mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2025-12-06 17:22:49 +01:00
upadte ingest config
This commit is contained in:
Wes Lambert
@@ -44,8 +44,8 @@
|
||||
},
|
||||
{
|
||||
"remove": {
|
||||
"field": "index_name_prefix",
|
||||
"ignore_failure": true
|
||||
"field": [ "index_name_prefix"],
|
||||
"ignore_failure": false
|
||||
}
|
||||
}
|
||||
]
|
||||
|
||||
@@ -6,48 +6,47 @@
|
||||
{ "rename": { "field": "message2.data", "target_field": "data", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.decoder", "target_field": "decoder", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.full_log", "target_field": "full_log", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id", "target_field": "id", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.id", "target_field": "log.id.id", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.location", "target_field": "location", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.manager", "target_field": "manager", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.predecoder", "target_field": "predecoder", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.timestamp", "target_field": "timestamp", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.rule", "target_field": "wazuh-rule", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.rule", "target_field": "rule", "ignore_missing": true } },
|
||||
{ "rename": { "field": "data.command", "target_field": "command", "ignore_missing": true } },
|
||||
{ "rename": { "field": "data.dstip", "target_field": "destination_ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "data.dstport", "target_field": "destination_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "data.dstuser", "target_field": "escalated_user", "ignore_missing": true } },
|
||||
{ "rename": { "field": "data.srcip", "target_field": "source_ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "data.srcuser", "target_field": "username", "ignore_missing": true } },
|
||||
{ "rename": { "field": "data.win.eventdata.destinationHostname", "target_field": "destination_hostname", "ignore_missing": true } },
|
||||
{ "rename": { "field": "data.win.eventdata.destinationIp", "target_field": "destination_ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "data.win.eventdata.destinationPort", "target_field": "destination_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "data.dstip", "target_field": "destination.ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "data.dstport", "target_field": "destination.port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "data.dstuser", "target_field": "user.escalated", "ignore_missing": true } },
|
||||
{ "rename": { "field": "data.srcip", "target_field": "source.ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "data.srcuser", "target_field": "source.user", "ignore_missing": true } },
|
||||
{ "rename": { "field": "data.win.eventdata.destinationHostname", "target_field": "destination.hostname", "ignore_missing": true } },
|
||||
{ "rename": { "field": "data.win.eventdata.destinationIp", "target_field": "destination.ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "data.win.eventdata.destinationPort", "target_field": "destination.port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "data.win.eventdata.image", "target_field": "image_path", "ignore_missing": true } },
|
||||
{ "rename": { "field": "data.win.eventdata.parentImage", "target_field": "parent_image_path", "ignore_missing": true } },
|
||||
{ "rename": { "field": "data.win.eventdata.sourceHostname", "target_field": "source_hostname", "ignore_missing": true } },
|
||||
{ "rename": { "field": "data.win.eventdata.sourceHostname", "target_field": "source.hostname", "ignore_missing": true } },
|
||||
{ "rename": { "field": "data.win.eventdata.sourceIp", "target_field": "source_ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "data.win.eventdata.sourcePort", "target_field": "source_port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "data.win.eventdata.targetFilename", "target_field": "target_filename", "ignore_missing": true } },
|
||||
{ "rename": { "field": "data.win.eventdata.user", "target_field": "username", "ignore_missing": true } },
|
||||
{ "rename": { "field": "data.win.system.eventID", "target_field": "event_id", "ignore_missing": true } },
|
||||
{ "rename": { "field": "predecoder.program_name", "target_field": "process", "ignore_missing": true } },
|
||||
{ "rename": { "field": "wazuh-rule.level", "target_field": "alert_level", "ignore_missing": true } },
|
||||
{ "rename": { "field": "wazuh-rule.description", "target_field": "description", "ignore_missing": true } },
|
||||
{ "set": { "if": "ctx.alert_level == 1", "field": "classification", "value": "None" } },
|
||||
{ "set": { "if": "ctx.alert_level == 2", "field": "classification", "value": "System low priority notification" } },
|
||||
{ "set": { "if": "ctx.alert_level == 3", "field": "classification", "value": "Successful/authorized event" } },
|
||||
{ "set": { "if": "ctx.alert_level == 4", "field": "classification", "value": "System low priority error" } },
|
||||
{ "set": { "if": "ctx.alert_level == 5", "field": "classification", "value": "User generated error" } },
|
||||
{ "set": { "if": "ctx.alert_level == 6", "field": "classification", "value": "Low relevance attack" } },
|
||||
{ "set": { "if": "ctx.alert_level == 7", "field": "classification", "value": "\"Bad word\" matching" } },
|
||||
{ "set": { "if": "ctx.alert_level == 8", "field": "classification", "value": "First time seen" } },
|
||||
{ "set": { "if": "ctx.alert_level == 9", "field": "classification", "value": "Error from invalid source" } },
|
||||
{ "set": { "if": "ctx.alert_level == 10", "field": "classification", "value": "Multiple user generated errors" } },
|
||||
{ "set": { "if": "ctx.alert_level == 11", "field": "classification", "value": "Integrity checking warning" } },
|
||||
{ "set": { "if": "ctx.alert_level == 12", "field": "classification", "value": "High importance event" } },
|
||||
{ "set": { "if": "ctx.alert_level == 13", "field": "classification", "value": "Unusal error (high importance)" } },
|
||||
{ "set": { "if": "ctx.alert_level == 14", "field": "classification", "value": "High importance security event" } },
|
||||
{ "set": { "if": "ctx.alert_level == 15", "field": "classification", "value": "Severe attack" } },
|
||||
{ "append": { "if": "ctx.alert_level != null", "field": "tags", "value": ["alert"] } },
|
||||
{ "rename": { "field": "data.win.eventdata.sourcePort", "target_field": "source.port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "data.win.eventdata.targetFilename", "target_field": "file.target", "ignore_missing": true } },
|
||||
{ "rename": { "field": "data.win.eventdata.user", "target_field": "user.name", "ignore_missing": true } },
|
||||
{ "rename": { "field": "data.win.system.eventID", "target_field": "event.code", "ignore_missing": true } },
|
||||
{ "rename": { "field": "predecoder.program_name", "target_field": "process.name", "ignore_missing": true } },
|
||||
{ "set": { "if": "ctx.rule.level == 1", "field": "category", "value": "None" } },
|
||||
{ "set": { "if": "ctx.rule.level == 2", "field": "category", "value": "System low priority notification" } },
|
||||
{ "set": { "if": "ctx.rule.level == 3", "field": "category", "value": "Successful/authorized event" } },
|
||||
{ "set": { "if": "ctx.rule.level == 4", "field": "rule.category", "value": "System low priority error" } },
|
||||
{ "set": { "if": "ctx.rule.level == 5", "field": "rule.category", "value": "User generated error" } },
|
||||
{ "set": { "if": "ctx.rule.level == 6", "field": "rule.category", "value": "Low relevance attack" } },
|
||||
{ "set": { "if": "ctx.rule.level == 7", "field": "rule.category", "value": "\"Bad word\" matching" } },
|
||||
{ "set": { "if": "ctx.rule.level == 8", "field": "rule.category", "value": "First time seen" } },
|
||||
{ "set": { "if": "ctx.rule.level == 9", "field": "rule.category", "value": "Error from invalid source" } },
|
||||
{ "set": { "if": "ctx.rule.level == 10", "field": "rule.category", "value": "Multiple user generated errors" } },
|
||||
{ "set": { "if": "ctx.rule.level == 11", "field": "rule.category", "value": "Integrity checking warning" } },
|
||||
{ "set": { "if": "ctx.rule.level == 12", "field": "rule.category", "value": "High importance event" } },
|
||||
{ "set": { "if": "ctx.rule.level == 13", "field": "rule.category", "value": "Unusal error (high importance)" } },
|
||||
{ "set": { "if": "ctx.rule.level == 14", "field": "rule.category", "value": "High importance security event" } },
|
||||
{ "set": { "if": "ctx.rule.level == 15", "field": "rule.category", "value": "Severe attack" } },
|
||||
{ "append": { "if": "ctx.rule.level != null", "field": "tags", "value": ["alert"] } },
|
||||
{ "remove": { "field": [ "host", "predecoder", "decoder" ], "ignore_missing": true, "ignore_failure": false } },
|
||||
{ "pipeline": { "name": "common" } }
|
||||
]
|
||||
}
|
||||
|
||||
24
salt/elasticsearch/files/ingest/zeek.common
Normal file
24
salt/elasticsearch/files/ingest/zeek.common
Normal file
@@ -0,0 +1,24 @@
|
||||
{
|
||||
"description" : "zeek.common",
|
||||
"processors" : [
|
||||
{ "rename": { "field": "@timestamp", "target_field": "es.timestamp", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.uid", "target_field": "log.id.uid", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_h", "target_field": "source.ip", "ignore_missing": true } },
|
||||
{ "set": { "field": "client.ip", "value": "{{source.ip}}" } },
|
||||
{ "dot_expander": { "field": "id.orig_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_p", "target_field": "source.port", "ignore_missing": true } },
|
||||
{ "set": { "field": "client.port", "value": "{{source.port}}" } },
|
||||
{ "dot_expander": { "field": "id.resp_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_h", "target_field": "destination.ip", "ignore_missing": true } },
|
||||
{ "set": { "field": "server.ip", "value": "{{destination.ip}}" } },
|
||||
{ "dot_expander": { "field": "id.resp_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination.port", "ignore_missing": true } },
|
||||
{ "set": { "field": "server.port", "value": "{{destination.port}}" } },
|
||||
{ "set": { "field": "event.module", "value": "zeek" } },
|
||||
{ "grok": { "field": "event_type", "patterns": ["zeek.%{WORD:event.dataset}"] } },
|
||||
{ "date": { "field": "message2.ts", "target_field": "@timestamp", "formats": ["ISO8601", "UNIX"], "ignore_failure": true } },
|
||||
{ "remove": { "field": ["message2.ts", "path"], "ignore_failure": true } },
|
||||
{ "pipeline": { "name": "common" } }
|
||||
]
|
||||
}
|
||||
58
salt/elasticsearch/files/ingest/zeek.common_ssl
Normal file
58
salt/elasticsearch/files/ingest/zeek.common_ssl
Normal file
@@ -0,0 +1,58 @@
|
||||
{
|
||||
"description" : "zeek.common_ssl",
|
||||
"processors" : [
|
||||
{
|
||||
"kv": {
|
||||
"field": "certificate_issuer",
|
||||
"field_split": ",",
|
||||
"value_split": "=",
|
||||
"ignore_missing": true,
|
||||
"ignore_failure": true,
|
||||
"include_keys": [ "CN", "C", "O", "OU", "ST", "SN", "L", "DC", "GN", "pseudonym", "serialNumber", "title", "initials" ]
|
||||
}
|
||||
},
|
||||
{ "rename":{ "field": "CN", "target_field": "issuer_common_name", "ignore_failure": true } },
|
||||
{ "rename":{ "field": "C", "target_field": "issuer_country_code", "ignore_failure": true } },
|
||||
{ "rename":{ "field": "O", "target_field": "issuer_organization", "ignore_failure": true } },
|
||||
{ "rename":{ "field": "OU", "target_field": "issuer_organization_unit", "ignore_failure": true } },
|
||||
{ "rename":{ "field": "ST", "target_field": "issuer_state", "ignore_failure": true } },
|
||||
{ "rename":{ "field": "SN", "target_field": "issuer_surname", "ignore_failure": true } },
|
||||
{ "rename":{ "field": "L", "target_field": "issuer_locality", "ignore_failure": true } },
|
||||
{ "rename":{ "field": "DC", "target_field": "issuer_distinguised_name", "ignore_failure": true } },
|
||||
{ "rename":{ "field": "GN", "target_field": "issuer_given_name", "ignore_failure": true } },
|
||||
{ "rename":{ "field": "pseudonym", "target_field": "issuer_pseudonym", "ignore_failure": true } },
|
||||
{ "rename":{ "field": "serialNumber", "target_field": "issuer_serial_number", "ignore_failure": true } },
|
||||
{ "rename":{ "field": "title", "target_field": "issuer_title", "ignore_failure": true } },
|
||||
{ "rename":{ "field": "initials", "target_field": "issuer_initials", "ignore_failure": true } },
|
||||
{
|
||||
"kv": {
|
||||
"field": "certificate_subject",
|
||||
"field_split": ",",
|
||||
"value_split": "=",
|
||||
"ignore_missing": true,
|
||||
"ignore_failure": true,
|
||||
"include_keys": [ "CN", "C", "O", "OU", "ST", "SN", "L", "GN", "pseudonym", "serialNumber", "title", "initials" ]
|
||||
}
|
||||
},
|
||||
{ "rename":{ "field": "CN", "target_field": "certificate_common_name", "ignore_failure": true } },
|
||||
{ "rename":{ "field": "C", "target_field": "certificate_country_code", "ignore_failure": true } },
|
||||
{ "rename":{ "field": "O", "target_field": "certificate_organization", "ignore_failure": true } },
|
||||
{ "rename":{ "field": "OU", "target_field": "certificate_organization_unit","ignore_failure": true } },
|
||||
{ "rename":{ "field": "ST", "target_field": "certificate_state", "ignore_failure": true } },
|
||||
{ "rename":{ "field": "SN", "target_field": "certificate_surname", "ignore_failure": true } },
|
||||
{ "rename":{ "field": "L", "target_field": "certificate_locality", "ignore_failure": true } },
|
||||
{ "rename":{ "field": "GN", "target_field": "certificate_given_name", "ignore_failure": true } },
|
||||
{ "rename":{ "field": "pseudonym", "target_field": "certificate_pseudonym", "ignore_failure": true } },
|
||||
{ "rename":{ "field": "serialNumber", "target_field": "certificate_serial_number", "ignore_failure": true } },
|
||||
{ "rename":{ "field": "title", "target_field": "certificate_title", "ignore_failure": true } },
|
||||
{ "rename":{ "field": "initials", "target_field": "certificate_initials", "ignore_failure": true } },
|
||||
{ "script":{ "lang": "painless", "source": "ctx.certificate_common_name_length = ctx.certificate_common_name.length()", "ignore_failure": true } },
|
||||
{ "script":{ "lang": "painless", "source": "ctx.issuer_common_name_length = ctx.issuer_common_name.length()", "ignore_failure": true } },
|
||||
{ "script":{ "lang": "painless", "source": "ctx.server_name_length = ctx.server_name.length()", "ignore_failure": true } },
|
||||
{
|
||||
"pipeline": {
|
||||
"name": "zeek.common"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
40
salt/elasticsearch/files/ingest/zeek.conn
Normal file
40
salt/elasticsearch/files/ingest/zeek.conn
Normal file
@@ -0,0 +1,40 @@
|
||||
{
|
||||
"description" : "zeek.conn",
|
||||
"processors" : [
|
||||
{ "remove": { "field": ["host"], "ignore_failure": false } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.proto", "target_field": "network.transport", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.service", "target_field": "network.protocol", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.duration", "target_field": "event.duration", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.orig_bytes", "target_field": "client.bytes", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.resp_bytes", "target_field": "server.bytes", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.conn_state", "target_field": "connection.state", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.local_orig", "target_field": "connection.local.originator", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.local_resp", "target_field": "connection.local.responder", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.missed_bytes", "target_field": "connection.bytes.missed", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.history", "target_field": "connection.history", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.orig_pkts", "target_field": "client.packets", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.orig_ip_bytes", "target_field": "client.ip_bytes", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.resp_pkts", "target_field": "server.packets", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.resp_ip_bytes", "target_field": "server.ip_bytes", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.tunnel_parents", "target_field": "connection.tunnel_parents", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.orig_cc", "target_field": "client.country_code","ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.resp_cc", "target_field": "server.country_code", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.sensorname", "target_field": "observer.name", "ignore_missing": true } },
|
||||
{ "script": { "lang": "painless", "source": "ctx.connection.bytes.total = (ctx.client.bytes + ctx.server.bytes)", "ignore_failure": true } },
|
||||
{ "set": { "if": "ctx.connection.state == 'S0'", "field": "connection.state_description", "value": "Connection attempt seen, no reply" } },
|
||||
{ "set": { "if": "ctx.connection.state == 'S1'", "field": "connection.state_description", "value": "Connection established, not terminated" } },
|
||||
{ "set": { "if": "ctx.connection.state == 'S2'", "field": "connection.state_description", "value": "Connection established and close attempt by originator seen (but no reply from responder)" } },
|
||||
{ "set": { "if": "ctx.connection.state == 'S3'", "field": "connection.state_description", "value": "Connection established and close attempt by responder seen (but no reply from originator)" } },
|
||||
{ "set": { "if": "ctx.connection.state == 'SF'", "field": "connection.state_description", "value": "Normal SYN/FIN completion" } },
|
||||
{ "set": { "if": "ctx.connection.state == 'REJ'", "field": "connection.state_description", "value": "Connection attempt rejected" } },
|
||||
{ "set": { "if": "ctx.connection.state == 'RSTO'", "field": "connection.state_description", "value": "Connection established, originator aborted (sent a RST)" } },
|
||||
{ "set": { "if": "ctx.connection.state == 'RSTR'", "field": "connection.state_description", "value": "Established, responder aborted" } },
|
||||
{ "set": { "if": "ctx.connection.state == 'RSTOS0'","field": "connection.state_description", "value": "Originator sent a SYN followed by a RST, we never saw a SYN-ACK from the responder" } },
|
||||
{ "set": { "if": "ctx.connection.state == 'RSTRH'", "field": "connection.state_description", "value": "Responder sent a SYN ACK followed by a RST, we never saw a SYN from the (purported) originator" } },
|
||||
{ "set": { "if": "ctx.connection.state == 'SH'", "field": "connection.state_description", "value": "Originator sent a SYN followed by a FIN, we never saw a SYN ACK from the responder (hence the connection was 'half' open)" } },
|
||||
{ "set": { "if": "ctx.connection.state == 'SHR'", "field": "connection.state_description", "value": "Responder sent a SYN ACK followed by a FIN, we never saw a SYN from the originator" } },
|
||||
{ "set": { "if": "ctx.connection.state == 'OTH'", "field": "connection.state_description", "value": "No SYN seen, just midstream traffic (a 'partial connection' that was not later closed)" } },
|
||||
{ "pipeline": { "name": "zeek.common" } }
|
||||
]
|
||||
}
|
||||
12
salt/elasticsearch/files/ingest/zeek.dce_rpc
Normal file
12
salt/elasticsearch/files/ingest/zeek.dce_rpc
Normal file
@@ -0,0 +1,12 @@
|
||||
{
|
||||
"description" : "zeek.dce_rpc",
|
||||
"processors" : [
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.rtt", "target_field": "event.duration", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.named_pipe", "target_field": "named_pipe", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.endpoint", "target_field": "endpoint", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.operation", "target_field": "operation", "ignore_missing": true } },
|
||||
{ "pipeline": { "name": "zeek.common" } }
|
||||
]
|
||||
}
|
||||
21
salt/elasticsearch/files/ingest/zeek.dhcp
Normal file
21
salt/elasticsearch/files/ingest/zeek.dhcp
Normal file
@@ -0,0 +1,21 @@
|
||||
{
|
||||
"description" : "zeek.dhcp",
|
||||
"processors" : [
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.uids", "target_field": "log.id.uids", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.mac", "target_field": "host.mac", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.assigned_ip", "target_field": "dhcp.assigned_ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.lease_time", "target_field": "dhcp.lease_time", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.trans_id", "target_field": "dhcp.transaction_id", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.assigned_addr", "target_field": "dhcp.assigned_ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.client_addr", "target_field": "client.address", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.server_addr", "target_field": "server.address", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.requested_addr", "target_field": "dhcp.requested_address", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.domain", "target_field": "host.domain", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.host_name", "target_field": "host.hostname", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.duration", "target_field": "event.duration", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.msg_types", "target_field": "message_types", "ignore_missing": true } },
|
||||
{ "pipeline": { "name": "zeek.common" } }
|
||||
]
|
||||
}
|
||||
11
salt/elasticsearch/files/ingest/zeek.dnp3
Normal file
11
salt/elasticsearch/files/ingest/zeek.dnp3
Normal file
@@ -0,0 +1,11 @@
|
||||
{
|
||||
"description" : "zeek.dnp3",
|
||||
"processors" : [
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.fc_request", "target_field": "fc_request", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.fc_reply", "target_field": "fc_reply", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.iin", "target_field": "iin", "ignore_missing": true } },
|
||||
{ "pipeline": { "name": "zeek.common" } }
|
||||
]
|
||||
}
|
||||
28
salt/elasticsearch/files/ingest/zeek.dns
Normal file
28
salt/elasticsearch/files/ingest/zeek.dns
Normal file
@@ -0,0 +1,28 @@
|
||||
{
|
||||
"description" : "zeek.dns",
|
||||
"processors" : [
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "dot_expander": { "field": "id.orig_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.proto", "target_field": "network.transport", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.trans_id", "target_field": "dns.id", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.rtt", "target_field": "event.duration", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.query", "target_field": "dns.query.name", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.qclass", "target_field": "dns.query.class", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.qclass_name", "target_field": "dns.query.class_name", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.qtype", "target_field": "dns.query.type", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.qtype_name", "target_field": "dns.query.type_name", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.rcode", "target_field": "dns.response.code", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.rcode_name", "target_field": "dns.response.code_name", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.AA", "target_field": "dns.authoritative", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.TC", "target_field": "dns.truncated", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.RD", "target_field": "dns.recursion.desired", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.RA", "target_field": "dns.recursion.available", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.Z", "target_field": "dns.reserved", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.answers", "target_field": "dns.answers", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.TTLs", "target_field": "dns.ttls", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.rejected", "target_field": "dns.query.rejected", "ignore_missing": true } },
|
||||
{ "script": { "lang": "painless", "source": "ctx.dns.query.length = ctx.dns.query.name.length()", "ignore_failure": true } },
|
||||
{ "pipeline": { "name": "zeek.common" } }
|
||||
]
|
||||
}
|
||||
20
salt/elasticsearch/files/ingest/zeek.dpd
Normal file
20
salt/elasticsearch/files/ingest/zeek.dpd
Normal file
@@ -0,0 +1,20 @@
|
||||
{
|
||||
"description" : "zeek.dpd",
|
||||
"processors" : [
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.uid", "target_field": "uid", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_h", "target_field": "source.ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_p", "target_field": "source.port", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_h", "target_field": "destination.ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination.port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.proto", "target_field": "network.protocol", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.analyzer", "target_field": "analyzer", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.failure_reason", "target_field": "failure_reason", "ignore_missing": true } },
|
||||
{ "pipeline": { "name": "zeek.common" } }
|
||||
]
|
||||
}
|
||||
34
salt/elasticsearch/files/ingest/zeek.files
Normal file
34
salt/elasticsearch/files/ingest/zeek.files
Normal file
@@ -0,0 +1,34 @@
|
||||
{
|
||||
"description" : "zeek.files",
|
||||
"processors" : [
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.fuid", "target_field": "log.id.fuid", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.rx_hosts", "target_field": "file.receive_ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.tx_hosts", "target_field": "file.transmit_ip", "ignore_missing": true } },
|
||||
{ "set": { "field": "server.ip", "value": "{{source.ip}}", "ignore_failure": true } },
|
||||
{ "set": { "field": "client.ip", "value": "{{destination.ip}}", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.conn_uids", "target_field": "log.id.uids", "ignore_missing": true } },
|
||||
{ "remove": { "field": "source", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.source", "target_field": "file.source", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.depth", "target_field": "file.depth", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.analyzers", "target_field": "file.analyzer", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.mime_type", "target_field": "file.mime_type", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.filename", "target_field": "file.name", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.duration", "target_field": "event.duration", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.local_orig", "target_field": "file.local_orig", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.is_orig", "target_field": "file.is_orig", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.seen_bytes", "target_field": "file.bytes.seen", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.total_bytes", "target_field": "file.bytes.total", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.missing_bytes", "target_field": "file.bytes.missing", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.overflow_bytes", "target_field": "file.bytes.overflow", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.timedout", "target_field": "file.timed_out", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.parent_fuid", "target_field": "log.id.parent_fuid", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.md5", "target_field": "hash.md5", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.sha1", "target_field": "hash.sha1", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.extracted", "target_field": "file.extracted.filename", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.extracted_cutoff", "target_field": "file.extracted.cutoff", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.extracted_size", "target_field": "file.extracted.size", "ignore_missing": true } },
|
||||
{ "pipeline": { "name": "zeek.common" } }
|
||||
]
|
||||
}
|
||||
25
salt/elasticsearch/files/ingest/zeek.ftp
Normal file
25
salt/elasticsearch/files/ingest/zeek.ftp
Normal file
@@ -0,0 +1,25 @@
|
||||
{
|
||||
"description" : "zeek.http",
|
||||
"processors" : [
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.user", "target_field": "ftp.user", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.password", "target_field": "ftp.password", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.command", "target_field": "ftp.command", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.arg", "target_field": "ftp.argument", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.mime_type", "target_field": "file.mimetype", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.file_size", "target_field": "file.size", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.reply_code", "target_field": "server.reply_code", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.reply_msg", "target_field": "server.reply_message", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "data_channel.passive", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.data_channel.passive","target_field": "ftp.data_channel_passive", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "data_channel.orig_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.data_channel.orig_h","target_field": "ftp.data_channel_source.ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "data_channel.resp_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.data_channel.resp_h","target_field": "ftp.data_channel_destination.ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "data_channel.resp_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.data_channel.resp_p","target_field": "ftp.data_channel_destination.port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.fuid", "target_field": "fuid", "ignore_missing": true } },
|
||||
{ "pipeline": { "name": "zeek.common" } }
|
||||
]
|
||||
}
|
||||
34
salt/elasticsearch/files/ingest/zeek.http
Normal file
34
salt/elasticsearch/files/ingest/zeek.http
Normal file
@@ -0,0 +1,34 @@
|
||||
{
|
||||
"description" : "zeek.http",
|
||||
"processors" : [
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.trans_depth", "target_field": "http.trans_depth", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.method", "target_field": "http.method", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.host", "target_field": "http.virtual_host", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.uri", "target_field": "http.uri", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.referrer", "target_field": "http.referrer", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.version", "target_field": "http.version", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.user_agent", "target_field": "http.useragent", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.request_body_len", "target_field": "http.request.body.length", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.response_body_len","target_field": "http.response.body.length", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.status_code", "target_field": "http.status_code", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.status_msg", "target_field": "http.status_message", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.info_code", "target_field": "http.info_code", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.info_msg", "target_field": "http.info_message", "ignore_missing": true } },
|
||||
{ "remove": { "field": "message2.tags", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.username", "target_field": "http.user", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.password", "target_field": "http.password", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.proxied", "target_field": "http.proxied", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.orig_fuids", "target_field": "log.id.orig_fuids", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.orig_filenames", "target_field": "file.orig_filenames", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.orig_mime_types", "target_field": "file.orig_mime_types", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.resp_fuids", "target_field": "log.id.resp_fuids", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.resp_filenames", "target_field": "file.resp_filenames", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.resp_mime_types", "target_field": "file.resp_mime_types", "ignore_missing": true } },
|
||||
{ "script": { "lang": "painless", "source": "ctx.uri_length = ctx.uri.length()", "ignore_failure": true } },
|
||||
{ "script": { "lang": "painless", "source": "ctx.useragent_length = ctx.useragent.length()", "ignore_failure": true } },
|
||||
{ "script": { "lang": "painless", "source": "ctx.virtual_host_length = ctx.virtual_host.length()", "ignore_failure": true } },
|
||||
{ "pipeline": { "name": "zeek.common" } }
|
||||
]
|
||||
}
|
||||
20
salt/elasticsearch/files/ingest/zeek.intel
Normal file
20
salt/elasticsearch/files/ingest/zeek.intel
Normal file
@@ -0,0 +1,20 @@
|
||||
{
|
||||
"description" : "zeek.intel",
|
||||
"processors" : [
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.seen.indicator", "target_field": "intel.indicator", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "seen.indicator_type", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.seen.indicator_type", "target_field": "intel.indicator_type", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "seen.where", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.seen.where", "target_field": "intel.seen_where", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "seen.node", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.seen.node", "target_field": "intel.seen_node", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.matched", "target_field": "intel.matched", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.sources", "target_field": "intel.sources", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.fuid", "target_field": "log.id.fuid", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.file_mime_type", "target_field": "file.mimetype", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.file_desc", "target_field": "file.description", "ignore_missing": true } },
|
||||
{ "pipeline": { "name": "zeek.common" } }
|
||||
]
|
||||
}
|
||||
17
salt/elasticsearch/files/ingest/zeek.irc
Normal file
17
salt/elasticsearch/files/ingest/zeek.irc
Normal file
@@ -0,0 +1,17 @@
|
||||
{
|
||||
"description" : "zeek.irc",
|
||||
"processors" : [
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.nick", "target_field": "irc.nickname", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.user", "target_field": "irc.username", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.command", "target_field": "irc.command.type", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.value", "target_field": "irc.command.value", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.addl", "target_field": "irc.command.info", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.dcc_file_name", "target_field": "file.name", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.dcc_file_size", "target_field": "file.size", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.dcc_mime_type", "target_field": "file.mime_type", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.fuid", "target_field": "log.id.fuid", "ignore_missing": true } },
|
||||
{ "pipeline": { "name": "zeek.common" } }
|
||||
]
|
||||
}
|
||||
22
salt/elasticsearch/files/ingest/zeek.kerberos
Normal file
22
salt/elasticsearch/files/ingest/zeek.kerberos
Normal file
@@ -0,0 +1,22 @@
|
||||
{
|
||||
"description" : "zeek.kerberos",
|
||||
"processors" : [
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.request_type", "target_field": "kerberos.request_type", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.client", "target_field": "kerberos.client", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.service", "target_field": "kerberos.service", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.success", "target_field": "kerberos.success", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.error_msg", "target_field": "kerberos.error_message", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.from", "target_field": "kerberos.ticket.valid.from", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.till", "target_field": "kerberos.ticket.valid.until", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.cipher", "target_field": "kerberos.ticket.cipher", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.forwardable", "target_field": "kerberos.ticket.forwardable", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.renewable", "target_field": "kerberos.ticket.renewable", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.client_cert_subject", "target_field": "kerberos.client.certificate.subject", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.client_cert_fuid", "target_field": "log.id.client_certificate_fuid", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.server_cert_subject", "target_field": "kerberos.server.certificate.subject", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.server_cert_fuid", "target_field": "log.id.server_certificate_fuid", "ignore_missing": true } },
|
||||
{ "pipeline": { "name": "zeek.common" } }
|
||||
]
|
||||
}
|
||||
10
salt/elasticsearch/files/ingest/zeek.modbus
Normal file
10
salt/elasticsearch/files/ingest/zeek.modbus
Normal file
@@ -0,0 +1,10 @@
|
||||
{
|
||||
"description" : "zeek.modbus",
|
||||
"processors" : [
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.func", "target_field": "modbus.function", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.exception", "target_field": "modbus.exception", "ignore_missing": true } },
|
||||
{ "pipeline": { "name": "zeek.common" } }
|
||||
]
|
||||
}
|
||||
13
salt/elasticsearch/files/ingest/zeek.mysql
Normal file
13
salt/elasticsearch/files/ingest/zeek.mysql
Normal file
@@ -0,0 +1,13 @@
|
||||
{
|
||||
"description" : "zeek.mysql",
|
||||
"processors" : [
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.cmd", "target_field": "mysql.command", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.arg", "target_field": "mysql.argument", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.success", "target_field": "mysql.success", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.rows", "target_field": "mysql.rows", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.response", "target_field": "mysql.response", "ignore_missing": true } },
|
||||
{ "pipeline": { "name": "zeek.common" } }
|
||||
]
|
||||
}
|
||||
26
salt/elasticsearch/files/ingest/zeek.notice
Normal file
26
salt/elasticsearch/files/ingest/zeek.notice
Normal file
@@ -0,0 +1,26 @@
|
||||
{
|
||||
"description" : "zeek.notice",
|
||||
"processors" : [
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.fuid", "target_field": "log.id.fuid", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.mime", "target_field": "file.mimetype", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.desc", "target_field": "file.description", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.proto", "target_field": "network.protocol", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.note", "target_field": "note", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.msg", "target_field": "msg", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.sub", "target_field": "sub_msg", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.p", "target_field": "p", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.n", "target_field": "n", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.peer_descr", "target_field": "peer_description", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.actions", "target_field": "action", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.suppress_for", "target_field": "suppress_for", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.dropped", "target_field": "dropped", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.destination_country_code", "target_field": "destination_country_code", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.destination_region", "target_field": "destination_region", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.destination_city", "target_field": "destination_city", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.destination_latitude", "target_field": "destination_latitude", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.destination_longitude", "target_field": "destination_longitude", "ignore_missing": true } },
|
||||
{ "pipeline": { "name": "zeek.common" } }
|
||||
]
|
||||
}
|
||||
16
salt/elasticsearch/files/ingest/zeek.ntlm
Normal file
16
salt/elasticsearch/files/ingest/zeek.ntlm
Normal file
@@ -0,0 +1,16 @@
|
||||
{
|
||||
"description" : "zeek.ntlm",
|
||||
"processors" : [
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.hostname", "target_field": "host.name", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.domainname", "target_field": "host.domain", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.success", "target_field": "ntlm.success", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.status", "target_field": "ntlm.status", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.username", "target_field": "user.name", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.server_dns_computer_name", "target_field": "ntlm.server.dns.name", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.server_nb_computer_name", "target_field": "ntlm.server.nb.name", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.server_tree_name", "target_field": "ntlm.server.tree.name", "ignore_missing": true } },
|
||||
{ "pipeline": { "name": "zeek.common" } }
|
||||
]
|
||||
}
|
||||
24
salt/elasticsearch/files/ingest/zeek.pe
Normal file
24
salt/elasticsearch/files/ingest/zeek.pe
Normal file
@@ -0,0 +1,24 @@
|
||||
{
|
||||
"description" : "zeek.pe",
|
||||
"processors" : [
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id", "target_field": "log.id.fuid", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.machine", "target_field": "file.machine", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.compile_ts", "target_field": "file.compile_timestamp", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.os", "target_field": "file.os", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.subsystem", "target_field": "file.subsystem", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.is_exe", "target_field": "file.is_exe", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.is_64bit", "target_field": "file.is_64bit", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.uses_aslr", "target_field": "file.aslr", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.uses_dep", "target_field": "file.dep", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.uses_code_integrity","target_field": "file.code_integrity","ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.uses_seh", "target_field": "file.seh", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.has_import_table", "target_field": "file.table.import", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.has_export_table", "target_field": "file.table.export", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.has_cert_table", "target_field": "file.table.cert", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.has_debug_data", "target_field": "file.debug_data", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.section_names", "target_field": "file.section_names", "ignore_missing": true } },
|
||||
{ "pipeline": { "name": "zeek.common" } }
|
||||
]
|
||||
}
|
||||
16
salt/elasticsearch/files/ingest/zeek.radius
Normal file
16
salt/elasticsearch/files/ingest/zeek.radius
Normal file
@@ -0,0 +1,16 @@
|
||||
{
|
||||
"description" : "zeek.radius",
|
||||
"processors" : [
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.username", "target_field": "user.name", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.mac", "target_field": "host.mac", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.framed_addr", "target_field": "framed_addr", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.remote_ip", "target_field": "destination.ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.connect_info", "target_field": "radius.connect_info", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.reply_msg", "target_field": "radius.reply_message", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.result", "target_field": "radius.result", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.logged", "target_field": "radius.logged", "ignore_missing": true } },
|
||||
{ "pipeline": { "name": "zeek.common" } }
|
||||
]
|
||||
}
|
||||
23
salt/elasticsearch/files/ingest/zeek.rdp
Normal file
23
salt/elasticsearch/files/ingest/zeek.rdp
Normal file
@@ -0,0 +1,23 @@
|
||||
{
|
||||
"description" : "zeek.rdp",
|
||||
"processors" : [
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.cookie", "target_field": "rdp.cookie", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.result", "target_field": "rdp.result", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.security_protocol","target_field": "rdp.security_protocol", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.keyboard_layout", "target_field": "rdp.keyboard_layout", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.client_build", "target_field": "rdp.client_build", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.client_name", "target_field": "client.name", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.client_dig_product_id", "target_field": "client.id.product", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.desktop_width", "target_field": "rdp.desktop.width", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.desktop_height", "target_field": "rdp.desktop.height", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.requested_color_depth", "target_field": "rdp.requested_color_depth", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.cert_type", "target_field": "rdp.certificate_type", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.cert_count", "target_field": "rdp.certificate_count", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.cert_permanent", "target_field": "rdp.certificate_permanent","ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.encryption_level", "target_field": "rdp.encryption_level", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.encryption_method","target_field": "rdp.encryption_method", "ignore_missing": true } },
|
||||
{ "pipeline": { "name": "zeek.common" } }
|
||||
]
|
||||
}
|
||||
18
salt/elasticsearch/files/ingest/zeek.rfb
Normal file
18
salt/elasticsearch/files/ingest/zeek.rfb
Normal file
@@ -0,0 +1,18 @@
|
||||
{
|
||||
"description" : "zeek.rfb",
|
||||
"processors" : [
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.client_major_version", "target_field": "rfb.client_major_version", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.client_minor_version", "target_field": "rfb.client_minor_version", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.server_major_version", "target_field": "rfb.server_major_version", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.server_minor_version", "target_field": "rfb.server_minor_version", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.authentication_method", "target_field": "rfb.authentication.method","ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.auth", "target_field": "rfb.authenticaiton.success", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.share_flag", "target_field": "rfb.share_flag", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.desktop_name", "target_field": "rfb.desktop.name", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.width", "target_field": "rfb.desktop.width", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.height", "target_field": "rfb.desktop.height", "ignore_missing": true } },
|
||||
{ "pipeline": { "name": "zeek.common" } }
|
||||
]
|
||||
}
|
||||
14
salt/elasticsearch/files/ingest/zeek.signatures
Normal file
14
salt/elasticsearch/files/ingest/zeek.signatures
Normal file
@@ -0,0 +1,14 @@
|
||||
{
|
||||
"description" : "zeek.signatures",
|
||||
"processors" : [
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.note", "target_field": "note", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.sig_id", "target_field": "signature_id", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.event_msg", "target_field": "event_message", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.sub_msg", "target_field": "sub_message", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.sig_count", "target_field": "signature_count", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.host_count", "target_field": "host.count", "ignore_missing": true } },
|
||||
{ "pipeline": { "name": "zeek.common" } }
|
||||
]
|
||||
}
|
||||
29
salt/elasticsearch/files/ingest/zeek.sip
Normal file
29
salt/elasticsearch/files/ingest/zeek.sip
Normal file
@@ -0,0 +1,29 @@
|
||||
{
|
||||
"description" : "zeek.sip",
|
||||
"processors" : [
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.trans_depth", "target_field": "sip.transaction.depth", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.method", "target_field": "sip.method", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.uri", "target_field": "sip.uri", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.date", "target_field": "sip.date", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.request_from", "target_field": "sip.request.from", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.request_to", "target_field": "sip.request.to", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.response_from", "target_field": "sip.response.from", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.response_to", "target_field": "sip.response.to", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.reply_to", "target_field": "sip.reply_to", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.call_id", "target_field": "sip.call_id", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.seq", "target_field": "sip.seq", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.subject", "target_field": "sip.subject", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.request_path", "target_field": "sip.request.path", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.response_path", "target_field": "sip.response.path", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.user_agent", "target_field": "client.user_agent", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.status_code", "target_field": "server.status_code", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.status_msg", "target_field": "server.status_message", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.warning", "target_field": "sip.warning", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.request_body_len", "target_field": "sip.request.body.length", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.response_body_len","target_field": "sip.response.body.length", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.content_type", "target_field": "sip.content_type", "ignore_missing": true } },
|
||||
{ "pipeline": { "name": "zeek.common" } }
|
||||
]
|
||||
}
|
||||
23
salt/elasticsearch/files/ingest/zeek.smb_files
Normal file
23
salt/elasticsearch/files/ingest/zeek.smb_files
Normal file
@@ -0,0 +1,23 @@
|
||||
{
|
||||
"description" : "zeek.smb_files",
|
||||
"processors" : [
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.fuid", "target_field": "log.id.fuid", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.action", "target_field": "file.action", "ignore_missing": true } },
|
||||
{ "remove": { "field": "path", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.path", "target_field": "file.path", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.name", "target_field": "file.name", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.size", "target_field": "file.size", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.prev_name", "target_field": "file.previous_name", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "times.modified", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.times.modified", "target_field": "file.times_modified", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "times.accessed", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.times.accessed", "target_field": "file.times_accessed", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "times.created", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.times.created", "target_field": "file.times_created", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "times.changed", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.times.changed", "target_field": "file.times_changed", "ignore_missing": true } },
|
||||
{ "pipeline": { "name": "zeek.common" } }
|
||||
]
|
||||
}
|
||||
12
salt/elasticsearch/files/ingest/zeek.smb_mapping
Normal file
12
salt/elasticsearch/files/ingest/zeek.smb_mapping
Normal file
@@ -0,0 +1,12 @@
|
||||
{
|
||||
"description" : "zeek.smb_files",
|
||||
"processors" : [
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.path", "target_field": "smb.path", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.service", "target_field": "smb.service", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.native_file_system", "target_field": "smb.file_system", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.share_type", "target_field": "smb.share_type", "ignore_missing": true } },
|
||||
{ "pipeline": { "name": "zeek.common" } }
|
||||
]
|
||||
}
|
||||
30
salt/elasticsearch/files/ingest/zeek.smtp
Normal file
30
salt/elasticsearch/files/ingest/zeek.smtp
Normal file
@@ -0,0 +1,30 @@
|
||||
{
|
||||
"description" : "zeek.smtp",
|
||||
"processors" : [
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "remove": { "field": "path", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.trans_depth", "target_field": "smtp.transaction_depth", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.helo", "target_field": "smtp.helo", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.mailfrom", "target_field": "smtp.mail_from", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.rcptto", "target_field": "smtp.recipient_to", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.date", "target_field": "smtp.mail_date", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.from", "target_field": "smtp.from", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.to", "target_field": "smtp.to", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.cc", "target_field": "smtp.cc", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.reply_to", "target_field": "smtp.reply_to", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.msg_id", "target_field": "smtp.message_id", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.in_reply_to", "target_field": "smtp.in_reply_to", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.subject", "target_field": "smtp.subject", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.x_originating_ip", "target_field": "smtp.x_originating_ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.first_received", "target_field": "smtp.first_received", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.second_received", "target_field": "smtp.second_received", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.last_reply", "target_field": "smtp.last_reply", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.path", "target_field": "smtp.path", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.user_agent", "target_field": "smtp.useragent", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.tls", "target_field": "smtp.tls", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.fuids", "target_field": "log.id.fuids", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.is_webmail", "target_field": "smtp.is_webmail", "ignore_missing": true } },
|
||||
{ "pipeline": { "name": "zeek.common" } }
|
||||
]
|
||||
}
|
||||
17
salt/elasticsearch/files/ingest/zeek.snmp
Normal file
17
salt/elasticsearch/files/ingest/zeek.snmp
Normal file
@@ -0,0 +1,17 @@
|
||||
{
|
||||
"description" : "zeek.snmp",
|
||||
"processors" : [
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.duration", "target_field": "event.duration", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.version", "target_field": "snmp.version", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.community", "target_field": "snmp.community", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.get_requests", "target_field": "snmp.get.requests", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.get_bulk_requests","target_field": "snmp.get.bulk_requests", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.get_responses", "target_field": "snmp.get.responses", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.set_requests", "target_field": "snmp.set.requests", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.display_string", "target_field": "snmp.display_string", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.up_since", "target_field": "snmp.up_since", "ignore_missing": true } },
|
||||
{ "pipeline": { "name": "zeek.common" } }
|
||||
]
|
||||
}
|
||||
20
salt/elasticsearch/files/ingest/zeek.socks
Normal file
20
salt/elasticsearch/files/ingest/zeek.socks
Normal file
@@ -0,0 +1,20 @@
|
||||
{
|
||||
"description" : "zeek.socks",
|
||||
"processors" : [
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.version", "target_field": "socks.version", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.user", "target_field": "socks.user", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.password", "target_field": "socks.password", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.status", "target_field": "socks.status", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.request_host", "target_field": "socks.request.host", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "request.name", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.request.name", "target_field": "socks.request.name", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.request_p", "target_field": "socks.request.port", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "bound.host", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.bound.host", "target_field": "socks.bound.host", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.bound_name", "target_field": "socks.bound.name", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.bound_p", "target_field": "socks.bound.port", "ignore_missing": true } },
|
||||
{ "pipeline": { "name": "zeek.common" } }
|
||||
]
|
||||
}
|
||||
23
salt/elasticsearch/files/ingest/zeek.software
Normal file
23
salt/elasticsearch/files/ingest/zeek.software
Normal file
@@ -0,0 +1,23 @@
|
||||
{
|
||||
"description" : "zeek.software",
|
||||
"processors" : [
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "dot_expander": { "field": "version.major", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.version.major", "target_field": "software.version.major", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "version.minor", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.version.minor", "target_field": "software.version.minor", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "version.minor2", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.version.minor2", "target_field": "software.version.minor2", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "version.minor3", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.version.minor3", "target_field": "version.minor3", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "version.addl", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.version.addl", "target_field": "software.version.additional_info", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.host", "target_field": "source.ip", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.host_p", "target_field": "source.port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.software_type", "target_field": "software.type", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.name", "target_field": "software.name", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.unparsed_version", "target_field": "software.version.unparsed", "ignore_missing": true } },
|
||||
{ "pipeline": { "name": "zeek.common" } }
|
||||
]
|
||||
}
|
||||
32
salt/elasticsearch/files/ingest/zeek.ssh
Normal file
32
salt/elasticsearch/files/ingest/zeek.ssh
Normal file
@@ -0,0 +1,32 @@
|
||||
{
|
||||
"description" : "zeek.conn",
|
||||
"processors" : [
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.version", "target_field": "ssh.version", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.hassh", "target_field": "hash.hassh", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.auth_success", "target_field": "ssh.authentication.success", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.auth_attempts", "target_field": "ssh.authentication.attempts", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.direction", "target_field": "ssh.direction", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.client", "target_field": "ssh.client", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.server", "target_field": "ssh.server", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.cipher_alg", "target_field": "ssh.cipher_algorithm", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.compression_alg", "target_field": "ssh.compression_algorithm", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.cshka", "target_field": "ssh.client_host_key_algorithms", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.host_key_alg", "target_field": "ssh.host_key_algorithm", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.hasshAlgorithms", "target_field": "ssh.hassh_algorithms", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.hasshServer", "target_field": "ssh.hassh_server", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.hasshVersion", "target_field": "ssh.hassh_version", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.kex_alg", "target_field": "ssh.kex_algorithm", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.mac_alg", "target_field": "ssh.mac_algorithm", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.sshka", "target_field": "ssh.server_host_key_algorithms", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.host_key", "target_field": "ssh.host_key", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.destination_region", "target_field": "destination.region", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.destination_city", "target_field": "destination.city", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.destination_latitude", "target_field": "destination.latitude", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.destination_longitude", "target_field": "destination.longitude", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.destination_country_code", "target_field": "destination.country_code", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.hasshServerAlgorithms", "target_field": "ssh.hassh_server_algorithms", "ignore_missing": true } },
|
||||
{ "pipeline": { "name": "zeek.common" } }
|
||||
]
|
||||
}
|
||||
25
salt/elasticsearch/files/ingest/zeek.ssl
Normal file
25
salt/elasticsearch/files/ingest/zeek.ssl
Normal file
@@ -0,0 +1,25 @@
|
||||
{
|
||||
"description" : "zeek.ssl",
|
||||
"processors" : [
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.version", "target_field": "ssl.version", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.cipher", "target_field": "ssl.cipher", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.curve", "target_field": "ssl.curve", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.server_name", "target_field": "ssl.server_name", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.resumed", "target_field": "ssl.resumed", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.last_alert", "target_field": "ssl.last_alert", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.next_protocol", "target_field": "ssl.next_protocol", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.established", "target_field": "ssl.established", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.cert_chain_fuids", "target_field": "ssl.certificate.chain_fuids", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.client_cert_chain_fuids", "target_field": "ssl.client.certificate.chain_fuids", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.subject", "target_field": "ssl.certificate.subject", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.issuer", "target_field": "ssl.certificate.issuer", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.client_subject", "target_field": "ssl.client.subject", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.client_issuer", "target_field": "ssl.client.issuer", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.validation_status","target_field": "ssl.validation_status", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.ja3", "target_field": "hash.ja3", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.ja3s", "target_field": "hash.ja3s", "ignore_missing": true } },
|
||||
{ "pipeline": { "name": "zeek.common_ssl" } }
|
||||
]
|
||||
}
|
||||
13
salt/elasticsearch/files/ingest/zeek.syslog
Normal file
13
salt/elasticsearch/files/ingest/zeek.syslog
Normal file
@@ -0,0 +1,13 @@
|
||||
{
|
||||
"description" : "zeek.syslog",
|
||||
"processors" : [
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.proto", "target_field": "network.protocol", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.facility", "target_field": "syslog.facility", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.severity", "target_field": "syslog.severity", "ignore_missing": true } },
|
||||
{ "remove": { "field": "message", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.message", "target_field": "message", "ignore_missing": true } },
|
||||
{ "pipeline": { "name": "zeek.common" } }
|
||||
]
|
||||
}
|
||||
8
salt/elasticsearch/files/ingest/zeek.tunnel
Normal file
8
salt/elasticsearch/files/ingest/zeek.tunnel
Normal file
@@ -0,0 +1,8 @@
|
||||
{
|
||||
"description" : "zeek.tunnel",
|
||||
"processors" : [
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "set": { "field": "event_type", "value": "zeek.tunnels" } },
|
||||
{ "pipeline": { "name": "zeek.tunnels" } }
|
||||
]
|
||||
}
|
||||
19
salt/elasticsearch/files/ingest/zeek.tunnels
Normal file
19
salt/elasticsearch/files/ingest/zeek.tunnels
Normal file
@@ -0,0 +1,19 @@
|
||||
{
|
||||
"description" : "zeek.tunnels",
|
||||
"processors" : [
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.uid", "target_field": "uid", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_h", "target_field": "source.ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.orig_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.orig_p", "target_field": "source.port", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_h", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_h", "target_field": "destination.ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "id.resp_p", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination.port", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.tunnel_type", "target_field": "tunnel_type", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.action", "target_field": "action", "ignore_missing": true } },
|
||||
{ "pipeline": { "name": "zeek.common" } }
|
||||
]
|
||||
}
|
||||
12
salt/elasticsearch/files/ingest/zeek.weird
Normal file
12
salt/elasticsearch/files/ingest/zeek.weird
Normal file
@@ -0,0 +1,12 @@
|
||||
{
|
||||
"description" : "zeek.weird",
|
||||
"processors" : [
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.name", "target_field": "weird.name", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.addl", "target_field": "weird.additional_info", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.notice", "target_field": "weird.notice", "ignore_missing": true } },
|
||||
{ "rename": { "field": "message2.peer", "target_field": "weird.peer", "ignore_missing": true } },
|
||||
{ "pipeline": { "name": "zeek.common" } }
|
||||
]
|
||||
}
|
||||
45
salt/elasticsearch/files/ingest/zeek.x509
Normal file
45
salt/elasticsearch/files/ingest/zeek.x509
Normal file
@@ -0,0 +1,45 @@
|
||||
{
|
||||
"description" : "zeek.x509",
|
||||
"processors" : [
|
||||
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
||||
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.id", "target_field": "id", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "certificate.version", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.certificate.version", "target_field": "x509.certificate.version", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "certificate.serial", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.certificate.serial", "target_field": "x509.certificate.serial", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "certificate.subject", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.certificate.subject", "target_field": "x509.certificate.subject", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "certificate.issuer", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.certificate.issuer", "target_field": "x509.certificate.issuer", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "certificate.not_valid_before", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.certificate.not_valid_before", "target_field": "x509.certificate.not_valid_before", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "certificate.not_valid_after", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.certificate.not_valid_after", "target_field": "x509.certificate.not_valid_after", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "certificate.key_alg", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.certificate.key_alg", "target_field": "x509.certificate.key.algorithm", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "certificate.sig_alg", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.certificate.sig_alg", "target_field": "x509.certificate.signing_algorithm", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "certificate.key_type", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.certificate.key_type", "target_field": "x509.certificate.key.type", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "certificate.key_length", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.certificate.key_length", "target_field": "x509.certificate.key.length", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "certificate.exponent", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.certificate.exponent", "target_field": "x509.certificate.exponent", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "certificate.curve", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.certificate.curve", "target_field": "x509.certificate.curve", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "san.dns", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.san.dns", "target_field": "x509.san_dns", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "san.uri", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.san.uri", "target_field": "x509.san_uri", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "san.email", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.san.email", "target_field": "x509.san_email", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "san.ip", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.san.ip", "target_field": "x509.san_ip", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "basic_constraints.ca", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.basic_constraints.ca", "target_field": "x509.basic_constraints.ca", "ignore_missing": true } },
|
||||
{ "dot_expander": { "field": "basic_constraints.path_length", "path": "message2", "ignore_failure": true } },
|
||||
{ "rename": { "field": "message2.basic_constraints.path_length", "target_field": "x509.basic_constraints.path_length", "ignore_missing": true } },
|
||||
{ "pipeline": { "name": "zeek.common_ssl" } }
|
||||
]
|
||||
}
|
||||
Reference in New Issue
Block a user