From 6cb4c02200d49b0150f977f6c01b00b85d4dca88 Mon Sep 17 00:00:00 2001 From: Wes Date: Wed, 30 Nov 2022 15:22:02 +0000 Subject: [PATCH 1/2] More field updates --- salt/elasticsearch/files/ingest/zeek.bsap_serial_rdb_ext | 4 ++-- salt/elasticsearch/files/ingest/zeek.ecat_foe_info | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/salt/elasticsearch/files/ingest/zeek.bsap_serial_rdb_ext b/salt/elasticsearch/files/ingest/zeek.bsap_serial_rdb_ext index c23509b80..ebe7e3300 100644 --- a/salt/elasticsearch/files/ingest/zeek.bsap_serial_rdb_ext +++ b/salt/elasticsearch/files/ingest/zeek.bsap_serial_rdb_ext @@ -4,8 +4,8 @@ { "remove": { "field": ["host"], "ignore_failure": true } }, { "json": { "field": "message", "target_field": "message2", "ignore_failure": true } }, { "rename": { "field": "message2.dfun", "target_field": "bsap.destination.function", "ignore_missing": true } }, - { "rename": { "field": "message2.seq", "target_field": "bsap.message.sequence", "ignore_missing": true } }, - { "rename": { "field": "message2.nsb", "target_field": "bsap.node.status.byte", "ignore_missing": true } }, + { "rename": { "field": "message2.seq", "target_field": "bsap.message_sequence", "ignore_missing": true } }, + { "rename": { "field": "message2.nsb", "target_field": "bsap.node.status_byte", "ignore_missing": true } }, { "rename": { "field": "message2.extfun", "target_field": "bsap.extension.function", "ignore_missing": true } }, { "rename": { "field": "message2.data", "target_field": "bsap.extension.function_data", "ignore_missing": true } }, { "pipeline": { "name": "zeek.common" } } diff --git a/salt/elasticsearch/files/ingest/zeek.ecat_foe_info b/salt/elasticsearch/files/ingest/zeek.ecat_foe_info index 75285ea18..6655f2cb7 100644 --- a/salt/elasticsearch/files/ingest/zeek.ecat_foe_info +++ b/salt/elasticsearch/files/ingest/zeek.ecat_foe_info @@ -5,7 +5,7 @@ { "json": { "field": "message", "target_field": "message2", "ignore_failure": true } }, { "rename": { "field": "message2.opcode", "target_field": "ecat.operation.code", "ignore_missing": true } }, { "rename": { "field": "message2.reserved", "target_field": "ecat.reserved", "ignore_missing": true } }, - { "rename": { "field": "message2.packet_num", "target_field": "ecat.packet.number", "ignore_missing": true } }, + { "rename": { "field": "message2.packet_num", "target_field": "ecat.packet_number", "ignore_missing": true } }, { "rename": { "field": "message2.error_code", "target_field": "ecat.error_code", "ignore_missing": true } }, { "rename": { "field": "message2.filename", "target_field": "ecat.filename", "ignore_missing": true } }, { "rename": { "field": "message2.data", "target_field": "ecat.data", "ignore_missing": true } }, From 8f0547bedafeb45bfc6f2f2ea8f818b6e4cad7d6 Mon Sep 17 00:00:00 2001 From: Wes Date: Wed, 30 Nov 2022 15:24:53 +0000 Subject: [PATCH 2/2] Change 'bsap.node.status_byte' to 'bsap.node_status_byte'. --- salt/elasticsearch/files/ingest/zeek.bsap_serial_rdb_ext | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/salt/elasticsearch/files/ingest/zeek.bsap_serial_rdb_ext b/salt/elasticsearch/files/ingest/zeek.bsap_serial_rdb_ext index ebe7e3300..2ca85ad78 100644 --- a/salt/elasticsearch/files/ingest/zeek.bsap_serial_rdb_ext +++ b/salt/elasticsearch/files/ingest/zeek.bsap_serial_rdb_ext @@ -5,7 +5,7 @@ { "json": { "field": "message", "target_field": "message2", "ignore_failure": true } }, { "rename": { "field": "message2.dfun", "target_field": "bsap.destination.function", "ignore_missing": true } }, { "rename": { "field": "message2.seq", "target_field": "bsap.message_sequence", "ignore_missing": true } }, - { "rename": { "field": "message2.nsb", "target_field": "bsap.node.status_byte", "ignore_missing": true } }, + { "rename": { "field": "message2.nsb", "target_field": "bsap.node_status_byte", "ignore_missing": true } }, { "rename": { "field": "message2.extfun", "target_field": "bsap.extension.function", "ignore_missing": true } }, { "rename": { "field": "message2.data", "target_field": "bsap.extension.function_data", "ignore_missing": true } }, { "pipeline": { "name": "zeek.common" } }