|
|
||||||
elasticsearch {
|
|
||||||
hosts => "{{ ES }}"
|
|
||||||
template => "/logstash-template.json"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,29 +0,0 @@
|
|||||||
{%- if grains['role'] == 'so-eval' -%}
|
|
||||||
{%- set ES = salt['pillar.get']('master:mainip', '') -%}
|
|
||||||
{%- else %}
|
|
||||||
{%- set ES = salt['pillar.get']('node:mainip', '') -%}
|
|
||||||
{%- endif %}
|
|
||||||
# Author: Justin Henderson
|
|
||||||
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
|
|
||||||
# Email: justin@hasecuritysolution.com
|
|
||||||
# Last Update: 12/9/2016
|
|
||||||
|
|
||||||
filter {
|
|
||||||
if [event_type] == "ids" and "test_data" not in [tags] {
|
|
||||||
mutate {
|
|
||||||
##add_tag => [ "conf_file_9033"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
output {
|
|
||||||
if [event_type] == "ids" and "test_data" not in [tags] {
|
|
||||||
#stdout { codec => rubydebug }
|
|
||||||
elasticsearch {
|
|
||||||
hosts => "{{ ES }}"
|
|
||||||
index => "logstash-ids-%{+YYYY.MM.dd}"
|
|
||||||
template_name => "logstash"
|
|
||||||
template => "/logstash-template.json"
|
|
||||||
template_overwrite => true
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,28 +0,0 @@
|
|||||||
{%- if grains['role'] == 'so-eval' -%}
|
|
||||||
{%- set ES = salt['pillar.get']('master:mainip', '') -%}
|
|
||||||
{%- else %}
|
|
||||||
{%- set ES = salt['pillar.get']('node:mainip', '') -%}
|
|
||||||
{%- endif %}
|
|
||||||
# Author: Justin Henderson
|
|
||||||
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
|
|
||||||
# Updated by: Doug Burks
|
|
||||||
# Last Update: 5/15/2017
|
|
||||||
|
|
||||||
filter {
|
|
||||||
if "syslog" in [tags] and "test_data" not in [tags] {
|
|
||||||
mutate {
|
|
||||||
##add_tag => [ "conf_file_9034"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
output {
|
|
||||||
if "syslog" in [tags] and "test_data" not in [tags] {
|
|
||||||
elasticsearch {
|
|
||||||
hosts => "{{ ES }}"
|
|
||||||
index => "logstash-syslog-%{+YYYY.MM.dd}"
|
|
||||||
template_name => "logstash"
|
|
||||||
template => "/logstash-template.json"
|
|
||||||
template_overwrite => true
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,32 +0,0 @@
|
|||||||
{%- if grains['role'] == 'so-eval' -%}
|
|
||||||
{%- set ES = salt['pillar.get']('master:mainip', '') -%}
|
|
||||||
{%- else %}
|
|
||||||
{%- set ES = salt['pillar.get']('node:mainip', '') -%}
|
|
||||||
{%- endif %}
|
|
||||||
# Author: Security Onion Solutions
|
|
||||||
# Last Update: 2/3/2020
|
|
||||||
# Output to ES for osquery tagged logs - EVAL install
|
|
||||||
|
|
||||||
|
|
||||||
filter {
|
|
||||||
if "osquery" in [tags] {
|
|
||||||
mutate {
|
|
||||||
rename => { "host" => "beat_host" }
|
|
||||||
remove_tag => ["beat"]
|
|
||||||
}
|
|
||||||
json {
|
|
||||||
source => "message"
|
|
||||||
target => "osquery"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
output {
|
|
||||||
if "osquery" in [tags] {
|
|
||||||
elasticsearch {
|
|
||||||
hosts => "{{ ES }}"
|
|
||||||
index => "logstash-osquery-%{+YYYY.MM.dd}"
|
|
||||||
template => "/logstash-template.json"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,29 +0,0 @@
|
|||||||
{%- if grains['role'] == 'so-eval' -%}
|
|
||||||
{%- set ES = salt['pillar.get']('master:mainip', '') -%}
|
|
||||||
{%- else %}
|
|
||||||
{%- set ES = salt['pillar.get']('node:mainip', '') -%}
|
|
||||||
{%- endif %}
|
|
||||||
# Author: Justin Henderson
|
|
||||||
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
|
|
||||||
# Email: justin@hasecuritysolution.com
|
|
||||||
# Last Update: 12/9/2016
|
|
||||||
|
|
||||||
filter {
|
|
||||||
if "firewall" in [tags] and "test_data" not in [tags] {
|
|
||||||
mutate {
|
|
||||||
##add_tag => [ "conf_file_9200"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
output {
|
|
||||||
if "firewall" in [tags] and "test_data" not in [tags] {
|
|
||||||
# stdout { codec => rubydebug }
|
|
||||||
elasticsearch {
|
|
||||||
hosts => "{{ ES }}"
|
|
||||||
index => "logstash-firewall-%{+YYYY.MM.dd}"
|
|
||||||
template_name => "logstash"
|
|
||||||
template => "/logstash-template.json"
|
|
||||||
template_overwrite => true
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,27 +0,0 @@
|
|||||||
{%- if grains['role'] == 'so-eval' -%}
|
|
||||||
{%- set ES = salt['pillar.get']('master:mainip', '') -%}
|
|
||||||
{%- else %}
|
|
||||||
{%- set ES = salt['pillar.get']('node:mainip', '') -%}
|
|
||||||
{%- endif %}
|
|
||||||
# Author: Justin Henderson
|
|
||||||
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
|
|
||||||
# Email: justin@hasecuritysolution.com
|
|
||||||
# Last Update: 12/9/2016
|
|
||||||
|
|
||||||
filter {
|
|
||||||
if [event_type] == "windows" and "test_data" not in [tags] {
|
|
||||||
mutate {
|
|
||||||
##add_tag => [ "conf_file_9300"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
output {
|
|
||||||
if [event_type] == "windows" and "test_data" not in [tags] {
|
|
||||||
#stdout { codec => rubydebug }
|
|
||||||
elasticsearch {
|
|
||||||
hosts => "{{ ES }}"
|
|
||||||
index => "logstash-windows-%{+YYYY.MM.dd}"
|
|
||||||
template => "/logstash-template.json"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,27 +0,0 @@
|
|||||||
{%- if grains['role'] == 'so-eval' -%}
|
|
||||||
{%- set ES = salt['pillar.get']('master:mainip', '') -%}
|
|
||||||
{%- else %}
|
|
||||||
{%- set ES = salt['pillar.get']('node:mainip', '') -%}
|
|
||||||
{%- endif %}
|
|
||||||
# Author: Justin Henderson
|
|
||||||
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
|
|
||||||
# Email: justin@hasecuritysolution.com
|
|
||||||
# Last Update: 12/9/2016
|
|
||||||
|
|
||||||
filter {
|
|
||||||
if [event_type] == "dns" and "test_data" not in [tags] {
|
|
||||||
mutate {
|
|
||||||
##add_tag => [ "conf_file_9301"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
output {
|
|
||||||
if [event_type] == "dns" and "test_data" not in [tags] {
|
|
||||||
#stdout { codec => rubydebug }
|
|
||||||
elasticsearch {
|
|
||||||
hosts => "{{ ES }}"
|
|
||||||
index => "logstash-%{+YYYY.MM.dd}"
|
|
||||||
template => "/logstash-template.json"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,28 +0,0 @@
|
|||||||
{%- if grains['role'] == 'so-eval' -%}
|
|
||||||
{%- set ES = salt['pillar.get']('master:mainip', '') -%}
|
|
||||||
{%- set NAME = grains.host -%}
|
|
||||||
{%- else %}
|
|
||||||
{%- set ES = salt['pillar.get']('node:mainip', '') -%}
|
|
||||||
{%- endif %}
|
|
||||||
# Author: Justin Henderson
|
|
||||||
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
|
|
||||||
# Email: justin@hasecuritysolution.com
|
|
||||||
# Last Update: 12/9/2016
|
|
||||||
|
|
||||||
filter {
|
|
||||||
if [event_type] == "suricata" and "test_data" not in [tags] {
|
|
||||||
mutate {
|
|
||||||
add_field => { "sensor_name" => "{{ NAME }}" }
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
output {
|
|
||||||
if [event_type] == "suricata" and "test_data" not in [tags] {
|
|
||||||
#stdout { codec => rubydebug }
|
|
||||||
elasticsearch {
|
|
||||||
hosts => "{{ ES }}"
|
|
||||||
index => "logstash-ids-%{+YYYY.MM.dd}"
|
|
||||||
template => "/logstash-template.json"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,25 +0,0 @@
|
|||||||
{%- if grains['role'] == 'so-eval' -%}
|
|
||||||
{%- set ES = salt['pillar.get']('master:mainip', '') -%}
|
|
||||||
{%- else %}
|
|
||||||
{%- set ES = salt['pillar.get']('node:mainip', '') -%}
|
|
||||||
{%- endif %}
|
|
||||||
# Author: Wes Lambert
|
|
||||||
# Last Update: 09/14/2018
|
|
||||||
filter {
|
|
||||||
if "beat" in [tags] {
|
|
||||||
mutate {
|
|
||||||
##add_tag => [ "conf_file_9500"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
output {
|
|
||||||
if "beat" in [tags] {
|
|
||||||
elasticsearch {
|
|
||||||
hosts => "{{ ES }}"
|
|
||||||
index => "logstash-beats-%{+YYYY.MM.dd}"
|
|
||||||
template_name => "logstash-beats"
|
|
||||||
template => "/beats-template.json"
|
|
||||||
template_overwrite => true
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,29 +0,0 @@
|
|||||||
{%- if grains['role'] == 'so-eval' -%}
|
|
||||||
{%- set ES = salt['pillar.get']('master:mainip', '') -%}
|
|
||||||
{%- else %}
|
|
||||||
{%- set ES = salt['pillar.get']('node:mainip', '') -%}
|
|
||||||
{%- endif %}
|
|
||||||
# Author: Justin Henderson
|
|
||||||
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
|
|
||||||
# Updated by: Doug Burks
|
|
||||||
# Last Update: 9/19/2018
|
|
||||||
|
|
||||||
filter {
|
|
||||||
if [event_type] =~ "ossec" {
|
|
||||||
mutate {
|
|
||||||
##add_tag => [ "conf_file_9600"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
output {
|
|
||||||
if [event_type] =~ "ossec" or "ossec" in [tags] {
|
|
||||||
elasticsearch {
|
|
||||||
hosts => "{{ ES }}"
|
|
||||||
index => "logstash-ossec-%{+YYYY.MM.dd}"
|
|
||||||
template_name => "logstash-ossec"
|
|
||||||
template => "/logstash-ossec-template.json"
|
|
||||||
template_overwrite => true
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,40 +0,0 @@
|
|||||||
input {
|
|
||||||
beats {
|
|
||||||
port => "5644"
|
|
||||||
ssl => true
|
|
||||||
ssl_certificate_authorities => ["/usr/share/filebeat/ca.crt"]
|
|
||||||
ssl_certificate => "/usr/share/logstash/filebeat.crt"
|
|
||||||
ssl_key => "/usr/share/logstash/filebeat.key"
|
|
||||||
tags => [ "beat" ]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
filter {
|
|
||||||
if [type] == "ids" or [type] =~ "bro" {
|
|
||||||
mutate {
|
|
||||||
rename => { "host" => "beat_host" }
|
|
||||||
remove_tag => ["beat"]
|
|
||||||
add_field => { "sensor_name" => "%{[beat][name]}" }
|
|
||||||
add_field => { "syslog-host_from" => "%{[beat][name]}" }
|
|
||||||
remove_field => [ "beat", "prospector", "input", "offset" ]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [type] =~ "ossec" {
|
|
||||||
mutate {
|
|
||||||
rename => { "host" => "beat_host" }
|
|
||||||
remove_tag => ["beat"]
|
|
||||||
add_field => { "syslog-host_from" => "%{[beat][name]}" }
|
|
||||||
remove_field => [ "beat", "prospector", "input", "offset" ]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [type] == "osquery" {
|
|
||||||
mutate {
|
|
||||||
rename => { "host" => "beat_host" }
|
|
||||||
remove_tag => ["beat"]
|
|
||||||
add_tag => ["osquery"]
|
|
||||||
}
|
|
||||||
json {
|
|
||||||
source => "message"
|
|
||||||
target => "osquery"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,181 +0,0 @@
|
|||||||
# Author: Justin Henderson
|
|
||||||
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
|
|
||||||
# Updated by: Doug Burks
|
|
||||||
# Last Update: 3/15/2018
|
|
||||||
|
|
||||||
filter {
|
|
||||||
if [type] == "ids" {
|
|
||||||
# This is the initial parsing of the log
|
|
||||||
if [engine] == "suricata" {
|
|
||||||
json {
|
|
||||||
source => "message"
|
|
||||||
}
|
|
||||||
mutate {
|
|
||||||
rename => { "alert" => "orig_alert" }
|
|
||||||
rename => { "[orig_alert][gid]" => "gid" }
|
|
||||||
rename => { "[orig_alert][signature_id]" => "sid" }
|
|
||||||
rename => { "[orig_alert][rev]" => "rev" }
|
|
||||||
rename => { "[orig_alert][signature]" => "alert" }
|
|
||||||
rename => { "[orig_alert][category]" => "classification" }
|
|
||||||
rename => { "[orig_alert][severity]" => "priority" }
|
|
||||||
rename => { "[orig_alert][rule]" => "rule_signature" }
|
|
||||||
rename => { "app_proto" => "application_protocol" }
|
|
||||||
rename => { "dest_ip" => "destination_ip" }
|
|
||||||
rename => { "dest_port" => "destination_port" }
|
|
||||||
rename => { "in_iface" => "interface" }
|
|
||||||
rename => { "proto" => "protocol" }
|
|
||||||
rename => { "src_ip" => "source_ip" }
|
|
||||||
rename => { "src_port" => "source_port" }
|
|
||||||
#rename => { "[fileinfo][filename]" => "filename" }
|
|
||||||
#rename => { "[fileinfo][gaps]" => "gaps" }
|
|
||||||
#rename => { "[fileinfo][size]" => "size" }
|
|
||||||
#rename => { "[fileinfo][state]" => "state" }
|
|
||||||
#rename => { "[fileinfo][stored]" => "stored" }
|
|
||||||
#rename => { "[fileinfo][tx_id]" => "tx_id" }
|
|
||||||
#rename => { "[flow][age]" => "duration" }
|
|
||||||
#rename => { "[flow][alerted]" => "flow_alerted" }
|
|
||||||
#rename => { "[flow][bytes_toclient]" => "bytes_to_client" }
|
|
||||||
#rename => { "[flow][bytes_toserver]" => "bytes_to_server" }
|
|
||||||
#rename => { "[flow][end]" => "flow_end" }
|
|
||||||
#rename => { "[flow][pkts_toclient]" => "packets_to_client" }
|
|
||||||
#rename => { "[flow][pkts_toserver]" => "packets_to_server" }
|
|
||||||
#rename => { "[flow][reason]" => "reason" }
|
|
||||||
#rename => { "[flow][start]" => "flow_start" }
|
|
||||||
#rename => { "[flow][state]" => "state" }
|
|
||||||
#rename => { "[netflow][age]" => "duration" }
|
|
||||||
#rename => { "[netflow][bytes]" => "bytes" }
|
|
||||||
#rename => { "[netflow][end]" => "netflow_end" }
|
|
||||||
#rename => { "[netflow][start]" => "netflow_start" }
|
|
||||||
#rename => { "[netflow][pkts]" => "packets" }
|
|
||||||
rename => { "[alert][action]" => "action" }
|
|
||||||
rename => { "[alert][category]" => "category" }
|
|
||||||
rename => { "[alert][gid]" => "gid" }
|
|
||||||
rename => { "[alert][rev]" => "rev" }
|
|
||||||
rename => { "[alert][severity]" => "severity" }
|
|
||||||
rename => { "[alert][signature]" => "signature" }
|
|
||||||
rename => { "[alert][signature_id]" => "sid" }
|
|
||||||
#rename => { "[dns][aa]" => "aa" }
|
|
||||||
#rename => { "[dns][flags]" => "flags" }
|
|
||||||
#rename => { "[dns][id]" => "id" }
|
|
||||||
#rename => { "[dns][qr]" => "qr" }
|
|
||||||
#rename => { "[dns][rcode]" => "rcode_name" }
|
|
||||||
#rename => { "[dns][rrname]" => "rrname" }
|
|
||||||
#rename => { "[dns][rrtype]" => "rrtype" }
|
|
||||||
#rename => { "[dns][tx_id]" => "tx_id" }
|
|
||||||
#rename => { "[dns][type]" => "record_type" }
|
|
||||||
#rename => { "[dns][version]" => "version" }
|
|
||||||
rename => { "[http][hostname]" => "virtual_host" }
|
|
||||||
rename => { "[http][http_content_type]" => "content_type" }
|
|
||||||
rename => { "[http][http_port]" => "http_port" }
|
|
||||||
rename => { "[http][http_method]" => "method" }
|
|
||||||
rename => { "[http][http_user_agent]" => "useragent" }
|
|
||||||
#rename => { "[http][length]" => "payload_length" }
|
|
||||||
#rename => { "[http][protocol]" => "http_version" }
|
|
||||||
rename => { "[http][status]" => "status_message" }
|
|
||||||
rename => { "[http][url]" => "url" }
|
|
||||||
#rename => { "[metadata][flowbits]" => "flowbits" }
|
|
||||||
rename => { "[tls][fingerprint]" => "certificate_serial_number" }
|
|
||||||
rename => { "[tls][issuerdn]" => "issuer_distinguished_name" }
|
|
||||||
rename => { "[tls][notafter]" => "certificate_not_valid_after" }
|
|
||||||
rename => { "[tls][notbefore]" => "certificate_not_valid_before" }
|
|
||||||
rename => { "[tls][subject]" => "certificate_common_name" }
|
|
||||||
rename => { "[tls][version]" => "tls_version" }
|
|
||||||
rename => { "event_type" => "ids_event_type" }
|
|
||||||
remove_field => [ "offset", "orig_alert", "beat", "input", "prospector" ]
|
|
||||||
remove_tag => [ "beats_input_codec_plain_applied" ]
|
|
||||||
add_tag => [ "eve" ]
|
|
||||||
|
|
||||||
}
|
|
||||||
} else {
|
|
||||||
grok {
|
|
||||||
match => ["message", "\[%{INT:gid}:%{INT:sid}:%{INT:rev}\]\s%{DATA:alert}\[Classification:\s+%{DATA:classification}\]\s+\[Priority:\s+%{INT:priority}\]:\s+<%{DATA:interface}>\s+{%{DATA:protocol}}\s+(?:%{IPV4:source_ip}|%{IPV6:source_ip}):%{INT:source_port}\s+->\s+(?:%{IPV4:destination_ip}|%{IPV6:destination_ip}):%{INT:destination_port}",
|
|
||||||
"message", "\[%{INT:gid}:%{INT:sid}:%{INT:rev}\]\s%{DATA:alert}\[Classification:\s+%{DATA:classification}\]\s+\[Priority:\s+%{INT:priority}\]:\s+<%{DATA:interface}>\s+{%{DATA:protocol}}\s(?:%{IPV4:source_ip}|%{IPV6:source_ip})\s+->\s+(?:%{IPV4:destination_ip}|%{IPV6:destination_ip})",
|
|
||||||
"message", "\[%{INT:gid}:%{INT:sid}:%{INT:rev}\]\s%{DATA:alert}\[Classification:\s+%{DATA:classification}\]\s+\[Priority:\s+%{INT:priority}\]:\s+{%{DATA:protocol}}\s+(?:%{IPV4:source_ip}|%{IPV6:source_ip}):%{INT:source_port}\s+->\s+%{IPV4:destination_ip}:%{INT:destination_port}",
|
|
||||||
"message", "\[%{INT:gid}:%{INT:sid}:%{INT:rev}\]\s%{DATA:alert}\[Classification:\s+%{DATA:classification}\]\s+\[Priority:\s+%{INT:priority}\]:\s+{%{DATA:protocol}}\s(?:%{IPV4:source_ip}|%{IPV6:source_ip})\s+->\s+(?:%{IPV4:destination_ip}|%{IPV6:destination_ip})",
|
|
||||||
"message", "\[%{INT:gid}:%{INT:sid}:%{INT:rev}\]\s%{DATA:alert}\[Classification:\s+%{DATA:classification}\]\s+\[Priority:\s+%{INT:priority}\]:\s+{%{DATA:protocol}}\s+(?:%{IPV4:source_ip}|%{IPV6:source_ip}):%{INT:source_port}\s+->\s+(?:%{IPV4:destination_ip}|%{IPV6:destination_ip}):%{INT:destination_port}",
|
|
||||||
"message", "\[%{INT:gid}:%{INT:sid}:%{INT:rev}\]\s%{DATA:alert}\[Classification:\s+%{DATA:classification}\]\s+\[Priority:\s+%{INT:priority}\]:\s+{%{DATA:protocol}}\s(?:%{IPV4:source_ip}|%{IPV6:source_ip})\s+->\s+(?:%{IPV4:source_ip}|%{IPV6:source_ip})",
|
|
||||||
"message", "\[%{INT:gid}:%{INT:sid}:%{INT:rev}\]\s%{DATA:alert}\[Classification:\s+%{DATA:classification}\]\s+\[Priority:\s+%{INT:priority}\]:\s+{%{DATA:protocol}}",
|
|
||||||
"message", "\A%{TIME} pid\(%{INT}\) Alert Received: %{INT} %{INT:priority} %{DATA:classification} %{DATA:interface} \{%{DATA:timestamp}} %{INT} %{INT} \{%{DATA:alert}} %{IP:source_ip} %{IP:destination_ip} %{INT:protocol} %{INT:source_port} %{INT:destination_port} %{INT:gid} %{INT:sid} %{INT:rev} %{INT} %{INT}\Z",
|
|
||||||
"message", "%{GREEDYDATA:alert}"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [timestamp] {
|
|
||||||
mutate {
|
|
||||||
add_field => { "logstash_timestamp" => "%{@timestamp}" }
|
|
||||||
}
|
|
||||||
mutate {
|
|
||||||
convert => { "logstash_timestamp" => "string" }
|
|
||||||
}
|
|
||||||
date {
|
|
||||||
match => [ "timestamp", "ISO8601" ]
|
|
||||||
}
|
|
||||||
mutate {
|
|
||||||
rename => { "logstash_timestamp" => "timestamp" }
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
# If the alert is a Snort GPL alert break it apart for easier reading and categorization
|
|
||||||
if [alert] =~ "GPL " {
|
|
||||||
# This will parse out the category type from the alert
|
|
||||||
grok {
|
|
||||||
match => { "alert" => "GPL\s+%{DATA:category}\s" }
|
|
||||||
}
|
|
||||||
# This will store the category
|
|
||||||
mutate {
|
|
||||||
add_field => { "rule_type" => "Snort GPL" }
|
|
||||||
lowercase => [ "category"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
# If the alert is an Emerging Threat alert break it apart for easier reading and categorization
|
|
||||||
if [alert] =~ "ET " {
|
|
||||||
# This will parse out the category type from the alert
|
|
||||||
grok {
|
|
||||||
match => { "alert" => "ET\s+%{DATA:category}\s" }
|
|
||||||
}
|
|
||||||
# This will store the category
|
|
||||||
mutate {
|
|
||||||
add_field => { "rule_type" => "Emerging Threats" }
|
|
||||||
lowercase => [ "category"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
# I recommend changing the field types below to integer so searches can do greater than or less than
|
|
||||||
# and also so math functions can be ran against them
|
|
||||||
mutate {
|
|
||||||
convert => [ "source_port", "integer" ]
|
|
||||||
convert => [ "destination_port", "integer" ]
|
|
||||||
convert => [ "gid", "integer" ]
|
|
||||||
convert => [ "sid", "integer" ]
|
|
||||||
# remove_field => [ "message"]
|
|
||||||
}
|
|
||||||
# This will translate the priority field into a severity field of either High, Medium, or Low
|
|
||||||
if [priority] == 1 {
|
|
||||||
mutate {
|
|
||||||
add_field => { "severity" => "High" }
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [priority] == 2 {
|
|
||||||
mutate {
|
|
||||||
add_field => { "severity" => "Medium" }
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [priority] == 3 {
|
|
||||||
mutate {
|
|
||||||
add_field => { "severity" => "Low" }
|
|
||||||
}
|
|
||||||
}
|
|
||||||
# This section adds URLs to lookup information about a rule online
|
|
||||||
if [sid] and [sid] > 0 and [sid] < 1000000 {
|
|
||||||
mutate {
|
|
||||||
add_field => [ "signature_info", "https://www.snort.org/search?query=%{gid}-%{sid}" ]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [sid] and [sid] > 1999999 and [sid] < 2999999 {
|
|
||||||
mutate {
|
|
||||||
add_field => [ "signature_info", "http://doc.emergingthreats.net/%{sid}" ]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
# mutate {
|
|
||||||
#add_tag => [ "conf_file_1033"]
|
|
||||||
# }
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,77 +0,0 @@
|
|||||||
# Original Author: Justin Henderson
|
|
||||||
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
|
|
||||||
# Updated by: Doug Burks
|
|
||||||
#
|
|
||||||
# This conf file is based on accepting logs for conn.log from Bro systems
|
|
||||||
filter {
|
|
||||||
if [type] == "bro_conn" {
|
|
||||||
# If message looks like json, try to parse it as such. Otherwise, fall back to csv or grok.
|
|
||||||
if [message] =~ /^{.*}$/ {
|
|
||||||
json {
|
|
||||||
source => "message"
|
|
||||||
}
|
|
||||||
|
|
||||||
mutate {
|
|
||||||
rename => { "ts" => "timestamp" }
|
|
||||||
#uid
|
|
||||||
rename => { "id.orig_h" => "source_ip" }
|
|
||||||
rename => { "id.orig_p" => "source_port" }
|
|
||||||
rename => { "id.resp_h" => "destination_ip" }
|
|
||||||
rename => { "id.resp_p" => "destination_port" }
|
|
||||||
rename => { "proto" => "protocol" }
|
|
||||||
#service
|
|
||||||
#duration
|
|
||||||
rename => { "orig_bytes" => "original_bytes" }
|
|
||||||
rename => { "resp_bytes" => "respond_bytes" }
|
|
||||||
rename => { "conn_state" => "connection_state" }
|
|
||||||
#local_orig
|
|
||||||
rename => { "local_resp" => "local_respond" }
|
|
||||||
#missed_bytes
|
|
||||||
#history
|
|
||||||
rename => { "orig_pkts" => "original_packets" }
|
|
||||||
rename => { "orig_ip_bytes" => "original_ip_bytes" }
|
|
||||||
rename => { "resp_pkts" => "respond_packets" }
|
|
||||||
rename => { "resp_ip_bytes" => "respond_ip_bytes" }
|
|
||||||
#tunnel_parents
|
|
||||||
rename => { "orig_cc" => "original_country_code" }
|
|
||||||
rename => { "resp_cc" => "respond_country_code" }
|
|
||||||
rename => { "sensorname" => "sensor_name" }
|
|
||||||
}
|
|
||||||
} else {
|
|
||||||
mutate {
|
|
||||||
gsub => [ "message", "[\"']", "" ]
|
|
||||||
}
|
|
||||||
csv {
|
|
||||||
columns => ["timestamp","uid","source_ip","source_port","destination_ip","destination_port","protocol","service","duration","original_bytes","respond_bytes","connection_state","local_orig","local_respond","missed_bytes","history","original_packets","original_ip_bytes","respond_packets","respond_ip_bytes","tunnel_parents","sensor_name"]
|
|
||||||
|
|
||||||
# If you use a custom delimiter, change the following value in between the quotes to your delimiter. Otherwise, insert a literal <tab> in between the two quotes on your logstash system, use a text editor like nano that doesn't convert tabs to spaces.
|
|
||||||
separator => " "
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
translate {
|
|
||||||
field => "connection_state"
|
|
||||||
|
|
||||||
destination => "connection_state_description"
|
|
||||||
|
|
||||||
dictionary => [
|
|
||||||
"S0", "Connection attempt seen, no reply",
|
|
||||||
"S1", "Connection established, not terminated",
|
|
||||||
"S2", "Connection established and close attempt by originator seen (but no reply from responder)",
|
|
||||||
"S3", "Connection established and close attempt by responder seen (but no reply from originator)",
|
|
||||||
"SF", "Normal SYN/FIN completion",
|
|
||||||
"REJ", "Connection attempt rejected",
|
|
||||||
"RSTO", "Connection established, originator aborted (sent a RST)",
|
|
||||||
"RSTR", "Established, responder aborted",
|
|
||||||
"RSTOS0", "Originator sent a SYN followed by a RST, we never saw a SYN-ACK from the responder",
|
|
||||||
"RSTRH", "Responder sent a SYN ACK followed by a RST, we never saw a SYN from the (purported) originator",
|
|
||||||
"SH", "Originator sent a SYN followed by a FIN, we never saw a SYN ACK from the responder (hence the connection was 'half' open)",
|
|
||||||
"SHR", "Responder sent a SYN ACK followed by a FIN, we never saw a SYN from the originator",
|
|
||||||
"OTH", "No SYN seen, just midstream traffic (a 'partial connection' that was not later closed)"
|
|
||||||
]
|
|
||||||
}
|
|
||||||
mutate {
|
|
||||||
#add_tag => [ "conf_file_1100"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,56 +0,0 @@
|
|||||||
# Author: Justin Henderson
|
|
||||||
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
|
|
||||||
# Updated by: Doug Burks and Wes Lambert
|
|
||||||
# Last Update: 1/3/2019
|
|
||||||
#
|
|
||||||
# This conf file is based on accepting logs for dhcp.log from Bro systems
|
|
||||||
filter {
|
|
||||||
if [type] == "bro_dhcp" {
|
|
||||||
# If message looks like json, try to parse it as such. Otherwise, fall back to csv or grok.
|
|
||||||
if [message] =~ /^{.*}$/ {
|
|
||||||
json {
|
|
||||||
source => "message"
|
|
||||||
}
|
|
||||||
|
|
||||||
mutate {
|
|
||||||
rename => { "ts" => "timestamp" }
|
|
||||||
#uid
|
|
||||||
rename => { "id.orig_h" => "source_ip" }
|
|
||||||
rename => { "id.orig_p" => "source_port" }
|
|
||||||
rename => { "id.resp_h" => "destination_ip" }
|
|
||||||
rename => { "id.resp_p" => "destination_port" }
|
|
||||||
#mac
|
|
||||||
#assigned_ip
|
|
||||||
#lease_time
|
|
||||||
rename => { "trans_id" => "transaction_id" }
|
|
||||||
# new dhcp log format
|
|
||||||
rename => { "assigned_addr" => "assigned_ip" }
|
|
||||||
rename => { "client_addr" => "source_ip" }
|
|
||||||
rename => { "server_addr" => "destination_ip" }
|
|
||||||
rename => { "requested_addr" => "requested_ip" }
|
|
||||||
rename => { "domain" => "domain_name" }
|
|
||||||
rename => { "host_name" => "hostname" }
|
|
||||||
rename => { "msg_types" => "message_types" }
|
|
||||||
rename => { "uids" => "uid" }
|
|
||||||
}
|
|
||||||
} else {
|
|
||||||
mutate {
|
|
||||||
gsub => [ "message", "[\"']", "" ]
|
|
||||||
}
|
|
||||||
# Bro logs in TSV format
|
|
||||||
csv {
|
|
||||||
columns => [ "timestamp", "uid", "source_ip", "destination_ip", "mac", "hostname", "client_fqdn", "domain_name", "requested_ip", "assigned_ip", "lease_time","client_message", "server_message", "message_types", "duration" ]
|
|
||||||
separator => " "
|
|
||||||
}
|
|
||||||
# Remove fields with empty values (-) to prevent field data type conflict
|
|
||||||
ruby {
|
|
||||||
code =>"
|
|
||||||
hash = event.to_hash.each do |key,value|
|
|
||||||
if value == '-'
|
|
||||||
event.remove(key)
|
|
||||||
end
|
|
||||||
end"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,74 +0,0 @@
|
|||||||
# Author: Justin Henderson
|
|
||||||
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
|
|
||||||
# Updated by: Doug Burks
|
|
||||||
# Last Update: 2/7/2018
|
|
||||||
#
|
|
||||||
# This conf file is based on accepting logs for dns.log from Bro systems
|
|
||||||
filter {
|
|
||||||
if [type] == "bro_dns" {
|
|
||||||
# If message looks like json, try to parse it as such. Otherwise, fall back to csv or grok.
|
|
||||||
if [message] =~ /^{.*}$/ {
|
|
||||||
json {
|
|
||||||
source => "message"
|
|
||||||
}
|
|
||||||
|
|
||||||
mutate {
|
|
||||||
rename => { "ts" => "timestamp" }
|
|
||||||
#uid
|
|
||||||
rename => { "id.orig_h" => "source_ip" }
|
|
||||||
rename => { "id.orig_p" => "source_port" }
|
|
||||||
rename => { "id.resp_h" => "destination_ip" }
|
|
||||||
rename => { "id.resp_p" => "destination_port" }
|
|
||||||
rename => { "proto" => "protocol" }
|
|
||||||
rename => { "trans_id" => "transaction_id" }
|
|
||||||
#rtt field
|
|
||||||
#query field
|
|
||||||
rename => { "qclass" => "query_class" }
|
|
||||||
rename => { "qclass_name" => "query_class_name" }
|
|
||||||
rename => { "qtype" => "query_type" }
|
|
||||||
rename => { "qtype_name" => "query_type_name" }
|
|
||||||
#rcode
|
|
||||||
#rcode_name
|
|
||||||
rename => { "AA" => "aa" }
|
|
||||||
rename => { "TC" => "tc" }
|
|
||||||
rename => { "RD" => "rd" }
|
|
||||||
rename => { "RA" => "ra" }
|
|
||||||
rename => { "Z" => "z" }
|
|
||||||
#answers
|
|
||||||
rename => { "TTLs" => "ttls" }
|
|
||||||
#rejected
|
|
||||||
}
|
|
||||||
} else {
|
|
||||||
|
|
||||||
mutate {
|
|
||||||
gsub => [ "message", "[\"']", "" ]
|
|
||||||
}
|
|
||||||
csv {
|
|
||||||
columns => ["timestamp","uid","source_ip","source_port","destination_ip","destination_port","protocol","transaction_id","rtt","query","query_class","query_class_name","query_type","query_type_name","rcode","rcode_name","aa","tc","rd","ra","z","answers","ttls","rejected"]
|
|
||||||
|
|
||||||
#If you use a custom delimiter, change the following value in between the quotes to your delimiter. Otherwise, insert a literal <tab> in between the two quotes on your logstash system, use a text editor like nano that doesn't convert tabs to spaces.
|
|
||||||
separator => " "
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
mutate {
|
|
||||||
add_tag => [ "dns" ]
|
|
||||||
}
|
|
||||||
if [ttls] == "-" {
|
|
||||||
mutate {
|
|
||||||
remove_field => [ "ttls" ]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [rtt] == "-" {
|
|
||||||
mutate {
|
|
||||||
remove_field => [ "rtt" ]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
#mutate {
|
|
||||||
#convert => [ "rtt", "float" ]
|
|
||||||
#}
|
|
||||||
mutate {
|
|
||||||
#add_tag => [ "conf_file_1102"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,42 +0,0 @@
|
|||||||
# Author: Justin Henderson
|
|
||||||
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
|
|
||||||
# Updated by: Doug Burks
|
|
||||||
# Last Update: 2/7/2018
|
|
||||||
#
|
|
||||||
# This conf file is based on accepting logs for dpd.log from Bro systems
|
|
||||||
filter {
|
|
||||||
if [type] == "bro_dpd" {
|
|
||||||
# If message looks like json, try to parse it as such. Otherwise, fall back to csv or grok.
|
|
||||||
if [message] =~ /^{.*}$/ {
|
|
||||||
json {
|
|
||||||
source => "message"
|
|
||||||
}
|
|
||||||
|
|
||||||
mutate {
|
|
||||||
rename => { "ts" => "timestamp" }
|
|
||||||
#uid
|
|
||||||
rename => { "id.orig_h" => "source_ip" }
|
|
||||||
rename => { "id.orig_p" => "source_port" }
|
|
||||||
rename => { "id.resp_h" => "destination_ip" }
|
|
||||||
rename => { "id.resp_p" => "destination_port" }
|
|
||||||
rename => { "proto" => "protocol" }
|
|
||||||
#analyzer
|
|
||||||
#failure_reason
|
|
||||||
}
|
|
||||||
} else {
|
|
||||||
|
|
||||||
mutate {
|
|
||||||
gsub => [ "message", "[\"']", "" ]
|
|
||||||
}
|
|
||||||
csv {
|
|
||||||
columns => ["timestamp","uid","source_ip","source_port","destination_ip","destination_port","protocol","analyzer","failure_reason"]
|
|
||||||
separator => " "
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
mutate {
|
|
||||||
#add_tag => [ "conf_file_1103"]
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,64 +0,0 @@
|
|||||||
# Author: Justin Henderson
|
|
||||||
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
|
|
||||||
# Updated by: Doug Burks
|
|
||||||
# Last Update: 2/7/2018
|
|
||||||
#
|
|
||||||
# This conf file is based on accepting logs for files.log from Bro systems
|
|
||||||
filter {
|
|
||||||
if [type] == "bro_files" {
|
|
||||||
# If message looks like json, try to parse it as such. Otherwise, fall back to csv or grok.
|
|
||||||
if [message] =~ /^{.*}$/ {
|
|
||||||
json {
|
|
||||||
source => "message"
|
|
||||||
}
|
|
||||||
|
|
||||||
mutate {
|
|
||||||
rename => { "ts" => "timestamp" }
|
|
||||||
#fuid
|
|
||||||
rename => { "tx_hosts" => "file_ip" }
|
|
||||||
rename => { "rx_hosts" => "destination_ip" }
|
|
||||||
rename => { "conn_uids" => "connection_uids" }
|
|
||||||
#source field
|
|
||||||
#depth field
|
|
||||||
rename => { "analyzers" => "analyzer" }
|
|
||||||
rename => { "mime_type" => "mimetype" }
|
|
||||||
rename => { "filename" => "file_name" }
|
|
||||||
#duration
|
|
||||||
#local_orig
|
|
||||||
#is_orig
|
|
||||||
#seen_bytes
|
|
||||||
#total_bytes
|
|
||||||
#missing_bytes
|
|
||||||
#overflow_bytes
|
|
||||||
rename => { "timedout" => "timed_out" }
|
|
||||||
#parent_fuid
|
|
||||||
#md5
|
|
||||||
#sha1
|
|
||||||
#sha256
|
|
||||||
#extracted
|
|
||||||
#extracted_cutoff
|
|
||||||
#extracted_size
|
|
||||||
}
|
|
||||||
} else {
|
|
||||||
|
|
||||||
csv {
|
|
||||||
columns => ["timestamp","fuid","file_ip","destination_ip","connection_uids","source","depth","analyzer","mimetype","file_name","duration","local_orig","is_orig","seen_bytes","total_bytes","missing_bytes","overflow_bytes","timed_out","parent_fuid","md5","sha1","sha256","extracted","extracted_cutoff","extracted_size"]
|
|
||||||
separator => " "
|
|
||||||
}
|
|
||||||
if [destination_ip] =~ /,/ {
|
|
||||||
mutate {
|
|
||||||
split => { "destination_ip" => "," }
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [file_ip] =~ /,/ {
|
|
||||||
mutate {
|
|
||||||
split => { "file_ip" => "," }
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
mutate {
|
|
||||||
#add_tag => [ "conf_file_1104"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,56 +0,0 @@
|
|||||||
# Original Author: Justin Henderson
|
|
||||||
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
|
|
||||||
# Updated by: Doug Burks
|
|
||||||
# Last Update: 2/7/2018
|
|
||||||
#
|
|
||||||
# This conf file is based on accepting logs for ftp.log from Bro systems
|
|
||||||
filter {
|
|
||||||
if [type] == "bro_ftp" {
|
|
||||||
# If message looks like json, try to parse it as such. Otherwise, fall back to csv or grok.
|
|
||||||
if [message] =~ /^{.*}$/ {
|
|
||||||
json {
|
|
||||||
source => "message"
|
|
||||||
}
|
|
||||||
|
|
||||||
mutate {
|
|
||||||
rename => { "ts" => "timestamp" }
|
|
||||||
#uid
|
|
||||||
rename => { "id.orig_h" => "source_ip" }
|
|
||||||
rename => { "id.orig_p" => "source_port" }
|
|
||||||
rename => { "id.resp_h" => "destination_ip" }
|
|
||||||
rename => { "id.resp_p" => "destination_port" }
|
|
||||||
rename => { "user" => "username" }
|
|
||||||
#password
|
|
||||||
rename => { "command" => "ftp_command" }
|
|
||||||
rename => { "arg" => "ftp_argument" }
|
|
||||||
rename => { "mime_type" => "mimetype" }
|
|
||||||
#file_size
|
|
||||||
#reply_code
|
|
||||||
rename => { "reply_msg" => "reply_message" }
|
|
||||||
rename => { "data_channel.passive" => "data_channel_passive" }
|
|
||||||
rename => { "data_channel.orig_h" => "data_channel_source_ip" }
|
|
||||||
rename => { "data_channel.resp_h" => "data_channel_destination_ip" }
|
|
||||||
rename => { "data_channel.resp_p" => "data_channel_destination_port" }
|
|
||||||
#fuid
|
|
||||||
}
|
|
||||||
|
|
||||||
mutate {
|
|
||||||
convert => { "reply" => "string" }
|
|
||||||
}
|
|
||||||
|
|
||||||
} else {
|
|
||||||
|
|
||||||
mutate {
|
|
||||||
gsub => [ "message", "[\"']", "" ]
|
|
||||||
}
|
|
||||||
csv {
|
|
||||||
columns => ["timestamp","uid","source_ip","source_port","destination_ip","destination_port","username","password","ftp_command","ftp_argument","mimetype","file_size","reply_code","reply_message","data_channel_passive","data_channel_source_ip","data_channel_destination_ip","data_channel_destination_port","fuid"]
|
|
||||||
separator => " "
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
mutate {
|
|
||||||
#add_tag => [ "conf_file_1105"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,77 +0,0 @@
|
|||||||
# Author: Justin Henderson
|
|
||||||
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
|
|
||||||
# Updated by: Doug Burks
|
|
||||||
#
|
|
||||||
# This conf file is based on accepting logs for http.log from Bro systems
|
|
||||||
filter {
|
|
||||||
if [type] == "bro_http" {
|
|
||||||
# If message looks like json, try to parse it as such. Otherwise, fall back to csv or grok.
|
|
||||||
if [message] =~ /^{.*}$/ {
|
|
||||||
|
|
||||||
# Rename logstash tags field to avoid being overwritten by Bro's http tags field
|
|
||||||
mutate {
|
|
||||||
rename => { "tags" => "tags-orig" }
|
|
||||||
}
|
|
||||||
json {
|
|
||||||
source => "message"
|
|
||||||
}
|
|
||||||
|
|
||||||
mutate {
|
|
||||||
rename => { "ts" => "timestamp" }
|
|
||||||
#uid
|
|
||||||
rename => { "id.orig_h" => "source_ip" }
|
|
||||||
rename => { "id.orig_p" => "source_port" }
|
|
||||||
rename => { "id.resp_h" => "destination_ip" }
|
|
||||||
rename => { "id.resp_p" => "destination_port" }
|
|
||||||
#trans_depth
|
|
||||||
#method
|
|
||||||
rename => { "host" => "virtual_host" }
|
|
||||||
#uri
|
|
||||||
#referrer
|
|
||||||
#version
|
|
||||||
#convert => { "version" => "string" }
|
|
||||||
rename => { "user_agent" => "useragent" }
|
|
||||||
#origin
|
|
||||||
rename => { "request_body_len" => "request_body_length" }
|
|
||||||
rename => { "response_body_len" => "response_body_length" }
|
|
||||||
#status_code
|
|
||||||
#status_message
|
|
||||||
rename => { "status_msg" => "status_message" }
|
|
||||||
#info_code
|
|
||||||
rename => { "info_msg" => "info_message" }
|
|
||||||
#tags
|
|
||||||
# Rename http tags field to http-tags
|
|
||||||
rename => { "tags" => "http-tags" }
|
|
||||||
# Rename logstash tags field to tags
|
|
||||||
rename => { "tags-orig" => "tags" }
|
|
||||||
#username
|
|
||||||
#password
|
|
||||||
#proxied
|
|
||||||
#orig_fuids
|
|
||||||
#orig_filenames
|
|
||||||
#orig_mime_types
|
|
||||||
#resp_fuids
|
|
||||||
#resp_filenames
|
|
||||||
#resp_mime_types
|
|
||||||
}
|
|
||||||
if [http-tags] {
|
|
||||||
mutate {
|
|
||||||
remove_field => [ "http-tags" ]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
} else {
|
|
||||||
grok {
|
|
||||||
match => [ "message", "(?<timestamp>(.*?))\t(?<uid>(.*?))\t(?<source_ip>(.*?))\t(?<source_port>(.*?))\t(?<destination_ip>(.*?))\t(?<destination_port>(.*?))\t(?<trans_depth>(.*?))\t(?<method>(.*?))\t(?<virtual_host>(.*?))\t(?<uri>(.*?))\t(?<referrer>(.*?))\t(?<version>(.*?))\t(?<useragent>(.*?))\t(?<origin>(.*?))\t(?<request_body_length>(.*?))\t(?<response_body_length>(.*?))\t(?<status_code>(.*?))\t(?<status_message>(.*?))\t(?<info_code>(.*?))\t(?<info_message>(.*?))\t(?<tags>(.*))\t(?<username>(.*))\t(?<password>(.*))\t(?<proxied>(.*))\t(?<orig_fuids>(.*))\t(?<orig_filenames>(.*?))\t(?<orig_mime_types>(.*))\t(?<resp_fuids>(.*))\t(?<resp_filenames>(.*?))\t(?<resp_mime_types>(.*))" ]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
if [useragent] == "-" {
|
|
||||||
mutate {
|
|
||||||
remove_field => [ "useragent" ]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
mutate {
|
|
||||||
#add_tag => [ "conf_file_1106"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,46 +0,0 @@
|
|||||||
# Author: Justin Henderson
|
|
||||||
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
|
|
||||||
# Updated by: Doug Burks
|
|
||||||
# Last Update: 2/7/2018
|
|
||||||
#
|
|
||||||
# This conf file is based on accepting logs for irc.log from Bro systems
|
|
||||||
filter {
|
|
||||||
if [type] == "bro_irc" {
|
|
||||||
# If message looks like json, try to parse it as such. Otherwise, fall back to csv or grok.
|
|
||||||
if [message] =~ /^{.*}$/ {
|
|
||||||
json {
|
|
||||||
source => "message"
|
|
||||||
}
|
|
||||||
|
|
||||||
mutate {
|
|
||||||
rename => { "ts" => "timestamp" }
|
|
||||||
#uid
|
|
||||||
rename => { "id.orig_h" => "source_ip" }
|
|
||||||
rename => { "id.orig_p" => "source_port" }
|
|
||||||
rename => { "id.resp_h" => "destination_ip" }
|
|
||||||
rename => { "id.resp_p" => "destination_port" }
|
|
||||||
#nick
|
|
||||||
rename => { "user" => "irc_username" }
|
|
||||||
rename => { "command" => "irc_command" }
|
|
||||||
#value
|
|
||||||
rename => { "addl" => "additional_info" }
|
|
||||||
#dcc_file_name
|
|
||||||
#dcc_file_size
|
|
||||||
#dcc_mime_type
|
|
||||||
#fuid
|
|
||||||
}
|
|
||||||
} else {
|
|
||||||
mutate {
|
|
||||||
gsub => [ "message", "[\"']", "" ]
|
|
||||||
}
|
|
||||||
csv {
|
|
||||||
columns => ["timestamp","uid","source_ip","source_port","destination_ip","destination_port","nick","irc_username","irc_command","value","additional_info","dcc_file_name","dcc_file_size","dcc_mime_type","fuid"]
|
|
||||||
separator => " "
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
mutate {
|
|
||||||
#add_tag => [ "conf_file_1107"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,56 +0,0 @@
|
|||||||
# Original Author: Justin Henderson
|
|
||||||
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
|
|
||||||
# Updated by: Doug Burks
|
|
||||||
# Last Update: 2/7/2018
|
|
||||||
#
|
|
||||||
# This conf file is based on accepting logs for kerberos.log from Bro systems
|
|
||||||
filter {
|
|
||||||
if [type] == "bro_kerberos" {
|
|
||||||
# If message looks like json, try to parse it as such. Otherwise, fall back to csv or grok.
|
|
||||||
if [message] =~ /^{.*}$/ {
|
|
||||||
json {
|
|
||||||
source => "message"
|
|
||||||
}
|
|
||||||
|
|
||||||
mutate {
|
|
||||||
rename => { "ts" => "timestamp" }
|
|
||||||
#uid
|
|
||||||
rename => { "id.orig_h" => "source_ip" }
|
|
||||||
rename => { "id.orig_p" => "source_port" }
|
|
||||||
rename => { "id.resp_h" => "destination_ip" }
|
|
||||||
rename => { "id.resp_p" => "destination_port" }
|
|
||||||
#request_type
|
|
||||||
#client
|
|
||||||
#service
|
|
||||||
rename => { "success" => "kerberos_success" }
|
|
||||||
rename => { "error_msg" => "error_message" }
|
|
||||||
rename => { "from" => "valid_from" }
|
|
||||||
rename => { "till" => "valid_till" }
|
|
||||||
#cipher
|
|
||||||
#forwardable
|
|
||||||
#renewable
|
|
||||||
rename => { "client_cert_subject" => "client_certificate_subject" }
|
|
||||||
rename => { "client_cert_fuid" => "client_certificate_fuid" }
|
|
||||||
rename => { "server_cert_subject" => "server_certificate_subject" }
|
|
||||||
rename => { "server_cert_fuid" => "server_certificate_fuid" }
|
|
||||||
}
|
|
||||||
|
|
||||||
mutate {
|
|
||||||
convert => { "kerberos_success" => "string" }
|
|
||||||
convert => { "renewable" => "string" }
|
|
||||||
}
|
|
||||||
|
|
||||||
} else {
|
|
||||||
mutate {
|
|
||||||
gsub => [ "message", "[\"']", "" ]
|
|
||||||
}
|
|
||||||
csv {
|
|
||||||
columns => ["timestamp","uid","source_ip","source_port","destination_ip","destination_port","request_type","client","service","kerberos_success","error_message","valid_from","valid_till","cipher","forwardable","renewable","client_certificate_subject","client_certificate_fuid","server_certificate_subject","server_certificate_fuid"]
|
|
||||||
separator => " "
|
|
||||||
}
|
|
||||||
}
|
|
||||||
mutate {
|
|
||||||
#add_tag => [ "conf_file_1108"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,56 +0,0 @@
|
|||||||
# Author: Justin Henderson
|
|
||||||
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
|
|
||||||
# Updated by: Doug Burks
|
|
||||||
# Last Update: 2/7/2018
|
|
||||||
#
|
|
||||||
# This conf file is based on accepting logs for notice.log from Bro systems
|
|
||||||
filter {
|
|
||||||
if [type] == "bro_notice" {
|
|
||||||
# If message looks like json, try to parse it as such. Otherwise, fall back to csv or grok.
|
|
||||||
if [message] =~ /^{.*}$/ {
|
|
||||||
json {
|
|
||||||
source => "message"
|
|
||||||
}
|
|
||||||
|
|
||||||
mutate {
|
|
||||||
rename => { "ts" => "timestamp" }
|
|
||||||
#uid
|
|
||||||
rename => { "id.orig_h" => "source_ip" }
|
|
||||||
rename => { "id.orig_p" => "source_port" }
|
|
||||||
rename => { "id.resp_h" => "destination_ip" }
|
|
||||||
rename => { "id.resp_p" => "destination_port" }
|
|
||||||
#fuid
|
|
||||||
rename => { "mime" => "file_mime_type" }
|
|
||||||
rename => { "desc" => "file_description" }
|
|
||||||
rename => { "proto" => "protocol" }
|
|
||||||
rename => { "note" => "note" }
|
|
||||||
rename => { "msg" => "msg" }
|
|
||||||
rename => { "sub" => "sub_msg" }
|
|
||||||
rename => { "src" => "source_ip" }
|
|
||||||
rename => { "dst" => "destination_ip" }
|
|
||||||
#p
|
|
||||||
#n
|
|
||||||
rename => { "peer_descr" => "peer_description" }
|
|
||||||
rename => { "actions" => "action" }
|
|
||||||
#suppress_for
|
|
||||||
#destination_country_code
|
|
||||||
#destination_region
|
|
||||||
#destination_city
|
|
||||||
#destination_latitude
|
|
||||||
#destination_longitude
|
|
||||||
}
|
|
||||||
} else {
|
|
||||||
mutate {
|
|
||||||
gsub => [ "message", "[\"']", "" ]
|
|
||||||
}
|
|
||||||
csv {
|
|
||||||
columns => ["timestamp","uid","source_ip","source_port","destination_ip","destination_port","fuid","file_mime_type","file_description","protocol","note","msg","sub_msg","source_ip","destination_ip","p","n","peer_description","action","suppress_for","destination_country_code","destination_region","destination_city","destination_latitude","destination_longitude"]
|
|
||||||
separator => " "
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
mutate {
|
|
||||||
#add_tag => [ "conf_file_1109"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,52 +0,0 @@
|
|||||||
# Author: Justin Henderson
|
|
||||||
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
|
|
||||||
# Updated by: Doug Burks
|
|
||||||
#
|
|
||||||
# This conf file is based on accepting logs for rdp.log from Bro systems
|
|
||||||
filter {
|
|
||||||
if [type] == "bro_rdp" {
|
|
||||||
# If message looks like json, try to parse it as such. Otherwise, fall back to csv or grok.
|
|
||||||
if [message] =~ /^{.*}$/ {
|
|
||||||
json {
|
|
||||||
source => "message"
|
|
||||||
}
|
|
||||||
|
|
||||||
mutate {
|
|
||||||
rename => { "ts" => "timestamp" }
|
|
||||||
#uid
|
|
||||||
rename => { "id.orig_h" => "source_ip" }
|
|
||||||
rename => { "id.orig_p" => "source_port" }
|
|
||||||
rename => { "id.resp_h" => "destination_ip" }
|
|
||||||
rename => { "id.resp_p" => "destination_port" }
|
|
||||||
#cookie
|
|
||||||
#result
|
|
||||||
#security_protocol
|
|
||||||
#client_channels
|
|
||||||
#keyboard_layout
|
|
||||||
#client_build
|
|
||||||
#client_name
|
|
||||||
rename => { "client_dig_product_id" => "client_digital_product_id" }
|
|
||||||
#desktop_width
|
|
||||||
#desktop_height
|
|
||||||
#requested_color_depth
|
|
||||||
rename => { "cert_type" => "certificate_type" }
|
|
||||||
rename => { "cert_count" => "certificate_count" }
|
|
||||||
rename => { "cert_permanent" => "certificate_permanent" }
|
|
||||||
#encryption_level
|
|
||||||
#encryption_method
|
|
||||||
}
|
|
||||||
} else {
|
|
||||||
mutate {
|
|
||||||
gsub => [ "message", "[\"']", "" ]
|
|
||||||
}
|
|
||||||
csv {
|
|
||||||
columns => ["timestamp","uid","source_ip","source_port","destination_ip","destination_port","cookie","result","security_protocol","client_channels","keyboard_layout","client_build","client_name","client_digital_product_id","desktop_width","desktop_height","requested_color_depth","certificate_type","certificate_count","certificate_permanent","encryption_level","encryption_method"]
|
|
||||||
separator => " "
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
mutate {
|
|
||||||
#add_tag => [ "conf_file_1110"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,43 +0,0 @@
|
|||||||
# Author: Justin Henderson
|
|
||||||
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
|
|
||||||
# Updated by: Doug Burks
|
|
||||||
# Last Update: 2/7/2018
|
|
||||||
#
|
|
||||||
# This conf file is based on accepting logs for signatures.log from Bro systems
|
|
||||||
filter {
|
|
||||||
if [type] == "bro_signatures" {
|
|
||||||
# If message looks like json, try to parse it as such. Otherwise, fall back to csv or grok.
|
|
||||||
if [message] =~ /^{.*}$/ {
|
|
||||||
json {
|
|
||||||
source => "message"
|
|
||||||
}
|
|
||||||
|
|
||||||
mutate {
|
|
||||||
rename => { "ts" => "timestamp" }
|
|
||||||
#uid
|
|
||||||
rename => { "id.orig_h" => "source_ip" }
|
|
||||||
rename => { "id.orig_p" => "source_port" }
|
|
||||||
rename => { "id.resp_h" => "destination_ip" }
|
|
||||||
rename => { "id.resp_p" => "destination_port" }
|
|
||||||
#note
|
|
||||||
rename => { "sig_id" => "signature_id" }
|
|
||||||
rename => { "event_msg" => "event_message" }
|
|
||||||
rename => { "sub_msg" => "sub_message" }
|
|
||||||
rename => { "sig_count" => "signature_count" }
|
|
||||||
#host_count
|
|
||||||
}
|
|
||||||
} else {
|
|
||||||
mutate {
|
|
||||||
gsub => [ "message", "[\"']", "" ]
|
|
||||||
}
|
|
||||||
csv {
|
|
||||||
columns => ["timestamp","uid","source_ip","source_port","destination_ip","destination_port","note","signature_id","event_message","sub_message","signature_count","host_count"]
|
|
||||||
separator => " "
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
mutate {
|
|
||||||
#add_tag => [ "conf_file_1111"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,65 +0,0 @@
|
|||||||
# Author: Justin Henderson
|
|
||||||
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
|
|
||||||
# Updated by: Doug Burks
|
|
||||||
# Last Update: 2/7/2018
|
|
||||||
#
|
|
||||||
# This conf file is based on accepting logs for smtp.log from Bro systems
|
|
||||||
filter {
|
|
||||||
if [type] == "bro_smtp" {
|
|
||||||
# If message looks like json, try to parse it as such. Otherwise, fall back to csv or grok.
|
|
||||||
if [message] =~ /^{.*}$/ {
|
|
||||||
json {
|
|
||||||
source => "message"
|
|
||||||
}
|
|
||||||
|
|
||||||
mutate {
|
|
||||||
rename => { "ts" => "timestamp" }
|
|
||||||
#uid
|
|
||||||
rename => { "id.orig_h" => "source_ip" }
|
|
||||||
rename => { "id.orig_p" => "source_port" }
|
|
||||||
rename => { "id.resp_h" => "destination_ip" }
|
|
||||||
rename => { "id.resp_p" => "destination_port" }
|
|
||||||
#trans_depth
|
|
||||||
#helo
|
|
||||||
rename => { "mailfrom" => "mail_from" }
|
|
||||||
rename => { "rcptto" => "recipient_to" }
|
|
||||||
rename => { "date" => "mail_date" }
|
|
||||||
#from
|
|
||||||
#to
|
|
||||||
#cc
|
|
||||||
#reply_to
|
|
||||||
rename => { "msg_id" => "message_id" }
|
|
||||||
#in_reply_to
|
|
||||||
#subject
|
|
||||||
#x_originating_ip
|
|
||||||
#first_received
|
|
||||||
#second_received
|
|
||||||
#last_reply
|
|
||||||
#path
|
|
||||||
rename => { "user_agent" => "useragent" }
|
|
||||||
#tls
|
|
||||||
#fuids
|
|
||||||
#is_webmail
|
|
||||||
}
|
|
||||||
|
|
||||||
mutate {
|
|
||||||
convert => { "tls" => "string" }
|
|
||||||
convert => { "is_webmail" => "string" }
|
|
||||||
}
|
|
||||||
|
|
||||||
} else {
|
|
||||||
grok {
|
|
||||||
match => [ "message", "(?<timestamp>(.*?))\t(?<uid>(.*?))\t(?<source_ip>(.*?))\t(?<source_port>(.*?))\t(?<destination_ip>(.*?))\t(?<destination_port>(.*?))\t(?<trans_depth>(.*?))\t(?<helo>(.*?))\t(?<mail_from>(.*?))\t(?<recipient_to>(.*?))\t(?<mail_date>(.*?))\t(?<from>(.*?))\t(?<to>(.*?))\t(?<cc>(.*?))\t(?<reply_to>(.*?))\t(?<message_id>(.*?))\t(?<in_reply_to>(.*?))\t(?<subject>(.*?))\t(?<x_originating_ip>(.*?))\t(?<first_received>(.*))\t(?<second_received>(.*))\t(?<last_reply>(.*))\t(?<path>(.*))\t(?<useragent>(.*))\t(?<tls>(.*))\t(?<fuids>(.*))\t(?<is_webmail>(.*))" ]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
if [useragent] == "-" {
|
|
||||||
mutate {
|
|
||||||
remove_field => [ "useragent" ]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
mutate {
|
|
||||||
#add_tag => [ "conf_file_1112"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,47 +0,0 @@
|
|||||||
# Author: Justin Henderson
|
|
||||||
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
|
|
||||||
# Updated by: Doug Burks
|
|
||||||
# Last Update: 2/7/2018
|
|
||||||
#
|
|
||||||
# This conf file is based on accepting logs for snmp.log from Bro systems
|
|
||||||
filter {
|
|
||||||
if [type] == "bro_snmp" {
|
|
||||||
# If message looks like json, try to parse it as such. Otherwise, fall back to csv or grok.
|
|
||||||
if [message] =~ /^{.*}$/ {
|
|
||||||
json {
|
|
||||||
source => "message"
|
|
||||||
}
|
|
||||||
|
|
||||||
mutate {
|
|
||||||
rename => { "ts" => "timestamp" }
|
|
||||||
#uid
|
|
||||||
rename => { "id.orig_h" => "source_ip" }
|
|
||||||
rename => { "id.orig_p" => "source_port" }
|
|
||||||
rename => { "id.resp_h" => "destination_ip" }
|
|
||||||
rename => { "id.resp_p" => "destination_port" }
|
|
||||||
#duration
|
|
||||||
#version
|
|
||||||
#convert => { "version" => "string" }
|
|
||||||
#community
|
|
||||||
#get_requests
|
|
||||||
#get_bulk_requests
|
|
||||||
#get_responses
|
|
||||||
#set_requests
|
|
||||||
#display_string
|
|
||||||
#up_since
|
|
||||||
}
|
|
||||||
} else {
|
|
||||||
mutate {
|
|
||||||
gsub => [ "message", "[\"']", "" ]
|
|
||||||
}
|
|
||||||
csv {
|
|
||||||
columns => ["timestamp","uid","source_ip","source_port","destination_ip","destination_port","duration","version","community","get_requests","get_bulk_requests","get_responses","set_requests","display_string","up_since"]
|
|
||||||
separator => " "
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
mutate {
|
|
||||||
#add_tag => [ "conf_file_1113"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,49 +0,0 @@
|
|||||||
# Author: Justin Henderson
|
|
||||||
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
|
|
||||||
# Updated by: Doug Burks
|
|
||||||
# Last Update: 2/7/2018
|
|
||||||
#
|
|
||||||
# This conf file is based on accepting logs for software.log from Bro systems
|
|
||||||
filter {
|
|
||||||
if [type] == "bro_software" {
|
|
||||||
# If message looks like json, try to parse it as such. Otherwise, fall back to csv or grok.
|
|
||||||
if [message] =~ /^{.*}$/ {
|
|
||||||
json {
|
|
||||||
source => "message"
|
|
||||||
}
|
|
||||||
|
|
||||||
mutate {
|
|
||||||
rename => { "ts" => "timestamp" }
|
|
||||||
#uid
|
|
||||||
rename => { "host" => "source_ip" }
|
|
||||||
rename => { "host_p" => "source_port" }
|
|
||||||
#software_type
|
|
||||||
#name
|
|
||||||
rename => { "version.major" => "version_major" }
|
|
||||||
rename => { "version.minor" => "version_minor" }
|
|
||||||
rename => { "version.minor2" => "version_minor2" }
|
|
||||||
rename => { "version.minor3" => "version_minor3" }
|
|
||||||
rename => { "version.addl" => "version_additional_info" }
|
|
||||||
#unparsed_version
|
|
||||||
}
|
|
||||||
|
|
||||||
mutate {
|
|
||||||
convert => { "version_major" => "string" }
|
|
||||||
convert => { "version_minor" => "string" }
|
|
||||||
}
|
|
||||||
|
|
||||||
} else {
|
|
||||||
mutate {
|
|
||||||
gsub => [ "message", "[\"']", "" ]
|
|
||||||
}
|
|
||||||
csv {
|
|
||||||
columns => ["timestamp","source_ip","source_port","software_type","name","version_major","version_minor","version_minor2","version_minor3","version_additional_info","unparsed_version"]
|
|
||||||
separator => " "
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
mutate {
|
|
||||||
#add_tag => [ "conf_file_1114"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,66 +0,0 @@
|
|||||||
# Author: Justin Henderson
|
|
||||||
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
|
|
||||||
# Updated by: Doug Burks and Wes Lambert
|
|
||||||
# Last Update: 10/30/2018
|
|
||||||
#
|
|
||||||
# This conf file is based on accepting logs for ssh.log from Bro systems
|
|
||||||
filter {
|
|
||||||
if [type] == "bro_ssh" {
|
|
||||||
# If message looks like json, try to parse it as such. Otherwise, fall back to csv or grok.
|
|
||||||
if [message] =~ /^{.*}$/ {
|
|
||||||
json {
|
|
||||||
source => "message"
|
|
||||||
}
|
|
||||||
|
|
||||||
mutate {
|
|
||||||
rename => { "ts" => "timestamp" }
|
|
||||||
#uid
|
|
||||||
rename => { "id.orig_h" => "source_ip" }
|
|
||||||
rename => { "id.orig_p" => "source_port" }
|
|
||||||
rename => { "id.resp_h" => "destination_ip" }
|
|
||||||
rename => { "id.resp_p" => "destination_port" }
|
|
||||||
#version
|
|
||||||
#convert => { "version" => "string" }
|
|
||||||
rename => { "auth_success" => "authentication_success" }
|
|
||||||
rename => { "auth_attempts" => "authentication_attempts" }
|
|
||||||
#direction
|
|
||||||
#client
|
|
||||||
#server
|
|
||||||
rename => { "cipher_alg" => "cipher_algorithm" }
|
|
||||||
rename => { "compression_alg" => "compression_algorithm" }
|
|
||||||
rename => { "cshka" => "client_host_key_algorithms" }
|
|
||||||
rename => { "host_key_alg" => "host_key_algorithm" }
|
|
||||||
rename => { "hasshAlgorithms" => "hassh_algorithms" }
|
|
||||||
rename => { "hasshServer" => "hassh_server" }
|
|
||||||
rename => { "hasshServerAlgorithms" => "hassh_server_algorithms" }
|
|
||||||
rename => { "hasshVersion" => "hassh_version" }
|
|
||||||
rename => { "kex_alg" => "kex_algorithm" }
|
|
||||||
rename => { "mac_alg" => "mac_algorithm" }
|
|
||||||
rename => { "sshka" => "server_host_key_algorithms" }
|
|
||||||
#host_key
|
|
||||||
#destination_country_code
|
|
||||||
#destination_region
|
|
||||||
#destination_city
|
|
||||||
#destination_latitude
|
|
||||||
#destination_longitude
|
|
||||||
}
|
|
||||||
|
|
||||||
mutate {
|
|
||||||
convert => { "authentication_success" => "string" }
|
|
||||||
}
|
|
||||||
|
|
||||||
} else {
|
|
||||||
mutate {
|
|
||||||
gsub => [ "message", "[\"']", "" ]
|
|
||||||
}
|
|
||||||
csv {
|
|
||||||
columns => ["timestamp","uid","source_ip","source_port","destination_ip","destination_port","version","authentication_success","authentication_attempts","direction","client","server","cipher_algorithm","mac_algorithm","compression_algorithm","kex_algorithm","host_key_algorithm","host_key","destination_country_code","destination_region","destination_city","destination_latitude","destination_longitude","hassh_version","hassh","hassh_server","client_host_key_algorithms","hassh_algorithms","server_host_key_algorithms","hassh_server_algorithms"]
|
|
||||||
separator => " "
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
mutate {
|
|
||||||
#add_tag => [ "conf_file_1115"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,186 +0,0 @@
|
|||||||
# Original Author: Justin Henderson
|
|
||||||
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
|
|
||||||
# Updated by: Doug Burks
|
|
||||||
# Last Update: 10/30/2018
|
|
||||||
#
|
|
||||||
# This conf file is based on accepting logs for ssl.log from Bro systems
|
|
||||||
filter {
|
|
||||||
if [type] == "bro_ssl" {
|
|
||||||
# If message looks like json, try to parse it as such. Otherwise, fall back to csv or grok.
|
|
||||||
if [message] =~ /^{.*}$/ {
|
|
||||||
json {
|
|
||||||
source => "message"
|
|
||||||
}
|
|
||||||
|
|
||||||
mutate {
|
|
||||||
rename => { "ts" => "timestamp" }
|
|
||||||
#uid
|
|
||||||
rename => { "id.orig_h" => "source_ip" }
|
|
||||||
rename => { "id.orig_p" => "source_port" }
|
|
||||||
rename => { "id.resp_h" => "destination_ip" }
|
|
||||||
rename => { "id.resp_p" => "destination_port" }
|
|
||||||
#version
|
|
||||||
#convert => { "version" => "string" }
|
|
||||||
#cipher
|
|
||||||
#curve
|
|
||||||
#server_name
|
|
||||||
#resumed
|
|
||||||
#last_alert
|
|
||||||
#next_protocol
|
|
||||||
#established
|
|
||||||
rename => { "cert_chain_fuids" => "certificate_chain_fuids" }
|
|
||||||
rename => { "client_cert_chain_fuids" => "client_certificate_chain_fuids" }
|
|
||||||
rename => { "subject" => "certificate_subject" }
|
|
||||||
rename => { "issuer" => "certificate_issuer" }
|
|
||||||
#client_subject
|
|
||||||
#client_issuer
|
|
||||||
#validation_status
|
|
||||||
#ja3
|
|
||||||
}
|
|
||||||
} else {
|
|
||||||
mutate {
|
|
||||||
gsub => [ "message", "[\"']", "" ]
|
|
||||||
}
|
|
||||||
csv {
|
|
||||||
columns => ["timestamp","uid","source_ip","source_port","destination_ip","destination_port","version","cipher","curve","server_name","resumed","last_alert","next_protocol","established","certificate_chain_fuids","client_certificate_chain_fuids","certificate_subject","certificate_issuer","client_subject","client_issuer","validation_status","ja3","ja3s"]
|
|
||||||
separator => " "
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
mutate {
|
|
||||||
gsub => [ "subject", "\\\\,", "|" ]
|
|
||||||
}
|
|
||||||
kv {
|
|
||||||
include_keys => [ "CN", "C", "O", "OU", "ST", "SN", "L", "DC", "GN", "pseudonym", "serialNumber", "title", "initials" ]
|
|
||||||
field_split => ","
|
|
||||||
source => "certificate_issuer"
|
|
||||||
}
|
|
||||||
mutate {
|
|
||||||
rename => { "CN" => "issuer_common_name"}
|
|
||||||
rename => { "C" => "issuer_country_code"}
|
|
||||||
rename => { "O" => "issuer_organization"}
|
|
||||||
rename => { "OU" => "issuer_organization_unit"}
|
|
||||||
rename => { "ST" => "issuer_state"}
|
|
||||||
rename => { "SN" => "issuer_surname"}
|
|
||||||
rename => { "L" => "issuer_locality"}
|
|
||||||
rename => { "DC" => "issuer_distinguished_name"}
|
|
||||||
rename => { "GN" => "issuer_given_name"}
|
|
||||||
rename => { "pseudonym" => "issuer_pseudonym"}
|
|
||||||
rename => { "serialNumber" => "issuer_serial_number"}
|
|
||||||
rename => { "title" => "issuer_title"}
|
|
||||||
rename => { "initials" => "issuer_initials"}
|
|
||||||
}
|
|
||||||
kv {
|
|
||||||
include_keys => [ "CN", "C", "O", "OU", "ST", "SN", "L", "GN", "pseudonym", "serialNumber", "title", "initials" ]
|
|
||||||
field_split => ","
|
|
||||||
source => "certificate_subject"
|
|
||||||
}
|
|
||||||
mutate {
|
|
||||||
rename => { "CN" => "certificate_common_name"}
|
|
||||||
rename => { "C" => "certificate_country_code"}
|
|
||||||
rename => { "O" => "certificate_organization"}
|
|
||||||
rename => { "OU" => "certificate_organization_unit"}
|
|
||||||
rename => { "ST" => "certificate_state"}
|
|
||||||
rename => { "SN" => "certificate_surname"}
|
|
||||||
rename => { "L" => "certificate_locality"}
|
|
||||||
rename => { "GN" => "certificate_given_name"}
|
|
||||||
rename => { "pseudonym" => "certificate_pseudonym"}
|
|
||||||
rename => { "serialNumber" => "certificate_serial_number"}
|
|
||||||
rename => { "title" => "certificate_title"}
|
|
||||||
rename => { "initials" => "certificate_initials"}
|
|
||||||
}
|
|
||||||
if [certificate_subject] == "-" {
|
|
||||||
mutate {
|
|
||||||
remove_field => [ "certificate_subject" ]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [certificate_issuer] == "-" {
|
|
||||||
mutate {
|
|
||||||
remove_field => [ "certificate_issuer" ]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [certificate_common_name] {
|
|
||||||
ruby {
|
|
||||||
code => "event.set('certificate_common_name_length', event.get('certificate_common_name').length)"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [issuer_common_name] {
|
|
||||||
ruby {
|
|
||||||
code => "event.set('issuer_common_name_length', event.get('issuer_common_name').length)"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [server_name] {
|
|
||||||
if [server_name] == "-" {
|
|
||||||
mutate {
|
|
||||||
remove_field => [ "server_name" ]
|
|
||||||
}
|
|
||||||
} else {
|
|
||||||
ruby {
|
|
||||||
code => "event.set('server_name_length', event.get('server_name').length)"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [certificate_chain_fuids] {
|
|
||||||
if [certificate_chain_fuids] == "-" {
|
|
||||||
mutate {
|
|
||||||
remove_field => [ "certificate_chain_fuids" ]
|
|
||||||
}
|
|
||||||
} else {
|
|
||||||
ruby {
|
|
||||||
code => "event.set('certificate_chain_count', event.get('certificate_chain_fuids').count(',') + 1)"
|
|
||||||
}
|
|
||||||
mutate {
|
|
||||||
convert => [ "certificate_chain_length", "integer" ]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [client_certificate_chain_fuids] == "-" {
|
|
||||||
mutate {
|
|
||||||
remove_field => [ "client_certificate_chain_fuids" ]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [client_issuer] == "-" {
|
|
||||||
mutate {
|
|
||||||
remove_field => [ "client_issuer" ]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [client_subject] == "-" {
|
|
||||||
mutate {
|
|
||||||
remove_field => [ "client_subject" ]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [curve] == "-" {
|
|
||||||
mutate {
|
|
||||||
remove_field => [ "curve" ]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [issuer] == "-" {
|
|
||||||
mutate {
|
|
||||||
remove_field => [ "issuer" ]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [query] == "-" {
|
|
||||||
mutate {
|
|
||||||
remove_field => [ "query" ]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [subject] == "-" {
|
|
||||||
mutate {
|
|
||||||
remove_field => [ "subject" ]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [validation_status] == "-" {
|
|
||||||
mutate {
|
|
||||||
remove_field => [ "validation_status" ]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if [ja3] == "-" {
|
|
||||||
mutate {
|
|
||||||
remove_field => [ "ja3" ]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
mutate {
|
|
||||||
#add_tag => [ "conf_file_1116"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user