CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 09:12:45 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #9273 from Security-Onion-Solutions/dev

Browse Source 
2.3.190
This commit is contained in:
Mike Reeves
2022-12-05 15:17:47 -05:00
committed by GitHub
parent fc649a565c 9cbbed1038
commit 93ca7548f8
131 changed files with 1821 additions and 366 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
README.md
View File

@@ -1,6 +1,6 @@
## Security Onion 2.3.182 ## Security Onion 2.3
Security Onion 2.3.182 is here! Security Onion 2.3 is here!
## Screenshots ## Screenshots

22
VERIFY_ISO.md
View File

@@ -1,18 +1,18 @@
### 2.3.182-20221109 ISO image built on 2022/11/09 ### 2.3.190-20221205 ISO image built on 2022/12/05
### Download and Verify ### Download and Verify
2.3.182-20221109 ISO image: 2.3.190-20221205 ISO image:
https://download.securityonion.net/file/securityonion/securityonion-2.3.182-20221109.iso https://download.securityonion.net/file/securityonion/securityonion-2.3.190-20221205.iso
MD5: E472D5A7C64662435F84FD56491D8967 MD5: E8D0BB6F43F67EC64F04AE239781E674
SHA1: D2069317553AF0A1FB4FB6FE15583FF4E8CB2973 SHA1: BC58236BDF8DBD86870182B6F79009406DC04138
SHA256: A074EB38B88C0A00BDFD7FB75B4ECB7C46CB0B4CC993CAB81EFDC708B0075D2C SHA256: 34A98078538060486C70A934839A271A5AD66CF50D55EEC04DA0B325B13D56AC
Signature for ISO image: Signature for ISO image:
https://github.com/Security-Onion-Solutions/securityonion/raw/master/sigs/securityonion-2.3.182-20221109.iso.sig https://github.com/Security-Onion-Solutions/securityonion/raw/master/sigs/securityonion-2.3.190-20221205.iso.sig
Signing key: Signing key:
https://raw.githubusercontent.com/Security-Onion-Solutions/securityonion/master/KEYS https://raw.githubusercontent.com/Security-Onion-Solutions/securityonion/master/KEYS
@@ -26,22 +26,22 @@ wget https://raw.githubusercontent.com/Security-Onion-Solutions/securityonion/ma
Download the signature file for the ISO: Download the signature file for the ISO:
``` ```
wget https://github.com/Security-Onion-Solutions/securityonion/raw/master/sigs/securityonion-2.3.182-20221109.iso.sig wget https://github.com/Security-Onion-Solutions/securityonion/raw/master/sigs/securityonion-2.3.190-20221205.iso.sig
``` ```
Download the ISO image: Download the ISO image:
``` ```
wget https://download.securityonion.net/file/securityonion/securityonion-2.3.182-20221109.iso wget https://download.securityonion.net/file/securityonion/securityonion-2.3.190-20221205.iso
``` ```
Verify the downloaded ISO image using the signature file: Verify the downloaded ISO image using the signature file:
``` ```
gpg --verify securityonion-2.3.182-20221109.iso.sig securityonion-2.3.182-20221109.iso gpg --verify securityonion-2.3.190-20221205.iso.sig securityonion-2.3.190-20221205.iso
``` ```
The output should show "Good signature" and the Primary key fingerprint should match what's shown below: The output should show "Good signature" and the Primary key fingerprint should match what's shown below:
``` ```
gpg: Signature made Wed 09 Nov 2022 07:30:32 AM EST using RSA key ID FE507013 gpg: Signature made Mon 05 Dec 2022 12:27:49 PM EST using RSA key ID FE507013
gpg: Good signature from "Security Onion Solutions, LLC <info@securityonionsolutions.com>" gpg: Good signature from "Security Onion Solutions, LLC <info@securityonionsolutions.com>"
gpg: WARNING: This key is not certified with a trusted signature! gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the owner. gpg: There is no indication that the signature belongs to the owner.

2
VERSION
View File

@@ -1 +1 @@
2.3.182 2.3.190

13
pillar/zeek/init.sls
View File

@@ -48,6 +48,19 @@ zeek:
- securityonion/bpfconf - securityonion/bpfconf
- securityonion/communityid - securityonion/communityid
- securityonion/file-extraction - securityonion/file-extraction
- oui-logging
- icsnpp-modbus
- icsnpp-dnp3
- icsnpp-bacnet
- icsnpp-ethercat
- icsnpp-enip
- icsnpp-opcua-binary
- icsnpp-bsap
- icsnpp-s7comm
- zeek-plugin-tds
- zeek-plugin-profinet
- zeek-spicy-wireguard
- zeek-spicy-stun
'@load-sigs': '@load-sigs':
- frameworks/signatures/detect-windows-shells - frameworks/signatures/detect-windows-shells
redef: redef:

15
salt/common/files/sensor-rotate.conf
View File

@@ -19,4 +19,17 @@
extension .log extension .log
dateext dateext
dateyesterday dateyesterday
} }
/opt/so/log/strelka/filecheck.log
{
daily
rotate 14
missingok
copytruncate
compress
create
extension .log
dateext
dateyesterday
}

12
salt/common/init.sls
View File

@@ -38,15 +38,15 @@ socore:
soconfperms: soconfperms:
file.directory: file.directory:
- name: /opt/so/conf - name: /opt/so/conf
- uid: 939 - user: 939
- gid: 939 - group: 939
- dir_mode: 770 - dir_mode: 770
sostatusconf: sostatusconf:
file.directory: file.directory:
- name: /opt/so/conf/so-status - name: /opt/so/conf/so-status
- uid: 939 - user: 939
- gid: 939 - group: 939
- dir_mode: 770 - dir_mode: 770
so-status.conf: so-status.conf:
@@ -57,8 +57,8 @@ so-status.conf:
sosaltstackperms: sosaltstackperms:
file.directory: file.directory:
- name: /opt/so/saltstack - name: /opt/so/saltstack
- uid: 939 - user: 939
- gid: 939 - group: 939
- dir_mode: 770 - dir_mode: 770
so_log_perms: so_log_perms:

2
salt/common/tools/sbin/so-pcap-export
View File

@@ -20,7 +20,7 @@ if [ $# -lt 2 ]; then
exit 1 exit 1
fi fi
docker exec -it so-sensoroni scripts/stenoquery.sh "$1" -w /nsm/pcapout/$2.pcap docker exec -t so-sensoroni scripts/stenoquery.sh "$1" -w /nsm/pcapout/$2.pcap
echo "" echo ""
echo "If successful, the output was written to: /nsm/pcapout/$2.pcap" echo "If successful, the output was written to: /nsm/pcapout/$2.pcap"

145
salt/common/tools/sbin/so-zeek-logs
View File

@@ -10,39 +10,118 @@ zeek_logs_enabled() {
} }
whiptail_manager_adv_service_zeeklogs() { whiptail_manager_adv_service_zeeklogs() {
BLOGS=$(whiptail --title "so-zeek-logs" --checklist "Please Select Logs to Send:" 24 78 12 \ BLOGS=$(whiptail --title "so-zeek-logs" --checklist "Please select logs to send:" 24 78 12 \
"conn" "Connection Logging" ON \ "conn" "" ON \
"dce_rpc" "RPC Logs" ON \ "dce_rpc" "" ON \
"dhcp" "DHCP Logs" ON \ "dhcp" "" ON \
"dnp3" "DNP3 Logs" ON \ "dnp3" "" ON \
"dns" "DNS Logs" ON \ "dns" "" ON \
"dpd" "DPD Logs" ON \ "dpd" "" ON \
"files" "Files Logs" ON \ "files" "" ON \
"ftp" "FTP Logs" ON \ "ftp" "" ON \
"http" "HTTP Logs" ON \ "http" "" ON \
"intel" "Intel Hits Logs" ON \ "intel" "" ON \
"irc" "IRC Chat Logs" ON \ "irc" "" ON \
"kerberos" "Kerberos Logs" ON \ "kerberos" "" ON \
"modbus" "MODBUS Logs" ON \ "modbus" "" ON \
"notice" "Zeek Notice Logs" ON \ "notice" "" ON \
"ntlm" "NTLM Logs" ON \ "ntlm" "" ON \
"pe" "PE Logs" ON \ "pe" "" ON \
"radius" "Radius Logs" ON \ "radius" "" ON \
"rfb" "RFB Logs" ON \ "rfb" "" ON \
"rdp" "RDP Logs" ON \ "rdp" "" ON \
"sip" "SIP Logs" ON \ "sip" "" ON \
"smb_files" "SMB Files Logs" ON \ "smb_files" "" ON \
"smb_mapping" "SMB Mapping Logs" ON \ "smb_mapping" "" ON \
"smtp" "SMTP Logs" ON \ "smtp" "" ON \
"snmp" "SNMP Logs" ON \ "snmp" "" ON \
"ssh" "SSH Logs" ON \ "software" "" ON \
"ssl" "SSL Logs" ON \ "ssh" "" ON \
"syslog" "Syslog Logs" ON \ "ssl" "" ON \
"tunnel" "Tunnel Logs" ON \ "syslog" "" ON \
"weird" "Zeek Weird Logs" ON \ "tunnel" "" ON \
"mysql" "MySQL Logs" ON \ "weird" "" ON \
"socks" "SOCKS Logs" ON \ "mysql" "" ON \
"x509" "x.509 Logs" ON 3>&1 1>&2 2>&3 ) "socks" "" ON \
"x509" "" ON \
"bacnet" "" ON \
"bacnet_discovery" "" ON \
"bacnet_property" "" ON \
"bsap_ip_header" "" ON \
"bsap_ip_rdb" "" ON \
"bsap_ip_unknown" "" ON \
"bsap_serial_header" "" ON \
"bsap_serial_rdb" "" ON \
"bsap_serial_rdb_ext" "" ON \
"bsap_serial_unknown" "" ON \
"cip" "" ON \
"cip_identity" "" ON \
"cip_io" "" ON \
"cotp" "" ON \
"dnp3_control" "" ON \
"dnp3_objects" "" ON \
"ecat_aoe_info" "" ON \
"ecat_arp_info" "" OFF \
"ecat_coe_info" "" ON \
"ecat_dev_info" "" ON \
"ecat_foe_info" "" ON \
"ecat_log_address" "" ON \
"ecat_registers" "" ON \
"ecat_soe_info" "" ON \
"enip" "" ON \
"modbus_detailed" "" ON \
"modbus_mask_write_register" "" ON \
"modbus_read_write_multiple_registers" "" ON \
"opcua_binary" "" ON \
"opcua_binary_activate_session" "" ON \
"opcua_binary_activate_session_client_software_cert" "" ON \
"opcua_binary_activate_session_diagnostic_info" "" ON \
"opcua_binary_activate_session_locale_id" "" ON \
"opcua_binary_browse" "" ON \
"opcua_binary_browse_description" "" ON \
"opcua_binary_browse_diagnostic_info" "" ON \
"opcua_binary_browse_request_continuation_point" "" ON \
"opcua_binary_browse_response_references" "" ON \
"opcua_binary_browse_result" "" ON \
"opcua_binary_create_session" "" ON \
"opcua_binary_create_session_discovery" "" ON \
"opcua_binary_create_session_endpoints" "" ON \
"opcua_binary_create_session_user_token" "" ON \
"opcua_binary_create_subscription" "" ON \
"opcua_binary_diag_info_detail" "" ON \
"opcua_binary_get_endpoints" "" ON \
"opcua_binary_get_endpoints_description" "" ON \
"opcua_binary_get_endpoints_discovery" "" ON \
"opcua_binary_get_endpoints_locale_id" "" ON \
"opcua_binary_get_endpoints_profile_uri" "" ON \
"opcua_binary_get_endpoints_user_token" "" ON \
"opcua_binary_opensecure_channel" "" ON \
"opcua_binary_read" "" ON \
"opcua_binary_read_array_dims" "" ON \
"opcua_binary_read_array_dims_link" "" ON \
"opcua_binary_read_diagnostic_info" "" ON \
"opcua_binary_read_extension_object" "" ON \
"opcua_binary_read_extension_object_link" "" ON \
"opcua_binary_read_nodes_to_read" "" ON \
"opcua_binary_read_results" "" ON \
"opcua_binary_read_results_link" "" ON \
"opcua_binary_read_status_code" "" ON \
"opcua_binary_read_variant_data" "" ON \
"opcua_binary_read_variant_data_link" "" ON \
"opcua_binary_status_code_detail" "" ON \
"profinet" "" ON \
"profinet_dce_rpc" "" ON \
"profinet_debug" "" ON \
"s7comm" "" ON \
"s7comm_plus" "" ON \
"s7comm_read_szl" "" ON \
"s7comm_upload_download" "" ON \
"stun" "" ON \
"stun_nat" "" ON \
"tds" "" ON \
"tds_rpc" "" ON \
"tds_sql_batch" "" ON \
"wireguard" "" ON 3>&1 1>&2 2>&3 )
local exitstatus=$? local exitstatus=$?

16
salt/common/tools/sbin/soup
View File

@@ -550,6 +550,7 @@ preupgrade_changes() {
[[ "$INSTALLEDVERSION" == 2.3.170 ]] && up_to_2.3.180 [[ "$INSTALLEDVERSION" == 2.3.170 ]] && up_to_2.3.180
[[ "$INSTALLEDVERSION" == 2.3.180 ]] && up_to_2.3.181 [[ "$INSTALLEDVERSION" == 2.3.180 ]] && up_to_2.3.181
[[ "$INSTALLEDVERSION" == 2.3.181 ]] && up_to_2.3.182 [[ "$INSTALLEDVERSION" == 2.3.181 ]] && up_to_2.3.182
[[ "$INSTALLEDVERSION" == 2.3.182 ]] && up_to_2.3.190
true true
} }
@@ -572,6 +573,7 @@ postupgrade_changes() {
[[ "$POSTVERSION" == 2.3.170 ]] && post_to_2.3.180 [[ "$POSTVERSION" == 2.3.170 ]] && post_to_2.3.180
[[ "$POSTVERSION" == 2.3.180 ]] && post_to_2.3.181 [[ "$POSTVERSION" == 2.3.180 ]] && post_to_2.3.181
[[ "$POSTVERSION" == 2.3.181 ]] && post_to_2.3.182 [[ "$POSTVERSION" == 2.3.181 ]] && post_to_2.3.182
[[ "$POSTVERSION" == 2.3.182 ]] && post_to_2.3.190
true true
} }
@@ -685,6 +687,11 @@ post_to_2.3.182() {
POSTVERSION=2.3.182 POSTVERSION=2.3.182
} }
post_to_2.3.190() {
echo "Nothing to do for .190"
POSTVERSION=2.3.190
}
stop_salt_master() { stop_salt_master() {
# kill all salt jobs across the grid because the hang indefinitely if they are queued and salt-master restarts # kill all salt jobs across the grid because the hang indefinitely if they are queued and salt-master restarts
set +e set +e
@@ -989,6 +996,15 @@ up_to_2.3.182() {
INSTALLEDVERSION=2.3.182 INSTALLEDVERSION=2.3.182
} }
up_to_2.3.190() {
echo "Upgrading to 2.3.190"
if [ -d /nsm/zeek/extracted/complete ]; then
chown -R zeek:socore /nsm/zeek/extracted/complete
chmod 770 /nsm/zeek/extracted/complete
fi
INSTALLEDVERSION=2.3.190
}
verify_upgradespace() { verify_upgradespace() {
CURRENTSPACE=$(df -BG / | grep -v Avail | awk '{print $4}' | sed 's/.$//') CURRENTSPACE=$(df -BG / | grep -v Avail | awk '{print $4}' | sed 's/.$//')
if [ "$CURRENTSPACE" -lt "10" ]; then if [ "$CURRENTSPACE" -lt "10" ]; then

14
salt/elasticsearch/files/ingest/zeek.bacnet Normal file
View File

@@ -0,0 +1,14 @@
{
"description" : "zeek.bacnet",
"processors" : [
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
{ "rename": { "field": "message2.is_orig", "target_field": "bacnet.is_orig", "ignore_missing": true } },
{ "rename": { "field": "message2.bvlc_function", "target_field": "bacnet.bclv.function", "ignore_missing": true } },
{ "rename": { "field": "message2.pdu_type", "target_field": "bacnet.pdu.type", "ignore_missing": true } },
{ "rename": { "field": "message2.pdu_service", "target_field": "bacnet.pdu.service", "ignore_missing": true } },
{ "rename": { "field": "message2.invoke_id", "target_field": "bacnet.invoke.id", "ignore_missing": true } },
{ "rename": { "field": "message2.result_code", "target_field": "bacnet.result.code", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}

15
salt/elasticsearch/files/ingest/zeek.bacnet_discovery Normal file
View File

@@ -0,0 +1,15 @@
{
"description" : "zeek.bacnet_discovery",
"processors" : [
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
{ "rename": { "field": "message2.is_orig", "target_field": "bacnet.is_orig", "ignore_missing": true } },
{ "rename": { "field": "message2.pdu_service", "target_field": "bacnet.pdu.service", "ignore_missing": true } },
{ "rename": { "field": "message2.object_type", "target_field": "bacnet.object.type", "ignore_missing": true } },
{ "rename": { "field": "message2.instance_number", "target_field": "bacnet.instance.number", "ignore_missing": true } },
{ "rename": { "field": "message2.vendor", "target_field": "bacnet.vendor", "ignore_missing": true } },
{ "rename": { "field": "message2.range", "target_field": "bacnet.range", "ignore_missing": true } },
{ "rename": { "field": "message2.object_name", "target_field": "bacnet.object.name", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}

15
salt/elasticsearch/files/ingest/zeek.bacnet_property Normal file
View File

@@ -0,0 +1,15 @@
{
"description" : "zeek.bacnet_property",
"processors" : [
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
{ "rename": { "field": "message2.is_orig", "target_field": "bacnet.is_orig", "ignore_missing": true } },
{ "rename": { "field": "message2.instance_number", "target_field": "bacnet.instance.number", "ignore_missing": true } },
{ "rename": { "field": "message2.pdu_service", "target_field": "bacnet.pdu.service", "ignore_missing": true } },
{ "rename": { "field": "message2.object_type", "target_field": "bacnet.object.type", "ignore_missing": true } },
{ "rename": { "field": "message2.property", "target_field": "bacnet.property", "ignore_missing": true } },
{ "rename": { "field": "message2.array_index", "target_field": "bacnet.array.index", "ignore_missing": true } },
{ "rename": { "field": "message2.value", "target_field": "bacnet.value", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}

10
salt/elasticsearch/files/ingest/zeek.bsap_ip_header Normal file
View File

@@ -0,0 +1,10 @@
{
"description" : "zeek.bsap_ip_header",
"processors" : [
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
{ "rename": { "field": "message2.num_msg", "target_field": "bsap.number.messages", "ignore_missing": true } },
{ "rename": { "field": "message2.type_name", "target_field": "bsap.message.type", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}

20
salt/elasticsearch/files/ingest/zeek.bsap_ip_rdb Normal file
View File

@@ -0,0 +1,20 @@
{
"description" : "zeek.bsap_ip_rdb",
"processors" : [
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
{ "rename": { "field": "message2.header_size", "target_field": "bsap.header.length", "ignore_missing": true } },
{ "rename": { "field": "message2.mes_seq", "target_field": "bsap.message.sequence", "ignore_missing": true } },
{ "rename": { "field": "message2.res_seq", "target_field": "bsap.response.sequence", "ignore_missing": true } },
{ "rename": { "field": "message2.data_len", "target_field": "bsap.data.length", "ignore_missing": true } },
{ "rename": { "field": "message2.sequence", "target_field": "bsap.function.sequence", "ignore_missing": true } },
{ "rename": { "field": "message2.app_func_code", "target_field": "bsap.application.function", "ignore_missing": true } },
{ "rename": { "field": "message2.node_status", "target_field": "bsap.node.status", "ignore_missing": true } },
{ "rename": { "field": "message2.func_code", "target_field": "bsap.application.sub_function", "ignore_missing": true } },
{ "rename": { "field": "message2.variable_count", "target_field": "bsap.variable.count", "ignore_missing": true } },
{ "rename": { "field": "message2.variables", "target_field": "bsap.vector.variables", "ignore_missing": true } },
{ "rename": { "field": "message2.variable_value", "target_field": "bsap.vector.variable.value", "ignore_missing": true } },
{ "rename": { "field": "message2.value", "target_field": "bsap.value", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}

9
salt/elasticsearch/files/ingest/zeek.bsap_ip_unknown Normal file
View File

@@ -0,0 +1,9 @@
{
"description" : "zeek.bsap_ip_unknown",
"processors" : [
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
{ "rename": { "field": "message2.data", "target_field": "bsap.ip.unknown.data", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}

17
salt/elasticsearch/files/ingest/zeek.bsap_serial_header Normal file
View File

@@ -0,0 +1,17 @@
{
"description" : "zeek.bsap_serial_header",
"processors" : [
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
{ "rename": { "field": "message2.ser", "target_field": "bsap.message.serial_number", "ignore_missing": true } },
{ "rename": { "field": "message2.dadd", "target_field": "bsap.destination.address", "ignore_missing": true } },
{ "rename": { "field": "message2.sadd", "target_field": "bsap.source.address", "ignore_missing": true } },
{ "rename": { "field": "message2.ctl", "target_field": "bsap.control.byte", "ignore_missing": true } },
{ "rename": { "field": "message2.dfun", "target_field": "bsap.destination.function", "ignore_missing": true } },
{ "rename": { "field": "message2.seq", "target_field": "bsap.message.sequence", "ignore_missing": true } },
{ "rename": { "field": "message2.sfun", "target_field": "bsap.source.function", "ignore_missing": true } },
{ "rename": { "field": "message2.nsb", "target_field": "bsap.node.status_byte", "ignore_missing": true } },
{ "rename": { "field": "message2.type_name", "target_field": "bsap.message.type", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}

11
salt/elasticsearch/files/ingest/zeek.bsap_serial_rdb Normal file
View File

@@ -0,0 +1,11 @@
{
"description" : "zeek.bsap_serial_rdb",
"processors" : [
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
{ "rename": { "field": "message2.func_code", "target_field": "bsap.rdb.function", "ignore_missing": true } },
{ "rename": { "field": "message2.variables", "target_field": "bsap.vector.variables", "ignore_missing": true } },
{ "rename": { "field": "message2.variable_value", "target_field": "bsap.vector.value", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}

13
salt/elasticsearch/files/ingest/zeek.bsap_serial_rdb_ext Normal file
View File

@@ -0,0 +1,13 @@
{
"description" : "zeek.bsap_serial_rdb_ext",
"processors" : [
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
{ "rename": { "field": "message2.dfun", "target_field": "bsap.destination.function", "ignore_missing": true } },
{ "rename": { "field": "message2.seq", "target_field": "bsap.message_sequence", "ignore_missing": true } },
{ "rename": { "field": "message2.nsb", "target_field": "bsap.node_status_byte", "ignore_missing": true } },
{ "rename": { "field": "message2.extfun", "target_field": "bsap.extension.function", "ignore_missing": true } },
{ "rename": { "field": "message2.data", "target_field": "bsap.extension.function_data", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}

9
salt/elasticsearch/files/ingest/zeek.bsap_serial_unknown Normal file
View File

@@ -0,0 +1,9 @@
{
"description" : "zeek.bsap_serial_unknown",
"processors" : [
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
{ "rename": { "field": "message2.data", "target_field": "bsap.serial.unknown.data", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}

19
salt/elasticsearch/files/ingest/zeek.cip Normal file
View File

@@ -0,0 +1,19 @@
{
"description" : "zeek.cip",
"processors" : [
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
{ "rename": { "field": "message2.is_orig", "target_field": "cip.is_orig", "ignore_missing": true } },
{ "rename": { "field": "message2.cip_sequence_count", "target_field": "cip.sequence_count", "ignore_missing": true } },
{ "rename": { "field": "message2.direction", "target_field": "cip.direction", "ignore_missing": true } },
{ "rename": { "field": "message2.cip_service_code", "target_field": "cip.service_code", "ignore_missing": true } },
{ "rename": { "field": "message2.cip_service", "target_field": "cip.service", "ignore_missing": true } },
{ "convert": { "field": "cip.service", "type": "string", "ignore_missing": true } },
{ "rename": { "field": "message2.cip_status", "target_field": "cip.status_code", "ignore_missing": true } },
{ "rename": { "field": "message2.class_id", "target_field": "cip.request.path.class.id", "ignore_missing": true } },
{ "rename": { "field": "message2.class_name", "target_field": "cip.request.path.class.name", "ignore_missing": true } },
{ "rename": { "field": "message2.instance_id", "target_field": "cip.request.path.instance.id", "ignore_missing": true } },
{ "rename": { "field": "message2.attribute_id", "target_field": "cip.request.path.attribute.id", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}

21
salt/elasticsearch/files/ingest/zeek.cip_identity Normal file
View File

@@ -0,0 +1,21 @@
{
"description" : "zeek.cip_identity",
"processors" : [
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
{ "rename": { "field": "message2.encapsulation_version", "target_field": "cip.encapsulation.version", "ignore_missing": true } },
{ "rename": { "field": "message2.socket_address", "target_field": "cip.socket.address", "ignore_missing": true } },
{ "rename": { "field": "message2.socket_port", "target_field": "cip.socket.port", "ignore_missing": true } },
{ "rename": { "field": "message2.vendor_id", "target_field": "cip.vendor.id", "ignore_missing": true } },
{ "rename": { "field": "message2.vendor_name", "target_field": "cip.vendor.name", "ignore_missing": true } },
{ "rename": { "field": "message2.device_type_id", "target_field": "cip.device.type.id", "ignore_missing": true } },
{ "rename": { "field": "message2.device_type_name", "target_field": "cip.device.type.name", "ignore_missing": true } },
{ "rename": { "field": "message2.product_code", "target_field": "cip.device.product.code", "ignore_missing": true } },
{ "rename": { "field": "message2.revision", "target_field": "cip.device.revision", "ignore_missing": true } },
{ "rename": { "field": "message2.device_status", "target_field": "cip.device.status", "ignore_missing": true } },
{ "rename": { "field": "message2.serial_number", "target_field": "cip.device.serial_number", "ignore_missing": true } },
{ "rename": { "field": "message2.product_name", "target_field": "cip.device.product.name", "ignore_missing": true } },
{ "rename": { "field": "message2.device_state", "target_field": "cip.device.state", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}

13
salt/elasticsearch/files/ingest/zeek.cip_io Normal file
View File

@@ -0,0 +1,13 @@
{
"description" : "zeek.cip_io",
"processors" : [
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
{ "rename": { "field": "message2.is_orig", "target_field": "cip.is_orig", "ignore_missing": true } },
{ "rename": { "field": "message2.connection_id", "target_field": "cip.connection.id", "ignore_missing": true } },
{ "rename": { "field": "message2.sequence_number", "target_field": "cip.sequence_number", "ignore_missing": true } },
{ "rename": { "field": "message2.data_length", "target_field": "cip.data.length", "ignore_missing": true } },
{ "rename": { "field": "message2.io_data", "target_field": "cip.io.data", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}

27
salt/elasticsearch/files/ingest/zeek.conn
View File

@@ -17,24 +17,25 @@
{ "rename": { "field": "message2.orig_ip_bytes", "target_field": "client.ip_bytes", "ignore_missing": true } }, { "rename": { "field": "message2.orig_ip_bytes", "target_field": "client.ip_bytes", "ignore_missing": true } },
{ "rename": { "field": "message2.resp_pkts", "target_field": "server.packets", "ignore_missing": true } }, { "rename": { "field": "message2.resp_pkts", "target_field": "server.packets", "ignore_missing": true } },
{ "rename": { "field": "message2.resp_ip_bytes", "target_field": "server.ip_bytes", "ignore_missing": true } }, { "rename": { "field": "message2.resp_ip_bytes", "target_field": "server.ip_bytes", "ignore_missing": true } },
{ "rename": { "field": "message2.orig_mac_oui", "target_field": "client.oui", "ignore_missing": true } },
{ "rename": { "field": "message2.tunnel_parents", "target_field": "log.id.tunnel_parents", "ignore_missing": true } }, { "rename": { "field": "message2.tunnel_parents", "target_field": "log.id.tunnel_parents", "ignore_missing": true } },
{ "rename": { "field": "message2.orig_cc", "target_field": "client.country_code","ignore_missing": true } }, { "rename": { "field": "message2.orig_cc", "target_field": "client.country_code","ignore_missing": true } },
{ "rename": { "field": "message2.resp_cc", "target_field": "server.country_code", "ignore_missing": true } }, { "rename": { "field": "message2.resp_cc", "target_field": "server.country_code", "ignore_missing": true } },
{ "rename": { "field": "message2.sensorname", "target_field": "observer.name", "ignore_missing": true } }, { "rename": { "field": "message2.sensorname", "target_field": "observer.name", "ignore_missing": true } },
{ "script": { "lang": "painless", "source": "ctx.network.bytes = (ctx.client.bytes + ctx.server.bytes)", "ignore_failure": true } }, { "script": { "lang": "painless", "source": "ctx.network.bytes = (ctx.client.bytes + ctx.server.bytes)", "ignore_failure": true } },
{ "set": { "if": "ctx.connection.state == 'S0'", "field": "connection.state_description", "value": "Connection attempt seen, no reply" } }, { "set": { "if": "ctx.connection?.state == 'S0'", "field": "connection.state_description", "value": "Connection attempt seen, no reply" } },
{ "set": { "if": "ctx.connection.state == 'S1'", "field": "connection.state_description", "value": "Connection established, not terminated" } }, { "set": { "if": "ctx.connection?.state == 'S1'", "field": "connection.state_description", "value": "Connection established, not terminated" } },
{ "set": { "if": "ctx.connection.state == 'S2'", "field": "connection.state_description", "value": "Connection established and close attempt by originator seen (but no reply from responder)" } }, { "set": { "if": "ctx.connection?.state == 'S2'", "field": "connection.state_description", "value": "Connection established and close attempt by originator seen (but no reply from responder)" } },
{ "set": { "if": "ctx.connection.state == 'S3'", "field": "connection.state_description", "value": "Connection established and close attempt by responder seen (but no reply from originator)" } }, { "set": { "if": "ctx.connection?.state == 'S3'", "field": "connection.state_description", "value": "Connection established and close attempt by responder seen (but no reply from originator)" } },
{ "set": { "if": "ctx.connection.state == 'SF'", "field": "connection.state_description", "value": "Normal SYN/FIN completion" } }, { "set": { "if": "ctx.connection?.state == 'SF'", "field": "connection.state_description", "value": "Normal SYN/FIN completion" } },
{ "set": { "if": "ctx.connection.state == 'REJ'", "field": "connection.state_description", "value": "Connection attempt rejected" } }, { "set": { "if": "ctx.connection?.state == 'REJ'", "field": "connection.state_description", "value": "Connection attempt rejected" } },
{ "set": { "if": "ctx.connection.state == 'RSTO'", "field": "connection.state_description", "value": "Connection established, originator aborted (sent a RST)" } }, { "set": { "if": "ctx.connection?.state == 'RSTO'", "field": "connection.state_description", "value": "Connection established, originator aborted (sent a RST)" } },
{ "set": { "if": "ctx.connection.state == 'RSTR'", "field": "connection.state_description", "value": "Established, responder aborted" } }, { "set": { "if": "ctx.connection?.state == 'RSTR'", "field": "connection.state_description", "value": "Established, responder aborted" } },
{ "set": { "if": "ctx.connection.state == 'RSTOS0'","field": "connection.state_description", "value": "Originator sent a SYN followed by a RST, we never saw a SYN-ACK from the responder" } }, { "set": { "if": "ctx.connection?.state == 'RSTOS0'","field": "connection.state_description", "value": "Originator sent a SYN followed by a RST, we never saw a SYN-ACK from the responder" } },
{ "set": { "if": "ctx.connection.state == 'RSTRH'", "field": "connection.state_description", "value": "Responder sent a SYN ACK followed by a RST, we never saw a SYN from the (purported) originator" } }, { "set": { "if": "ctx.connection?.state == 'RSTRH'", "field": "connection.state_description", "value": "Responder sent a SYN ACK followed by a RST, we never saw a SYN from the (purported) originator" } },
{ "set": { "if": "ctx.connection.state == 'SH'", "field": "connection.state_description", "value": "Originator sent a SYN followed by a FIN, we never saw a SYN ACK from the responder (hence the connection was 'half' open)" } }, { "set": { "if": "ctx.connection?.state == 'SH'", "field": "connection.state_description", "value": "Originator sent a SYN followed by a FIN, we never saw a SYN ACK from the responder (hence the connection was 'half' open)" } },
{ "set": { "if": "ctx.connection.state == 'SHR'", "field": "connection.state_description", "value": "Responder sent a SYN ACK followed by a FIN, we never saw a SYN from the originator" } }, { "set": { "if": "ctx.connection?.state == 'SHR'", "field": "connection.state_description", "value": "Responder sent a SYN ACK followed by a FIN, we never saw a SYN from the originator" } },
{ "set": { "if": "ctx.connection.state == 'OTH'", "field": "connection.state_description", "value": "No SYN seen, just midstream traffic (a 'partial connection' that was not later closed)" } }, { "set": { "if": "ctx.connection?.state == 'OTH'", "field": "connection.state_description", "value": "No SYN seen, just midstream traffic (a 'partial connection' that was not later closed)" } },
{ "pipeline": { "name": "zeek.common" } } { "pipeline": { "name": "zeek.common" } }
] ]
} }

10
salt/elasticsearch/files/ingest/zeek.cotp Normal file
View File

@@ -0,0 +1,10 @@
{
"description" : "zeek.cotp",
"processors" : [
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
{ "rename": { "field": "message2.pdu_code", "target_field": "cotp.pdu.code", "ignore_missing": true } },
{ "rename": { "field": "message2.pdu_name", "target_field": "cotp.pdu.name", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}

16
salt/elasticsearch/files/ingest/zeek.dnp3_control Normal file
View File

@@ -0,0 +1,16 @@
{
"description" : "zeek.dnp3_control",
"processors" : [
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
{ "rename": { "field": "message2.block_type", "target_field": "dnp3.block_type", "ignore_missing": true } },
{ "rename": { "field": "message2.function_code", "target_field": "dnp3.function_code", "ignore_missing": true } },
{ "rename": { "field": "message2.index_number", "target_field": "dnp3.index_number", "ignore_missing": true } },
{ "rename": { "field": "message2.trip_control_code","target_field": "dnp3.trip_control_code", "ignore_missing": true } },
{ "rename": { "field": "message2.operation_type", "target_field": "dnp3.operation_type", "ignore_missing": true } },
{ "rename": { "field": "message2.execute_count", "target_field": "dnp3.execute_count", "ignore_missing": true } },
{ "rename": { "field": "message2.on_time", "target_field": "dnp3.on_time", "ignore_missing": true } },
{ "rename": { "field": "message2.off_time", "target_field": "dnp3.off_time", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}

13
salt/elasticsearch/files/ingest/zeek.dnp3_objects Normal file
View File

@@ -0,0 +1,13 @@
{
"description" : "zeek.dnp3_objects",
"processors" : [
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
{ "rename": { "field": "message2.function_code", "target_field": "dnp3.function_code", "ignore_missing": true } },
{ "rename": { "field": "message2.object_type", "target_field": "dnp3.object_type", "ignore_missing": true } },
{ "rename": { "field": "message2.object_count", "target_field": "dnp3.object_count", "ignore_missing": true } },
{ "rename": { "field": "message2.range_low", "target_field": "dnp3.range_low", "ignore_missing": true } },
{ "rename": { "field": "message2.range_high", "target_field": "dnp3.range_high", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}

17
salt/elasticsearch/files/ingest/zeek.ecat_aoe_info Normal file
View File

@@ -0,0 +1,17 @@
{
"description" : "zeek.ecat_aoe_info",
"processors" : [
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
{ "rename": { "field": "message2.targetid", "target_field": "destination.mac", "ignore_missing": true } },
{ "rename": { "field": "message2.targetport", "target_field": "destination.port", "ignore_missing": true } },
{ "convert": { "field": "destination.port", "type": "integer", "ignore_missing": true } },
{ "rename": { "field": "message2.senderid", "target_field": "source.mac", "ignore_missing": true } },
{ "rename": { "field": "message2.senderport", "target_field": "source.port", "ignore_missing": true } },
{ "convert": { "field": "source.port", "type": "integer", "ignore_missing": true } },
{ "rename": { "field": "message2.cmd", "target_field": "ecat.command", "ignore_missing": true } },
{ "rename": { "field": "message2.stateflags", "target_field": "ecat.state.flags", "ignore_missing": true } },
{ "rename": { "field": "message2.data", "target_field": "ecat.data", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}

15
salt/elasticsearch/files/ingest/zeek.ecat_arp_info Normal file
View File

@@ -0,0 +1,15 @@
{
"description" : "zeek.ecat_arp_info",
"processors" : [
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
{ "rename": { "field": "message2.arp_type", "target_field": "ecat.arp.type", "ignore_missing": true } },
{ "rename": { "field": "message2.mac_src", "target_field": "source.mac", "ignore_missing": true } },
{ "rename": { "field": "message2.mac_dst", "target_field": "destination.mac", "ignore_missing": true } },
{ "rename": { "field": "message2.SPA", "target_field": "source.ip", "ignore_missing": true } },
{ "rename": { "field": "message2.SHA", "target_field": "ecat.sender.hardware.address", "ignore_missing": true } },
{ "rename": { "field": "message2.TPA", "target_field": "destination.ip", "ignore_missing": true } },
{ "rename": { "field": "message2.THA", "target_field": "ecat.target.hardware.address", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}

14
salt/elasticsearch/files/ingest/zeek.ecat_coe_info Normal file
View File

@@ -0,0 +1,14 @@
{
"description" : "zeek.ecat_coe_info",
"processors" : [
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
{ "rename": { "field": "message2.number", "target_field": "ecat.message.number", "ignore_missing": true } },
{ "rename": { "field": "message2.Type", "target_field": "ecat.message.type", "ignore_missing": true } },
{ "rename": { "field": "message2.req_resp", "target_field": "ecat.request.response_type", "ignore_missing": true } },
{ "rename": { "field": "message2.index", "target_field": "ecat.index", "ignore_missing": true } },
{ "rename": { "field": "message2.subindex", "target_field": "ecat.sub.index", "ignore_missing": true } },
{ "rename": { "field": "message2.dataoffset", "target_field": "ecat.data_offset", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}

18
salt/elasticsearch/files/ingest/zeek.ecat_dev_info Normal file
View File

@@ -0,0 +1,18 @@
{
"description" : "zeek.ecat_dev_info",
"processors" : [
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
{ "rename": { "field": "message2.slave_id", "target_field": "ecat.slave.address", "ignore_missing": true } },
{ "rename": { "field": "message2.revision", "target_field": "ecat.revision", "ignore_missing": true } },
{ "rename": { "field": "message2.dev_type", "target_field": "ecat.device.type", "ignore_missing": true } },
{ "rename": { "field": "message2.build", "target_field": "ecat.build.version", "ignore_missing": true } },
{ "rename": { "field": "message2.fmmucnt", "target_field": "ecat.fieldbus.memory_mgmt_unit", "ignore_missing": true } },
{ "rename": { "field": "message2.smcount", "target_field": "ecat.sync.manager_count", "ignore_missing": true } },
{ "rename": { "field": "message2.ports", "target_field": "ecat.port", "ignore_missing": true } },
{ "convert": { "field": "ecat.port", "type": "integer", "ignore_missing": true } },
{ "rename": { "field": "message2.dpram", "target_field": "ecat.ram.size", "ignore_missing": true } },
{ "rename": { "field": "message2.features", "target_field": "ecat.features", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}

14
salt/elasticsearch/files/ingest/zeek.ecat_foe_info Normal file
View File

@@ -0,0 +1,14 @@
{
"description" : "zeek.ecat_foe_info",
"processors" : [
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
{ "rename": { "field": "message2.opcode", "target_field": "ecat.operation.code", "ignore_missing": true } },
{ "rename": { "field": "message2.reserved", "target_field": "ecat.reserved", "ignore_missing": true } },
{ "rename": { "field": "message2.packet_num", "target_field": "ecat.packet_number", "ignore_missing": true } },
{ "rename": { "field": "message2.error_code", "target_field": "ecat.error_code", "ignore_missing": true } },
{ "rename": { "field": "message2.filename", "target_field": "ecat.filename", "ignore_missing": true } },
{ "rename": { "field": "message2.data", "target_field": "ecat.data", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}

14
salt/elasticsearch/files/ingest/zeek.ecat_log_address Normal file
View File

@@ -0,0 +1,14 @@
{
"description" : "zeek.ecat_log_address",
"processors" : [
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
{ "rename": { "field": "message2.srcmac", "target_field": "source.mac", "ignore_missing": true } },
{ "rename": { "field": "message2.dstmac", "target_field": "destination.mac", "ignore_missing": true } },
{ "rename": { "field": "message2.Log_Addr", "target_field": "ecat.log.address", "ignore_missing": true } },
{ "rename": { "field": "message2.Length", "target_field": "ecat.length", "ignore_missing": true } },
{ "rename": { "field": "message2.Command", "target_field": "ecat.command", "ignore_missing": true } },
{ "rename": { "field": "message2.data", "target_field": "ecat.data", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}

15
salt/elasticsearch/files/ingest/zeek.ecat_registers Normal file
View File

@@ -0,0 +1,15 @@
{
"description" : "zeek.ecat_registers",
"processors" : [
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
{ "rename": { "field": "message2.srcmac", "target_field": "source.mac", "ignore_missing": true } },
{ "rename": { "field": "message2.dstmac", "target_field": "destination.mac", "ignore_missing": true } },
{ "rename": { "field": "message2.Command", "target_field": "ecat.command", "ignore_missing": true } },
{ "rename": { "field": "message2.Slave_Addr", "target_field": "ecat.slave.address", "ignore_missing": true } },
{ "rename": { "field": "message2.Register_Type", "target_field": "ecat.register.type", "ignore_missing": true } },
{ "rename": { "field": "message2.Register_Addr", "target_field": "ecat.register.address", "ignore_missing": true } },
{ "rename": { "field": "message2.data", "target_field": "ecat.data", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}

14
salt/elasticsearch/files/ingest/zeek.ecat_soe_info Normal file
View File

@@ -0,0 +1,14 @@
{
"description" : "zeek.ecat_soe_info",
"processors" : [
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
{ "rename": { "field": "message2.opcode", "target_field": "ecat.operation.code", "ignore_missing": true } },
{ "rename": { "field": "message2.incomplete", "target_field": "ecat.function.check", "ignore_missing": true } },
{ "rename": { "field": "message2.error", "target_field": "ecat.error", "ignore_missing": true } },
{ "rename": { "field": "message2.drive_num", "target_field": "ecat.drive.number", "ignore_missing": true } },
{ "rename": { "field": "message2.element_flags", "target_field": "ecat.element.flags", "ignore_missing": true } },
{ "rename": { "field": "message2.index", "target_field": "ecat.index", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}

16
salt/elasticsearch/files/ingest/zeek.enip Normal file
View File

@@ -0,0 +1,16 @@
{
"description" : "zeek.enip",
"processors" : [
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
{ "rename": { "field": "message2.is_orig", "target_field": "enip.is_orig", "ignore_missing": true } },
{ "rename": { "field": "message2.enip_command_code", "target_field": "enip.command_code", "ignore_missing": true } },
{ "rename": { "field": "message2.enip_command", "target_field": "enip.command", "ignore_missing": true } },
{ "rename": { "field": "message2.length", "target_field": "enip.length", "ignore_missing": true } },
{ "rename": { "field": "message2.session_handle", "target_field": "enip.session.handle", "ignore_missing": true } },
{ "rename": { "field": "message2.enip_status", "target_field": "enip.status_code", "ignore_missing": true } },
{ "rename": { "field": "message2.sender_context", "target_field": "enip.sender.context", "ignore_missing": true } },
{ "rename": { "field": "message2.options", "target_field": "enip.options", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}

14
salt/elasticsearch/files/ingest/zeek.modbus_detailed Normal file
View File

@@ -0,0 +1,14 @@
{
"description" : "zeek.modbus_detailed",
"processors" : [
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
{ "rename": { "field": "message2.unit_id", "target_field": "modbus.unit_id", "ignore_missing": true } },
{ "rename": { "field": "message2.func", "target_field": "modbus.function", "ignore_missing": true } },
{ "rename": { "field": "message2.network_direction", "target_field": "modbus.network.direction", "ignore_missing": true } },
{ "rename": { "field": "message2.address", "target_field": "modbus.address", "ignore_missing": true } },
{ "rename": { "field": "message2.quality", "target_field": "modbus.quality", "ignore_missing": true } },
{ "rename": { "field": "message2.values", "target_field": "modbus.values", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}

14
salt/elasticsearch/files/ingest/zeek.modbus_mask_write_register Normal file
View File

@@ -0,0 +1,14 @@
{
"description" : "zeek.modbus_mask_write_register",
"processors" : [
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
{ "rename": { "field": "message2.unit_id", "target_field": "modbus.unit_id", "ignore_missing": true } },
{ "rename": { "field": "message2.func", "target_field": "modbus.function", "ignore_missing": true } },
{ "rename": { "field": "message2.network_direction", "target_field": "modbus.network.direction", "ignore_missing": true } },
{ "rename": { "field": "message2.address", "target_field": "modbus.address", "ignore_missing": true } },
{ "rename": { "field": "message2.and_mask", "target_field": "modbus.and_mask", "ignore_missing": true } },
{ "rename": { "field": "message2.or_mask", "target_field": "modbus.or_mask", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}

16
salt/elasticsearch/files/ingest/zeek.modbus_read_write_multiple_registers Normal file
View File

@@ -0,0 +1,16 @@
{
"description" : "zeek.read_write_multiple_registers",
"processors" : [
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
{ "rename": { "field": "message2.unit_id", "target_field": "modbus.unit_id", "ignore_missing": true } },
{ "rename": { "field": "message2.func", "target_field": "modbus.function", "ignore_missing": true } },
{ "rename": { "field": "message2.network_direction", "target_field": "modbus.network.direction", "ignore_missing": true } },
{ "rename": { "field": "message2.write_start_address", "target_field": "modbus.write.start.address", "ignore_missing": true } },
{ "rename": { "field": "message2.write_registers", "target_field": "modbus.write.registers", "ignore_missing": true } },
{ "rename": { "field": "message2.read_start_address", "target_field": "modbus.read.start.address", "ignore_missing": true } },
{ "rename": { "field": "message2.read.quality", "target_field": "modbus.read.quality", "ignore_missing": true } },
{ "rename": { "field": "message2.read_registers", "target_field": "modbus.read.registers", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}

32
salt/elasticsearch/files/ingest/zeek.opcua_binary Normal file
View File

@@ -0,0 +1,32 @@
{
"description" : "zeek.opcua_binary",
"processors" : [
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
{ "rename": { "field": "message2.msg_type", "target_field": "opcua.message_type", "ignore_missing": true } },
{ "rename": { "field": "message2.is_final", "target_field": "opcua.final", "ignore_missing": true } },
{ "rename": { "field": "message2.msg_size", "target_field": "opcua.message_size", "ignore_missing": true } },
{ "rename": { "field": "message2.snd_buf_size", "target_field": "opcua.sender.buffer_size", "ignore_missing": true } },
{ "rename": { "field": "message2.seq_number", "target_field": "opcua.sequence_number", "ignore_missing": true } },
{ "rename": { "field": "message2.sec_channel_id", "target_field": "opcua.secure_channel_id", "ignore_missing": true } },
{ "rename": { "field": "message2.seq_number", "target_field": "opcua.sequence_number", "ignore_missing": true } },
{ "rename": { "field": "message2.opcua_link_id", "target_field": "opcua.link_id", "ignore_missing": true } },
{ "rename": { "field": "message2.request_id", "target_field": "opcua.request_id", "ignore_missing": true } },
{ "rename": { "field": "message2.namespace_idx", "target_field": "opcua.namespace_index", "ignore_missing": true } },
{ "rename": { "field": "message2.encoding_mask", "target_field": "opcua.encoding_mask", "ignore_missing": true } },
{ "convert": { "field": "opcua.encoding_mask", "type": "string",
"ignore_missing": true } },
{ "rename": { "field": "message2.identifier", "target_field": "opcua.identifier", "ignore_missing": true } },
{ "rename": { "field": "message2.identifier_str", "target_field": "opcua.identifier_string", "ignore_missing": true } },
{ "rename": { "field": "message2.req_hdr_node_id_type", "target_field": "opcua.request.header.node.id_type", "ignore_missing": true } },
{ "rename": { "field": "message2.req_hdr_node_id_numeric", "target_field": "opcua.request.header.node.id_numeric", "ignore_missing": true } },
{ "rename": { "field": "message2.req_hdr_timestamp", "target_field": "opcua.request.header.timestamp", "ignore_missing": true } },
{ "rename": { "field": "message2.req_hdr_request_handle", "target_field": "opcua.request.handle", "ignore_missing": true } },
{ "rename": { "field": "message2.req_hdr_return_diag", "target_field": "opcua.request.header.return_diag", "ignore_missing": true } },
{ "rename": { "field": "message2.req_hdr_audit_entry_id", "target_field": "opcua.request.header.audit_entry_id", "ignore_missing": true } },
{ "rename": { "field": "message2.req_hdr_timeout_hint", "target_field": "opcua.request.header.timeout_hint", "ignore_missing": true } },
{ "rename": { "field": "message2.req_hdr_add_hdr_type_id", "target_field": "opcua.request.header.type_id", "ignore_missing": true } },
{ "rename": { "field": "message2.req_hdr_add_hdr_enc_mask", "target_field": "opcua.request.header.enc_mask", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}

19
salt/elasticsearch/files/ingest/zeek.opcua_binary_activate_session Normal file
View File

@@ -0,0 +1,19 @@
{
"description" : "zeek.opcua_binary_activate_session",
"processors" : [
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true} },
{ "rename": { "field": "message2.opcua_link_id", "target_field": "opcua.link_id", "ignore_missing": true } },
{ "rename": { "field": "message2.ext_obj_type_id_namespace_idx", "target_field": "opcua.namespace_index", "ignore_missing": true } },
{ "rename": { "field": "message2.ext_obj_type_id_encoding_mask", "target_field": "opcua.encoding_mask", "ignore_missing": true } },
{ "convert": { "field": "opcua.encoding_mask", "type": "string", "ignore_missing": true } },
{ "rename": { "field": "message2.ext_obj_type_id_numeric", "target_field": "opcua.identifier_numeric", "ignore_missing": true } },
{ "rename": { "field": "message2.ext_obj_type_id_str", "target_field": "opcua.identifier_string", "ignore_missing": true } },
{ "rename": { "field": "message2.ext_obj_encoding", "target_field": "opcua.encoding", "ignore_missing": true } },
{ "rename": { "field": "message2.ext_obj_policy_id", "target_field": "opcua.policy_id", "ignore_missing": true } },
{ "rename": { "field": "message2.ext_obj_user_name", "target_field": "opcua.user_name", "ignore_missing": true } },
{ "rename": { "field": "message2.ext_obj_password", "target_field": "opcua.password", "ignore_missing": true } },
{ "rename": { "field": "message2.server_nonce", "target_field": "opcua.server_nonce", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}

11
salt/elasticsearch/files/ingest/zeek.opcua_binary_activate_session_client_software_cert Normal file
View File

@@ -0,0 +1,11 @@
{
"description" : "zeek.opcua_binary_activate_session_client_software_cert",
"processors" : [
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
{ "rename": { "field": "message2.client_software_cert_link_id", "target_field": "opcua.client_software_cert_link_id", "ignore_missing": true } },
{ "rename": { "field": "message2.cert_data", "target_field": "opcua.certificate.data", "ignore_missing": true } },
{ "rename": { "field": "message2.cert_signature", "target_field": "opcua.certificate.signature", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}

10
salt/elasticsearch/files/ingest/zeek.opcua_binary_activate_session_diagnostic_info Normal file
View File

@@ -0,0 +1,10 @@
{
"description" : "zeek.opcua_binary_activate_session_diagnostic_info",
"processors" : [
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
{ "rename": { "field": "message2.activate_session_diag_info_link_id", "target_field": "opcua.activate_session_diag_info_link_id", "ignore_missing": true } },
{ "rename": { "field": "message2.diag_info_link_id", "target_field": "opcua.diag_info_link_id", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}

10
salt/elasticsearch/files/ingest/zeek.opcua_binary_activate_session_locale_id Normal file
View File

@@ -0,0 +1,10 @@
{
"description" : "zeek.opcua_binary_activate_session_locale_id",
"processors" : [
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
{ "rename": { "field": "message2.opcua_locale_link_id", "target_field": "opcua.locale_link_id", "ignore_missing": true } },
{ "rename": { "field": "message2.local_id", "target_field": "opcua.local_id", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}

18
salt/elasticsearch/files/ingest/zeek.opcua_binary_browse Normal file
View File

@@ -0,0 +1,18 @@
{
"description" : "zeek.opcua_binary_browse",
"processors" : [
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
{ "rename": { "field": "message2.opcua_link_id", "target_field": "opcua.link_id", "ignore_missing": true } },
{ "rename": { "field": "message2.browse_service_type", "target_field": "opcua.service_type", "ignore_missing": true } },
{ "rename": { "field": "message2.browse_view_id_encoding_mask", "target_field": "opcua.encoding_mask", "ignore_missing": true } },
{ "convert": { "field": "opcua.encoding_mask", "type": "string",
"ignore_missing": true } },
{ "rename": { "field": "message2.browse_view_id_numeric", "target_field": "opcua.identifier_numeric", "ignore_missing": true } },
{ "rename": { "field": "message2.browse_view_description_timestamp", "target_field": "opcua.view_description_timestamp", "ignore_missing": true } },
{ "rename": { "field": "message2.browse_view_description_view_version", "target_field": "opcua.description_view_version", "ignore_missing": true } },
{ "rename": { "field": "message2.browse_description_link_id", "target_field": "opcua.description_link_id", "ignore_missing": true } },
{ "rename": { "field": "message2.req_max_ref_nodes", "target_field": "opcua.request.max_ref_nodes", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}

17
salt/elasticsearch/files/ingest/zeek.opcua_binary_browse_description Normal file
View File

@@ -0,0 +1,17 @@
{
"description" : "zeek.opcua_binary_browse_description",
"processors" : [
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
{ "rename": { "field": "message2.browse_description_link_id", "target_field": "opcua.browse_description_link_id", "ignore_missing": true } },
{ "rename": { "field": "message2.browse_description_encoding_mask", "target_field": "opcua.browse_description_encoding_mask", "ignore_missing": true } },
{ "rename": { "field": "message2.browse_description_numeric", "target_field": "opcua.browse_description_numeric", "ignore_missing": true } },
{ "rename": { "field": "message2.browse_direction", "target_field": "opcua.browse_direction", "ignore_missing": true } },
{ "rename": { "field": "message2.browse_description_ref_encoding_mask", "target_field": "opcua.browse_description_ref_encoding_mask", "ignore_missing": true } },
{ "rename": { "field": "message2.browse_description_ref_numeric", "target_field": "opcua.browse_description_ref_numeric", "ignore_missing": true } },
{ "rename": { "field": "message2.browse_description_include_subtypes", "target_field": "opcua.browse_description_include_subtypes", "ignore_missing": true } },
{ "rename": { "field": "message2.browse_node_class_mask", "target_field": "opcua.browse_node_class_mask", "ignore_missing": true } },
{ "rename": { "field": "message2.browse_result_mask", "target_field": "opcua.browse_result_mask", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}

10
salt/elasticsearch/files/ingest/zeek.opcua_binary_browse_diagnostic_info Normal file
View File

@@ -0,0 +1,10 @@
{
"description" : "zeek.opcua_binary_browse_diagnostic_info",
"processors" : [
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
{ "rename": { "field": "message2.browse_diag_info_link_id", "target_field": "opcua.browse_session_diag_info_link_id", "ignore_missing": true } },
{ "rename": { "field": "message2.diag_info_link_id", "target_field": "opcua.diag_info_link_id", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}

10
salt/elasticsearch/files/ingest/zeek.opcua_binary_browse_request_continuation_point Normal file
View File

@@ -0,0 +1,10 @@
{
"description" : "zeek.opcua_binary_browse_request_continuation_point",
"processors" : [
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
{ "rename": { "field": "message2.browse_next_link_id", "target_field": "opcua.browse_next_link_id", "ignore_missing": true } },
{ "rename": { "field": "message2.continuation_point", "target_field": "opcua.continuation_point", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}

22
salt/elasticsearch/files/ingest/zeek.opcua_binary_browse_response_references Normal file
View File

@@ -0,0 +1,22 @@
{
"description" : "zeek.opcua_binary_browse_response_references",
"processors" : [
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
{ "rename": { "field": "message2.browse_reference_link_id", "target_field": "opcua.link_id", "ignore_missing": true } },
{ "rename": { "field": "message2.browse_response_ref_encoding_mask", "target_field": "opcua.reference_encoding_mask", "ignore_missing": true } },
{ "rename": { "field": "message2.browse_response_ref_numeric", "target_field": "opcua.reference_numeric", "ignore_missing": true } },
{ "rename": { "field": "message2.browse_response_is_forward", "target_field": "opcua.is_forward", "ignore_missing": true } },
{ "rename": { "field": "message2.response_ref_type_encoding_mask", "target_field": "opcua.reference_type_encoding_mask", "ignore_missing": true } },
{ "rename": { "field": "message2.browse_response_ref_type_namespace_idx", "target_field": "opcua.namespace_index", "ignore_missing": true } },
{ "rename": { "field": "message2.browse_response_ref_type_numeric", "target_field": "opcua.reference_type_numeric", "ignore_missing": true } },
{ "rename": { "field": "message2.browse_response_ref_name", "target_field": "opcua.reference_name", "ignore_missing": true } },
{ "rename": { "field": "message2.browse_response_display_name_mask", "target_field": "opcua.display_name_mask", "ignore_missing": true } },
{ "rename": { "field": "message2.browse_response_display_name_locale", "target_field": "opcua.display_name_local", "ignore_missing": true } },
{ "rename": { "field": "message2.browse_response_display_name_text", "target_field": "opcua.display_name_text", "ignore_missing": true } },
{ "rename": { "field": "message2.browse_response_node_class", "target_field": "opcua.node_class", "ignore_missing": true } },
{ "rename": { "field": "message2.browse_response_type_def_encoding_mask", "target_field": "opcua.type_def_encoding_mask", "ignore_missing": true } },
{ "rename": { "field": "message2.browse_response_type_def_numeric", "target_field": "opcua.type_def_numeric", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}

11
salt/elasticsearch/files/ingest/zeek.opcua_binary_browse_result Normal file
View File

@@ -0,0 +1,11 @@
{
"description" : "zeek.opcua_binary_browse_result",
"processors" : [
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
{ "rename": { "field": "message2.browse_response_link_id", "target_field": "opcua.response_link_id", "ignore_missing": true } },
{ "rename": { "field": "message2.browse_reference_link_id", "target_field": "opcua.reference_link_id", "ignore_missing": true } },
{ "rename": { "field": "message2.status_code_link_id", "target_field": "opcua.status_code_link_id", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}

19
salt/elasticsearch/files/ingest/zeek.opcua_binary_create_session Normal file
View File

@@ -0,0 +1,19 @@
{
"description" : "zeek.opcua_binary_create_session",
"processors" : [
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true} },
{ "rename": { "field": "message2.opcua_link_id", "target_field": "opcua.link_id", "ignore_missing": true } },
{ "rename": { "field": "message2.session_id_encoding_mask", "target_field": "opcua.session_id_encoding_mask", "ignore_missing": true } },
{ "rename": { "field": "message2.session_id_namespace_idx", "target_field": "opcua.session_id_namespace_index", "ignore_missing": true } },
{ "rename": { "field": "message2.session_id_guid", "target_field": "opcua.session_id_guid", "ignore_missing": true } },
{ "rename": { "field": "message2.auth_token_encoding_mask", "target_field": "opcua.auth_token_encoding_mask", "ignore_missing": true } },
{ "rename": { "field": "message2.auth_token_namespace_idx", "target_field": "opcua.auth_token_namespace_index", "ignore_missing": true } },
{ "rename": { "field": "message2.auth_token_guid", "target_field": "opcua.auth_token_guid", "ignore_missing": true } },
{ "rename": { "field": "message2.revised_session_timeout", "target_field": "opcua.revised_session_timeout", "ignore_missing": true } },
{ "rename": { "field": "message2.server_nonce", "target_field": "opcua.server_nonce", "ignore_missing": true } },
{ "rename": { "field": "message2.endpoint_link_id", "target_field": "opcua.endpoint_link_id", "ignore_missing": true } },
{ "rename": { "field": "message2.max_req_msg_size", "target_field": "opcua.request.max_message_size", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}

11
salt/elasticsearch/files/ingest/zeek.opcua_binary_create_session_discovery Normal file
View File

@@ -0,0 +1,11 @@
{
"description" : "zeek.opcua_binary_create_session_discovery",
"processors" : [
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
{ "rename": { "field": "message2.discovery_profile_link_id", "target_field": "opcua.discovery_profile_link_id", "ignore_missing": true } },
{ "rename": { "field": "message2.discovery_profile_uri", "target_field": "opcua.discovery_profile_uri", "ignore_missing": true } },
{ "rename": { "field": "message2.discovery_profile_url", "target_field": "opcua.discovery_profile_url", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}

22
salt/elasticsearch/files/ingest/zeek.opcua_binary_create_session_endpoints Normal file
View File

@@ -0,0 +1,22 @@
{
"description" : "zeek.opcua_binary_create_session_endpoints",
"processors" : [
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
{ "rename": { "field": "message2.endpoint_link_id", "target_field": "opcua.endpoint_link_id", "ignore_missing": true } },
{ "rename": { "field": "message2.endpoint_url", "target_field": "opcua.endpoint_url", "ignore_missing": true } },
{ "rename": { "field": "message2.application_uri", "target_field": "opcua.application_uri", "ignore_missing": true } },
{ "rename": { "field": "message2.product_uri", "target_field": "opcua.product_uri", "ignore_missing": true } },
{ "rename": { "field": "message2.encoding_mask", "target_field": "opcua.encoding_mask", "ignore_missing": true } },
{ "convert": { "field": "opcua.encoding_mask", "type": "string", "ignore_missing": true } },
{ "rename": { "field": "message2.locale", "target_field": "opcua.locale", "ignore_missing": true } },
{ "rename": { "field": "message2.text", "target_field": "opcua.text", "ignore_missing": true } },
{ "rename": { "field": "message2.application_type", "target_field": "opcua.application_type", "ignore_missing": true } },
{ "rename": { "field": "message2.message_security_mode", "target_field": "opcua.message_security_mode", "ignore_missing": true } },
{ "rename": { "field": "message2.security_policy_uri", "target_field": "opcua.security_policy_uri", "ignore_missing": true } },
{ "rename": { "field": "message2.user_token_link_id", "target_field": "opcua.user_token_link_id", "ignore_missing": true } },
{ "rename": { "field": "message2.transport_profile_uri", "target_field": "opcua.transport_profile_uri", "ignore_missing": true } },
{ "rename": { "field": "message2.security_level", "target_field": "opcua.security_level", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}

11
salt/elasticsearch/files/ingest/zeek.opcua_binary_create_session_user_token Normal file
View File

@@ -0,0 +1,11 @@
{
"description" : "zeek.opcua_binary_create_session_user_token",
"processors" : [
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
{ "rename": { "field": "message2.user_token_link_id", "target_field": "opcua.user_token_link_id", "ignore_missing": true } },
{ "rename": { "field": "message2.user_token_link_id", "target_field": "opcua.user_token_policy_id", "ignore_missing": true } },
{ "rename": { "field": "message2.user_token_link_id", "target_field": "opcua.user_token_type", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}

15
salt/elasticsearch/files/ingest/zeek.opcua_binary_create_subscription Normal file
View File

@@ -0,0 +1,15 @@
{
"description" : "zeek.opcua_binary_create_subscription",
"processors" : [
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
{ "rename": { "field": "message2.opcua_link_id", "target_field": "opcua.link_id", "ignore_missing": true } },
{ "rename": { "field": "message2.requested_publishing_interval", "target_field": "opcua.publish_interval", "ignore_missing": true } },
{ "rename": { "field": "message2.requested_lifetime_count", "target_field": "opcua.lifetime_count", "ignore_missing": true } },
{ "rename": { "field": "message2.requested_max_keep_alive_count", "target_field": "opcua.max_keepalive", "ignore_missing": true } },
{ "rename": { "field": "message2.max_notifications_per_publish", "target_field": "opcua.max_notifications", "ignore_missing": true } },
{ "rename": { "field": "message2.publishing_enabled", "target_field": "opcua.publish_enabled", "ignore_missing": true } },
{ "rename": { "field": "message2.priority", "target_field": "opcua.priority", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}

21
salt/elasticsearch/files/ingest/zeek.opcua_binary_diag_info_detail Normal file
View File

@@ -0,0 +1,21 @@
{
"description" : "zeek.opcua_binary_diag_info_detail",
"processors" : [
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
{ "rename": { "field": "message2.diag_info_link_id", "target_field": "opcua.diag_info_link_id", "ignore_missing": true } },
{ "rename": { "field": "message2.source", "target_field": "opcua.source", "ignore_missing": true } },
{ "rename": { "field": "message2.source_str", "target_field": "opcua.source_string", "ignore_missing": true } },
{ "rename": { "field": "message2.inner_diag_level", "target_field": "opcua.inner_diag_level", "ignore_missing": true } },
{ "rename": { "field": "message2.has_symbolic_id", "target_field": "opcua.has_symbolic_id", "ignore_missing": true } },
{ "rename": { "field": "message2.has_namespace_uri", "target_field": "opcua.has_namespace_uri", "ignore_missing": true } },
{ "rename": { "field": "message2.has_locale", "target_field": "opcua.has_locale", "ignore_missing": true } },
{ "rename": { "field": "message2.has_locale_txt", "target_field": "opcua.has_locale_txt", "ignore_missing": true } },
{ "rename": { "field": "message2.has_addl_info", "target_field": "opcua.has_addl_info", "ignore_missing": true } },
{ "rename": { "field": "message2.addl_info", "target_field": "opcua.addl_info", "ignore_missing": true } },
{ "rename": { "field": "message2.has_inner_stat_code", "target_field": "opcua.has_inner_stat_code", "ignore_missing": true } },
{ "rename": { "field": "message2.inner_stat_code", "target_field": "opcua.inner_stat_code", "ignore_missing": true } },
{ "rename": { "field": "message2.has_inner_diag_info", "target_field": "opcua.has_inner_diag_info", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}

10
salt/elasticsearch/files/ingest/zeek.opcua_binary_get_endpoints Normal file
View File

@@ -0,0 +1,10 @@
{
"description" : "zeek.opcua_binary_get_endpoints",
"processors" : [
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
{ "rename": { "field": "message2.opcua_link_id", "target_field": "opcua.link_id", "ignore_missing": true } },
{ "rename": { "field": "message2.endpoint_url", "target_field": "opcua.endpoint_url", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}

23
salt/elasticsearch/files/ingest/zeek.opcua_binary_get_endpoints_description Normal file
View File

@@ -0,0 +1,23 @@
{
"description" : "zeek.opcua_binary_get_endpoints_description",
"processors" : [
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
{ "rename": { "field": "message2.endpoint_description_link_id", "target_field": "opcua.endpoint_description_link_id", "ignore_missing": true } },
{ "rename": { "field": "message2.application_uri", "target_field": "opcua.application_uri", "ignore_missing": true } },
{ "rename": { "field": "message2.endpoint_uri", "target_field": "opcua.endpoint_uri", "ignore_missing": true } },
{ "rename": { "field": "message2.product_uri", "target_field": "opcua.product_uri", "ignore_missing": true } },
{ "rename": { "field": "message2.encoding_mask", "target_field": "opcua.encoding_mask", "ignore_missing": true } },
{ "convert": { "field": "opcua.encoding_mask", "type": "string",
"ignore_missing": true } },
{ "rename": { "field": "message2.locale", "target_field": "opcua.locale", "ignore_missing": true } },
{ "rename": { "field": "message2.text", "target_field": "opcua.text", "ignore_missing": true } },
{ "rename": { "field": "message2.application_type", "target_field": "opcua.application_type", "ignore_missing": true } },
{ "rename": { "field": "message2.message_security_mode", "target_field": "opcua.message_security_mode", "ignore_missing": true } },
{ "rename": { "field": "message2.security_policy_uri", "target_field": "opcua.security_policy_uri", "ignore_missing": true } },
{ "rename": { "field": "message2.user_token_link_id", "target_field": "opcua.user_token_link_id", "ignore_missing": true } },
{ "rename": { "field": "message2.transport_profile_uri", "target_field": "opcua.transport_profile_uri", "ignore_missing": true } },
{ "rename": { "field": "message2.security_level", "target_field": "opcua.security_level", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}

10
salt/elasticsearch/files/ingest/zeek.opcua_binary_get_endpoints_discovery Normal file
View File

@@ -0,0 +1,10 @@
{
"description" : "zeek.opcua_binary_get_endpoints_discovery",
"processors" : [
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
{ "rename": { "field": "message2.discovery_profile_link_id", "target_field": "opcua.discovery_profile_link_id", "ignore_missing": true } },
{ "rename": { "field": "message2.discovery_profile_url", "target_field": "opcua.discovery_profile_url", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}

10
salt/elasticsearch/files/ingest/zeek.opcua_binary_get_endpoints_locale_id Normal file
View File

@@ -0,0 +1,10 @@
{
"description" : "zeek.opcua_binary_get_endpoints_locale_id",
"processors" : [
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
{ "rename": { "field": "message2.opcua_locale_link_id", "target_field": "opcua.locale_link_id", "ignore_missing": true } },
{ "rename": { "field": "message2.local_id", "target_field": "opcua.local_id", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}

10
salt/elasticsearch/files/ingest/zeek.opcua_binary_get_endpoints_profile_uri Normal file
View File

@@ -0,0 +1,10 @@
{
"description" : "zeek.opcua_binary_get_endpoints_profile_uri",
"processors" : [
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
{ "rename": { "field": "message2.profile_uri_link_id", "target_field": "opcua.profile_uri_link_id", "ignore_missing": true } },
{ "rename": { "field": "message2.profile_uri", "target_field": "opcua.profile_uri", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}

11
salt/elasticsearch/files/ingest/zeek.opcua_binary_get_endpoints_user_token Normal file
View File

@@ -0,0 +1,11 @@
{
"description" : "zeek.opcua_binary_get_endpoints_user_token",
"processors" : [
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
{ "rename": { "field": "message2.user_token_link_id", "target_field": "opcua.user_token_link_id", "ignore_missing": true } },
{ "rename": { "field": "message2.user_token_type", "target_field": "opcua.user_token_type", "ignore_missing": true } },
{ "rename": { "field": "message2.user_token_sec_policy_uri", "target_field": "opcua.user_token_security_policy_uri", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}

15
salt/elasticsearch/files/ingest/zeek.opcua_binary_opensecure_channel Normal file
View File

@@ -0,0 +1,15 @@
{
"description" : "zeek.opcua_binary_opensecure_channel",
"processors" : [
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
{ "rename": { "field": "message2.opcua_link_id", "target_field": "opcua.link_id", "ignore_missing": true } },
{ "rename": { "field": "message2.server_proto_ver", "target_field": "opcua.server_proto_ver", "ignore_missing": true } },
{ "rename": { "field": "message2.sec_token_sec_channel_id", "target_field": "opcua.sec_token_sec_channel_id", "ignore_missing": true } },
{ "rename": { "field": "message2.sec_token_id", "target_field": "opcua.sec_token_id", "ignore_missing": true } },
{ "rename": { "field": "message2.sec_token_created_at", "target_field": "opcua.sec_token_created_at", "ignore_missing": true } },
{ "rename": { "field": "message2.sec_token_revised_time", "target_field": "opcua.sec_token_revised_time", "ignore_missing": true } },
{ "rename": { "field": "message2.server_nonce", "target_field": "opcua.server_nonce", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}

10
salt/elasticsearch/files/ingest/zeek.opcua_binary_read Normal file
View File

@@ -0,0 +1,10 @@
{
"description" : "zeek.opcua_binary_read",
"processors" : [
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
{ "rename": { "field": "message2.opcua_link_id", "target_field": "opcua.link_id", "ignore_missing": true } },
{ "rename": { "field": "message2.read_results_link_id", "target_field": "opcua.read_results_link_id", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}

10
salt/elasticsearch/files/ingest/zeek.opcua_binary_read_array_dims Normal file
View File

@@ -0,0 +1,10 @@
{
"description" : "zeek.opcua_binary_read_array_dims",
"processors" : [
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
{ "rename": { "field": "message2.array_dim_link_id", "target_field": "opcua.array_dim_link_id", "ignore_missing": true } },
{ "rename": { "field": "message2.dimension", "target_field": "opcua.dimension", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}

10
salt/elasticsearch/files/ingest/zeek.opcua_binary_read_array_dims_link Normal file
View File

@@ -0,0 +1,10 @@
{
"description" : "zeek.opcua_binary_read_array_dims_link",
"processors" : [
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
{ "rename": { "field": "message2.variant_data_array_dim_link_id", "target_field": "opcua.variant_data_array_dim_link_id", "ignore_missing": true } },
{ "rename": { "field": "message2.array_dim_link_id", "target_field": "opcua.array_dim_link_id", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}

10
salt/elasticsearch/files/ingest/zeek.opcua_binary_read_diagnostic_info Normal file
View File

@@ -0,0 +1,10 @@
{
"description" : "zeek.opcua_binary_read_diagnostic_info",
"processors" : [
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
{ "rename": { "field": "message2.read_diag_info_link_id", "target_field": "opcua.read_diag_info_link_id", "ignore_missing": true } },
{ "rename": { "field": "message2.diag_info_link_id", "target_field": "opcua.diag_info_link_id", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}

14
salt/elasticsearch/files/ingest/zeek.opcua_binary_read_extension_object Normal file
View File

@@ -0,0 +1,14 @@
{
"description" : "zeek.opcua_binary_read_extension_object",
"processors" : [
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
{ "rename": { "field": "message2.ext_obj_link_id", "target_field": "opcua.ext_obj_link_id", "ignore_missing": true } },
{ "rename": { "field": "message2.ext_obj_node_id_encoding_mask", "target_field": "opcua.ext_obj_node_id_encoding_mask", "ignore_missing": true } },
{ "rename": { "field": "message2.ext_obj_node_id_namespace_idx", "target_field": "opcua.ext_obj_node_id_namespace_index", "ignore_missing": true } },
{ "rename": { "field": "message2.ext_obj_node_id_numeric", "target_field": "opcua.ext_obj_node_id_numeric", "ignore_missing": true } },
{ "rename": { "field": "message2.ext_obj_type_id_str", "target_field": "opcua.ext_obj_type_id_string", "ignore_missing": true } },
{ "rename": { "field": "message2.ext_obj_encoding", "target_field": "opcua.ext_obj_encoding", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}

10
salt/elasticsearch/files/ingest/zeek.opcua_binary_read_extension_object_link Normal file
View File

@@ -0,0 +1,10 @@
{
"description" : "zeek.opcua_binary_read_extension_object_link",
"processors" : [
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
{ "rename": { "field": "message2.variant_data_ext_obj_link_id", "target_field": "opcua.variant_data_ext_obj_link_id", "ignore_missing": true } },
{ "rename": { "field": "message2.ext_obj_link_id", "target_field": "opcua.ext_obj_link_id", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}

15
salt/elasticsearch/files/ingest/zeek.opcua_binary_read_nodes_to_read Normal file
View File

@@ -0,0 +1,15 @@
{
"description" : "zeek.opcua_binary_read_nodes_to_read",
"processors" : [
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
{ "rename": { "field": "message2.nodes_to_read_link_id", "target_field": "opcua.nodes_to_read_link_id", "ignore_missing": true } },
{ "rename": { "field": "message2.node_id_encoding_mask", "target_field": "opcua.node_id_encoding_mask", "ignore_missing": true } },
{ "rename": { "field": "message2.node_id_numeric", "target_field": "opcua.node_id_numeric", "ignore_missing": true } },
{ "rename": { "field": "message2.attribute_id", "target_field": "opcua.attribute_id", "ignore_missing": true } },
{ "rename": { "field": "message2.attribute_id_str", "target_field": "opcua.attribute_id_string", "ignore_missing": true } },
{ "rename": { "field": "message2.data_encoding_name_idx", "target_field": "opcua.data_encoding_name_index", "ignore_missing": true } },
{ "rename": { "field": "message2.data_encoding_name", "target_field": "opcua.data_encoding_name", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}

17
salt/elasticsearch/files/ingest/zeek.opcua_binary_read_results Normal file
View File

@@ -0,0 +1,17 @@
{
"description" : "zeek.opcua_binary_read_results",
"processors" : [
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
{ "rename": { "field": "message2.results_link_id", "target_field": "opcua.results_link_id", "ignore_missing": true } },
{ "rename": { "field": "message2.level", "target_field": "opcua.level", "ignore_missing": true } },
{ "rename": { "field": "message2.data_value_encoding_mask", "target_field": "opcua.data_value_encoding_mask", "ignore_missing": true } },
{ "rename": { "field": "message2.data_variant_encoding_mask", "target_field": "opcua.data_variant_encoding_mask", "ignore_missing": true } },
{ "rename": { "field": "message2.data_variant_data_type", "target_field": "opcua.data_variant_data_type", "ignore_missing": true } },
{ "rename": { "field": "message2.data_variant_data_type_str", "target_field": "opcua.data_variant_data_type_string", "ignore_missing": true } },
{ "rename": { "field": "message2.built_in_data_type", "target_field": "opcua.built_in_data_type", "ignore_missing": true } },
{ "rename": { "field": "message2.built_in_data_type_str", "target_field": "opcua.built_in_data_type_string", "ignore_missing": true } },
{ "rename": { "field": "message2.read_results_variant_data_link_id", "target_field": "opcua.read_results_variant_data_link_id", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}

10
salt/elasticsearch/files/ingest/zeek.opcua_binary_read_results_link Normal file
View File

@@ -0,0 +1,10 @@
{
"description" : "zeek.opcua_binary_read_results_link",
"processors" : [
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
{ "rename": { "field": "message2.read_results_link_id", "target_field": "opcua.read_results_link_id", "ignore_missing": true } },
{ "rename": { "field": "message2.results_link_id", "target_field": "opcua.results_link_id", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}

10
salt/elasticsearch/files/ingest/zeek.opcua_binary_read_status_code Normal file
View File

@@ -0,0 +1,10 @@
{
"description" : "zeek.opcua_binary_read_status_code",
"processors" : [
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
{ "rename": { "field": "message2.read_status_code_link_id", "target_field": "opcua.read_status_code_link_id", "ignore_missing": true } },
{ "rename": { "field": "message2.status_code_link_id", "target_field": "opcua.status_code_link_id", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}

10
salt/elasticsearch/files/ingest/zeek.opcua_binary_read_variant_data Normal file
View File

@@ -0,0 +1,10 @@
{
"description" : "zeek.opcua_binary_read_variant_data",
"processors" : [
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
{ "rename": { "field": "message2.read_variant_data_link_id", "target_field": "opcua.read_variant_data_link_id", "ignore_missing": true } },
{ "rename": { "field": "message2.variant_data_value_signed_numeric", "target_field": "opcua.variant_data_value_signed_numeric", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}

10
salt/elasticsearch/files/ingest/zeek.opcua_binary_read_variant_data_link Normal file
View File

@@ -0,0 +1,10 @@
{
"description" : "zeek.opcua_binary_read_variant_data_link",
"processors" : [
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
{ "rename": { "field": "message2.read_results_variant_data_link_id", "target_field": "opcua.read_results_variant_data_link_id", "ignore_missing": true } },
{ "rename": { "field": "message2.read_variant_data_link_id", "target_field": "opcua.read_variant_data_link_id", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}

21
salt/elasticsearch/files/ingest/zeek.opcua_binary_status_code_detail Normal file
View File

@@ -0,0 +1,21 @@
{
"description" : "zeek.opcua_binary_status_code_detail",
"processors" : [
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
{ "rename": { "field": "message2.status_code", "target_field": "opcua.status_code", "ignore_missing": true } },
{ "rename": { "field": "message2.status_code_link_id", "target_field": "opcua.status_code_link_id", "ignore_missing": true } },
{ "rename": { "field": "message2.source", "target_field": "opcua.source", "ignore_missing": true } },
{ "rename": { "field": "message2.source_str", "target_field": "opcua.source_string", "ignore_missing": true } },
{ "rename": { "field": "message2.source_level", "target_field": "opcua.source_level", "ignore_missing": true } },
{ "rename": { "field": "message2.severity", "target_field": "opcua.severity", "ignore_missing": true } },
{ "rename": { "field": "message2.severity_str", "target_field": "opcua.severity_string", "ignore_missing": true } },
{ "rename": { "field": "message2.sub_code", "target_field": "opcua.sub_code", "ignore_missing": true } },
{ "rename": { "field": "message2.sub_code_str", "target_field": "opcua.sub_code_string", "ignore_missing": true } },
{ "rename": { "field": "message2.structure_changed", "target_field": "opcua.structure_changed", "ignore_missing": true } },
{ "rename": { "field": "message2.semantics_changed", "target_field": "opcua.semantics_changed", "ignore_missing": true } },
{ "rename": { "field": "message2.info_type", "target_field": "opcua.info_type", "ignore_missing": true } },
{ "rename": { "field": "message2.info_type_str", "target_field": "opcua.info_type_string", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}

13
salt/elasticsearch/files/ingest/zeek.profinet Normal file
View File

@@ -0,0 +1,13 @@
{
"description" : "zeek.profinet",
"processors" : [
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true} },
{ "rename": { "field": "message2.operation_type", "target_field": "profinet.operation_type", "ignore_missing": true } },
{ "rename": { "field": "message2.block_version", "target_field": "profinet.block_version", "ignore_missing": true } },
{ "rename": { "field": "message2.slot_number", "target_field": "profinet.slot_number", "ignore_missing": true } },
{ "rename": { "field": "message2.subslot_number", "target_field": "profinet.subslot_number", "ignore_missing": true } },
{ "rename": { "field": "message2.index", "target_field": "profinet.index", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}

15
salt/elasticsearch/files/ingest/zeek.profinet_dce_rpc Normal file
View File

@@ -0,0 +1,15 @@
{
"description" : "zeek.profinet_dce_rpc",
"processors" : [
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true} },
{ "rename": { "field": "message2.version", "target_field": "profinet.version", "ignore_missing": true } },
{ "rename": { "field": "message2.packet_type", "target_field": "profinet.packet_type", "ignore_missing": true } },
{ "rename": { "field": "message2.object_uuid", "target_field": "profinet.object_uuid", "ignore_missing": true } },
{ "rename": { "field": "message2.interface_uuid", "target_field": "profinet.interface_uuid", "ignore_missing": true } },
{ "rename": { "field": "message2.activity_uuid", "target_field": "profinet.activity_uuid", "ignore_missing": true } },
{ "rename": { "field": "message2.server_boot_time", "target_field": "profinet.server.boot_time", "ignore_missing": true } },
{ "rename": { "field": "message2.operation", "target_field": "profinet.operation", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}

15
salt/elasticsearch/files/ingest/zeek.s7comm Normal file
View File

@@ -0,0 +1,15 @@
{
"description" : "zeek.s7comm",
"processors" : [
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
{ "rename": { "field": "message2.rosctr_code", "target_field": "s7.ros.control.code", "ignore_missing": true } },
{ "rename": { "field": "message2.rosctr_name", "target_field": "s7.ros.control.name", "ignore_missing": true } },
{ "rename": { "field": "message2.pdu_reference", "target_field": "s7.pdu_reference", "ignore_missing": true } },
{ "rename": { "field": "message2.function_code", "target_field": "s7.function.code", "ignore_missing": true } },
{ "rename": { "field": "message2.function_name", "target_field": "s7.function.name", "ignore_missing": true } },
{ "rename": { "field": "message2.error_class", "target_field": "s7.error.class", "ignore_missing": true } },
{ "rename": { "field": "message2.error_code", "target_field": "s7.error.code", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}

11
salt/elasticsearch/files/ingest/zeek.s7comm_plus Normal file
View File

@@ -0,0 +1,11 @@
{
"description" : "zeek.s7comm_plus",
"processors" : [
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
{ "rename": { "field": "message2.version", "target_field": "s7.version", "ignore_missing": true } },
{ "rename": { "field": "message2.opcode", "target_field": "s7.opcode.value", "ignore_missing": true } },
{ "rename": { "field": "message2.opcode_name", "target_field": "s7.opcode.name", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}

15
salt/elasticsearch/files/ingest/zeek.s7comm_read_szl Normal file
View File

@@ -0,0 +1,15 @@
{
"description" : "zeek.s7comm_read_szl",
"processors" : [
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
{ "rename": { "field": "message2.pdu_reference", "target_field": "s7.pdu_reference", "ignore_missing": true } },
{ "rename": { "field": "message2.method", "target_field": "s7.method", "ignore_missing": true } },
{ "rename": { "field": "message2.szl_id", "target_field": "s7.szl_id", "ignore_missing": true } },
{ "rename": { "field": "message2.szl_id_name", "target_field": "s7.szl_id_name", "ignore_missing": true } },
{ "rename": { "field": "message2.szl_index", "target_field": "s7.szl_index", "ignore_missing": true } },
{ "rename": { "field": "message2.return_code", "target_field": "s7.return_code", "ignore_missing": true } },
{ "rename": { "field": "message2.return_code_name", "target_field": "s7.return_code_name", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}

18
salt/elasticsearch/files/ingest/zeek.s7comm_upload_download Normal file
View File

@@ -0,0 +1,18 @@
{
"description" : "zeek.s7comm_upload_download",
"processors" : [
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
{ "rename": { "field": "message2.rosctr", "target_field": "s7.ros.control.name", "ignore_missing": true } },
{ "rename": { "field": "message2.pdu_reference", "target_field": "s7.pdu_reference", "ignore_missing": true } },
{ "rename": { "field": "message2.function_code", "target_field": "s7.function_code", "ignore_missing": true } },
{ "rename": { "field": "message2.function_status", "target_field": "s7.function_status", "ignore_missing": true } },
{ "rename": { "field": "message2.session_id", "target_field": "s7.session_id", "ignore_missing": true } },
{ "rename": { "field": "message2.blocklength", "target_field": "s7.block.length", "ignore_missing": true } },
{ "rename": { "field": "message2.filename", "target_field": "s7.file.name", "ignore_missing": true } },
{ "rename": { "field": "message2.block_type", "target_field": "s7.block.type", "ignore_missing": true } },
{ "rename": { "field": "message2.block_number", "target_field": "s7.block.number", "ignore_missing": true } },
{ "rename": { "field": "message2.destination_filesystem", "target_field": "s7.destination.filesystem", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}

15
salt/elasticsearch/files/ingest/zeek.stun Normal file
View File

@@ -0,0 +1,15 @@
{
"description" : "zeek.stun",
"processors" : [
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true} },
{ "rename": { "field": "message2.proto", "target_field": "network.protocol", "ignore_missing": true } },
{ "rename": { "field": "message2.is_orig", "target_field": "stun.is_orig", "ignore_missing": true } },
{ "rename": { "field": "message2.trans_id", "target_field": "stun.id", "ignore_missing": true } },
{ "rename": { "field": "message2.method", "target_field": "stun.method", "ignore_missing": true } },
{ "rename": { "field": "message2.class", "target_field": "stun.class", "ignore_missing": true } },
{ "rename": { "field": "message2.attr_types", "target_field": "stun.attribute.types", "ignore_missing": true } },
{ "rename": { "field": "message2.attr_vals", "target_field": "stun.attribute.values", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}

13
salt/elasticsearch/files/ingest/zeek.stun_nat Normal file
View File

@@ -0,0 +1,13 @@
{
"description" : "zeek.stun_nat",
"processors" : [
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true} },
{ "rename": { "field": "message2.proto", "target_field": "network.protocol", "ignore_missing": true } },
{ "rename": { "field": "message2.is_orig", "target_field": "stun.is_orig", "ignore_missing": true } },
{ "rename": { "field": "message2.wan_addrs", "target_field": "stun.wan.addresses", "ignore_missing": true } },
{ "rename": { "field": "message2.wan_ports", "target_field": "stun.wan.ports", "ignore_missing": true } },
{ "rename": { "field": "message2.lan_addrs", "target_field": "stun.lan.addresses", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}

9
salt/elasticsearch/files/ingest/zeek.tds Normal file
View File

@@ -0,0 +1,9 @@
{
"description" : "zeek.tds",
"processors" : [
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
{ "rename": { "field": "message2.command", "target_field": "tds.command", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}

10
salt/elasticsearch/files/ingest/zeek.tds_rpc Normal file
View File

@@ -0,0 +1,10 @@
{
"description" : "zeek.tds_rpc",
"processors" : [
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
{ "rename": { "field": "message2.procedure_name", "target_field": "tds.procedure_name", "ignore_missing": true } },
{ "rename": { "field": "message2.parameters", "target_field": "tds.parameters", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}

10
salt/elasticsearch/files/ingest/zeek.tds_sql_batch Normal file
View File

@@ -0,0 +1,10 @@
{
"description" : "zeek.tds_sql_batch",
"processors" : [
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
{ "rename": { "field": "message2.header_type", "target_field": "tds.header_type", "ignore_missing": true } },
{ "rename": { "field": "message2.query", "target_field": "tds.query", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}

11
salt/elasticsearch/files/ingest/zeek.wireguard Normal file
View File

@@ -0,0 +1,11 @@
{
"description" : "zeek.wireguard",
"processors" : [
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
{ "rename": { "field": "message2.established", "target_field": "wireguard.established", "ignore_missing": true } },
{ "rename": { "field": "message2.initiations", "target_field": "wireguard.initiations", "ignore_missing": true } },
{ "rename": { "field": "message2.responses", "target_field": "wireguard.responses", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}

8
salt/filebeat/etc/filebeat.yml
View File

@@ -144,6 +144,10 @@ filebeat.inputs:
dataset: {{ LOGNAME }} dataset: {{ LOGNAME }}
category: network category: network
processors: processors:
{%- if LOGNAME is match('^bacnet*|^bsap*|^cip*|^cotp*|^dnp3*|^ecat*|^enip*|^modbus*|^opcua*|^profinet*|^s7comm*') %}
- add_tags:
tags: ["ics"]
{%- endif %}
- drop_fields: - drop_fields:
fields: ["source", "prospector", "input", "offset", "beat"] fields: ["source", "prospector", "input", "offset", "beat"]
@@ -161,6 +165,10 @@ filebeat.inputs:
category: network category: network
imported: true imported: true
processors: processors:
{%- if LOGNAME is match('^bacnet*|^bsap*|^cip*|^cotp*|^dnp3*|^ecat*|^enip*|^modbus*|^opcua*|^profinet*|^s7comm*') %}
- add_tags:
tags: ["ics"]
{%- endif %}
- add_tags: - add_tags:
tags: ["import"] tags: ["import"]
- dissect: - dissect:

28
salt/sensoroni/files/analyzers/README.md
View File

@@ -5,20 +5,19 @@ Security Onion provides a means for performing data analysis on varying inputs.
## Supported Observable Types ## Supported Observable Types
The built-in analyzers support the following observable types: The built-in analyzers support the following observable types:
| Name | Domain | Hash | IP | JA3 | Mail | Other | URI | URL | User Agent | | Name | Domain | Hash | IP | Mail | Other | URI | URL | User Agent |
| ------------------------|--------|-------|-------|-------|-------|-------|-------|-------|------------ | ------------------------|--------|-------|-------|-------|-------|-------|-------|-------|
| Alienvault OTX |&check; |&check;|&check;|&cross;|&cross;|&cross;|&cross;|&check;|&cross;| | Alienvault OTX |&check; |&check;|&check;|&cross;|&cross;|&cross;|&check;|&cross;|
| EmailRep |&cross; |&cross;|&cross;|&cross;|&check;|&cross;|&cross;|&cross;|&cross;| | EmailRep |&cross; |&cross;|&cross;|&check;|&cross;|&cross;|&cross;|&cross;|
| Greynoise |&cross; |&cross;|&check;|&cross;|&cross;|&cross;|&cross;|&cross;|&cross;| | Greynoise |&cross; |&cross;|&check;|&cross;|&cross;|&cross;|&cross;|&cross;|
| JA3er |&cross; |&cross;|&cross;|&check;|&cross;|&cross;|&cross;|&cross;|&cross;| | LocalFile |&check; |&check;|&check;|&cross;|&check;|&cross;|&check;|&cross;|
| LocalFile |&check; |&check;|&check;|&check;|&cross;|&check;|&cross;|&check;|&cross;| | Malware Hash Registry |&cross; |&check;|&cross;|&cross;|&cross;|&cross;|&check;|&cross;|
| Malware Hash Registry |&cross; |&check;|&cross;|&cross;|&cross;|&cross;|&cross;|&check;|&cross;| | Pulsedive |&check; |&check;|&check;|&cross;|&cross;|&check;|&check;|&check;|
| Pulsedive |&check; |&check;|&check;|&cross;|&cross;|&cross;|&check;|&check;|&check;| | Spamhaus |&cross; |&cross;|&check;|&cross;|&cross;|&cross;|&cross;|&cross;|
| Spamhaus |&cross; |&cross;|&check;|&cross;|&cross;|&cross;|&cross;|&cross;|&cross;| | Urlhaus |&cross; |&cross;|&cross;|&cross;|&cross;|&cross;|&check;|&cross;|
| Urlhaus |&cross; |&cross;|&cross;|&cross;|&cross;|&cross;|&cross;|&check;|&cross;| | Urlscan |&cross; |&cross;|&cross;|&cross;|&cross;|&cross;|&check;|&cross;|
| Urlscan |&cross; |&cross;|&cross;|&cross;|&cross;|&cross;|&cross;|&check;|&cross;| | Virustotal |&check; |&check;|&check;|&cross;|&cross;|&cross;|&check;|&cross;|
| Virustotal |&check; |&check;|&check;|&cross;|&cross;|&cross;|&cross;|&check;|&cross;| | WhoisLookup |&check; |&cross;|&cross;|&cross;|&cross;|&check;|&cross;|&cross;|
| WhoisLookup |&check; |&cross;|&cross;|&cross;|&cross;|&cross;|&check;|&cross;|&cross;|
## Authentication ## Authentication
Many analyzers require authentication, via an API key or similar. The table below illustrates which analyzers require authentication. Many analyzers require authentication, via an API key or similar. The table below illustrates which analyzers require authentication.
@@ -28,7 +27,6 @@ Many analyzers require authentication, via an API key or similar. The table belo
[AlienVault OTX](https://otx.alienvault.com/api) |&check;| [AlienVault OTX](https://otx.alienvault.com/api) |&check;|
[EmailRep](https://emailrep.io/key) |&check;| [EmailRep](https://emailrep.io/key) |&check;|
[GreyNoise](https://www.greynoise.io/plans/community) |&check;| [GreyNoise](https://www.greynoise.io/plans/community) |&check;|
[JA3er](https://ja3er.com/) |&cross;|
LocalFile |&cross;| LocalFile |&cross;|
[Malware Hash Registry](https://hash.cymru.com/docs_whois) |&cross;| [Malware Hash Registry](https://hash.cymru.com/docs_whois) |&cross;|
[Pulsedive](https://pulsedive.com/api/) |&check;| [Pulsedive](https://pulsedive.com/api/) |&check;|

2
salt/sensoroni/files/analyzers/emailrep/emailrep.py
View File

@@ -53,7 +53,7 @@ def analyze(conf, input):
def main(): def main():
dir = os.path.dirname(os.path.realpath(__file__)) dir = os.path.dirname(os.path.realpath(__file__))
parser = argparse.ArgumentParser(description='Search Greynoise for a given artifact') parser = argparse.ArgumentParser(description='Search EmailRep for a given artifact')
parser.add_argument('artifact', help='the artifact represented in JSON format') parser.add_argument('artifact', help='the artifact represented in JSON format')
parser.add_argument('-c', '--config', metavar="CONFIG_FILE", default=dir + "/emailrep.yaml", help='optional config file to use instead of the default config file') parser.add_argument('-c', '--config', metavar="CONFIG_FILE", default=dir + "/emailrep.yaml", help='optional config file to use instead of the default config file')

0
salt/sensoroni/files/analyzers/emailrep/source-packages/PyYAML-6.0-cp39-cp39-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_12_x86_64.manylinux2010_x86_64.whl → salt/sensoroni/files/analyzers/emailrep/source-packages/PyYAML-6.0-cp39-cp39-manylinux_2_5_x86_64.whl
View File

0
salt/sensoroni/files/analyzers/greynoise/source-packages/PyYAML-6.0-cp39-cp39-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_12_x86_64.manylinux2010_x86_64.whl → salt/sensoroni/files/analyzers/greynoise/source-packages/PyYAML-6.0-cp39-cp39-manylinux_2_5_x86_64.whl
View File

0
salt/sensoroni/files/analyzers/ja3er/__init__.py
View File

7
salt/sensoroni/files/analyzers/ja3er/ja3er.json
View File

@@ -1,7 +0,0 @@
{
"name": "JA3er Hash Search",
"version": "0.1",
"author": "Security Onion Solutions",
"description": "This analyzer queries JA3er user agents and sightings",
"supportedTypes" : ["ja3"]
}

53
salt/sensoroni/files/analyzers/ja3er/ja3er.py
View File

@@ -1,53 +0,0 @@
import json
import os
import requests
import helpers
import argparse
def sendReq(conf, meta, hash):
url = conf['base_url'] + hash
response = requests.request('GET', url)
return response.json()
def prepareResults(raw):
if "error" in raw:
if "Sorry" in raw["error"]:
status = "ok"
summary = "no_results"
elif "Invalid hash" in raw["error"]:
status = "caution"
summary = "invalid_input"
else:
status = "caution"
summary = "internal_failure"
else:
status = "info"
summary = "suspicious"
results = {'response': raw, 'summary': summary, 'status': status}
return results
def analyze(conf, input):
meta = helpers.loadMetadata(__file__)
data = helpers.parseArtifact(input)
helpers.checkSupportedType(meta, data["artifactType"])
response = sendReq(conf, meta, data["value"])
return prepareResults(response)
def main():
dir = os.path.dirname(os.path.realpath(__file__))
parser = argparse.ArgumentParser(description='Search JA3er for a given artifact')
parser.add_argument('artifact', help='the artifact represented in JSON format')
parser.add_argument('-c', '--config', metavar="CONFIG_FILE", default=dir + "/ja3er.yaml", help='optional config file to use instead of the default config file')
args = parser.parse_args()
if args.artifact:
results = analyze(helpers.loadConfig(args.config), args.artifact)
print(json.dumps(results))
if __name__ == "__main__":
main()

1
salt/sensoroni/files/analyzers/ja3er/ja3er.yaml
View File

@@ -1 +0,0 @@
base_url: https://ja3er.com/search/

72
salt/sensoroni/files/analyzers/ja3er/ja3er_test.py
View File

@@ -1,72 +0,0 @@
from io import StringIO
import sys
from unittest.mock import patch, MagicMock
from ja3er import ja3er
import unittest
class TestJa3erMethods(unittest.TestCase):
def test_main_missing_input(self):
with patch('sys.exit', new=MagicMock()) as sysmock:
with patch('sys.stderr', new=StringIO()) as mock_stderr:
sys.argv = ["cmd"]
ja3er.main()
self.assertEqual(mock_stderr.getvalue(), "usage: cmd [-h] [-c CONFIG_FILE] artifact\ncmd: error: the following arguments are required: artifact\n")
sysmock.assert_called_once_with(2)
def test_main_success(self):
output = {"foo": "bar"}
with patch('sys.stdout', new=StringIO()) as mock_stdout:
with patch('ja3er.ja3er.analyze', new=MagicMock(return_value=output)) as mock:
sys.argv = ["cmd", "input"]
ja3er.main()
expected = '{"foo": "bar"}\n'
self.assertEqual(mock_stdout.getvalue(), expected)
mock.assert_called_once()
def test_sendReq(self):
with patch('requests.request', new=MagicMock(return_value=MagicMock())) as mock:
meta = {}
conf = {"base_url": "myurl/"}
hash = "abcd1234"
response = ja3er.sendReq(conf=conf, meta=meta, hash=hash)
mock.assert_called_once_with("GET", "myurl/abcd1234")
self.assertIsNotNone(response)
def test_prepareResults_none(self):
raw = {"error": "Sorry no values found"}
results = ja3er.prepareResults(raw)
self.assertEqual(results["response"], raw)
self.assertEqual(results["summary"], "no_results")
self.assertEqual(results["status"], "ok")
def test_prepareResults_invalidHash(self):
raw = {"error": "Invalid hash"}
results = ja3er.prepareResults(raw)
self.assertEqual(results["response"], raw)
self.assertEqual(results["summary"], "invalid_input")
self.assertEqual(results["status"], "caution")
def test_prepareResults_internal_failure(self):
raw = {"error": "unknown"}
results = ja3er.prepareResults(raw)
self.assertEqual(results["response"], raw)
self.assertEqual(results["summary"], "internal_failure")
self.assertEqual(results["status"], "caution")
def test_prepareResults_info(self):
raw = [{"User-Agent": "Blah/5.0", "Count": 24874, "Last_seen": "2022-04-08 16:18:38"}, {"Comment": "Brave browser v1.36.122\n\n", "Reported": "2022-03-28 20:26:42"}]
results = ja3er.prepareResults(raw)
self.assertEqual(results["response"], raw)
self.assertEqual(results["summary"], "suspicious")
self.assertEqual(results["status"], "info")
def test_analyze(self):
output = {"info": "Results found."}
artifactInput = '{"value":"abcd1234","artifactType":"ja3"}'
conf = {"base_url": "myurl/"}
with patch('ja3er.ja3er.sendReq', new=MagicMock(return_value=output)) as mock:
results = ja3er.analyze(conf, artifactInput)
self.assertEqual(results["summary"], "suspicious")
mock.assert_called_once()

2
salt/sensoroni/files/analyzers/ja3er/requirements.txt
View File

@@ -1,2 +0,0 @@
requests>=2.27.1
pyyaml>=6.0

BIN
salt/sensoroni/files/analyzers/ja3er/source-packages/certifi-2021.10.8-py2.py3-none-any.whl
View File

Binary file not shown.

BIN
salt/sensoroni/files/analyzers/ja3er/source-packages/charset_normalizer-2.0.12-py3-none-any.whl
View File

Binary file not shown.

Some files were not shown because too many files have changed in this diff Show More