From 9994d47a434aa2351d3a4ec7834f4983051ecce9 Mon Sep 17 00:00:00 2001
From: weslambert <wlambertts@gmail.com>
Date: Mon, 21 Nov 2022 16:46:47 -0500
Subject: [PATCH] Add 'ics' tag to events generated from ICS protocol logs

---
 salt/filebeat/etc/filebeat.yml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/salt/filebeat/etc/filebeat.yml b/salt/filebeat/etc/filebeat.yml
index f38ffd0d7..00146d5d1 100644
--- a/salt/filebeat/etc/filebeat.yml
+++ b/salt/filebeat/etc/filebeat.yml
@@ -145,6 +145,10 @@ filebeat.inputs:
       dataset: {{ LOGNAME }}
       category: network
   processors:
+    {%- if LOGNAME is match('^bacnet*|^cip*|^cotp*|^dnp3*|^ecat*|^enip*|^modbus*|^opcua*'|^profinet*'|^s7comm*') %}
+  - add_tags:
+    tags: ["ics"]
+    {%- endif %}
   - drop_fields:
       fields: ["source", "prospector", "input", "offset", "beat"]
  
@@ -162,6 +166,10 @@ filebeat.inputs:
       category: network
       imported: true
   processors:
+    {%- if LOGNAME is match('^bacnet*|^cip*|^cotp*|^dnp3*|^ecat*|^enip*|^modbus*|^opcua*'|^profinet*'|^s7comm*') %}
+  - add_tags:
+    tags: ["ics"]
+    {%- endif %}
   - add_tags:
       tags: ["import"]
   - dissect: