From 85d30520ceb7ee5954b516c68472d2bffacef034 Mon Sep 17 00:00:00 2001 From: lock-wire Date: Fri, 4 Nov 2022 20:28:20 -0700 Subject: [PATCH] Add BSAP protocol --- .../files/ingest/zeek.bsap_ip_header | 10 ++++++++++ .../files/ingest/zeek.bsap_ip_rdb | 20 +++++++++++++++++++ .../files/ingest/zeek.bsap_ip_unknown | 9 +++++++++ .../files/ingest/zeek.bsap_serial_header | 17 ++++++++++++++++ .../files/ingest/zeek.bsap_serial_rdb | 11 ++++++++++ .../files/ingest/zeek.bsap_serial_rdb_ext | 13 ++++++++++++ .../files/ingest/zeek.bsap_serial_unknown | 9 +++++++++ 7 files changed, 89 insertions(+) create mode 100644 salt/elasticsearch/files/ingest/zeek.bsap_ip_header create mode 100644 salt/elasticsearch/files/ingest/zeek.bsap_ip_rdb create mode 100644 salt/elasticsearch/files/ingest/zeek.bsap_ip_unknown create mode 100644 salt/elasticsearch/files/ingest/zeek.bsap_serial_header create mode 100644 salt/elasticsearch/files/ingest/zeek.bsap_serial_rdb create mode 100644 salt/elasticsearch/files/ingest/zeek.bsap_serial_rdb_ext create mode 100644 salt/elasticsearch/files/ingest/zeek.bsap_serial_unknown diff --git a/salt/elasticsearch/files/ingest/zeek.bsap_ip_header b/salt/elasticsearch/files/ingest/zeek.bsap_ip_header new file mode 100644 index 000000000..59f7bca04 --- /dev/null +++ b/salt/elasticsearch/files/ingest/zeek.bsap_ip_header @@ -0,0 +1,10 @@ +{ + "description" : "zeek.bsap_ip_header", + "processors" : [ + { "remove": { "field": ["host"], "ignore_failure": true } }, + { "json": { "field": "message", "target_field": "message2", "ignore_failure": true } }, + { "rename": { "field": "message2.num_msg", "target_field": "bsap.number.messages", "ignore_missing": true } }, + { "rename": { "field": "message2.type_name", "target_field": "bsap.message.type", "ignore_missing": true } }, + { "pipeline": { "name": "zeek.common" } } + ] +} \ No newline at end of file diff --git a/salt/elasticsearch/files/ingest/zeek.bsap_ip_rdb b/salt/elasticsearch/files/ingest/zeek.bsap_ip_rdb new file mode 100644 index 000000000..6490e0aa9 --- /dev/null +++ b/salt/elasticsearch/files/ingest/zeek.bsap_ip_rdb @@ -0,0 +1,20 @@ +{ + "description" : "zeek.bsap_ip_rdb", + "processors" : [ + { "remove": { "field": ["host"], "ignore_failure": true } }, + { "json": { "field": "message", "target_field": "message2", "ignore_failure": true } }, + { "rename": { "field": "message2.header_size", "target_field": "bsap.header.legnth", "ignore_missing": true } }, + { "rename": { "field": "message2.mes_seq", "target_field": "bsap.message.sequence", "ignore_missing": true } }, + { "rename": { "field": "message2.res_seq", "target_field": "bsap.response.sequence", "ignore_missing": true } }, + { "rename": { "field": "message2.data_len", "target_field": "bsap.data.lenght", "ignore_missing": true } }, + { "rename": { "field": "message2.sequence", "target_field": "bsap.function.sequence", "ignore_missing": true } }, + { "rename": { "field": "message2.app_func_code", "target_field": "bsap.application.function", "ignore_missing": true } }, + { "rename": { "field": "message2.node_status", "target_field": "bsap.node.status", "ignore_missing": true } }, + { "rename": { "field": "message2.func_code", "target_field": "bsap.application.sub.function", "ignore_missing": true } }, + { "rename": { "field": "message2.variable_count", "target_field": "bsap.variable.count", "ignore_missing": true } }, + { "rename": { "field": "message2.variables", "target_field": "bsap.vector.variables", "ignore_missing": true } }, + { "rename": { "field": "message2.variable_value", "target_field": "bsap.vector.variable.value", "ignore_missing": true } }, + { "rename": { "field": "message2.value", "target_field": "bacnet.value", "ignore_missing": true } }, + { "pipeline": { "name": "zeek.common" } } + ] +} diff --git a/salt/elasticsearch/files/ingest/zeek.bsap_ip_unknown b/salt/elasticsearch/files/ingest/zeek.bsap_ip_unknown new file mode 100644 index 000000000..2e94f55b5 --- /dev/null +++ b/salt/elasticsearch/files/ingest/zeek.bsap_ip_unknown @@ -0,0 +1,9 @@ +{ + "description" : "zeek.bsap_ip_unknown", + "processors" : [ + { "remove": { "field": ["host"], "ignore_failure": true } }, + { "json": { "field": "message", "target_field": "message2", "ignore_failure": true } }, + { "rename": { "field": "message2.data", "target_field": "bsap.ip.unknown.data", "ignore_missing": true } }, + { "pipeline": { "name": "zeek.common" } } + ] +} diff --git a/salt/elasticsearch/files/ingest/zeek.bsap_serial_header b/salt/elasticsearch/files/ingest/zeek.bsap_serial_header new file mode 100644 index 000000000..1c81dbf2a --- /dev/null +++ b/salt/elasticsearch/files/ingest/zeek.bsap_serial_header @@ -0,0 +1,17 @@ +{ + "description" : "zeek.bsap_serial_header", + "processors" : [ + { "remove": { "field": ["host"], "ignore_failure": true } }, + { "json": { "field": "message", "target_field": "message2", "ignore_failure": true } }, + { "rename": { "field": "message2.ser", "target_field": "bsap.message.serial.number", "ignore_missing": true } }, + { "rename": { "field": "message2.dadd", "target_field": "bsap.destination.address", "ignore_missing": true } }, + { "rename": { "field": "message2.sadd", "target_field": "bsap.scource.address", "ignore_missing": true } }, + { "rename": { "field": "message2.ctl", "target_field": "bsap.control.byte", "ignore_missing": true } }, + { "rename": { "field": "message2.dfun", "target_field": "bsap.destination.function", "ignore_missing": true } }, + { "rename": { "field": "message2.seq", "target_field": "bsap.message.sequence", "ignore_missing": true } }, + { "rename": { "field": "message2.sfun", "target_field": "bsap.source.function", "ignore_missing": true } }, + { "rename": { "field": "message2.nsb", "target_field": "bsap.node.status.byte", "ignore_missing": true } }, + { "rename": { "field": "message2.type_name", "target_field": "bsap.message.type", "ignore_missing": true } }, + { "pipeline": { "name": "zeek.common" } } + ] +} \ No newline at end of file diff --git a/salt/elasticsearch/files/ingest/zeek.bsap_serial_rdb b/salt/elasticsearch/files/ingest/zeek.bsap_serial_rdb new file mode 100644 index 000000000..71e0ad9e1 --- /dev/null +++ b/salt/elasticsearch/files/ingest/zeek.bsap_serial_rdb @@ -0,0 +1,11 @@ +{ + "description" : "zeek.bsap_serial_rdb", + "processors" : [ + { "remove": { "field": ["host"], "ignore_failure": true } }, + { "json": { "field": "message", "target_field": "message2", "ignore_failure": true } }, + { "rename": { "field": "message2.func_code", "target_field": "bsap.rdb.function", "ignore_missing": true } }, + { "rename": { "field": "message2.variables", "target_field": "bsap.vector.variables", "ignore_missing": true } }, + { "rename": { "field": "message2.variable_value", "target_field": "bsap.vector.value", "ignore_missing": true } }, + { "pipeline": { "name": "zeek.common" } } + ] +} \ No newline at end of file diff --git a/salt/elasticsearch/files/ingest/zeek.bsap_serial_rdb_ext b/salt/elasticsearch/files/ingest/zeek.bsap_serial_rdb_ext new file mode 100644 index 000000000..9809d68a0 --- /dev/null +++ b/salt/elasticsearch/files/ingest/zeek.bsap_serial_rdb_ext @@ -0,0 +1,13 @@ +{ + "description" : "zeek.bsap_serial_rdb_ext", + "processors" : [ + { "remove": { "field": ["host"], "ignore_failure": true } }, + { "json": { "field": "message", "target_field": "message2", "ignore_failure": true } }, + { "rename": { "field": "message2.dfun", "target_field": "bsap.destination.function", "ignore_missing": true } }, + { "rename": { "field": "message2.seq", "target_field": "bsap.message.sequence", "ignore_missing": true } }, + { "rename": { "field": "message2.nsb", "target_field": "bsap.node.status.byte", "ignore_missing": true } }, + { "rename": { "field": "message2.extfun", "target_field": "bsap.extenstion.function", "ignore_missing": true } }, + { "rename": { "field": "message2.data", "target_field": "bsap.extenstion.function.data", "ignore_missing": true } }, + { "pipeline": { "name": "zeek.common" } } + ] +} \ No newline at end of file diff --git a/salt/elasticsearch/files/ingest/zeek.bsap_serial_unknown b/salt/elasticsearch/files/ingest/zeek.bsap_serial_unknown new file mode 100644 index 000000000..2b9331c93 --- /dev/null +++ b/salt/elasticsearch/files/ingest/zeek.bsap_serial_unknown @@ -0,0 +1,9 @@ +{ + "description" : "zeek.bsap_serial_unknown", + "processors" : [ + { "remove": { "field": ["host"], "ignore_failure": true } }, + { "json": { "field": "message", "target_field": "message2", "ignore_failure": true } }, + { "rename": { "field": "message2.data", "target_field": "bsap.serial.unknown.data", "ignore_missing": true } }, + { "pipeline": { "name": "zeek.common" } } + ] +}