CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 09:12:45 +01:00
Code Issues Packages Projects Releases Wiki Activity

Misc fixes

Browse Source
This commit is contained in:
William Wernert
2021-07-16 14:59:44 -04:00
parent 3a12d28d20
commit 9bf1d3e0c6
3 changed files with 8 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
salt/elasticsearch/files/ingest/logscan
View File

@@ -2,14 +2,17 @@
"description": "logscan",
"processors": [
{ "set": { "field": "event.severity", "value": 2 } },
{ "json": { "field": "message", "add_to_root": true, "ignore_failure": true } },
{ "rename": { "field": "@timestamp", "target_field": "event.ingested", "ignore_missing": true } },
{ "date": { "field": "timestamp", "target_field": "event.created", "formats": [ "ISO8601", "UNIX" ], "ignore_failure": true } },
{ "date": { "field": "start_time", "target_field": "@timestamp", "formats": [ "ISO8601", "UNIX" ], "ignore_failure": true } },
{ "date": { "field": "start_time", "target_field": "event.start", "formats": [ "ISO8601", "UNIX" ], "ignore_failure": true } },
{ "date": { "field": "end_time", "target_field": "event.end", "formats": [ "ISO8601", "UNIX" ], "ignore_failure": true } },
{ "rename": { "field": "source_ip", "target_field": "source.ip" } },
{ "append": { "field": "logsscan.source.ips", "value": "{{{source.ip}}}" } },
{ "rename": { "field": "source_ips", "target_field": "logscan.source.ips" } },
{ "remove": { "field": "start_time", "ignore_missing": true } },
{ "remove": { "field": "end_time", "ignore_missing": true } },
{ "rename": { "field": "source_ip", "target_field": "source.ip", "ignore_missing": true } },
{ "append": { "field": "logsscan.source.ips", "value": "{{{source.ip}}}", "ignore_failure": true } },
{ "rename": { "field": "source_ips", "target_field": "logscan.source.ips", "ignore_missing": true } },
{ "set": { "if": "ctx.model == 'kff'", "field": "rule.name", "value": "LOGSCAN KFF MODEL THRESHOLD" } },
{ "set": { "if": "ctx.model == 'kff'", "field": "rule.description", "value": "High ratio of login failures in 5 minute window" } },
{ "set": { "if": "ctx.model == 'kl'", "field": "rule.name", "value": "LOGSCAN KL MODEL THRESHOLD" } },

2
salt/filebeat/etc/filebeat.yml
View File

@@ -114,7 +114,7 @@ filebeat.inputs:
- type: log
paths:
- /opt/so/log/logscan/alerts.log
- /logs/logscan/alerts.log
fields:
module: logscan
dataset: alert

2
salt/logstash/pipelines/config/so/9800_output_logscan.conf.jinja
View File

@@ -16,7 +16,7 @@ output {
user => "{{ ES_USER }}"
password => "{{ ES_PASS }}"
{% endif %}
index => "so-%{[event][module]}"
index => "so-logscan"
template_name => "so-common"
template => "/templates/so-common-template.json"
template_overwrite => true