CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-07 09:42:46 +01:00
Code Issues Packages Projects Releases Wiki Activity

Add file, process, and winlog mapping changes

Browse Source
This commit is contained in:
Wes Lambert
2022-03-03 13:37:27 +00:00
parent 8f97f09c9c
commit 85979cbce8
4 changed files with 170 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

69
salt/elasticsearch/templates/component/so/dtc-client-mappings.json Normal file
View File

@@ -0,0 +1,69 @@
{
"_meta": {
"documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-client.html",
"ecs_version": "1.12.2"
},
"template": {
"settings": {
"analysis": {
"analyzer": {
"es_security_analyzer": {
"type": "custom",
"char_filter": [
"whitespace_no_way"
],
"filter": [
"lowercase",
"trim"
],
"tokenizer": "keyword"
}
},
"char_filter": {
"whitespace_no_way": {
"type": "pattern_replace",
"pattern": "(\\s)+",
"replacement": "$1"
}
},
"filter": {
"path_hierarchy_pattern_filter": {
"type": "pattern_capture",
"preserve_original": true,
"patterns": [
"((?:[^\\\\]*\\\\)*)(.*)",
"((?:[^/]*/)*)(.*)"
]
}
},
"tokenizer": {
"path_tokenizer": {
"type": "path_hierarchy",
"delimiter": "\\"
}
}
}
},
"mappings": {
"properties": {
"client": {
"properties": {
"address": {
"ignore_above": 1024,
"type": "keyword",
"fields": {
"security": {
"type": "text",
"analyzer": "es_security_analyzer"
},
"keyword": {
"type": "keyword"
}
}
}
}
}
}
}
}
}

8
salt/elasticsearch/templates/component/so/dtc-file-mappings.json
View File

@@ -48,6 +48,14 @@
"properties": { "properties": {
"file": { "file": {
"properties": { "properties": {
"accessed": {
"type": "date"
"fields": {
"keyword": {
"type": "keyword"
}
}
},
"mime_type": { "mime_type": {
"ignore_above": 1024, "ignore_above": 1024,
"type": "keyword", "type": "keyword",

16
salt/elasticsearch/templates/component/so/dtc-process-mappings.json
View File

@@ -59,6 +59,22 @@
} }
}, },
"type": "wildcard" "type": "wildcard"
},
"pid": {
"type": "long",
"fields": {
"keyword": {
"type": "keyword"
}
}
},
"ppid": {
"type": "long",
"fields": {
"keyword": {
"type": "keyword"
}
}
} }
} }
} }

77
salt/elasticsearch/templates/component/so/dtc-winlog-mappings.json Normal file
View File

@@ -0,0 +1,77 @@
{
"_meta": {
"documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-base.html",
"ecs_version": "1.12.2"
},
"template": {
"settings": {
"analysis": {
"analyzer": {
"es_security_analyzer": {
"type": "custom",
"char_filter": [
"whitespace_no_way"
],
"filter": [
"lowercase",
"trim"
],
"tokenizer": "keyword"
}
},
"char_filter": {
"whitespace_no_way": {
"type": "pattern_replace",
"pattern": "(\\s)+",
"replacement": "$1"
}
},
"filter": {
"path_hierarchy_pattern_filter": {
"type": "pattern_capture",
"preserve_original": true,
"patterns": [
"((?:[^\\\\]*\\\\)*)(.*)",
"((?:[^/]*/)*)(.*)"
]
}
},
"tokenizer": {
"path_tokenizer": {
"type": "path_hierarchy",
"delimiter": "\\"
}
}
}
},
"mappings": {
"properties": {
"winlog": {
"properties": {
"event_id": {
"ignore_above": 1024,
"type": "keyword",
"fields": {
"security": {
"type": "text",
"analyzer": "es_security_analyzer"
}
}
},
"record_id": {
"ignore_above": 1024,
"type": "keyword",
"fields": {
"security": {
"type": "text",
"analyzer": "es_security_analyzer"
}
}
}
}
}
}
}
}
}