CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-18 23:13:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch '2.4/dev' into jertel/wip

Browse Source
This commit is contained in:
Jason Ertel
2025-03-04 10:55:29 -05:00
parent 0047246cf2 95d3a2d834
commit 85450693a2
9 changed files with 70 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
salt/elasticsearch/files/ingest/zeek.ntp Normal file
View File

@@ -0,0 +1,16 @@
{
"description" : "zeek.ntp",
"processors":[
{"set": {"field":"event.dataset", "value":"ntp", "ignore_failure":true}},
{"json": {"field":"message", "target_field":"message2", "ignore_failure":true}},
{"rename": {"field":"message2.version", "target_field":"ntp.version", "ignore_missing":true}},
{"rename": {"field":"message2.mode", "target_field":"ntp.mode", "ignore_missing":true}},
{"rename": {"field":"message2.poll", "target_field":"ntp.poll", "ignore_missing":true}},
{"rename": {"field":"message2.precision", "target_field":"ntp.precision", "ignore_missing":true}},
{"rename": {"field":"message2.org_time", "target_field":"ntp.org_time", "ignore_missing":true}},
{"rename": {"field":"message2.xmt_time", "target_field":"ntp.xmt_time", "ignore_missing":true}},
{"date": {"field":"ntp.org_time", "target_field":"ntp.org_time", "formats":["UNIX", "UNIX_MS"], "ignore_failure": true, "if":"ctx?.ntp?.org_time != null"}},
{"date": {"field":"ntp.xmt_time", "target_field":"ntp.xmt_time", "formats":["UNIX", "UNIX_MS"], "ignore_failure": true, "if":"ctx?.ntp?.xmt_time != null"}},
{"pipeline":{"name":"zeek.common"}}
]
}

10
salt/elasticsearch/files/ingest/zeek.traceroute Normal file
View File

@@ -0,0 +1,10 @@
{
"description":"zeek.traceroute",
"processors":[
{"set": {"field":"event.dataset", "value":"traceroute" }},
{"json": {"field":"message", "target_field":"message2" }},
{"rename": {"field":"message2.src", "target_field":"source.ip", "ignore_missing":true,"ignore_failure":true}},
{"rename": {"field":"message2.dst", "target_field":"destination.ip", "ignore_missing":true,"ignore_failure":true}},
{"pipeline": {"name":"zeek.common"}}
]
}

1
salt/elasticsearch/soc_elasticsearch.yaml
View File

@@ -80,6 +80,7 @@ elasticsearch:
managed_integrations:
description: List of integrations to add into SOC config UI. Enter the full or partial integration name. Eg. 1password, 1pass
forcedType: "[]string"
multiline: True
global: True
advanced: True
helpLink: elasticsearch.html

10
salt/elasticsearch/templates/component/elastic-agent/logs-soc@package.json Normal file
View File

@@ -0,0 +1,10 @@
{
"template": {},
"_meta": {
"package": {
"name": "log"
},
"managed_by": "fleet",
"managed": true
}
}