From 66c89abbc6a0d96662123212e8f27a4f0dbcbfff Mon Sep 17 00:00:00 2001 From: Wes Lambert Date: Sat, 16 May 2020 14:58:06 +0000 Subject: [PATCH 1/5] Fix DHCP message types --- salt/elasticsearch/files/ingest/zeek.dhcp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/salt/elasticsearch/files/ingest/zeek.dhcp b/salt/elasticsearch/files/ingest/zeek.dhcp index 3005016ef..7bdc90f20 100644 --- a/salt/elasticsearch/files/ingest/zeek.dhcp +++ b/salt/elasticsearch/files/ingest/zeek.dhcp @@ -15,7 +15,7 @@ { "rename": { "field": "message2.domain", "target_field": "host.domain", "ignore_missing": true } }, { "rename": { "field": "message2.host_name", "target_field": "host.hostname", "ignore_missing": true } }, { "rename": { "field": "message2.duration", "target_field": "event.duration", "ignore_missing": true } }, - { "rename": { "field": "message2.msg_types", "target_field": "message_types", "ignore_missing": true } }, + { "rename": { "field": "message2.msg_types", "target_field": "dchp_message_types", "ignore_missing": true } }, { "pipeline": { "name": "zeek.common" } } ] } From 6a2ddd4ef6a78acf8a6f1cde0dcdccbfea08ae44 Mon Sep 17 00:00:00 2001 From: Wes Lambert Date: Sat, 16 May 2020 14:58:51 +0000 Subject: [PATCH 2/5] move to DNS --- salt/elasticsearch/files/ingest/zeek.dns.tld | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/salt/elasticsearch/files/ingest/zeek.dns.tld b/salt/elasticsearch/files/ingest/zeek.dns.tld index f82cc628a..80fb0f609 100644 --- a/salt/elasticsearch/files/ingest/zeek.dns.tld +++ b/salt/elasticsearch/files/ingest/zeek.dns.tld @@ -1,13 +1,13 @@ { "description" : "zeek.dns.tld", "processors" : [ - { "script": { "lang": "painless", "source": "ctx.top_level_domain = ctx.dns.query.name.substring(ctx.dns.query.name.lastIndexOf('.') + 1)", "ignore_failure": true } }, - { "script": { "lang": "painless", "source": "ctx.query_without_tld = ctx.dns.query.name.substring(0, (ctx.dns.query.name.lastIndexOf('.')))", "ignore_failure": true } }, - { "script": { "lang": "painless", "source": "ctx.parent_domain = ctx.query_without_tld.substring(ctx.query_without_tld.lastIndexOf('.') + 1)", "ignore_failure": true } }, - { "script": { "lang": "painless", "source": "ctx.subdomain = ctx.query_without_tld.substring(0, (ctx.query_without_tld.lastIndexOf('.')))", "ignore_failure": true } }, - { "script": { "lang": "painless", "source": "ctx.highest_registered_domain = ctx.parent_domain + '.' + ctx.top_level_domain", "ignore_failure": true } }, - { "script": { "lang": "painless", "source": "ctx.subdomain_length = ctx.subdomain.length()", "ignore_failure": true } }, - { "script": { "lang": "painless", "source": "ctx.parent_domain_length = ctx.parent_domain.length()", "ignore_failure": true } }, + { "script": { "lang": "painless", "source": "ctx.dns.top_level_domain = ctx.dns.query.name.substring(ctx.dns.query.name.lastIndexOf('.') + 1)", "ignore_failure": true } }, + { "script": { "lang": "painless", "source": "ctx.dns.query_without_tld = ctx.dns.query.name.substring(0, (ctx.dns.query.name.lastIndexOf('.')))", "ignore_failure": true } }, + { "script": { "lang": "painless", "source": "ctx.dns.parent_domain = ctx.query_without_tld.substring(ctx.query_without_tld.lastIndexOf('.') + 1)", "ignore_failure": true } }, + { "script": { "lang": "painless", "source": "ctx.dns.subdomain = ctx.query_without_tld.substring(0, (ctx.query_without_tld.lastIndexOf('.')))", "ignore_failure": true } }, + { "script": { "lang": "painless", "source": "ctx.dns.highest_registered_domain = ctx.parent_domain + '.' + ctx.top_level_domain", "ignore_failure": true } }, + { "script": { "lang": "painless", "source": "ctx.dns.subdomain_length = ctx.subdomain.length()", "ignore_failure": true } }, + { "script": { "lang": "painless", "source": "ctx.dns.parent_domain_length = ctx.parent_domain.length()", "ignore_failure": true } }, { "remove": { "field": "query_without_tld", "ignore_failure": true } } ] } From f0662eed4841261d275574f7c7a8798fef2edbd3 Mon Sep 17 00:00:00 2001 From: Wes Lambert Date: Sat, 16 May 2020 14:59:41 +0000 Subject: [PATCH 3/5] remark Beat tag for now --- salt/logstash/pipelines/config/so/0010_input_hhbeats.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/salt/logstash/pipelines/config/so/0010_input_hhbeats.conf b/salt/logstash/pipelines/config/so/0010_input_hhbeats.conf index 6b7667f5c..050d01d73 100644 --- a/salt/logstash/pipelines/config/so/0010_input_hhbeats.conf +++ b/salt/logstash/pipelines/config/so/0010_input_hhbeats.conf @@ -5,7 +5,7 @@ input { ssl_certificate_authorities => ["/usr/share/filebeat/ca.crt"] ssl_certificate => "/usr/share/logstash/filebeat.crt" ssl_key => "/usr/share/logstash/filebeat.key" - tags => [ "beat" ] + #tags => [ "beat" ] } } filter { From 9845ee189c5afd73edc63f035d7f70fce9ce8114 Mon Sep 17 00:00:00 2001 From: Wes Lambert Date: Sat, 16 May 2020 15:02:41 +0000 Subject: [PATCH 4/5] fix message_types for real --- salt/elasticsearch/files/ingest/zeek.dhcp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/salt/elasticsearch/files/ingest/zeek.dhcp b/salt/elasticsearch/files/ingest/zeek.dhcp index 7bdc90f20..aafe4d73f 100644 --- a/salt/elasticsearch/files/ingest/zeek.dhcp +++ b/salt/elasticsearch/files/ingest/zeek.dhcp @@ -15,7 +15,7 @@ { "rename": { "field": "message2.domain", "target_field": "host.domain", "ignore_missing": true } }, { "rename": { "field": "message2.host_name", "target_field": "host.hostname", "ignore_missing": true } }, { "rename": { "field": "message2.duration", "target_field": "event.duration", "ignore_missing": true } }, - { "rename": { "field": "message2.msg_types", "target_field": "dchp_message_types", "ignore_missing": true } }, + { "rename": { "field": "message2.msg_types", "target_field": "dchp.message_types", "ignore_missing": true } }, { "pipeline": { "name": "zeek.common" } } ] } From 4b91ade2e8b2863f7000e39d2d9eb7c7d8249f25 Mon Sep 17 00:00:00 2001 From: Wes Lambert Date: Sat, 16 May 2020 15:03:27 +0000 Subject: [PATCH 5/5] fix message_types one more time :) --- salt/elasticsearch/files/ingest/zeek.dhcp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/salt/elasticsearch/files/ingest/zeek.dhcp b/salt/elasticsearch/files/ingest/zeek.dhcp index aafe4d73f..f3a551edd 100644 --- a/salt/elasticsearch/files/ingest/zeek.dhcp +++ b/salt/elasticsearch/files/ingest/zeek.dhcp @@ -15,7 +15,7 @@ { "rename": { "field": "message2.domain", "target_field": "host.domain", "ignore_missing": true } }, { "rename": { "field": "message2.host_name", "target_field": "host.hostname", "ignore_missing": true } }, { "rename": { "field": "message2.duration", "target_field": "event.duration", "ignore_missing": true } }, - { "rename": { "field": "message2.msg_types", "target_field": "dchp.message_types", "ignore_missing": true } }, + { "rename": { "field": "message2.msg_types", "target_field": "dhcp.message_types", "ignore_missing": true } }, { "pipeline": { "name": "zeek.common" } } ] }