Merge pull request #53 from weslambert/master

Wazuh archive logs

salt/filebeat/etc/filebeat.yml

@@ -47,6 +47,16 @@ filebeat.prospectors:
     fields_under_root: true
     clean_removed: false
     close_removed: false
+
+  - type: log
+    paths:
+      - /wazuh/archives/archives.json
+    fields:
+      type: ossec_archive
+    fields_under_root: true
+    clean_removed: false
+    close_removed: false
+
 {%- endif %}
 
 #----------------------------- Logstash output ---------------------------------

salt/filebeat/init.sls

@@ -62,6 +62,7 @@ so-filebeat:
       - /nsm/bro:/nsm/bro:ro
       - /opt/so/log/suricata:/suricata:ro
       - /opt/so/wazuh/logs/alerts/:/wazuh/alerts:ro
+      - /opt/so/wazuh/logs/archives/:/wazuh/archives:ro
       - /opt/so/conf/filebeat/etc/pki/filebeat.crt:/usr/share/filebeat/filebeat.crt:ro
       - /opt/so/conf/filebeat/etc/pki/filebeat.key:/usr/share/filebeat/filebeat.key:ro
       - /etc/ssl/certs/intca.crt:/usr/share/filebeat/intraca.crt:ro

salt/logstash/files/dynamic/0006_input_beats.conf

@@ -9,7 +9,7 @@ input {
   }
 }
 filter {
-  if [type] == "ids" {
+  if [type] == "ids" or [type] =~ "bro" {
     mutate {
       rename => { "host" => "beat_host" }
       remove_tag => ["beat"]
@@ -17,11 +17,10 @@ filter {
       add_field => { "syslog-host_from" => "%{[beat][name]}" }
     }
   }
-  if "bro" in [tags] {
+  if [type] =~ "ossec" {
     mutate {
       rename => { "host" => "beat_host" }
       remove_tag => ["beat"]
-      add_field => { "sensor_name" => "%{[beat][name]}" }
       add_field => { "syslog-host_from" => "%{[beat][name]}" }
     }
   }