CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-10 19:22:54 +01:00
Code Issues Packages Projects Releases Wiki Activity

Only append source.ip to logscan.source.ips if it's been created

Browse Source
This commit is contained in:
William Wernert
2021-08-02 09:50:49 -04:00
parent 4f39cd1d7f
commit 8a49039b85
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
salt/elasticsearch/files/ingest/logscan.alert
View File

@@ -11,8 +11,8 @@
{ "remove": { "field": "start_time", "ignore_missing": true } }, { "remove": { "field": "start_time", "ignore_missing": true } },
{ "remove": { "field": "end_time", "ignore_missing": true } }, { "remove": { "field": "end_time", "ignore_missing": true } },
{ "rename": { "field": "source_ip", "target_field": "source.ip", "ignore_missing": true } }, { "rename": { "field": "source_ip", "target_field": "source.ip", "ignore_missing": true } },
{ "append": { "field": "logscan.source.ips", "value": "{{{source.ip}}}", "ignore_failure": true } },
{ "rename": { "field": "top_source_ips", "target_field": "logscan.source.ips", "ignore_missing": true } }, { "rename": { "field": "top_source_ips", "target_field": "logscan.source.ips", "ignore_missing": true } },
{ "append": { "if": "ctx.source != null", "field": "logscan.source.ips", "value": "{{{source.ip}}}", "ignore_failure": true } },
{ "set": { "if": "ctx.model == 'k1'", "field": "rule.name", "value": "LOGSCAN K1 MODEL THRESHOLD" } }, { "set": { "if": "ctx.model == 'k1'", "field": "rule.name", "value": "LOGSCAN K1 MODEL THRESHOLD" } },
{ "set": { "if": "ctx.model == 'k1'", "field": "rule.description", "value": "High number of logins from single IP in 1 minute window" } }, { "set": { "if": "ctx.model == 'k1'", "field": "rule.description", "value": "High number of logins from single IP in 1 minute window" } },
{ "set": { "if": "ctx.model == 'k5'", "field": "rule.name", "value": "LOGSCAN K5 MODEL THRESHOLD" } }, { "set": { "if": "ctx.model == 'k5'", "field": "rule.name", "value": "LOGSCAN K5 MODEL THRESHOLD" } },