CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 17:22:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #707 from Security-Onion-Solutions/fix/dhcp_parsing

Browse Source 
Fix/dhcp parsing
This commit is contained in:
weslambert
2020-05-16 11:04:13 -04:00
committed by GitHub
parent 5619768212 4b91ade2e8
commit 95141574d4
3 changed files with 9 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
salt/elasticsearch/files/ingest/zeek.dhcp
View File

@@ -15,7 +15,7 @@
{ "rename": { "field": "message2.domain", "target_field": "host.domain", "ignore_missing": true } }, { "rename": { "field": "message2.domain", "target_field": "host.domain", "ignore_missing": true } },
{ "rename": { "field": "message2.host_name", "target_field": "host.hostname", "ignore_missing": true } }, { "rename": { "field": "message2.host_name", "target_field": "host.hostname", "ignore_missing": true } },
{ "rename": { "field": "message2.duration", "target_field": "event.duration", "ignore_missing": true } }, { "rename": { "field": "message2.duration", "target_field": "event.duration", "ignore_missing": true } },
{ "rename": { "field": "message2.msg_types", "target_field": "message_types", "ignore_missing": true } }, { "rename": { "field": "message2.msg_types", "target_field": "dhcp.message_types", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } } { "pipeline": { "name": "zeek.common" } }
] ]
} }

14
salt/elasticsearch/files/ingest/zeek.dns.tld
View File

@@ -1,13 +1,13 @@
{ {
"description" : "zeek.dns.tld", "description" : "zeek.dns.tld",
"processors" : [ "processors" : [
{ "script": { "lang": "painless", "source": "ctx.top_level_domain = ctx.dns.query.name.substring(ctx.dns.query.name.lastIndexOf('.') + 1)", "ignore_failure": true } }, { "script": { "lang": "painless", "source": "ctx.dns.top_level_domain = ctx.dns.query.name.substring(ctx.dns.query.name.lastIndexOf('.') + 1)", "ignore_failure": true } },
{ "script": { "lang": "painless", "source": "ctx.query_without_tld = ctx.dns.query.name.substring(0, (ctx.dns.query.name.lastIndexOf('.')))", "ignore_failure": true } }, { "script": { "lang": "painless", "source": "ctx.dns.query_without_tld = ctx.dns.query.name.substring(0, (ctx.dns.query.name.lastIndexOf('.')))", "ignore_failure": true } },
{ "script": { "lang": "painless", "source": "ctx.parent_domain = ctx.query_without_tld.substring(ctx.query_without_tld.lastIndexOf('.') + 1)", "ignore_failure": true } }, { "script": { "lang": "painless", "source": "ctx.dns.parent_domain = ctx.query_without_tld.substring(ctx.query_without_tld.lastIndexOf('.') + 1)", "ignore_failure": true } },
{ "script": { "lang": "painless", "source": "ctx.subdomain = ctx.query_without_tld.substring(0, (ctx.query_without_tld.lastIndexOf('.')))", "ignore_failure": true } }, { "script": { "lang": "painless", "source": "ctx.dns.subdomain = ctx.query_without_tld.substring(0, (ctx.query_without_tld.lastIndexOf('.')))", "ignore_failure": true } },
{ "script": { "lang": "painless", "source": "ctx.highest_registered_domain = ctx.parent_domain + '.' + ctx.top_level_domain", "ignore_failure": true } }, { "script": { "lang": "painless", "source": "ctx.dns.highest_registered_domain = ctx.parent_domain + '.' + ctx.top_level_domain", "ignore_failure": true } },
{ "script": { "lang": "painless", "source": "ctx.subdomain_length = ctx.subdomain.length()", "ignore_failure": true } }, { "script": { "lang": "painless", "source": "ctx.dns.subdomain_length = ctx.subdomain.length()", "ignore_failure": true } },
{ "script": { "lang": "painless", "source": "ctx.parent_domain_length = ctx.parent_domain.length()", "ignore_failure": true } }, { "script": { "lang": "painless", "source": "ctx.dns.parent_domain_length = ctx.parent_domain.length()", "ignore_failure": true } },
{ "remove": { "field": "query_without_tld", "ignore_failure": true } } { "remove": { "field": "query_without_tld", "ignore_failure": true } }
] ]
} }

2
salt/logstash/pipelines/config/so/0010_input_hhbeats.conf
View File

@@ -5,7 +5,7 @@ input {
ssl_certificate_authorities => ["/usr/share/filebeat/ca.crt"] ssl_certificate_authorities => ["/usr/share/filebeat/ca.crt"]
ssl_certificate => "/usr/share/logstash/filebeat.crt" ssl_certificate => "/usr/share/logstash/filebeat.crt"
ssl_key => "/usr/share/logstash/filebeat.key" ssl_key => "/usr/share/logstash/filebeat.key"
tags => [ "beat" ] #tags => [ "beat" ]
} }
} }
filter { filter {