diff --git a/salt/elasticsearch/files/ingest/common b/salt/elasticsearch/files/ingest/common index 01d18529b..d0acaed13 100644 --- a/salt/elasticsearch/files/ingest/common +++ b/salt/elasticsearch/files/ingest/common @@ -41,6 +41,8 @@ { "set": { "if": "ctx.event?.severity == 2", "field": "event.severity_label", "value": "medium", "override": true } }, { "set": { "if": "ctx.event?.severity == 3", "field": "event.severity_label", "value": "high", "override": true } }, { "set": { "if": "ctx.event?.severity == 4", "field": "event.severity_label", "value": "critical", "override": true } }, + { "rename": { "field": "fields.category", "target_field": "event.category", "ignore_failure": true, "ignore_missing": true } }, + { "rename": { "field": "fields.module", "target_field": "event.module", "ignore_failure": true, "ignore_missing": true } }, { "rename": { "field": "module", "target_field": "event.module", "ignore_failure": true, "ignore_missing": true } }, { "rename": { "field": "dataset", "target_field": "event.dataset", "ignore_failure": true, "ignore_missing": true } }, { "rename": { "field": "category", "target_field": "event.category", "ignore_failure": true, "ignore_missing": true } }, @@ -53,7 +55,7 @@ { "convert": { "field": "event.severity", "type": "integer", "ignore_failure": true, "ignore_missing": true } }, { "remove": { - "field": [ "index_name_prefix", "message2", "type" ], + "field": [ "index_name_prefix", "message2", "type", "fields" ], "ignore_failure": true } } diff --git a/salt/elasticsearch/files/ingest/ossec b/salt/elasticsearch/files/ingest/ossec index c1368e23f..5dbfafd32 100644 --- a/salt/elasticsearch/files/ingest/ossec +++ b/salt/elasticsearch/files/ingest/ossec @@ -1,52 +1,53 @@ { "description" : "ossec", "processors" : [ - { "json": { "field": "message", "target_field": "message2", "ignore_failure": true } }, - { "rename": { "field": "message2.agent", "target_field": "agent", "ignore_missing": true } }, - { "rename": { "field": "message2.data", "target_field": "data", "ignore_missing": true } }, - { "rename": { "field": "message2.decoder", "target_field": "decoder", "ignore_missing": true } }, - { "rename": { "field": "message2.full_log", "target_field": "full_log", "ignore_missing": true } }, - { "rename": { "field": "message2.id", "target_field": "log.id.id", "ignore_missing": true } }, - { "rename": { "field": "message2.location", "target_field": "location", "ignore_missing": true } }, - { "rename": { "field": "message2.manager", "target_field": "manager", "ignore_missing": true } }, - { "rename": { "field": "message2.predecoder", "target_field": "predecoder", "ignore_missing": true } }, - { "rename": { "field": "message2.timestamp", "target_field": "timestamp", "ignore_missing": true } }, - { "rename": { "field": "message2.rule", "target_field": "rule", "ignore_missing": true } }, - { "rename": { "field": "data.command", "target_field": "command", "ignore_missing": true } }, - { "rename": { "field": "data.dstip", "target_field": "destination.ip", "ignore_missing": true } }, - { "rename": { "field": "data.dstport", "target_field": "destination.port", "ignore_missing": true } }, - { "rename": { "field": "data.dstuser", "target_field": "user.escalated", "ignore_missing": true } }, - { "rename": { "field": "data.srcip", "target_field": "source.ip", "ignore_missing": true } }, - { "rename": { "field": "data.srcuser", "target_field": "source.user", "ignore_missing": true } }, - { "rename": { "field": "data.win.eventdata.destinationHostname", "target_field": "destination.hostname", "ignore_missing": true } }, - { "rename": { "field": "data.win.eventdata.destinationIp", "target_field": "destination.ip", "ignore_missing": true } }, - { "rename": { "field": "data.win.eventdata.destinationPort", "target_field": "destination.port", "ignore_missing": true } }, - { "rename": { "field": "data.win.eventdata.image", "target_field": "image_path", "ignore_missing": true } }, - { "rename": { "field": "data.win.eventdata.parentImage", "target_field": "parent_image_path", "ignore_missing": true } }, - { "rename": { "field": "data.win.eventdata.sourceHostname", "target_field": "source.hostname", "ignore_missing": true } }, - { "rename": { "field": "data.win.eventdata.sourceIp", "target_field": "source_ip", "ignore_missing": true } }, - { "rename": { "field": "data.win.eventdata.sourcePort", "target_field": "source.port", "ignore_missing": true } }, - { "rename": { "field": "data.win.eventdata.targetFilename", "target_field": "file.target", "ignore_missing": true } }, - { "rename": { "field": "data.win.eventdata.user", "target_field": "user.name", "ignore_missing": true } }, - { "rename": { "field": "data.win.system.eventID", "target_field": "event.code", "ignore_missing": true } }, - { "rename": { "field": "predecoder.program_name", "target_field": "process.name", "ignore_missing": true } }, - { "set": { "if": "ctx.rule.level == 1", "field": "rule.category", "value": "None" } }, - { "set": { "if": "ctx.rule.level == 2", "field": "rule.category", "value": "System low priority notification" } }, - { "set": { "if": "ctx.rule.level == 3", "field": "rule.category", "value": "Successful/authorized event" } }, - { "set": { "if": "ctx.rule.level == 4", "field": "rule.category", "value": "System low priority error" } }, - { "set": { "if": "ctx.rule.level == 5", "field": "rule.category", "value": "User generated error" } }, - { "set": { "if": "ctx.rule.level == 6", "field": "rule.category", "value": "Low relevance attack" } }, - { "set": { "if": "ctx.rule.level == 7", "field": "rule.category", "value": "\"Bad word\" matching" } }, - { "set": { "if": "ctx.rule.level == 8", "field": "rule.category", "value": "First time seen" } }, - { "set": { "if": "ctx.rule.level == 9", "field": "rule.category", "value": "Error from invalid source" } }, - { "set": { "if": "ctx.rule.level == 10", "field": "rule.category", "value": "Multiple user generated errors" } }, - { "set": { "if": "ctx.rule.level == 11", "field": "rule.category", "value": "Integrity checking warning" } }, - { "set": { "if": "ctx.rule.level == 12", "field": "rule.category", "value": "High importance event" } }, - { "set": { "if": "ctx.rule.level == 13", "field": "rule.category", "value": "Unusal error (high importance)" } }, - { "set": { "if": "ctx.rule.level == 14", "field": "rule.category", "value": "High importance security event" } }, - { "set": { "if": "ctx.rule.level == 15", "field": "rule.category", "value": "Severe attack" } }, - { "append": { "if": "ctx.rule.level != null", "field": "tags", "value": ["alert"] } }, - { "remove": { "field": [ "host", "predecoder", "decoder" ], "ignore_missing": true, "ignore_failure": false } }, - { "pipeline": { "name": "common" } } + { "json": { "field": "message", "target_field": "message2", "ignore_failure": true } }, + { "remove": { "field": [ "agent" ], "ignore_missing": true, "ignore_failure": true } }, + { "rename": { "field": "message2.agent", "target_field": "agent", "ignore_missing": true } }, + { "rename": { "field": "message2.data", "target_field": "data", "ignore_missing": true } }, + { "rename": { "field": "message2.decoder", "target_field": "decoder", "ignore_missing": true } }, + { "rename": { "field": "message2.full_log", "target_field": "log.full", "ignore_missing": true } }, + { "rename": { "field": "message2.id", "target_field": "log.id.id", "ignore_missing": true } }, + { "rename": { "field": "message2.location", "target_field": "log.location", "ignore_missing": true } }, + { "rename": { "field": "message2.manager", "target_field": "manager", "ignore_missing": true } }, + { "rename": { "field": "message2.predecoder", "target_field": "predecoder", "ignore_missing": true } }, + { "rename": { "field": "message2.timestamp", "target_field": "event.timestamp", "ignore_missing": true } }, + { "rename": { "field": "message2.previous_log", "target_field": "log.previous_log", "ignore_missing": true } }, + { "rename": { "field": "message2.previous_output", "target_field": "log.previous_output", "ignore_missing": true } }, + { "rename": { "field": "message2.rule", "target_field": "rule", "ignore_missing": true } }, + { "rename": { "field": "message2.syscheck", "target_field": "host.syscheck", "ignore_missing": true } }, + { "rename": { "field": "data.command", "target_field": "process.command_line", "ignore_missing": true } }, + { "rename": { "field": "data.dstip", "target_field": "destination.ip", "ignore_missing": true } }, + { "rename": { "field": "data.dstport", "target_field": "destination.port", "ignore_missing": true } }, + { "rename": { "field": "data.dstuser", "target_field": "user.escalated", "ignore_missing": true } }, + { "rename": { "field": "data.srcip", "target_field": "source.ip", "ignore_missing": true } }, + { "rename": { "field": "data.process", "target_field": "process", "ignore_missing": true } }, + { "rename": { "field": "data.program", "target_field": "program", "ignore_missing": true } }, + { "rename": { "field": "data.win.eventdata.destinationHostname", "target_field": "destination.hostname", "ignore_missing": true } }, + { "rename": { "field": "data.win.eventdata.destinationIp", "target_field": "destination.ip", "ignore_missing": true } }, + { "rename": { "field": "data.win.eventdata.destinationPort", "target_field": "destination.port", "ignore_missing": true } }, + { "rename": { "field": "data.win.eventdata.sourceHostname", "target_field": "source.hostname", "ignore_missing": true } }, + { "rename": { "field": "data.win.eventdata.sourceIp", "target_field": "source_ip", "ignore_missing": true } }, + { "rename": { "field": "data.win.eventdata.sourcePort", "target_field": "source.port", "ignore_missing": true } }, + { "rename": { "field": "data.win.eventdata.targetFilename", "target_field": "file.target", "ignore_missing": true } }, + { "rename": { "field": "data.win.eventdata.user", "target_field": "user.name", "ignore_missing": true } }, + { "rename": { "field": "data.win.system", "target_field": "winlog", "ignore_missing": true } }, + { "rename": { "field": "data.win.eventdata", "target_field": "winlog.event_data", "ignore_missing": true } }, + { "rename": { "field": "winlog.eventID", "target_field": "winlog.event_id", "ignore_missing": true } }, + { "rename": { "field": "predecoder.program_name", "target_field": "process.name", "ignore_missing": true } }, + { "rename": { "field": "decoder.name", "target_field": "event.dataset", "ignore_missing": true } }, + { "rename": { "field": "rule.description", "target_field": "rule.name", "ignore_missing": true } }, + { + "remove": { + "field": [ "predecoder" ], + "ignore_failure": true + } + }, + { "rename": { "field": "fields.category", "target_field": "event.category", "ignore_failure": true, "ignore_missing": true } }, + { "rename": { "field": "fields.module", "target_field": "event.module", "ignore_failure": true, "ignore_missing": true } }, + { "pipeline": { "if": "ctx.winlog?.channel == 'Microsoft-Windows-Sysmon/Operational'", "name": "sysmon" } }, + { "pipeline": { "if": "ctx.winlog?.channel != 'Microsoft-Windows-Sysmon/Operational'", "name":"win.eventlogs" } }, + { "set": { "if": "ctx.containsKey('rule') && ctx.rule != null", "field": "event.dataset", "value": "alert", "override": true } }, + { "pipeline": { "name": "common" } } ] } diff --git a/salt/elasticsearch/files/ingest/ossec.alert b/salt/elasticsearch/files/ingest/ossec.alert deleted file mode 100644 index 7654bf255..000000000 --- a/salt/elasticsearch/files/ingest/ossec.alert +++ /dev/null @@ -1,59 +0,0 @@ -{ - "description" : "ossec", - "processors" : [ - { "json": { "field": "message", "target_field": "message2", "ignore_failure": true } }, - { "remove": { "field": [ "agent" ], "ignore_missing": true, "ignore_failure": false } }, - { "rename": { "field": "message2.agent", "target_field": "agent", "ignore_missing": true } }, - { "rename": { "field": "message2.data", "target_field": "data", "ignore_missing": true } }, - { "rename": { "field": "message2.decoder", "target_field": "decoder", "ignore_missing": true } }, - { "rename": { "field": "message2.full_log", "target_field": "log.full", "ignore_missing": true } }, - { "rename": { "field": "message2.id", "target_field": "log.id.id", "ignore_missing": true } }, - { "rename": { "field": "message2.location", "target_field": "log.location", "ignore_missing": true } }, - { "rename": { "field": "message2.manager", "target_field": "manager", "ignore_missing": true } }, - { "rename": { "field": "message2.predecoder", "target_field": "predecoder", "ignore_missing": true } }, - { "rename": { "field": "message2.timestamp", "target_field": "event.timestamp", "ignore_missing": true } }, - { "rename": { "field": "message2.previous_log", "target_field": "log.previous_log", "ignore_missing": true } }, - { "rename": { "field": "message2.previous_output", "target_field": "log.previous_output", "ignore_missing": true } }, - { "rename": { "field": "message2.rule", "target_field": "rule", "ignore_missing": true } }, - { "rename": { "field": "message2.syscheck", "target_field": "host.syscheck", "ignore_missing": true } }, - { "rename": { "field": "data.command", "target_field": "process.command_line", "ignore_missing": true } }, - { "rename": { "field": "data.dstip", "target_field": "destination.ip", "ignore_missing": true } }, - { "rename": { "field": "data.dstport", "target_field": "destination.port", "ignore_missing": true } }, - { "rename": { "field": "data.dstuser", "target_field": "user.escalated", "ignore_missing": true } }, - { "rename": { "field": "data.srcip", "target_field": "source.ip", "ignore_missing": true } }, - { "rename": { "field": "data.win.eventdata.destinationHostname", "target_field": "destination.hostname", "ignore_missing": true } }, - { "rename": { "field": "data.win.eventdata.destinationIp", "target_field": "destination.ip", "ignore_missing": true } }, - { "rename": { "field": "data.win.eventdata.destinationPort", "target_field": "destination.port", "ignore_missing": true } }, - { "rename": { "field": "data.win.eventdata.image", "target_field": "image_path", "ignore_missing": true } }, - { "rename": { "field": "data.win.eventdata.parentImage", "target_field": "parent_image_path", "ignore_missing": true } }, - { "rename": { "field": "data.win.eventdata.sourceHostname", "target_field": "source.hostname", "ignore_missing": true } }, - { "rename": { "field": "data.win.eventdata.sourceIp", "target_field": "source_ip", "ignore_missing": true } }, - { "rename": { "field": "data.win.eventdata.sourcePort", "target_field": "source.port", "ignore_missing": true } }, - { "rename": { "field": "data.win.eventdata.targetFilename", "target_field": "file.target", "ignore_missing": true } }, - { "rename": { "field": "data.win.eventdata.user", "target_field": "user.name", "ignore_missing": true } }, - { "rename": { "field": "data.win.system.eventID", "target_field": "event.code", "ignore_missing": true } }, - { "rename": { "field": "predecoder.program_name", "target_field": "process.name", "ignore_missing": true } }, - { "rename": { "field": "rule.description", "target_field": "rule.name", "ignore_missing": true } }, - { "set": { "if": "ctx.rule.level == 1", "field": "rule.category", "value": "None" } }, - { "set": { "if": "ctx.rule.level == 2", "field": "rule.category", "value": "System low priority notification" } }, - { "set": { "if": "ctx.rule.level == 3", "field": "rule.category", "value": "Successful/authorized event" } }, - { "set": { "if": "ctx.rule.level == 4", "field": "rule.category", "value": "System low priority error" } }, - { "set": { "if": "ctx.rule.level == 5", "field": "rule.category", "value": "User generated error" } }, - { "set": { "if": "ctx.rule.level == 6", "field": "rule.category", "value": "Low relevance attack" } }, - { "set": { "if": "ctx.rule.level == 7", "field": "rule.category", "value": "\"Bad word\" matching" } }, - { "set": { "if": "ctx.rule.level == 8", "field": "rule.category", "value": "First time seen" } }, - { "set": { "if": "ctx.rule.level == 9", "field": "rule.category", "value": "Error from invalid source" } }, - { "set": { "if": "ctx.rule.level == 10", "field": "rule.category", "value": "Multiple user generated errors" } }, - { "set": { "if": "ctx.rule.level == 11", "field": "rule.category", "value": "Integrity checking warning" } }, - { "set": { "if": "ctx.rule.level == 12", "field": "rule.category", "value": "High importance event" } }, - { "set": { "if": "ctx.rule.level == 13", "field": "rule.category", "value": "Unusal error (high importance)" } }, - { "set": { "if": "ctx.rule.level == 14", "field": "rule.category", "value": "High importance security event" } }, - { "set": { "if": "ctx.rule.level == 15", "field": "rule.category", "value": "Severe attack" } }, - { "set": { "if": "ctx.rule.level <= 7", "field": "event.severity", "value": 1, "override": true } }, - { "set": { "if": "ctx.rule.level >= 8 && ctx.rule.level <= 11", "field": "event.severity", "value": 2, "override": true } }, - { "set": { "if": "ctx.rule.level >= 12", "field": "event.severity", "value": 3, "override": true } }, - { "append": { "if": "ctx.rule.level != null", "field": "tags", "value": ["alert"] } }, - { "remove": { "field": [ "predecoder", "decoder" ], "ignore_missing": true, "ignore_failure": false } }, - { "pipeline": { "name": "common" } } - ] -} diff --git a/salt/elasticsearch/files/ingest/sysmon b/salt/elasticsearch/files/ingest/sysmon index 5fe46b3a5..2ca5c6193 100644 --- a/salt/elasticsearch/files/ingest/sysmon +++ b/salt/elasticsearch/files/ingest/sysmon @@ -30,25 +30,40 @@ { "rename": { "field": "winlog.event_data.DestinationHostname", "target_field": "destination.hostname", "ignore_missing": true } }, { "rename": { "field": "winlog.event_data.DestinationIp", "target_field": "destination.ip", "ignore_missing": true } }, { "rename": { "field": "winlog.event_data.DestinationPort", "target_field": "destination.port", "ignore_missing": true } }, + { "rename": { "field": "winlog.event_data.image", "target_field": "process.executable", "ignore_missing": true } }, { "rename": { "field": "winlog.event_data.Image", "target_field": "process.executable", "ignore_missing": true } }, + { "rename": { "field": "winlog.event_data.processID", "target_field": "process.pid", "ignore_missing": true } }, { "rename": { "field": "winlog.event_data.ProcessID", "target_field": "process.pid", "ignore_missing": true } }, + { "rename": { "field": "winlog.event_data.processGuid", "target_field": "process.entity_id", "ignore_missing": true } }, { "rename": { "field": "winlog.event_data.ProcessGuid", "target_field": "process.entity_id", "ignore_missing": true } }, + { "rename": { "field": "winlog.event_data.commandLine", "target_field": "process.command_line", "ignore_missing": true } }, { "rename": { "field": "winlog.event_data.CommandLine", "target_field": "process.command_line", "ignore_missing": true } }, + { "rename": { "field": "winlog.event_data.currentDirectory", "target_field": "process.working_directory", "ignore_missing": true } }, { "rename": { "field": "winlog.event_data.CurrentDirectory", "target_field": "process.working_directory", "ignore_missing": true } }, + { "rename": { "field": "winlog.event_data.description", "target_field": "process.pe.description", "ignore_missing": true } }, { "rename": { "field": "winlog.event_data.Description", "target_field": "process.pe.description", "ignore_missing": true } }, + { "rename": { "field": "winlog.event_data.product", "target_field": "process.pe.product", "ignore_missing": true } }, { "rename": { "field": "winlog.event_data.Product", "target_field": "process.pe.product", "ignore_missing": true } }, + { "rename": { "field": "winlog.event_data.company", "target_field": "process.pe.company", "ignore_missing": true } }, { "rename": { "field": "winlog.event_data.Company", "target_field": "process.pe.company", "ignore_missing": true } }, + { "rename": { "field": "winlog.event_data.originalFileName", "target_field": "process.pe.original_file_name", "ignore_missing": true } }, { "rename": { "field": "winlog.event_data.OriginalFileName", "target_field": "process.pe.original_file_name", "ignore_missing": true } }, + { "rename": { "field": "winlog.event_data.fileVersion", "target_field": "process.pe.file_version", "ignore_missing": true } }, { "rename": { "field": "winlog.event_data.FileVersion", "target_field": "process.pe.file_version", "ignore_missing": true } }, + { "rename": { "field": "winlog.event_data.parentCommandLine", "target_field": "process.parent.command_line", "ignore_missing": true } }, { "rename": { "field": "winlog.event_data.ParentCommandLine", "target_field": "process.parent.command_line", "ignore_missing": true } }, + { "rename": { "field": "winlog.event_data.parentImage", "target_field": "process.parent.executable", "ignore_missing": true } }, { "rename": { "field": "winlog.event_data.ParentImage", "target_field": "process.parent.executable", "ignore_missing": true } }, + { "rename": { "field": "winlog.event_data.parentProcessGuid", "target_field": "process.parent.entity_id", "ignore_missing": true } }, { "rename": { "field": "winlog.event_data.ParentProcessGuid", "target_field": "process.parent.entity_id", "ignore_missing": true } }, + { "rename": { "field": "winlog.event_data.parentProcessId", "target_field": "process.ppid", "ignore_missing": true } }, { "rename": { "field": "winlog.event_data.ParentProcessId", "target_field": "process.ppid", "ignore_missing": true } }, { "rename": { "field": "winlog.event_data.Protocol", "target_field": "network.transport", "ignore_missing": true } }, { "rename": { "field": "winlog.event_data.User", "target_field": "user.name", "ignore_missing": true } }, { "rename": { "field": "winlog.event_data.SourceHostname", "target_field": "source.hostname", "ignore_missing": true } }, { "rename": { "field": "winlog.event_data.SourceIp", "target_field": "source.ip", "ignore_missing": true } }, { "rename": { "field": "winlog.event_data.SourcePort", "target_field": "source.port", "ignore_missing": true } }, - { "rename": { "field": "winlog.event_data.targetFilename", "target_field": "file.target", "ignore_missing": true } } + { "rename": { "field": "winlog.event_data.targetFilename", "target_field": "file.target", "ignore_missing": true } }, + { "rename": { "field": "winlog.event_data.TargetFilename", "target_field": "file.target", "ignore_missing": true } } ] -} \ No newline at end of file +}