evalfix

salt/logstash/conf/pipelines/eval/0010_input_hhbeats.conf

@@ -1,40 +0,0 @@
-input {
-  beats {
-    port => "5644"
-    ssl => true
-    ssl_certificate_authorities => ["/usr/share/filebeat/ca.crt"]
-    ssl_certificate => "/usr/share/logstash/filebeat.crt"
-    ssl_key => "/usr/share/logstash/filebeat.key"
-    tags => [ "beat" ]
-  }
-}
-filter {
-  if [type] == "ids" or [type] =~ "bro" {
-    mutate {
-      rename => { "host" => "beat_host" }
-      remove_tag => ["beat"]
-      add_field => { "sensor_name" => "%{[beat][name]}" }
-      add_field => { "syslog-host_from" => "%{[beat][name]}" }
-      remove_field => [ "beat", "prospector", "input", "offset" ]
-    }
-  }
-  if [type] =~ "ossec" {
-    mutate {
-      rename => { "host" => "beat_host" }
-      remove_tag => ["beat"]
-      add_field => { "syslog-host_from" => "%{[beat][name]}" }
-      remove_field => [ "beat", "prospector", "input", "offset" ]
-    }
-   }
-    if [type] == "osquery" {
-    mutate {
-      rename => { "host" => "beat_host" }
-      remove_tag => ["beat"]
-      add_tag => ["osquery"]
-        	}
-   json {
-    source => "message"
-    target => "osquery"
-        }
-  }
-}

salt/logstash/conf/pipelines/eval/templates/0800_input_eval.conf

@@ -9,173 +9,173 @@ input {
 	}
 	file {
 		path => "/nsm/zeek/logs/current/conn*.log"
-		type => "zeek_conn"
-	    	tags => ["zeek"]
+		type => "bro_conn"
+	    	tags => ["bro"]
 	}
 	file {
 		path => "/nsm/zeek/logs/current/dce_rpc*.log"
-		type => "zeek_dce_rpc"
-	    	tags => ["zeek"]
+		type => "bro_dce_rpc"
+	    	tags => ["bro"]
 	}
 	file {
 		path => "/nsm/zeek/logs/current/dhcp*.log"
-		type => "zeek_dhcp"
-	    	tags => ["zeek"]
+		type => "bro_dhcp"
+	    	tags => ["bro"]
 	}
 	file {
 		path => "/nsm/zeek/logs/current/dnp3*.log"
-		type => "zeek_dnp3"
-	    	tags => ["zeek"]
+		type => "bro_dnp3"
+	    	tags => ["bro"]
 	}
 	file {
 		path => "/nsm/zeek/logs/current/dns*.log"
-		type => "zeek_dns"
-	    	tags => ["zeek"]
+		type => "bro_dns"
+	    	tags => ["bro"]
 	}
 	file {
 		path => "/nsm/zeek/logs/current/dpd*.log"
-		type => "zeek_dpd"
-	    	tags => ["zeek"]
+		type => "bro_dpd"
+	    	tags => ["bro"]
 	}
 	file {
 		path => "/nsm/zeek/logs/current/files*.log"
-		type => "zeek_files"
-	    	tags => ["zeek"]
+		type => "bro_files"
+	    	tags => ["bro"]
 	}
 	file {
 		path => "/nsm/zeek/logs/current/ftp*.log"
-		type => "zeek_ftp"
-	    	tags => ["zeek"]
+		type => "bro_ftp"
+	    	tags => ["bro"]
 	}
 	file {
 		path => "/nsm/zeek/logs/current/http*.log"
-		type => "zeek_http"
-	    	tags => ["zeek"]
+		type => "bro_http"
+	    	tags => ["bro"]
 	}
 	file {
 		path => "/nsm/zeek/logs/current/intel*.log"
-		type => "zeek_intel"
-	    	tags => ["zeek"]
+		type => "bro_intel"
+	    	tags => ["bro"]
 	}
 	file {
 		path => "/nsm/zeek/logs/current/irc*.log"
-		type => "zeek_irc"
-	    	tags => ["zeek"]
+		type => "bro_irc"
+	    	tags => ["bro"]
 	}
 	file {
 		path => "/nsm/zeek/logs/current/kerberos*.log"
-		type => "zeek_kerberos"
-	    	tags => ["zeek"]
+		type => "bro_kerberos"
+	    	tags => ["bro"]
 	}
 	file {
 		path => "/nsm/zeek/logs/current/modbus*.log"
-		type => "zeek_modbus"
-	    	tags => ["zeek"]
+		type => "bro_modbus"
+	    	tags => ["bro"]
 	}
 	file {
 		path => "/nsm/zeek/logs/current/mysql*.log"
-		type => "zeek_mysql"
-	    	tags => ["zeek"]
+		type => "bro_mysql"
+	    	tags => ["bro"]
 	}
 	file {
 		path => "/nsm/zeek/logs/current/notice*.log"
-		type => "zeek_notice"
-	    	tags => ["zeek"]
+		type => "bro_notice"
+	    	tags => ["bro"]
 	}
 	file {
 		path => "/nsm/zeek/logs/current/ntlm*.log"
-		type => "zeek_ntlm"
-	    	tags => ["zeek"]
+		type => "bro_ntlm"
+	    	tags => ["bro"]
 	}
 	file {
 		path => "/nsm/zeek/logs/current/pe*.log"
-		type => "zeek_pe"
-	    	tags => ["zeek"]
+		type => "bro_pe"
+	    	tags => ["bro"]
 	}
 	file {
 		path => "/nsm/zeek/logs/current/radius*.log"
-		type => "zeek_radius"
-	    	tags => ["zeek"]
+		type => "bro_radius"
+	    	tags => ["bro"]
 	}
 	file {
 		path => "/nsm/zeek/logs/current/rdp*.log"
-		type => "zeek_rdp"
-	    	tags => ["zeek"]
+		type => "bro_rdp"
+	    	tags => ["bro"]
 	}
 	file {
 		path => "/nsm/zeek/logs/current/rfb*.log"
-		type => "zeek_rfb"
-	    	tags => ["zeek"]
+		type => "bro_rfb"
+	    	tags => ["bro"]
 	}
 	file {
 		path => "/nsm/zeek/logs/current/signatures*.log"
-		type => "zeek_signatures"
-	    	tags => ["zeek"]
+		type => "bro_signatures"
+	    	tags => ["bro"]
 	}
 	file {
 		path => "/nsm/zeek/logs/current/sip*.log"
-		type => "zeek_sip"
-	    	tags => ["zeek"]
+		type => "bro_sip"
+	    	tags => ["bro"]
 	}
 	file {
 		path => "/nsm/zeek/logs/current/smb_files*.log"
-		type => "zeek_smb_files"
-	    	tags => ["zeek"]
+		type => "bro_smb_files"
+	    	tags => ["bro"]
 	}
 	file {
 		path => "/nsm/zeek/logs/current/smb_mapping*.log"
-		type => "zeek_smb_mapping"
-	    	tags => ["zeek"]
+		type => "bro_smb_mapping"
+	    	tags => ["bro"]
 	}
 	file {
 		path => "/nsm/zeek/logs/current/smtp*.log"
-		type => "zeek_smtp"
-	    	tags => ["zeek"]
+		type => "bro_smtp"
+	    	tags => ["bro"]
 	}
 	file {
 		path => "/nsm/zeek/logs/current/snmp*.log"
-		type => "zeek_snmp"
-	    	tags => ["zeek"]
+		type => "bro_snmp"
+	    	tags => ["bro"]
 	}
 	file {
 		path => "/nsm/zeek/logs/current/socks*.log"
-		type => "zeek_socks"
-	    	tags => ["zeek"]
+		type => "bro_socks"
+	    	tags => ["bro"]
 	}
 	file {
 		path => "/nsm/zeek/logs/current/software*.log"
-		type => "zeek_software"
-	    	tags => ["zeek"]
+		type => "bro_software"
+	    	tags => ["bro"]
 	}
 	file {
 		path => "/nsm/zeek/logs/current/ssh*.log"
-		type => "zeek_ssh"
-	    	tags => ["zeek"]
+		type => "bro_ssh"
+	    	tags => ["bro"]
 	}
 	file {
 		path => "/nsm/zeek/logs/current/ssl*.log"
-		type => "zeek_ssl"
-	    	tags => ["zeek"]
+		type => "bro_ssl"
+	    	tags => ["bro"]
 	}
 	file {
 		path => "/nsm/zeek/logs/current/syslog*.log"
-		type => "zeek_syslog"
-	    	tags => ["zeek"]
+		type => "bro_syslog"
+	    	tags => ["bro"]
 	}
 	file {
 		path => "/nsm/zeek/logs/current/tunnel*.log"
-		type => "zeek_tunnels"
-	    	tags => ["zeek"]
+		type => "bro_tunnels"
+	    	tags => ["bro"]
 	}
 	file {
 		path => "/nsm/zeek/logs/current/weird*.log"
-		type => "zeek_weird"
-	    	tags => ["zeek"]
+		type => "bro_weird"
+	    	tags => ["bro"]
 	}
 	file {
 		path => "/nsm/zeek/logs/current/x509*.log"
-		type => "zeek_x509"
-	    	tags => ["zeek"]
+		type => "bro_x509"
+	    	tags => ["bro"]
 	}
   file {
     path => "/wazuh/alerts/alerts.json"