CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-14 21:22:48 +01:00
Code Issues Packages Projects Releases Wiki Activity

parse Bro logs using Elasticsearch ingest node

Browse Source
This commit is contained in:
doug
2019-09-23 16:04:23 -04:00
parent c685089b2b
commit 8472b24a67
48 changed files with 1375 additions and 123 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
salt/elasticsearch/files/ingest/bro_files Normal file
View File

@@ -0,0 +1,32 @@
{
"description" : "bro_files",
"processors" : [
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
{ "rename": { "field": "message2.fuid", "target_field": "fuid", "ignore_missing": true } },
{ "rename": { "field": "message2.tx_hosts", "target_field": "file_ip", "ignore_missing": true } },
{ "rename": { "field": "message2.rx_hosts.0", "target_field": "destination_ip", "ignore_missing": true } },
{ "remove": { "field": "message2.rx_hosts", "ignore_missing": true } },
{ "rename": { "field": "message2.conn_uids", "target_field": "uid", "ignore_missing": true } },
{ "remove": { "field": "source", "ignore_missing": true } },
{ "rename": { "field": "message2.source", "target_field": "source", "ignore_missing": true } },
{ "rename": { "field": "message2.depth", "target_field": "depth", "ignore_missing": true } },
{ "rename": { "field": "message2.analyzers", "target_field": "analyzer", "ignore_missing": true } },
{ "rename": { "field": "message2.mime_type", "target_field": "mimetype", "ignore_missing": true } },
{ "rename": { "field": "message2.filename", "target_field": "file_name", "ignore_missing": true } },
{ "rename": { "field": "message2.duration", "target_field": "duration", "ignore_missing": true } },
{ "rename": { "field": "message2.local_orig", "target_field": "local_orig", "ignore_missing": true } },
{ "rename": { "field": "message2.is_orig", "target_field": "is_orig", "ignore_missing": true } },
{ "rename": { "field": "message2.seen_bytes", "target_field": "seen_bytes", "ignore_missing": true } },
{ "rename": { "field": "message2.total_bytes", "target_field": "total_bytes", "ignore_missing": true } },
{ "rename": { "field": "message2.missing_bytes", "target_field": "missing_bytes", "ignore_missing": true } },
{ "rename": { "field": "message2.overflow_bytes", "target_field": "overflow_bytes", "ignore_missing": true } },
{ "rename": { "field": "message2.timedout", "target_field": "timed_out", "ignore_missing": true } },
{ "rename": { "field": "message2.parent_fuid", "target_field": "parent_fuid", "ignore_missing": true } },
{ "rename": { "field": "message2.md5", "target_field": "md5", "ignore_missing": true } },
{ "rename": { "field": "message2.sha1", "target_field": "sha1", "ignore_missing": true } },
{ "rename": { "field": "message2.extracted", "target_field": "extracted", "ignore_missing": true } },
{ "rename": { "field": "message2.extracted_cutoff", "target_field": "extracted_cutoff", "ignore_missing": true } },
{ "rename": { "field": "message2.extracted_size", "target_field": "extracted_size", "ignore_missing": true } },
{ "pipeline": { "name": "bro_common" } }
]
}