CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 17:22:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

LS salt module - rework of the init.sls

Browse Source
This commit is contained in:
Mike Reeves
2018-02-09 16:05:30 -05:00
parent 3d71d2a76c
commit a2f3985813
98 changed files with 15 additions and 4164 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
pillar/masters/example.sls
View File

@@ -3,3 +3,5 @@ master:
esaccessip: 127.0.0.1
esheap: CHANGEME
esclustername: {{ grains.host }}
freq: 0
domainstats: 0

19
salt/logstash/files/conf.d/0000_input_syslogng.conf
View File

@@ -1,19 +0,0 @@
# Original Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Updated by: Doug Burks
# Last Update: 5/15/2017
input {
tcp {
port => 6050
codec => json
tags => "syslogng"
}
}
filter {
if "syslogng" in [tags] {
mutate {
#add_tag => [ "conf_file_0000"]
}
}
}

19
salt/logstash/files/conf.d/0001_input_json.conf
View File

@@ -1,19 +0,0 @@
# Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Email: justin@hasecuritysolution.com
# Last Update: 12/9/2016
input {
tcp {
port => 6051
codec => json
tags => [ "json" ]
}
}
filter {
if "json" in [tags] {
mutate {
#add_tag => [ "conf_file_0001"]
}
}
}

22
salt/logstash/files/conf.d/0002_input_windows_json.conf
View File

@@ -1,22 +0,0 @@
# Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Email: justin@hasecuritysolution.com
# Last Update: 12/9/2016
input {
tcp {
port => 6052
type => "windows"
tags => [ "json" ]
codec => json {
charset => "CP1252"
}
}
}
filter {
if [type] == "windows" {
mutate {
#add_tag => [ "conf_file_0002"]
}
}
}

18
salt/logstash/files/conf.d/0003_input_syslog.conf
View File

@@ -1,18 +0,0 @@
# Original Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Updated by: Doug Burks
# Last Update: 5/15/2017
#input {
# udp {
# port => 1514
# tags => "syslog"
# }
#}
#filter {
# if "syslog" in [tags] {
# mutate {
# #add_tag => [ "conf_file_0003"]
# }
# }
#}

19
salt/logstash/files/conf.d/0005_input_suricata.conf
View File

@@ -1,19 +0,0 @@
# Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Email: justin@hasecuritysolution.com
# Last Update: 12/9/2016
input {
tcp {
port => 6053
codec => json
type => "suricata"
}
}
filter {
if [type] == "suricata" {
mutate {
#add_tag => [ "conf_file_0005"]
}
}
}

11
salt/logstash/files/conf.d/0006_input_beats.conf
View File

@@ -1,11 +0,0 @@
# Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Email: justin@hasecuritysolutions.com
# Last Update: 12/11/2017
input {
beats {
port => "5044"
tags => [ "beat" ]
}
}

182
salt/logstash/files/conf.d/0007_input_import.conf
View File

@@ -1,182 +0,0 @@
# Updated by: Doug Burks
# Last Update: 5/16/2017
input {
file {
path => "/nsm/import/bro/conn*"
type => "bro_conn"
tags => ["bro", "import"]
}
file {
path => "/nsm/import/bro/dce_rpc*"
type => "bro_dce_rpc"
tags => ["bro", "import"]
}
file {
path => "/nsm/import/bro/dhcp*"
type => "bro_dhcp"
tags => ["bro", "import"]
}
file {
path => "/nsm/import/bro/dnp3*"
type => "bro_dnp3"
tags => ["bro", "import"]
}
file {
path => "/nsm/import/bro/dns*"
type => "bro_dns"
tags => ["bro", "import"]
}
file {
path => "/nsm/import/bro/dpd*"
type => "bro_dpd"
tags => ["bro", "import"]
}
file {
path => "/nsm/import/bro/files*"
type => "bro_files"
tags => ["bro", "import"]
}
file {
path => "/nsm/import/bro/ftp*"
type => "bro_ftp"
tags => ["bro", "import"]
}
file {
path => "/nsm/import/bro/http*"
type => "bro_http"
tags => ["bro", "import"]
}
file {
path => "/nsm/import/bro/intel*"
type => "bro_intel"
tags => ["bro", "import"]
}
file {
path => "/nsm/import/bro/irc*"
type => "bro_irc"
tags => ["bro", "import"]
}
file {
path => "/nsm/import/bro/kerberos*"
type => "bro_kerberos"
tags => ["bro", "import"]
}
file {
path => "/nsm/import/bro/modbus*"
type => "bro_modbus"
tags => ["bro", "import"]
}
file {
path => "/nsm/import/bro/mysql*"
type => "bro_mysql"
tags => ["bro", "import"]
}
file {
path => "/nsm/import/bro/notice*"
type => "bro_notice"
tags => ["bro", "import"]
}
file {
path => "/nsm/import/bro/ntlm*"
type => "bro_ntlm"
tags => ["bro", "import"]
}
file {
path => "/nsm/import/bro/pe*"
type => "bro_pe"
tags => ["bro", "import"]
}
file {
path => "/nsm/import/bro/radius*"
type => "bro_radius"
tags => ["bro", "import"]
}
file {
path => "/nsm/import/bro/rdp*"
type => "bro_rdp"
tags => ["bro", "import"]
}
file {
path => "/nsm/import/bro/rfb*"
type => "bro_rfb"
tags => ["bro", "import"]
}
file {
path => "/nsm/import/bro/signatures*"
type => "bro_signatures"
tags => ["bro", "import"]
}
file {
path => "/nsm/import/bro/sip*"
type => "bro_sip"
tags => ["bro", "import"]
}
file {
path => "/nsm/import/bro/smb_files*"
type => "bro_smb_files"
tags => ["bro", "import"]
}
file {
path => "/nsm/import/bro/smb_mapping*"
type => "bro_smb_mapping"
tags => ["bro", "import"]
}
file {
path => "/nsm/import/bro/smtp*"
type => "bro_smtp"
tags => ["bro", "import"]
}
file {
path => "/nsm/import/bro/snmp*"
type => "bro_snmp"
tags => ["bro", "import"]
}
file {
path => "/nsm/import/bro/socks*"
type => "bro_socks"
tags => ["bro", "import"]
}
file {
path => "/nsm/import/bro/software*"
type => "bro_software"
tags => ["bro", "import"]
}
file {
path => "/nsm/import/bro/ssh*"
type => "bro_ssh"
tags => ["bro", "import"]
}
file {
path => "/nsm/import/bro/ssl*"
type => "bro_ssl"
tags => ["bro", "import"]
}
file {
path => "/nsm/import/bro/syslog*"
type => "bro_syslog"
tags => ["bro", "import"]
}
file {
path => "/nsm/import/bro/tunnel*"
type => "bro_tunnels"
tags => ["bro", "import"]
}
file {
path => "/nsm/import/bro/weird*"
type => "bro_weird"
tags => ["bro", "import"]
}
file {
path => "/nsm/import/bro/x509*"
type => "bro_x509"
tags => ["bro", "import"]
}
}
filter {
if "import" in [tags] {
mutate {
#add_tag => [ "conf_file_0006"]
}
}
}

13
salt/logstash/files/conf.d/1000_preprocess_log_elapsed.conf
View File

@@ -1,13 +0,0 @@
# Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Email: justin@hasecuritysolution.com
# Last Update: 12/9/2016
filter {
ruby {
code => "event.set('task_start', Time.now.to_f)"
}
mutate {
#add_tag => [ "conf_file_1000"]
}
}

30
salt/logstash/files/conf.d/1001_preprocess_syslogng.conf
View File

@@ -1,30 +0,0 @@
# Updated by: Doug Burks
# Last Update: 5/15/2017
filter {
if "syslogng" in [tags] {
mutate {
rename => { "MESSAGE" => "message" }
rename => { "PROGRAM" => "type" }
rename => { "FACILITY" => "syslog-facility" }
rename => { "FILE_NAME" => "syslog-file_name" }
rename => { "HOST" => "syslog-host" }
rename => { "HOST_FROM" => "syslog-host_from" }
rename => { "LEGACY_MSGHDR" => "syslog-legacy_msghdr" }
rename => { "PID" => "syslog-pid" }
rename => { "PRIORITY" => "syslog-priority" }
rename => { "SOURCEIP" => "syslog-sourceip" }
rename => { "TAGS" => "syslog-tags" }
#add_tag => [ "conf_file_1000"]
}
if "bro_" in [type] {
mutate {
add_tag => [ "bro"]
}
} else {
mutate {
add_tag => [ "syslog"]
}
}
}
}

18
salt/logstash/files/conf.d/1002_preprocess_json.conf
View File

@@ -1,18 +0,0 @@
# Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Email: justin@hasecuritysolution.com
# Last Update: 12/9/2016
filter {
if "json" in [tags]{
json {
source => "message"
}
mutate {
remove_tag => [ "json" ]
}
mutate {
#add_tag => [ "conf_file_1001"]
}
}
}

24
salt/logstash/files/conf.d/1003_preprocess_bro.conf
View File

@@ -1,24 +0,0 @@
# Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Updated by: Doug Burks
# Last Update: 5/15/2017
filter {
if "bro" in [tags] {
# If a log comes in with a message starting with # then drop it as it doesn'then
# contain anything and is the header of a rotated bro log
if [message] =~ /^#/ {
drop { }
} else {
# Replace the host field with the host found in the bro log
if [bro_host] {
# mutate {
# replace => [ "host", "%{bro_host}" ]
# }
}
}
mutate {
#add_tag => [ "conf_file_1002"]
}
}
}

19
salt/logstash/files/conf.d/1004_preprocess_syslog_types.conf
View File

@@ -1,19 +0,0 @@
filter {
if "syslog" in [tags] {
if [host] == "172.16.1.1" {
mutate {
add_field => { "type" => "fortinet" }
add_tag => [ "firewall" ]
}
}
if [host] == "10.0.0.101" {
mutate {
add_field => { "type" => "brocade" }
add_tag => [ "switch" ]
}
}
mutate {
#add_tag => [ "conf_file_1003"]
}
}
}

156
salt/logstash/files/conf.d/1026_preprocess_dhcp.conf
View File

@@ -1,156 +0,0 @@
# Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Email: justin@hasecuritysolution.com
# Last Update: 12/9/2016
#
# This conf file is based on accepting logs for DHCP. It is currently based on Windows DHCP only.
filter {
if [type] == "dhcp" {
mutate {
add_field => { "Hostname" => "%{host}" }
}
mutate {
strip => "message"
}
}
# If the message contains nothing then drop it
if [message] =~ /^$/ {
drop { }
}
# If the message starts with # then drop it as it is the header of the DHCP log.
# This behavior is normal when the log is rotated.
if [message] =~ /^#/ {
drop { }
} else {
if [type] == "dhcp" {
# This is the initial parsing of the log
grok {
# Server 2008+
match => { "message" => "%{DATA:id},%{DATE_US:date},(?<time>%{HOUR}:%{MINUTE}:%{SECOND}),%{DATA:description},%{IPV4:ip},%{DATA:Hostname},%{DATA:mac},%{DATA:Username},%{INT:TransactionID},%{INT:QResult},%{DATA:ProbationTime},%{DATA:CorrelationID}"}
# Server 2003
match => { "message" => "%{DATA:id},%{DATE_US:date},(?<time>%{HOUR}:%{MINUTE}:%{SECOND}),%{DATA:description},%{IPV4:ip},%{DATA:Hostname},%{DATA:mac},"}
match => { "message" => "%{DATA:id},%{DATA:date},(?<time>%{HOUR}:%{MINUTE}:%{SECOND}),%{DATA:description},%{DATA:ip},%{DATA:Hostname},%{DATA:mac},"}
}
# This section below translates the message ID into something humans can understand.
if [id] == "00" {
mutate {
add_field => [ "event", "The log was started"]
}
}
if [id] == "01" {
mutate {
add_field => [ "event", "The log was stopped"]
}
}
if [id] == "02" {
mutate {
add_field => [ "event", "The log was temporarily paused due to low disk space"]
}
}
if [id] == "10" {
mutate {
add_field => [ "event", "A new IP address was leased to a client"]
}
}
if [id] == "11" {
mutate {
add_field => [ "event", "A lease was renewed by a client"]
}
}
if [id] == "12" {
mutate {
add_field => [ "event", "A lease was released by a client"]
}
}
if [id] == "13" {
mutate {
add_field => [ "event", "An IP address was found to be in use on the network"]
}
}
if [id] == "14" {
mutate {
add_field => [ "event", "A lease request could not be satisfied because the scope's address pool was exhausted"]
}
}
if [id] == "15" {
mutate {
add_field => [ "event", "A lease was denied"]
}
}
if [id] == "16" {
mutate {
add_field => [ "event", "A lease was deleted"]
}
}
if [id] == "17" {
mutate {
add_field => [ "event", "A lease was expired and DNS records for an expired leases have not been deleted"]
}
}
if [id] == "18" {
mutate {
add_field => [ "event", "A lease was expired and DNS records were deleted"]
}
}
if [id] == "20" {
mutate {
add_field => [ "event", "A BOOTP address was leased to a client"]
}
}
if [id] == "21" {
mutate {
add_field => [ "event", "A dynamic BOOTP address was leased to a client"]
}
}
if [id] == "22" {
mutate {
add_field => [ "event", "A BOOTP request could not be satisfied because the scope's address pool for BOOTP was exhausted"]
}
}
if [id] == "23" {
mutate {
add_field => [ "event", "A BOOTP IP address was deleted after checking to see it was not in use"]
}
}
if [id] == "24" {
mutate {
add_field => [ "event", "IP address cleanup operation has began"]
}
}
if [id] == "25" {
mutate {
add_field => [ "event", "IP address cleanup statistics"]
}
}
if [id] == "30" {
mutate {
add_field => [ "event", "DNS update request to the named DNS server"]
}
}
if [id] == "31" {
mutate {
add_field => [ "event", "DNS update failed"]
}
}
if [id] == "32" {
mutate {
add_field => [ "event", "DNS update successful"]
}
}
if [id] == "33" {
mutate {
add_field => [ "event", "Packet dropped due to NAP policy"]
}
}
# If the message failed to parse correctly keep the message for debugging. Otherwise, drop it.
#if "_grokparsefailure" not in [tags] {
# mutate {
# remove_field => [ "message"]
# }
#}
}
mutate {
#add_tag => [ "conf_file_1026"]
}
}
}

31
salt/logstash/files/conf.d/1029_preprocess_esxi.conf
View File

@@ -1,31 +0,0 @@
# Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Email: justin@hasecuritysolution.com
# Last Update: 12/9/2016
#
# This configuration file takes ESXi syslog messages and filters them. There is no input as the logs would have came in via syslog
filter {
# This is an example of using an IP address range to classify a syslog message to a specific type of log
# This is helpful as so many devices only send logs via syslog
if [host] =~ "10\.[0-1]\.9\." {
mutate {
replace => ["type", "esxi"]
}
}
if [host] =~ "\.234$" {
mutate {
replace => ["type", "esxi"]
}
}
if [type] == "esxi" {
grok {
match => { "message" => "(?:%{SYSLOGTIMESTAMP:timestamp}|%{TIMESTAMP_ISO8601:timestamp8601}) (?:%{SYSLOGHOST:logsource}) (?:%{SYSLOGPROG}): (?<messagebody>(?:\[(?<esxi_thread_id>[0-9A-Z]{8,8}) %{DATA:esxi_loglevel} \'%{DATA:esxi_service}\'\] %{GREEDYDATA:esxi_message}|%{GREEDYDATA}))"}
# pattern => ['(?:%{SYSLOGTIMESTAMP:timestamp}|%{TIMESTAMP_ISO8601:timestamp8601}) (?:%{SYSLOGHOST:logsource}) (?:%{SYSLOGPROG}): (?<messagebody>(?:\[(?<esxi_thread_id>[0-9A-Z]{8,8}) %{DATA:esxi_loglevel} \'%{DATA:esxi_service}\'\] %{GREEDYDATA:esxi_message}|%{GREEDYDATA}))']
}
mutate {
#add_tag => [ "conf_file_1029"]
}
}
}

21
salt/logstash/files/conf.d/1030_preprocess_greensql.conf
View File

@@ -1,21 +0,0 @@
# Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Email: justin@hasecuritysolution.com
# Last Update: 12/9/2016
filter {
if [type] == "greensql" {
# This section is parsing out the fields for GreenSQL syslog data
grok {
match => { "message" => "<%{INT:Code}>%{DATA:Category}\[%{INT:Transcation}\]:\s*Database=%{DATA:Database}\sUser=%{DATA:UserName}\sApplication Name=%{DATA:Application}\sSource IP=%{IPV4:SrcIp}\sSource Port=%{INT:SrcPort}\sTarget IP=?%{IPV4:DstIp}\sTarget Port=%{DATA:DstPort}\sQuery=%{GREEDYDATA:Query}"}
match => { "message" => "<%{INT:Code}>%{DATA:Category}\[%{INT:Transcation}\]:\sAdmin_Name=%{DATA:UserName}\sIP_Address=%{IPV4:SrcIp}\sUser_Agent=%{DATA:UserAgent}\sMessage=%{DATA:StatusMessage}\sDescription=%{DATA:Description}\sSeverity=%{GREEDYDATA:Severity}"}
}
# Remove the message field as it is unnecessary
#mutate {
# remove_field => [ "message"]
#}
mutate {
#add_tag => [ "conf_file_1030"]
}
}
}

21
salt/logstash/files/conf.d/1031_preprocess_iis.conf
View File

@@ -1,21 +0,0 @@
# Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Email: justin@hasecuritysolution.com
# Last Update: 12/9/2016
filter {
if [type] == "iis" {
# The log is expected to have come from NXLog and in JSON format. This allows for automatic parsing of fields
json {
source => "message"
}
# This removes the message field as it is unneccesary and tags the packet as web
mutate {
# remove_field => [ "message"]
add_tag => [ "web" ]
}
mutate {
#add_tag => [ "conf_file_1031"]
}
}
}

26
salt/logstash/files/conf.d/1032_preprocess_mcafee.conf
View File

@@ -1,26 +0,0 @@
# Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Email: justin@hasecuritysolution.com
# Last Update: 12/9/2016
#
# This file looks for McAfee EPO logs
filter {
if [type] == "mcafee" {
# NXLog should be sending the logs in JSON format so they auto parse
json {
source => "message"
}
# This section converts the UTC fields to the proper time format
date {
match => [ "ReceivedUTC", "YYYY-MM-dd HH:mm:ss" ]
target => [ "ReceivedUTC" ]
}
date {
match => [ "DetectedUTC", "YYYY-MM-dd HH:mm:ss" ]
target => [ "DetectedUTC" ]
}
mutate {
#add_tag => [ "conf_file_1032"]
}
}
}

89
salt/logstash/files/conf.d/1033_preprocess_snort.conf
View File

@@ -1,89 +0,0 @@
# Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Updated by: Wes Lambert
# Last Update: 12/15/2017
filter {
if [type] == "snort" {
# This is the initial parsing of the log
grok {
match => ["message", "\[%{INT:gid}:%{INT:sid}:%{INT:rev}\]\s%{DATA:alert}\[Classification:\s+%{DATA:classification}\]\s+\[Priority:\s+%{INT:priority}\]:\s+<%{DATA:interface}>\s+{%{DATA:protocol}}\s+(?:%{IPV4:source_ip}|%{IPV6:source_ip}):%{INT:source_port}\s+->\s+(?:%{IPV4:destination_ip}|%{IPV6:destination_ip}):%{INT:destination_port}",
"message", "\[%{INT:gid}:%{INT:sid}:%{INT:rev}\]\s%{DATA:alert}\[Classification:\s+%{DATA:classification}\]\s+\[Priority:\s+%{INT:priority}\]:\s+<%{DATA:interface}>\s+{%{DATA:protocol}}\s(?:%{IPV4:source_ip}|%{IPV6:source_ip})\s+->\s+(?:%{IPV4:destination_ip}|%{IPV6:destination_ip})",
"message", "\[%{INT:gid}:%{INT:sid}:%{INT:rev}\]\s%{DATA:alert}\[Classification:\s+%{DATA:classification}\]\s+\[Priority:\s+%{INT:priority}\]:\s+{%{DATA:protocol}}\s+(?:%{IPV4:source_ip}|%{IPV6:source_ip}):%{INT:source_port}\s+->\s+%{IPV4:destination_ip}:%{INT:destination_port}",
"message", "\[%{INT:gid}:%{INT:sid}:%{INT:rev}\]\s%{DATA:alert}\[Classification:\s+%{DATA:classification}\]\s+\[Priority:\s+%{INT:priority}\]:\s+{%{DATA:protocol}}\s(?:%{IPV4:source_ip}|%{IPV6:source_ip})\s+->\s+(?:%{IPV4:destination_ip}|%{IPV6:destination_ip})",
"message", "\[%{INT:gid}:%{INT:sid}:%{INT:rev}\]\s%{DATA:alert}\[Classification:\s+%{DATA:classification}\]\s+\[Priority:\s+%{INT:priority}\]:\s+{%{DATA:protocol}}\s+(?:%{IPV4:source_ip}|%{IPV6:source_ip}):%{INT:source_port}\s+->\s+(?:%{IPV4:destination_ip}|%{IPV6:destination_ip}):%{INT:destination_port}",
"message", "\[%{INT:gid}:%{INT:sid}:%{INT:rev}\]\s%{DATA:alert}\[Classification:\s+%{DATA:classification}\]\s+\[Priority:\s+%{INT:priority}\]:\s+{%{DATA:protocol}}\s(?:%{IPV4:source_ip}|%{IPV6:source_ip})\s+->\s+(?:%{IPV4:source_ip}|%{IPV6:source_ip})",
"message", "\[%{INT:gid}:%{INT:sid}:%{INT:rev}\]\s%{DATA:alert}\[Classification:\s+%{DATA:classification}\]\s+\[Priority:\s+%{INT:priority}\]:\s+{%{DATA:protocol}}",
"message", "%{GREEDYDATA:alert}"]
}
# If the alert is a Snort GPL alert break it apart for easier reading and categorization
if [alert] =~ "GPL " {
# This will parse out the category type from the alert
grok {
match => { "alert" => "GPL\s+%{DATA:category}\s" }
}
# This will store the category
mutate {
add_field => { "rule_type" => "Snort GPL" }
lowercase => [ "category"]
}
}
# If the alert is an Emerging Threat alert break it apart for easier reading and categorization
if [alert] =~ "ET " {
# This will parse out the category type from the alert
grok {
match => { "alert" => "ET\s+%{DATA:category}\s" }
}
# This will store the category
mutate {
add_field => { "rule_type" => "Emerging Threats" }
lowercase => [ "category"]
}
}
# I recommend changing the field types below to integer so searches can do greater than or less than
# and also so math functions can be ran against them
mutate {
convert => [ "source_port", "integer" ]
convert => [ "destination_port", "integer" ]
convert => [ "gid", "integer" ]
convert => [ "sid", "integer" ]
# remove_field => [ "message"]
}
# This will translate the priority field into a severity field of either High, Medium, or Low
if [priority] == 1 {
mutate {
add_field => { "severity" => "High" }
}
}
if [priority] == 2 {
mutate {
add_field => { "severity" => "Medium" }
}
}
if [priority] == 3 {
mutate {
add_field => { "severity" => "Low" }
}
}
# This section adds URLs to lookup information about a rule online
if [sid] and [sid] > 0 and [sid] < 1000000 {
mutate {
add_field => [ "signature_info", "https://www.snort.org/search?query=%{gid}-%{sid}" ]
}
}
if [sid] and [sid] > 1999999 and [sid] < 2999999 {
mutate {
add_field => [ "signature_info", "http://doc.emergingthreats.net/%{sid}" ]
}
}
if [gid] and [gid] == 1 and [sid] and [sid] > 0 and [sid] < 1000000000 {
ruby {
code => "sid = event.get('sid'); event.set('rule', `grep -h sid:#{sid} /etc/nsm/rules/*.rules | sort -u`)"
}
}
# mutate {
#add_tag => [ "conf_file_1033"]
# }
}
}

16
salt/logstash/files/conf.d/1034_preprocess_syslog.conf
View File

@@ -1,16 +0,0 @@
# Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Updated by: Doug Burks
# Last Update: 5/22/2017
filter {
if [type] == "syslog" {
# This drops syslog messages regarding license messages. You may want to comment it out.
#if [message] =~ "license" {
# drop { }
#}
mutate {
#convert => [ "status_code", "integer" ]
}
}
}

44
salt/logstash/files/conf.d/1100_preprocess_bro_conn.conf
View File

@@ -1,44 +0,0 @@
# Original Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Updated by: Wes Lambert
# Last Update: 12/14/2017
#
# This conf file is based on accepting logs for conn.log from Bro systems
filter {
if [type] == "bro_conn" {
# This is the initial parsing of the log
mutate {
gsub => [ "message", "[\"']", "" ]
}
csv {
columns => ["timestamp","uid","source_ip","source_port","destination_ip","destination_port","protocol","service","duration","original_bytes","respond_bytes","connection_state","local_orig","local_respond","missed_bytes","history","original_packets","original_ipbytes","respond_packets","respond_ipbytes","tunnel_parents","original_country_code","respond_country_code","sensor_name"]
# If you use a custom delimiter, change the following value in between the quotes to your delimiter. Otherwise, insert a literal <tab> in between the two quotes on your logstash system, use a text editor like nano that doesn't convert tabs to spaces.
separator => " "
}
translate {
field => "connection_state"
destination => "connection_state_description"
dictionary => [
"S0", "Connection attempt seen, no reply",
"S1", "Connection established, not terminated",
"S2", "Connection established and close attempt by originator seen (but no reply from responder)",
"S3", "Connection established and close attempt by responder seen (but no reply from originator)",
"SF", "Normal SYN/FIN completion",
"REJ", "Connection attempt rejected",
"RSTO", "Connection established, originator aborted (sent a RST)",
"RSTR", "Established, responder aborted",
"RSTOS0", "Originator sent a SYN followed by a RST, we never saw a SYN-ACK from the responder",
"RSTRH", "Responder sent a SYN ACK followed by a RST, we never saw a SYN from the (purported) originator",
"SH", "Originator sent a SYN followed by a FIN, we never saw a SYN ACK from the responder (hence the connection was 'half' open)",
"SHR", "Responder sent a SYN ACK followed by a FIN, we never saw a SYN from the originator",
"OTH", "No SYN seen, just midstream traffic (a 'partial connection' that was not later closed)"
]
}
mutate {
#add_tag => [ "conf_file_1100"]
}
}
}

17
salt/logstash/files/conf.d/1101_preprocess_bro_dhcp.conf
View File

@@ -1,17 +0,0 @@
# Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Email: justin@hasecuritysolution.com
# Last Update: 12/9/2016
#
# This conf file is based on accepting logs for dhcp.log from Bro systems
filter {
if [type] == "bro_dhcp" {
# This is the initial parsing of the log
grok {
match => [ "message", "(?<timestamp>(.*?))\t(?<uid>(.*?))\t(?<source_ip>(.*?))\t(?<source_port>(.*?))\t(?<destination_ip>(.*?))\t(?<destination_port>(.*?))\t(?<mac>(.*?))\t(?<assigned_ip>(.*?))\t(?<lease_time>(.*?))\t(?<transaction_id>(.*))" ]
}
mutate {
#add_tag => [ "conf_file_1101"]
}
}
}

36
salt/logstash/files/conf.d/1102_preprocess_bro_dns.conf
View File

@@ -1,36 +0,0 @@
# Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Email: justin@hasecuritysolution.com
# Updated by Wes Lambert
# Last Update: 12/14/2017
#
# This conf file is based on accepting logs for dns.log from Bro systems
filter {
if [type] == "bro_dns" {
# This is the initial parsing of the log
mutate {
gsub => [ "message", "[\"']", "" ]
}
csv {
columns => ["timestamp","uid","source_ip","source_port","destination_ip","destination_port","protocol","transaction_id","rtt","query","query_class","query_class_name","query_type","query_type_name","rcode","rcode_name","aa","tc","rd","ra","z","answers","ttls","rejected"]
#If you use a custom delimiter, change the following value in between the quotes to your delimiter. Otherwise, insert a literal <tab> in between the two quotes on your logstash system, use a text editor like nano that doesn't convert tabs to spaces.
separator => " "
}
mutate {
add_tag => [ "dns" ]
}
if [ttls] == "-" {
mutate {
remove_field => [ "ttls" ]
}
} else {
mutate {
convert => [ "ttls", "float" ]
}
}
mutate {
#add_tag => [ "conf_file_1102"]
}
}
}

22
salt/logstash/files/conf.d/1103_preprocess_bro_dpd.conf
View File

@@ -1,22 +0,0 @@
# Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Email: justin@hasecuritysolution.com
# Updated by Wes Lambert
# Last Update: 12/14/2017
#
# This conf file is based on accepting logs for dpd.log from Bro systems
filter {
if [type] == "bro_dpd" {
# This is the initial parsing of the log
mutate {
gsub => [ "message", "[\"']", "" ]
}
csv {
columns => ["timestamp","uid","source_ip","source_port","destination_ip","destination_port","protocol","analyzer","failure_reason"]
separator => " "
}
mutate {
#add_tag => [ "conf_file_1103"]
}
}
}

18
salt/logstash/files/conf.d/1104_preprocess_bro_files.conf
View File

@@ -1,18 +0,0 @@
# Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Email: justin@hasecuritysolution.com
# Last Update: 12/14/2017 - Wes lambert
#
# This conf file is based on accepting logs for files.log from Bro systems
filter {
if [type] == "bro_files" {
# This is the initial parsing of the log
csv {
columns => ["timestamp","fuid","file_ip","destination_ip","connection_uids","source","depth","analyzer","mimetype","file_name","duration","local_orig","is_orig","seen_bytes","total_bytes","missing_bytes","overflow_bytes","timed_out","parent_fuid","md5","sha1","sha256","extracted"]
separator => " "
}
mutate {
#add_tag => [ "conf_file_1104"]
}
}
}

21
salt/logstash/files/conf.d/1105_preprocess_bro_ftp.conf
View File

@@ -1,21 +0,0 @@
# Original Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Updated by: Wes Lambert
# Last Update: 12/14/2017
#
# This conf file is based on accepting logs for ftp.log from Bro systems
filter {
if [type] == "bro_ftp" {
# This is the initial parsing of the log
mutate {
gsub => [ "message", "[\"']", "" ]
}
csv {
columns => ["timestamp","uid","source_ip","source_port","destination_ip","destination_port","ftp_username","password","ftp_command","ftp_argument","mimetype","file_size","reply_code","reply_message","data_channel_passive","data_channel_source_ip","data_channel_destination_ip","data_channel_destination_port","fuid"]
separator => " "
}
mutate {
#add_tag => [ "conf_file_1105"]
}
}
}

21
salt/logstash/files/conf.d/1106_preprocess_bro_http.conf
View File

@@ -1,21 +0,0 @@
# Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Updated by: Doug Burks
# Last Update: 5/15/2017
#
# This conf file is based on accepting logs for http.log from Bro systems
filter {
if [type] == "bro_http" {
grok {
match => [ "message", "(?<timestamp>(.*?))\t(?<uid>(.*?))\t(?<source_ip>(.*?))\t(?<source_port>(.*?))\t(?<destination_ip>(.*?))\t(?<destination_port>(.*?))\t(?<trans_depth>(.*?))\t(?<method>(.*?))\t(?<virtual_host>(.*?))\t(?<uri>(.*?))\t(?<referrer>(.*?))\t(?<version>(.*?))\t(?<useragent>(.*?))\t(?<request_body_length>(.*?))\t(?<response_body_length>(.*?))\t(?<status_code>(.*?))\t(?<status_message>(.*?))\t(?<info_code>(.*?))\t(?<info_message>(.*?))\t(?<tags>(.*))\t(?<user>(.*))\t(?<password>(.*))\t(?<proxied>(.*))\t(?<orig_fuids>(.*))\t(?<orig_filenames>(.*?))\t(?<orig_mime_types>(.*))\t(?<resp_fuids>(.*))\t(?<resp_filenames>(.*?))\t(?<resp_mime_types>(.*))" ]
}
if [useragent] == "-" {
mutate {
remove_field => [ "useragent" ]
}
}
mutate {
#add_tag => [ "conf_file_1106"]
}
}
}

22
salt/logstash/files/conf.d/1107_preprocess_bro_irc.conf
View File

@@ -1,22 +0,0 @@
# Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Email: justin@hasecuritysolution.com
# Update by Wes Lambert
# Last Update: 12/14/2017
#
# This conf file is based on accepting logs for irc.log from Bro systems
filter {
if [type] == "bro_irc" {
# This is the initial parsing of the log
mutate {
gsub => [ "message", "[\"']", "" ]
}
csv {
columns => ["timestamp","uid","source_ip","source_port","destination_ip","destination_port","nick","irc_username","irc_command","value","additional_info","dcc_file_name","dcc_file_size","dcc_mime_type","fuid"]
separator => " "
}
mutate {
#add_tag => [ "conf_file_1107"]
}
}
}

20
salt/logstash/files/conf.d/1108_preprocess_bro_kerberos.conf
View File

@@ -1,20 +0,0 @@
# Original Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Updated by: Wes Lambert
# Last Update: 12/14/2017
#
# This conf file is based on accepting logs for kerberos.log from Bro systems
filter {
if [type] == "bro_kerberos" {
mutate {
gsub => [ "message", "[\"']", "" ]
}
csv {
columns => ["timestamp","uid","source_ip","source_port","destination_ip","destination_port","request_type","client","service","kerberos_success","error_message","valid_from","valid_till","cipher","forwardable","renewable","client_certificate_subject","client_certificate_fuid","server_certificate_subject","server_certificate_fuid"]
separator => " "
}
mutate {
#add_tag => [ "conf_file_1108"]
}
}
}

22
salt/logstash/files/conf.d/1109_preprocess_bro_notice.conf
View File

@@ -1,22 +0,0 @@
# Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Email: justin@hasecuritysolution.com
# Update by Wes Lambert
# Last Update: 12/14/2017
#
# This conf file is based on accepting logs for notice.log from Bro systems
filter {
if [type] == "bro_notice" {
# This is the initial parsing of the log
mutate {
gsub => [ "message", "[\"']", "" ]
}
csv {
columns => ["timestamp","uid","source_ip","source_port","destination_ip","destination_port","fuid","file_mime_type","file_description","protocol","note","msg","sub_msg","source_ip","destination_ip","p","n","peer_description","action","suppress_for","dropped","destination_country_code","destination_region","destination_city","destination_latitude","destination_longitude"]
separator => " "
}
mutate {
#add_tag => [ "conf_file_1109"]
}
}
}

21
salt/logstash/files/conf.d/1110_preprocess_bro_rdp.conf
View File

@@ -1,21 +0,0 @@
# Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Email: justin@hasecuritysolution.com
# Update by Wes Lambert
# Last Update: 12/14/2016
#
# This conf file is based on accepting logs for weird.log from Bro systems
filter {
if [type] == "bro_rdp" {
mutate {
gsub => [ "message", "[\"']", "" ]
}
csv {
columns => ["timestamp","uid","source_ip","source_port","destination_ip","destination_port","cookie","result","security_protocol","keyboard_layout","client_build","client_name","client_digital_product_id","desktop_width","desktop_height","requested_color_depth","certificate_type","certificate_count","certificate_permanent","encryption_level","encryption_method"]
separator => " "
}
mutate {
#add_tag => [ "conf_file_1110"]
}
}
}

22
salt/logstash/files/conf.d/1111_preprocess_bro_signatures.conf
View File

@@ -1,22 +0,0 @@
# Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Email: justin@hasecuritysolution.com
# Updated by Wes Lambert
# Last Update: 12/14/2017
#
# This conf file is based on accepting logs for signatures.log from Bro systems
filter {
if [type] == "bro_signatures" {
# This is the initial parsing of the log
mutate {
gsub => [ "message", "[\"']", "" ]
}
csv {
columns => ["timestamp","uid","source_ip","source_port","destination_ip","destination_port","note","signature_id","event_message","sub_message","signature_count","host_count"]
separator => " "
}
mutate {
#add_tag => [ "conf_file_1111"]
}
}
}

21
salt/logstash/files/conf.d/1112_preprocess_bro_smtp.conf
View File

@@ -1,21 +0,0 @@
# Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Updated by: Doug Burks
# Last Update: 5/15/2017
#
# This conf file is based on accepting logs for smtp.log from Bro systems
filter {
if [type] == "bro_smtp" {
grok {
match => [ "message", "(?<timestamp>(.*?))\t(?<uid>(.*?))\t(?<source_ip>(.*?))\t(?<source_port>(.*?))\t(?<destination_ip>(.*?))\t(?<destination_port>(.*?))\t(?<trans_depth>(.*?))\t(?<helo>(.*?))\t(?<mail_from>(.*?))\t(?<recipient_to>(.*?))\t(?<mail_date>(.*?))\t(?<from>(.*?))\t(?<to>(.*?))\t(?<cc>(.*?))\t(?<reply_to>(.*?))\t(?<message_id>(.*?))\t(?<in_reply_to>(.*?))\t(?<subject>(.*?))\t(?<x_originating_ip>(.*?))\t(?<first_received>(.*))\t(?<second_received>(.*))\t(?<last_reply>(.*))\t(?<path>(.*))\t(?<useragent>(.*))\t(?<tls>(.*))\t(?<fuids>(.*))\t(?<is_webmail>(.*))" ]
}
if [useragent] == "-" {
mutate {
remove_field => [ "useragent" ]
}
}
mutate {
#add_tag => [ "conf_file_1112"]
}
}
}

22
salt/logstash/files/conf.d/1113_preprocess_bro_snmp.conf
View File

@@ -1,22 +0,0 @@
# Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Email: justin@hasecuritysolution.com
# Update by Wes Lambert
# Last Update: 12/14/2017
#
# This conf file is based on accepting logs for snmp.log from Bro systems
filter {
if [type] == "bro_snmp" {
# This is the initial parsing of the log
mutate {
gsub => [ "message", "[\"']", "" ]
}
csv {
columns => ["timestamp","uid","source_ip","source_port","destination_ip","destination_port","duration","version","community","get_requests","get_bulk_requests","get_responses","set_requests","display_string","up_since"]
separator => " "
}
mutate {
#add_tag => [ "conf_file_1113"]
}
}
}

22
salt/logstash/files/conf.d/1114_preprocess_bro_software.conf
View File

@@ -1,22 +0,0 @@
# Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Email: justin@hasecuritysolution.com
# Update by Wes Lambert
# Last Update: 12/14/2017
#
# This conf file is based on accepting logs for software.log from Bro systems
filter {
if [type] == "bro_software" {
# This is the initial parsing of the log
mutate {
gsub => [ "message", "[\"']", "" ]
}
csv {
columns => ["timestamp","source_ip","source_port","software_type","name","version_major","version_minor","version_minor2","version_minor3","version_additional_info","unparsed_version"]
separator => " "
}
mutate {
#add_tag => [ "conf_file_1114"]
}
}
}

21
salt/logstash/files/conf.d/1115_preprocess_bro_ssh.conf
View File

@@ -1,21 +0,0 @@
# Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Updated by: Wes Lambert
# Last Update: 12/14/2017
#
# This conf file is based on accepting logs for ssh.log from Bro systems
filter {
if [type] == "bro_ssh" {
# This is the initial parsing of the log
mutate {
gsub => [ "message", "[\"']", "" ]
}
csv {
columns => ["timestamp","uid","source_ip","source_port","destination_ip","destination_port","version","authentication_success","authentication_attempts","direction","client","server","cipher_algorithm","mac_algorithm","compression_algorithm","kex_algorithm","host_key_algorithm","host_key","destination_country_code","destination_region","destination_city","destination_latitude","destination_longitude"]
separator => " "
}
mutate {
#add_tag => [ "conf_file_1115"]
}
}
}

149
salt/logstash/files/conf.d/1116_preprocess_bro_ssl.conf
View File

@@ -1,149 +0,0 @@
# Original Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Updated by: Wes Lambert
# Last Update: 12/14/2017
#
# This conf file is based on accepting logs for ssl.log from Bro systems
filter {
if [type] == "bro_ssl" {
# This is the initial parsing of the log
mutate {
gsub => [ "message", "[\"']", "" ]
}
csv {
columns => ["timestamp","uid","source_ip","source_port","destination_ip","destination_port","version","cipher","curve","server_name","resumed","last_alert","next_protocol","established","certificate_chain_fuids","client_certificate_chain_fuids","certificate_subject","certificate_issuer","client_subject","client_issuer","validation_status","ja3"]
separator => " "
}
mutate {
gsub => [ "subject", "\\\\,", "|" ]
}
kv {
include_keys => [ "CN", "C", "O", "OU", "ST", "SN", "L", "DC", "GN", "pseudonym", "serialNumber", "title", "initials" ]
field_split => ","
source => "certificate_issuer"
}
mutate {
rename => { "CN" => "issuer_common_name"}
rename => { "C" => "issuer_country_code"}
rename => { "O" => "issuer_organization"}
rename => { "OU" => "issuer_organization_unit"}
rename => { "ST" => "issuer_state"}
rename => { "SN" => "issuer_surname"}
rename => { "L" => "issuer_locality"}
rename => { "DC" => "issuer_distinguished_name"}
rename => { "GN" => "issuer_given_name"}
rename => { "pseudonym" => "issuer_pseudonym"}
rename => { "serialNumber" => "issuer_serial_number"}
rename => { "title" => "issuer_title"}
rename => { "initials" => "issuer_initials"}
}
kv {
include_keys => [ "CN", "C", "O", "OU", "ST", "SN", "L", "GN", "pseudonym", "serialNumber", "title", "initials" ]
field_split => ","
source => "certificate_subject"
}
mutate {
rename => { "CN" => "certificate_common_name"}
rename => { "C" => "certificate_country_code"}
rename => { "O" => "certificate_organization"}
rename => { "OU" => "certificate_organization_unit"}
rename => { "ST" => "certificate_state"}
rename => { "SN" => "certificate_surname"}
rename => { "L" => "certificate_locality"}
rename => { "GN" => "certificate_given_name"}
rename => { "pseudonym" => "certificate_pseudonym"}
rename => { "serialNumber" => "certificate_serial_number"}
rename => { "title" => "certificate_title"}
rename => { "initials" => "certificate_initials"}
}
if [certificate_subject] == "-" {
mutate {
remove_field => [ "certificate_subject" ]
}
}
if [certificate_issuer] == "-" {
mutate {
remove_field => [ "certificate_issuer" ]
}
}
if [certificate_common_name] {
ruby {
code => "event.set('certificate_common_name_length', event.get('certificate_common_name').length)"
}
}
if [issuer_common_name] {
ruby {
code => "event.set('issuer_common_name_length', event.get('issuer_common_name').length)"
}
}
if [server_name] == "-" {
mutate {
remove_field => [ "server_name" ]
}
} else {
ruby {
code => "event.set('server_name_length', event.get('server_name').length)"
}
}
if [certificate_chain_fuids] == "-" {
mutate {
remove_field => [ "certificate_chain_fuids" ]
}
} else {
ruby {
code => "event.set('certificate_chain_count', event.get('certificate_chain_fuids').count(',') + 1)"
}
mutate {
convert => [ "certificate_chain_length", "integer" ]
}
}
if [client_certificate_chain_fuids] == "-" {
mutate {
remove_field => [ "client_certificate_chain_fuids" ]
}
}
if [client_issuer] == "-" {
mutate {
remove_field => [ "client_issuer" ]
}
}
if [client_subject] == "-" {
mutate {
remove_field => [ "client_subject" ]
}
}
if [curve] == "-" {
mutate {
remove_field => [ "curve" ]
}
}
if [issuer] == "-" {
mutate {
remove_field => [ "issuer" ]
}
}
if [query] == "-" {
mutate {
remove_field => [ "query" ]
}
}
if [subject] == "-" {
mutate {
remove_field => [ "subject" ]
}
}
if [validation_status] == "-" {
mutate {
remove_field => [ "validation_status" ]
}
}
if [ja3] == "-" {
mutate {
remove_field => [ "ja3" ]
}
}
mutate {
#add_tag => [ "conf_file_1116"]
}
}
}

23
salt/logstash/files/conf.d/1117_preprocess_bro_syslog.conf
View File

@@ -1,23 +0,0 @@
# Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Email: justin@hasecuritysolution.com
#
# Updated by Wes Lambert
# Last Update: 12/14/2017
#
# This conf file is based on accepting logs for syslog.log from Bro systems
filter {
if [type] == "bro_syslog" {
# This is the initial parsing of the log
mutate {
gsub => [ "message", "[\"']", "" ]
}
csv {
columns => ["timestamp","uid","source_ip","source_port","destination_ip","destination_port","protocol","facility","severity","message"]
separator => " "
}
mutate {
#add_tag => [ "conf_file_1117"]
}
}
}

22
salt/logstash/files/conf.d/1118_preprocess_bro_tunnel.conf
View File

@@ -1,22 +0,0 @@
# Original Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Updated by: Wes Lambert
# Last Update: 12/14/2017
#
# This conf file is based on accepting logs for tunnel.log from Bro systems
# Security Onion syslog-ng.conf sets type to "bro_tunnels"
filter {
if [type] == "bro_tunnels" {
# This is the initial parsing of the log
mutate {
gsub => [ "message", "[\"']", "" ]
}
csv {
columns => ["timestamp","uid","source_ip","source_port","destination_ip","destination_port","tunnel_type","action"]
separator => " "
}
mutate {
#add_tag => [ "conf_file_1118"]
}
}
}

16
salt/logstash/files/conf.d/1119_preprocess_bro_weird.conf
View File

@@ -1,16 +0,0 @@
# Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Email: justin@hasecuritysolution.com
# Last Update: 12/9/2016
#
# This conf file is based on accepting logs for weird.log from Bro systems
filter {
if [type] == "bro_weird" {
grok {
match => [ "message", "(?<timestamp>(.*?))\t(?<uid>(.*?))\t(?<source_ip>(.*?))\t(?<source_port>(.*?))\t(?<destination_ip>(.*?))\t(?<destination_port>(.*?))\t(?<name>(.*?))\t(?<additional_info>(.*?))\t(?<notice>(.*?))\t(?<peer>(.*))" ]
}
mutate {
#add_tag => [ "conf_file_1119"]
}
}
}

30
salt/logstash/files/conf.d/1121_preprocess_bro_mysql.conf
View File

@@ -1,30 +0,0 @@
# Original Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Updated by: Wes Lambert
# Last Update: 12/14/2017
#
# This conf file is based on accepting logs for mysql.log from Bro systems
#
# Parse using grok
filter {
if [type] == "bro_mysql" {
grok {
match => [ "message", "(?<timestamp>(.*?))\t(?<uid>(.*?))\t(?<source_ip>(.*?))\t(?<source_port>(.*?))\t(?<destination_ip>(.*?))\t(?<destination_port>(.*?))\t(?<mysql_command>(.*?))\t(?<mysql_argument>(.*?))\t(?<mysql_success>(.*?))\t(?<rows>(.*?))\t(?<response>(.*))" ]
}
mutate {
#add_tag => [ "conf_file_1121"]
}
}
}
# Reverting to grok for now, due to double-quoted values in log file
# Parse using csv filter
#filter {
# if [type] == "bro_mysql" {
# csv {
# columns => ["timestamp","uid","source_ip","source_port","destination_ip","destination_port","mysql_command","mysql_argument","mysql_success","rows","response"]
# separator => " "
# quote_char=
# }
# }
#}

34
salt/logstash/files/conf.d/1122_preprocess_bro_socks.conf
View File

@@ -1,34 +0,0 @@
# Original Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Updated by: Wes Lambert
# Last Update: 12/14/2017
#
# This conf file is based on accepting logs for socks.log from Bro systems
# Parse using csv
filter {
if [type] == "bro_socks" {
mutate {
gsub => [ "message", "[\"']", "" ]
}
csv {
columns => ["timestamp","uid","source_ip","source_port","destination_ip","destination_port","version","user","password","server_status","request_host","request_name","request_port","bound_host","bound_name","bound_port"]
separator => " "
}
mutate {
#add_tag => [ "conf_file_1105"]
}
}
}
# Parse using grok
#filter {
# if [type] == "bro_socks" {
# # This is the initial parsing of the log
# grok {
# match => [ "message", "(?<timestamp>(.*?))\t(?<uid>(.*?))\t(?<source_ip>(.*?))\t(?<source_port>(.*?))\t(?<destination_ip>(.*?))\t(?<destination_port>(.*?))\t(?<version>(.*?))\t(?<user>(.*?))\t(?<password>(.*?))\t(?<status>(.*))\t(?<request_host>(.*))\t(?<request_name>(.*))\t(?<request_port>(.*))\t(?<bound_host>(.*))\t(?<bound_name>(.*))\t(?<bound_port>(.*))" ]
# }
# mutate {
# #add_tag => [ "conf_file_1122"]
# }
# }
#}

123
salt/logstash/files/conf.d/1123_preprocess_bro_x509.conf
View File

@@ -1,123 +0,0 @@
# Original Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Updated by: Doug Burks
# Last Update: 5/13/2017
#
# This conf file is based on accepting logs for x509.log from Bro systems
filter {
if [type] == "bro_x509" {
grok {
match => [ "message", "(?<timestamp>(.*?))\t(?<id>(.*?))\t(?<certificate_version>(.*?))\t(?<certificate_serial>(.*?))\t(?<certificate_subject>(.*?))\t(?<certificate_issuer>(.*?))\t(?<certificate_not_valid_before>(.*?))\t(?<certificate_not_valid_after>(.*?))\t(?<certificate_key_algorithm>(.*?))\t(?<certificate_signing_algorithm>(.*))\t(?<certificate_key_type>(.*))\t(?<certificate_key_length>(.*))\t(?<certificate_exponent>(.*))\t(?<certificate_curve>(.*))\t(?<san_dns>(.*))\t(?<san_uri>(.*))\t(?<san_email>(.*))\t(?<san_ip>(.*))\t(?<basic_constraints_ca>(.*))\t(?<basic_constraints_path_length>(.*))" ]
}
mutate {
gsub => [ "certificate_issuer", "\\\\,", "|" ]
gsub => [ "certificate_subject", "\\\\,", "|" ]
}
kv {
include_keys => [ "CN", "C", "O", "OU", "ST", "SN", "L", "DC", "GN", "pseudonym", "serialNumber", "title", "initials" ]
field_split => ","
source => "certificate_issuer"
}
mutate {
rename => { "CN" => "issuer_common_name"}
rename => { "C" => "issuer_country_code"}
rename => { "O" => "issuer_organization"}
rename => { "OU" => "issuer_organization_unit"}
rename => { "ST" => "issuer_state"}
rename => { "SN" => "issuer_surname"}
rename => { "L" => "issuer_locality"}
rename => { "DC" => "issuer_distinguished_name"}
rename => { "GN" => "issuer_given_name"}
rename => { "pseudonym" => "issuer_pseudonym"}
rename => { "serialNumber" => "issuer_serial_number"}
rename => { "title" => "issuer_title"}
rename => { "initials" => "issuer_initials"}
}
kv {
include_keys => [ "CN", "C", "O", "OU", "ST", "SN", "L", "GN", "pseudonym", "serialNumber", "title", "initials" ]
field_split => ","
source => "certificate_subject"
}
mutate {
rename => { "CN" => "certificate_common_name"}
rename => { "C" => "certificate_country_code"}
rename => { "O" => "certificate_organization"}
rename => { "OU" => "certificate_organization_unit"}
rename => { "ST" => "certificate_state"}
rename => { "SN" => "certificate_surname"}
rename => { "L" => "certificate_locality"}
rename => { "GN" => "certificate_given_name"}
rename => { "pseudonym" => "certificate_pseudonym"}
rename => { "serialNumber" => "certificate_serial_number"}
rename => { "title" => "certificate_title"}
rename => { "initials" => "certificate_initials"}
convert => [ "certificate_key_length", "integer" ]
convert => [ "certificate_not_valid_after", "integer" ]
convert => [ "certificate_not_valid_before", "integer" ]
}
if [query] == "-" {
mutate {
remove_field => [ "query" ]
}
}
if [san_dns] == "-" {
mutate {
remove_field => [ "san_dns" ]
}
}
if [san_email] == "-" {
mutate {
remove_field => [ "san_email" ]
}
}
if [san_uri] == "-" {
mutate {
remove_field => [ "san_uri" ]
}
}
if [san_ip] == "-" {
mutate {
remove_field => [ "san_ip" ]
}
}
if [certificate_common_name] {
ruby {
code => "event.set('certificate_common_name_length', event.get('certificate_common_name').length)"
}
}
if [issuer_common_name] {
ruby {
code => "event.set('issuer_common_name_length', event.get('issuer_common_name').length)"
}
}
if [certificate_not_valid_after] == "-" {
mutate {
remove_field => [ "certificate_not_valid_after" ]
}
}
if [certificate_not_valid_before] == "-" {
mutate {
remove_field => [ "certificate_not_valid_before" ]
}
}
if [certificate_not_valid_after] and [certificate_not_valid_before] {
ruby {
code => "event.set('certificate_number_days_valid', ((event.get('certificate_not_valid_after') - event.get('certificate_not_valid_before')) / 86400).ceil)"
}
date {
match => [ "certificate_not_valid_after", "UNIX" ]
target => "certificate_not_valid_after"
}
date {
match => [ "certificate_not_valid_before", "UNIX" ]
target => "certificate_not_valid_before"
}
}
mutate {
#add_tag => [ "conf_file_1123"]
}
}
}

21
salt/logstash/files/conf.d/1124_preprocess_bro_intel.conf
View File

@@ -1,21 +0,0 @@
# Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Updated by: Wes Lambert
# Last Update: 12/14/2017
#
# This conf file is based on accepting logs for intel.log from Bro systems
filter {
if [type] == "bro_intel" {
# This is the initial parsing of the log
mutate {
gsub => [ "message", "[\"']", "" ]
}
csv {
columns => ["timestamp","uid","source_ip","source_port","destination_ip","destination_port","indicator","indicator_type","seen_where","seen_node","matched","sources","fuid","mimetype","file_description"]
separator => " "
}
mutate {
#add_tag => [ "conf_file_1124"]
}
}
}

34
salt/logstash/files/conf.d/1125_preprocess_bro_modbus.conf
View File

@@ -1,34 +0,0 @@
# Author: Wes Lambert
# wlambertts@gmail.com
#
# Adapted from existing filters provided by Justin Henderson
#
# Last Update: 12/14/2017
#
# This conf file is based on accepting logs for modbus.log from Bro systems
#
# Parse using csv filter
filter {
if [type] == "bro_modbus" {
# This is the initial parsing of the log
mutate {
gsub => [ "message", "[\"']", "" ]
}
csv {
columns => ["timestamp","uid","source_ip","source_port","destination_ip","destination_port","function","exception"]
separator => " "
}
}
}
# Parse using grok
#filter {
# if [type] == "bro_modbus" {
# grok {
# match => [ "message", "(?<timestamp>(.*?))\t(?<uid>(.*?))\t(?<source_ip>(.*?))\t(?<source_port>(.*?))\t(?<destination_ip>(.*?))\t(?<destination_port>(.*?))\t(?<func>(.*?))\t(?<exception>(.*?))$" ]
# }
#mutate {
#add_tag => [ "conf_file_1125"]
#}
# }
#}

32
salt/logstash/files/conf.d/1126_preprocess_bro_sip.conf
View File

@@ -1,32 +0,0 @@
# Author: Wes Lambert
# wlambertts@gmail.com
#
# Adapted from existing filters provided by Justin Henderson
#
# Last Update: 05/12/2017
#
# This conf file is based on accepting logs for sip.log from Bro systems
#
# Parse using csv filter
#filter {
# if [type] == "bro_sip" {
# csv {
# columns => ["timestamp","uid","source_ip","source_port","destination_ip","destination_port","trans_depth","method","uri","date","request_from","request_to","response_from","response_to","reply_to","call_id","seq","subject","request_path","response_path","user_agent","status_code","status_msg","warning","request_body_len","response_body_len","content_type"]
# separator => " "
# }
# }
#}
# some sip logs have quotes which cause csvparsefailures, so let's fall back to grok
# Parse using grok
filter {
if [type] == "bro_sip" {
grok {
match => [ "message", "(?<timestamp>(.*?))\t(?<uid>(.*?))\t(?<source_ip>(.*?))\t(?<source_port>(.*?))\t(?<destination_ip>(.*?))\t(?<destination_port>(.*?))\t(?<trans_depth>(.*?))\t(?<method>(.*?))\t(?<uri>(.*?))\t(?<date>(.*?))\t(?<request_from>(.*?))\t(?<request_to>(.*?))\t(?<response_from>(.*?))\t(?<response_to>(.*?))\t(?<reply_to>(.*?))\t(?<call_id>(.*?))\t(?<seq>(.*?))\t(?<subject>(.*?))\t(?<request_path>(.*?))\t(?<response_path>(.*?))\t(?<user_agent>(.*?))\t(?<status_code>(.*?))\t(?<status_msg>(.*?))\t(?<warning>(.*?))\t(?<request_body_len>(.*?))\t(?<response_body_len>(.*?))\t(?<content_type>(.*?))$" ]
}
mutate {
add_tag => [ "conf_file_1126"]
}
}
}

33
salt/logstash/files/conf.d/1127_preprocess_bro_radius.conf
View File

@@ -1,33 +0,0 @@
# Author: Wes Lambert
# wlambertts@gmail.com
#
# Adapted from existing filters provided by Justin Henderson
#
# Last Update: 12/14/2017
#
# This conf file is based on accepting logs for radius.log from Bro systems
#
# Parse using csv filter
filter {
if [type] == "bro_radius" {
mutate {
gsub => [ "message", "[\"']", "" ]
}
csv {
columns => ["timestamp","uid","source_ip","source_port","destination_ip","destination_port","radius_username","mac","remote_ip","connect_info","result","logged"]
separator => " "
}
}
}
# Parse using grok
#filter {
# if [type] == "bro_radius" {
# grok {
# match => [ "message", "(?<timestamp>(.*?))\t(?<uid>(.*?))\t(?<source_ip>(.*?))\t(?<source_port>(.*?))\t(?<destination_ip>(.*?))\t(?<destination_port>(.*?))\t(?<username>(.*?))\t(?<mac>(.*?))\t(?<remote_ip>(.*?))\t(?<logged>(.*?))\t(?<connect_info>(.*?))$" ]
# }
# mutate {
# #add_tag => [ "conf_file_1127"]
# }
# }
#}

33
salt/logstash/files/conf.d/1128_preprocess_bro_pe.conf
View File

@@ -1,33 +0,0 @@
# Author: Wes Lambert
# wlambertts@gmail.com
#
# Adapted from existing filters provided by Justin Henderson
#
# Last Update: 12/14/2017
#
# This conf file is based on accepting logs for pe.log from Bro systems
#
# Parse using csv filter
filter {
if [type] == "bro_pe" {
mutate {
gsub => [ "message", "[\"']", "" ]
}
csv {
columns => ["timestamp","fuid","machine","compile_ts","os","subsystem","is_exe","is_64bit","uses_aslr","uses_dep","uses_code_integrity","uses_seh","has_import_table","has_export_table","has_cert_table","has_debug_data","section_names"]
separator => " "
}
}
}
# Parse using grok
#filter {
# if [type] == "bro_pe" {
# grok {
# match => [ "message", "(?<timestamp>(.*?))\t(?<fuid>(.*?))\t(?<machine>(.*?))\t(?<compile_ts>(.*?))\t(?<os>(.*?))\t(?<subsystem>(.*?))\t(?<is_exe>(.*?))\t(?<is_64bit>(.*?))\t(?<uses_aslr>(.*?))\t(?<uses_dep>(.*?))\t(?<uses_code_integrity>(.*?))\t(?<uses_seh>(.*?))\t(?<has_import_table>(.*?))\t(?<has_export_table>(.*?))\t(?<has_cert_table>(.*?))\t(?<has_debug_data>(.*?))\t(?<section_names>(.*?))$" ]
# }
# mutate {
# #add_tag => [ "conf_file_1128"]
# }
# }
#}

33
salt/logstash/files/conf.d/1129_preprocess_bro_rfb.conf
View File

@@ -1,33 +0,0 @@
# Author: Wes Lambert
# wlambertts@gmail.com
#
# Adapted from existing filters provided by Justin Henderson
#
# Last Update: 12/14/2017
#
# This conf file is based on accepting logs for rfb.log from Bro systems
#
# Parse using csv filter
filter {
if [type] == "bro_rfb" {
mutate {
gsub => [ "message", "[\"']", "" ]
}
csv {
columns => ["timestamp","uid","source_ip","source_port","destination_ip","destination_port","client_major_version","client_minor_version","server_major_version","server_minor_version","authentication_method","auth","share_flag","desktop_name","width","height"]
separator => " "
}
}
}
# Parse using grok
#filter {
# if [type] == "bro_rfb" {
# grok {
# match => [ "message", "(?<timestamp>(.*?))\t(?<uid>(.*?))\t(?<source_ip>(.*?))\t(?<source_port>(.*?))\t(?<destination_ip>(.*?))\t(?<destination_port>(.*?))\t(?<client_major_version>(.*?))\t(?<client_minor_version>(.*?))\t(?<server_major_version>(.*?))\t(?<server_minor_version>(.*?))\t(?<authentication_method>(.*?))\t(?<auth>(.*?))\t(?<share_flag>(.*?))\t(?<desktop_name>(.*?))\t(?<width>(.*?))\t(?<height>(.*?))$" ]
# }
# mutate {
# #add_tag => [ "conf_file_1129"]
# }
# }
#}

33
salt/logstash/files/conf.d/1130_preprocess_bro_dnp3.conf
View File

@@ -1,33 +0,0 @@
# Author: Wes Lambert
# wlambertts@gmail.com
#
# Adapted from existing filters provided by Justin Henderson
#
# Last Update: 12/14/2017
#
# This conf file is based on accepting logs for dnp3.log from Bro systems
#
# Parse using csv filter
filter {
if [type] == "bro_dnp3" {
mutate {
gsub => [ "message", "[\"']", "" ]
}
csv {
columns => ["timestamp","uid","source_ip","source_port","destination_ip","destination_port","fc_request","fc_reply","iin"]
separator => " "
}
}
}
# Parse using grok
#filter {
# if [type] == "bro_dnp3" {
# grok {
# match => [ "message", "(?<timestamp>(.*?))\t(?<uid>(.*?))\t(?<source_ip>(.*?))\t(?<source_port>(.*?))\t(?<destination_ip>(.*?))\t(?<destination_port>(.*?))\t(?<fc_request>(.*?))\t(?<fc_reply>(.*?))\t(?<iin>(.*?))$" ]
# }
# mutate {
# #add_tag => [ "conf_file_1129"]
# }
# }
#}

21
salt/logstash/files/conf.d/1131_preprocess_bro_smb_files.conf
View File

@@ -1,21 +0,0 @@
# Author: Wes Lambert
# wlambertts@gmail.com
#
# Adapted from existing filters provided by Justin Henderson
#
# Last Update: 12/14/2017
#
# This conf file is based on accepting logs for smb_files.log from Bro systems
#
# Parse using csv filter
filter {
if [type] == "bro_smb_files" {
mutate {
gsub => [ "message", "[\"']", "" ]
}
csv {
columns => ["timestamp","uid","source_ip","source_port","destination_ip","destination_port","fuid","action","path","name","size","prev_name","times_modified","times_accessed","times_created","times_changed"]
separator => " "
}
}
}

21
salt/logstash/files/conf.d/1132_preprocess_bro_smb_mapping.conf
View File

@@ -1,21 +0,0 @@
# Author: Wes Lambert
# wlambertts@gmail.com
#
# Adapted from existing filters provided by Justin Henderson
#
# Last Update: 12/14/2017
#
# This conf file is based on accepting logs for smb_mapping.log from Bro systems
#
# Parse using csv filter
filter {
if [type] == "bro_smb_mapping" {
mutate {
gsub => [ "message", "[\"']", "" ]
}
csv {
columns => ["timestamp","uid","source_ip","source_port","destination_ip","destination_port","path","service","native_file_system","share_type"]
separator => " "
}
}
}

21
salt/logstash/files/conf.d/1133_preprocess_bro_ntlm.conf
View File

@@ -1,21 +0,0 @@
# Author: Wes Lambert
# wlambertts@gmail.com
#
# Adapted from existing filters provided by Justin Henderson
#
# Last Update: 12/14/2017
#
# This conf file is based on accepting logs for ntlm.log from Bro systems
#
# Parse using csv filter
filter {
if [type] == "bro_ntlm" {
mutate {
gsub => [ "message", "[\"']", "" ]
}
csv {
columns => ["timestamp","uid","source_ip","source_port","destination_ip","destination_port","ntlm_username","hostname","domain_name","ntlm_success","status"]
separator => " "
}
}
}

21
salt/logstash/files/conf.d/1134_preprocess_bro_dce_rpc.conf
View File

@@ -1,21 +0,0 @@
# Author: Wes Lambert
# wlambertts@gmail.com
#
# Adapted from existing filters provided by Justin Henderson
#
# Last Update: 12/14/2017
#
# This conf file is based on accepting logs for dce_rpc.log from Bro systems
#
# Parse using csv filter
filter {
if [type] == "bro_dce_rpc" {
mutate {
gsub => [ "message", "[\"']", "" ]
}
csv {
columns => ["timestamp","uid","source_ip","source_port","destination_ip","destination_port","rtt","named_pipe","endpoint","operation"]
separator => " "
}
}
}

16
salt/logstash/files/conf.d/1998_test_data.conf
View File

@@ -1,16 +0,0 @@
# Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Email: justin@hasecuritysolution.com
# Last Update: 12/9/2016
filter {
if [test] == "test" {
mutate {
remove_field => [ "test" ]
add_tag => [ "test_data" ]
}
mutate {
#add_tag => [ "conf_file_1998"]
}
}
}

59
salt/logstash/files/conf.d/2000_network_flow.conf
View File

@@ -1,59 +0,0 @@
# Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Email: justin@hasecuritysolution.com
# Last Update: 12/9/2016
filter {
if [type] == "sflow" {
if [message] =~ /CNTR/ {
drop { }
}
grok {
match => { "message" => "%{WORD:sample_type},%{IP:sflow_source_ip},%{WORD:in_port:int},%{WORD:out_port:int},%{WORD:source_mac},%{WORD:destination_mac},%{WORD:ether_type},%{NUMBER:in_vlan:int},%{NUMBER:out_vlan:int},%{IP:source_ip},%{IP:destination_ip},%{NUMBER:protocol:int},%{WORD:type_of_service},%{WORD:ttl:int},%{NUMBER:source_port:int},%{NUMBER:destination_port:int},%{DATA:tcp_flags},%{NUMBER:packet_size:int},%{NUMBER:ip_size:int},%{NUMBER:sample_rate:int}" }
}
if "_grokparsefailure" in [tags] {
drop { }
}
mutate {
add_field => {
"[source_hostname]" => "%{source_ip}"
"[destination_hostname]" => "%{destination_ip}"
"[sflow_source_hostname]" => "%{sflow_source_ip}"
}
}
translate {
field => "[source_port]"
destination => "[source_service]"
dictionary_path => "/lib/dictionaries/iana_services.yaml"
}
translate {
field => "[destination_port]"
destination => "[destination_service]"
dictionary_path => "/lib/dictionaries/iana_services.yaml"
}
translate {
field => "[protocol]"
destination => "[protocol_name]"
dictionary_path => "/lib/dictionaries/iana_protocols.yaml"
}
translate {
field => "[tcp_flags]"
destination => "[tcp_flag]"
dictionary_path => "/lib/dictionaries/tcp_flags.yaml"
}
mutate {
add_field => { "ips" => [ "%{sflow_source_ip}" ] }
}
mutate {
#add_tag => [ "conf_file_2000"]
}
}
}

136
salt/logstash/files/conf.d/6000_bro.conf
View File

@@ -1,136 +0,0 @@
# Original Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Updated by: Doug Burks
# Last Update: 5/16/2017
#
# This conf file is based on accepting logs for conn.log from Bro systems
filter {
if "bro" in [tags] {
if [duration] == "-" {
mutate {
replace => [ "duration", "0" ]
}
}
if [original_bytes] == "-" {
mutate {
replace => [ "original_bytes", "0" ]
}
}
# If MissedBytes is unspecified set it to zero so it is an integer
if [missed_bytes] == "-" {
mutate {
replace => [ "missed_bytes", "0" ]
}
}
# If OriginalIPBytes is unspecified set it to zero so it is an integer
if [original_ip_bytes] == "-" {
mutate {
replace => [ "original_ip_bytes", "0" ]
}
}
# If RespondBytes is unspecified set it to zero so it is an integer
if [respond_bytes] == "-" {
mutate {
replace => [ "respond_bytes", "0" ]
}
}
# If RespondIPBytes is unspecified set it to zero so it is an integer
if [respond_ip_bytes] == "-" {
mutate {
replace => [ "respond_ip_bytes", "0" ]
}
}
if [source_port] == "-" {
mutate {
remove_field => ["source_port"]
}
}
if [destination_port] == "-" {
mutate {
remove_field => ["destination_port"]
}
}
if [virtual_host] == "-" {
mutate {
remove_field => ["virtual_host"]
}
}
# I renamed conn_uids to uid so that it is easy to pivot to all things tied to a connection
mutate {
rename => [ "connection_uids", "uid" ]
}
# If total_bytes is set to "-" change it to 0 so it is an integer
if [total_bytes] == "-" {
mutate {
replace => [ "total_bytes", "0" ]
}
}
# If seen_bytes is set to "-" change it to 0 so it is an integer
if [seen_bytes] == "-" {
mutate {
replace => [ "seen_bytes", "0" ]
}
}
# If missing_bytes is set to "-" change it to 0 so it is an integer
if [missing_bytes] == "-" {
mutate {
replace => [ "missing_bytes", "0" ]
}
}
# If pverflow_bytes is set to "-" change it to 0 so it is an integer
if [overflow_bytes] == "-" {
mutate {
replace => [ "overflow_bytes", "0" ]
}
}
# I recommend changing the field types below to integer or floats so searches can do greater than or less than
# and also so math functions can be ran against them
mutate {
convert => [ "bound_port", "integer" ]
convert => [ "data_channel_destination_port", "integer" ]
convert => [ "destination_port", "integer" ]
convert => [ "depth", "integer" ]
convert => [ "duration", "float" ]
convert => [ "info_code", "integer" ]
convert => [ "missed_bytes", "integer" ]
convert => [ "missing_bytes", "integer" ]
convert => [ "n", "integer" ]
convert => [ "original_bytes", "integer" ]
convert => [ "original_packets", "integer" ]
convert => [ "original_ip_bytes", "integer" ]
convert => [ "overflow_bytes", "integer" ]
convert => [ "p", "integer" ]
convert => [ "query_class", "integer" ]
convert => [ "query_type", "integer" ]
convert => [ "rcode", "integer" ]
convert => [ "request_body_length", "integer" ]
convert => [ "request_port", "integer" ]
convert => [ "respond_bytes", "integer" ]
convert => [ "respond_packets", "integer" ]
convert => [ "respond_ip_bytes", "integer" ]
convert => [ "response_body_length", "integer" ]
convert => [ "seen_bytes", "integer" ]
convert => [ "source_port", "integer" ]
convert => [ "status_code", "integer" ]
convert => [ "suppress_for", "float" ]
convert => [ "total_bytes", "integer" ]
convert => [ "trans_depth", "integer" ]
convert => [ "transaction_id", "integer" ]
lowercase => [ "query" ]
#remove_field => [ "timestamp" ]
}
# Combine OriginalBytes and RespondBytes and save the value to total_bytes
if [original_bytes] {
if [respond_bytes] {
ruby {
code => "event.set('total_bytes', event.get('original_bytes') + event.get('respond_bytes'))"
}
}
}
mutate {
#add_tag => [ "conf_file_6000"]
}
}
}

14
salt/logstash/files/conf.d/6001_bro_import.conf
View File

@@ -1,14 +0,0 @@
# Updated by: Doug Burks
# Last Update: 5/16/2017
#
# If we're importing old Bro logs, let's use the original Bro timestamp instead of the time of import
filter {
if "import" in [tags] and "bro" in [tags] {
date {
match => [ "timestamp", "UNIX" ]
}
mutate {
#add_tag => [ "conf_file_6001"]
}
}
}

11
salt/logstash/files/conf.d/6002_syslog.conf
View File

@@ -1,11 +0,0 @@
# Updated by: Doug Burks
# Last Update: 5/16/2017
#
filter {
if "syslog" in [tags] {
mutate {
#convert => [ "status_code", "integer" ]
#add_tag => [ "conf_file_6002"]
}
}
}

33
salt/logstash/files/conf.d/6101_switch_brocade.conf
View File

@@ -1,33 +0,0 @@
# Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Email: justin@hasecuritysolution.com
# Last Update: 12/9/2016
filter {
if [type] == "brocade" {
grok {
match => ["message", "<%{DATA}>%{GREEDYDATA:sys_message}"]
}
grok {
match => { "sys_message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid:int}\])?: %{GREEDYDATA:syslog_message}" }
add_field => [ "received_at", "%{@timestamp}" ]
}
if [syslog_message] =~ "Interface ethernet" or [syslog_program] == "PORT" {
grok {
match => { "syslog_message" => "%{DATA}%{INT:unit}\/%{INT:interface_type}\/%{INT:interface:int}" }
}
mutate {
add_field => { "interface_port" => "%{unit}/%{interface_type}/%{interface}" }
}
}
date {
match => [ "syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss" ]
timezone => "America/Chicago"
remove_field => "syslog_timestamp"
remove_field => "received_at"
}
mutate {
#add_tag => [ "conf_file_6101"]
}
}
}

281
salt/logstash/files/conf.d/6200_firewall_fortinet.conf
View File

@@ -1,281 +0,0 @@
# Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Email: justin@hasecuritysolution.com
# Last Update: 12/9/2016
filter {
if [type] == "fortinet" {
mutate {
gsub => [ "message", "= ", "=NA " ]
}
grok {
match => ["message", "type=%{DATA:event_type}\s+"]
tag_on_failure => []
}
grok {
match => ["message", "<%{DATA}>%{GREEDYDATA:kv}"]
tag_on_failure => []
}
kv {
source => "kv"
exclude_keys => [ "type" ]
}
mutate {
gsub => [ "log", "= ", "=NA " ]
}
kv {
source => "log"
target => "SubLog"
}
grok {
match => ["message", "custom: DOM-ALL, dns_query=%{DATA:dns_query};"]
tag_on_failure => [ "" ]
}
mutate {
rename => { "action" => "action" }
rename => { "addr" => "addr_ip" }
rename => { "age" => "age" }
rename => { "assigned" => "assigned_ip" }
rename => { "assignip" => "assign_ip" }
rename => { "ap" => "access_point" }
rename => { "app" => "application" }
rename => { "appcat" => "application_category" }
rename => { "applist" => "application_list" }
rename => { "apprisk" => "application_risk" }
rename => { "approfile" => "accessPoint_profile" }
rename => { "apscan" => "access_point_scan" }
rename => { "apstatus" => "acces_point_status" }
rename => { "aptype" => "access_point_type" }
rename => { "authproto" => "authentication_protocol" }
rename => { "bandwidth" => "bandwidth" }
rename => { "banned_src" => "banned_source" }
rename => { "cat" => "category" }
rename => { "catdesc" => "category_description" }
rename => { "cfgattr" => "configuration_attribute" }
rename => { "cfgobj" => "configuration_object" }
rename => { "cfgpath" => "configuration_path" }
rename => { "cfgtid" => "configuration_transaction_id" }
rename => { "channel" => "channel" }
rename => { "community" => "community" }
rename => { "cookies" => "cookies" }
rename => { "craction" => "cr_action" }
rename => { "crlevel" => "cr_level" }
rename => { "crscore" => "cr_score" }
rename => { "datarange" => "data_range" }
rename => { "desc" => "description" }
rename => { "detectionmethod" => "detection_method" }
rename => { "devid" => "device_id" }
rename => { "devname" => "device_name" }
rename => { "devtype" => "device_type" }
rename => { "dhcp_msg" => "dhcp_message" }
rename => { "disklograte" => "disk_lograte" }
rename => { "dstcountry" => "destination_country" }
rename => { "dstintf" => "destination_interface" }
rename => { "dstip" => "destination_ip" }
rename => { "dstport" => "destination_port" }
rename => { "duration" => "elapsed_time" }
rename => { "error_num" => "error_number" }
rename => { "espauth" => "esp_authentication" }
rename => { "esptransform" => "esp_transform" }
rename => { "eventid" => "event_id" }
rename => { "eventtype" => "event_type" }
rename => { "fazlograte" => "faz_lograte" }
rename => { "filename" => "file_name" }
rename => { "filesize" => "file_size" }
rename => { "filetype" => "file_type" }
rename => { "hostname" => "hostname" }
rename => { "ip" => "source_ip" }
rename => { "localip" => "source_ip" }
rename => { "locip" => "local_ip" }
rename => { "locport" => "source_port" }
rename => { "logid" => "log_id" }
rename => { "logver" => "log_version" }
rename => { "manuf" => "manufacturer" }
rename => { "mem" => "memory" }
rename => { "meshmode" => "mesh_mode" }
rename => { "msg" => "message" }
rename => { "nextstat" => "next_stat" }
rename => { "onwire" => "on_wire" }
rename => { "osname" => "os_name" }
rename => { "osversion" => "unauthenticated_user" }
rename => { "outintf" => "outbound_interface" }
rename => { "peer_notif" => "peer_notification" }
rename => { "phase2_name" => "phase2_name" }
rename => { "policyid" => "policy_id" }
rename => { "policytype" => "policy_type" }
rename => { "port" => "port" }
rename => { "probeproto" => "probe_protocol" }
rename => { "proto" => "protocol_number" }
rename => { "radioband" => "radio_band" }
rename => { "radioidclosest" => "radio_id_closest" }
rename => { "radioiddetected" => "radio_id_detected" }
rename => { "rcvd" => "bytes_received" }
rename => { "rcvdbyte" => "bytes_received" }
rename => { "rcvdpkt" => "packets_received" }
rename => { "remip" => "destination_ip" }
rename => { "remport" => "remote_port" }
rename => { "reqtype" => "request_type" }
rename => { "scantime" => "scan_time" }
rename => { "securitymode" => "security_mode" }
rename => { "sent" => "bytes_sent" }
rename => { "sentbyte" => "bytes_sent" }
rename => { "sentpkt" => "packets_sent" }
rename => { "session_id" => "session_id" }
rename => { "setuprate" => "setup_rate" }
rename => { "sn" => "serial" }
rename => { "snclosest" => "serial_closest_access_point" }
rename => { "sndetected" => "serial_access_point_that_detected_rogue_ap" }
rename => { "snmeshparent" => "serial_mesh_parent" }
rename => { "srccountry" => "source_country" }
rename => { "srcip" => "source_ip" }
rename => { "srcmac" => "source_mac" }
rename => { "srcname" => "source_name" }
rename => { "srcintf" => "source_interface" }
rename => { "srcport" => "source_port" }
rename => { "stacount" => "station_count" }
rename => { "stamac" => "static_mac" }
rename => { "srccountry" => "source_country" }
rename => { "srcip" => "source_ip" }
rename => { "srcmac" => "source_mac" }
rename => { "srcname" => "source_name" }
rename => { "sn" => "serial" }
rename => { "srcintf" => "source_interface" }
rename => { "srcport" => "source_port" }
rename => { "total" => "total_bytes" }
rename => { "totalsession" => "total_sessions" }
rename => { "trandisp" => "nat_translation_type" }
rename => { "tranip" => "nat_destination_ip" }
rename => { "tranport" => "nat_destination_port" }
rename => { "transip" => "nat_source_ip" }
rename => { "transport" => "nat_source_port" }
rename => { "tunnelid" => "tunnel_id" }
rename => { "tunnelip" => "tunnel_ip" }
rename => { "tunneltype" => "tunnel_type" }
rename => { "unauthuser" => "unauthenticated_user_source" }
rename => { "unauthusersource" => "os_version" }
rename => { "vendorurl" => "vendor_url" }
rename => { "vpntunnel" => "vpn_tunnel" }
rename => { "vulncat" => "vulnerability_category" }
rename => { "vulncmt" => "vulnerability_count" }
rename => { "vulnid" => "vulnerability_id" }
rename => { "vulnname" => "vulnerability_name" }
rename => { "vulnref" => "vulnerability_reference" }
rename => { "vulnscore" => "vulnerability_score" }
rename => { "xauthgroup" => "x_authentication_group" }
rename => { "xauthuser" => "x_authentication_user" }
rename => { "[SubLog][appid]" => "sub_application_id" }
rename => { "[SubLog][devid]" => "sub_device_id" }
rename => { "[SubLog][dstip]" => "sub_destination_ip" }
rename => { "[SubLog][srcip]" => "sub_source_ip" }
rename => { "[SubLog][dstport]" => "sub_destination_port" }
rename => { "[SubLog][eventtype]" => "sub_event_type" }
rename => { "[SubLog][proto]" => "sub_protocol_number" }
rename => { "[SubLog][date]" => "sub_date" }
rename => { "[SubLog][time]" => "sub_time" }
rename => { "[SubLog][srcport]" => "sub_source_port" }
rename => { "[SubLog][subtype]" => "sub_subtype" }
rename => { "[SubLog][devname]" => "sub_device_name" }
rename => { "[SubLog][itime]" => "sub_itime" }
rename => { "[SubLog][level]" => "sub_level" }
rename => { "[SubLog][logid]" => "sub_log_id" }
rename => { "[SubLog][logver]" => "sub_log_version" }
rename => { "[SubLog][type]" => "sub_event_type" }
rename => { "[SubLog][vd]" => "sub_vd" }
rename => { "[SubLog][action]" => "sub_action" }
rename => { "[SubLog][logdesc]" => "sub_destination_ip" }
rename => { "[SubLog][policyid]" => "sub_olicy_id" }
rename => { "[SubLog][reason]" => "sub_reason" }
rename => { "[SubLog][service]" => "sub_service" }
rename => { "[SubLog][sessionid]" => "sub_session_id" }
rename => { "[SubLog][src]" => "sub_source_ip" }
rename => { "[SubLog][status]" => "sub_status" }
rename => { "[SubLog][ui]" => "sub_ui" }
rename => { "[SubLog][urlfilteridx]" => "sub_url_filter_idx" }
strip => [ "bytes_sent", "bytes_received" ]
convert => [ "bytes_sent", "integer" ]
convert => [ "bytes_received", "integer" ]
convert => [ "cr_score", "integer" ]
convert => [ "cr_action", "integer" ]
convert => [ "elapsed_time", "integer" ]
convert => [ "destination_port", "integer" ]
convert => [ "source_port", "integer" ]
convert => [ "local_port", "integer" ]
convert => [ "remote_port", "integer" ]
convert => [ "packets_sent", "integer" ]
convert => [ "packets_received", "integer" ]
convert => [ "port", "integer" ]
convert => [ "ProtocolNumber", "integer" ]
convert => [ "XAuthUser", "string" ]
remove_field => [ "kv", "log" ]
}
if [tunnel_ip] == "N/A" {
mutate {
remove_field => [ "tunnel_ip" ]
}
}
if [nat_destination_ip] {
mutate {
add_field => { "ips" => [ "%{nat_destination_ip}" ] }
add_field => { "destination_ips" => [ "%{nat_destination_ip}" ] }
}
}
if [sub_destination_ip] {
mutate {
add_field => { "ips" => [ "%{sub_destination_ip}" ] }
add_field => { "destination_ips" => [ "%{sub_destination_ip}" ] }
}
}
if [nat_source_ip] {
mutate {
add_field => { "ips" => [ "%{nat_source_ip}" ] }
add_field => { "source_ips" => [ "%{nat_source_ip}" ] }
}
}
if [sub_source_ip] {
mutate {
add_field => { "ips" => [ "%{sub_source_ip}" ] }
add_field => { "source_ips" => [ "%{sub_source_ip}" ] }
}
}
if [addr_ip] {
mutate {
add_field => { "ips" => [ "%{addr_ip}" ] }
}
}
if [assign_ip] {
mutate {
add_field => { "ips" => [ "%{assign_ip}" ] }
}
}
if [assigned_ip] {
mutate {
add_field => { "ips" => [ "%{assigned_ip}" ] }
}
}
grok {
match => ["message", "type=%{DATA:event_type}\s+"]
}
if [date] and [time] {
mutate {
add_field => { "receive_time" => "%{date} %{time}" }
remove_field => [ "date", "time" ]
}
date {
timezone => "America/Chicago"
match => [ "receive_time", "YYYY-MM-dd HH:mm:ss" ]
target => "receive_time"
}
mutate {
rename => { "receive_time" => "@timestamp" }
}
} else {
mutate {
add_tag => [ "missing_date" ]
}
}
mutate {
#add_tag => [ "conf_file_6200"]
}
}
}

33
salt/logstash/files/conf.d/6201_firewall_pfsense.conf
View File

@@ -1,33 +0,0 @@
# Author: Wes Lambert
# Last Update: 11/06/2017
filter {
if [type] == "filterlog" {
grok {
match => ["message", "(%{NONNEGINT:rule_number})?\,(%{NONNEGINT:sub_rule_number})?\,(%{DATA:anchor})?\,(%{NONNEGINT:tracker_id})?\,%{DATA:interface}\,%{DATA:reason}\,%{DATA:action}\,%{DATA:direction}\,%{NONNEGINT:ip_version},%{GREEDYDATA:sub_msg}"]
}
if [ip_version] =~ "4" {
csv {
source => [sub_msg]
columns => ["ipv4_tos","ipv4_ecn","ipv4_ttl","ipv4_id","ipv4_offset", "ipv4_flags","ipv4_protocol_id","ipv4_protocol","ipv4_protocol_length","source_ip","destination_ip","source_port","destination_port","data_length","tcp_flags","sequence_number","ack","window","urg","options"]
separator => ","
}
}
if [ip_version] =~ "6" {
csv {
source => [sub_msg]
columns => ["class","flow_label","hop_limit","protocol","protocol_id","length","source_ip","destination_ip","source_port","destination_port","data_length"]
separator => ","
}
}
mutate {
convert => [ "destination_port", "integer" ]
convert => [ "source_port", "integer" ]
convert => [ "ip_version", "integer" ]
replace => { "type" => "firewall" }
add_tag=> [ "pfsense","firewall" ]
remove_field => [ "sub_msg" ]
}
}
}

161
salt/logstash/files/conf.d/6300_windows.conf
View File

@@ -1,161 +0,0 @@
# Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Email: justin@hasecuritysolution.com
# Last Update: 12/9/2016
filter {
if [type] == "windows" {
# json {
# source => "message"
# }
date {
match => ["EventTime", "YYYY-MM-dd HH:mm:ss"]
remove_field => [ "EventTime" ]
}
if [EventID] == 4634 {
mutate {
add_tag => [ "logoff" ]
}
}
if [EventID] == 4624 or [EventID] == 528 or [EventID] == 540 or [EventID] == 552 or [EventID] == 682 or [EventID] == 4648 or [EventID] == 4778 {
mutate {
add_tag => [ "logon" ]
add_tag => [ "alert_data" ]
}
}
if [EventID] == 529 or [EventID] == 4625 or [EventID] == 530 or [EventID] == 531 or [EventID] == 532 or [EventID] == 533 or [EventID] == 534 or [EventID] == 535 or [EventID] == 536 or [EventID] == 536 or [EventID] == 537 or [EventID] == 538 or [EventID] == 539 or [EventID] == 4625 or [EventID] == 4771 {
mutate {
add_tag => [ "logon_failure" ]
add_tag => [ "alert_data" ]
}
}
# Critical event IDs to monitor
if [EventID] == 7030 or [EventID] == 4720 or [EventID] == 4722 or [EventID] == 4724 or [EventID] == 4738 or [EventID] == 4732 or [EventID] == 1102 or [EventID] == 1056 or [EventID] == 2003 or [EventID] == 2005 or [EventID] == 8003 or [EventID] == 8004 or [EventID] == 8006 or [EventID] == 8007 {
mutate {
add_tag => [ "alert_data" ]
}
}
# Critical event IDs to monitor
if [EventID] == 5152 { drop {} }
if [EventID] == 4688 { drop {} }
if [EventID] == 4689 { drop {} } # Process Termination:Not needed due to Sysmon
if [Channel] == "Microsoft-Windows-Known Folders API Service" { drop {} }
if [EventID] == 3 and [SourceIp] =~ "255$" { drop {} }
if [EventID] == 3 and [DestinationIp] =~ "255$" { drop {} }
# Whitelist/Blacklist check
if [EventID] == 7045 {
translate {
field => "ServiceName"
destination => "ServiceCheck"
dictionary_path => "/lib/dictionaries/services.yaml"
}
}
if [EventID] == 7045 and !([ServiceCheck]) {
mutate {
add_tag => [ "alert_data","new_service" ]
}
}
if [ServiceCheck] == 'whitelist' {
mutate {
remove_field => [ "ServiceCheck" ]
add_tag => [ "whitelist" ]
}
}
if [ServiceCheck] == 'blacklist' {
mutate {
remove_field => [ "ServiceCheck" ]
add_tag => [ "blacklist" ]
}
}
if [EventID] == 5158 {
if [Application] == "System" { drop {} }
if [Application] =~ "\\windows\\system32\\spoolsv\.exe" { drop {} }
if [Application] =~ "\\windows\\system32\\wbem\\wmiprvse\.exe" { drop {} }
if [Application] =~ "mcafee" { drop {} }
if [Application] =~ "carestream" { drop {} }
if [Application] =~ "Softdent" { drop {} }
}
if [ProcessName] == "C:\\Windows\\System32\\wbem\\WmiPrvSE\.exe" and [SubjectUserName] == "SolarwindsHO" { drop {} }
if [EventID] == 4690 { drop {} }
if [EventID] == 861 and [AccountName] == "ntp" { drop {} }
if [EventID] == 5158 and [Application] =~ "\\windows\\system32\\lsass\.exe$" { drop {} }
if [EventID] == 5158 and [Application] =~ "\\windows\\system32\\svchost\.exe$" { drop {} }
if [EventID] == 5158 and [Application] =~ "\\windows\\system32\\dfsrs\.exe$" { drop {} }
if [EventID] == 5447 { drop {} }
mutate {
rename => [ "AccountName", "user" ]
rename => [ "AccountType", "account_type" ]
rename => [ "ActivityID", "activity_id" ]
rename => [ "Category", "category" ]
rename => [ "ClientAddress", "client_ip" ]
rename => [ "Channel", "channel" ]
rename => [ "DCIPAddress", "domain_controller_ip" ]
rename => [ "DCName", "domain_controller_name" ]
rename => [ "EventID", "event_id" ]
rename => [ "EventReceivedTime", "event_received_time" ]
rename => [ "EventType", "event_type" ]
rename => [ "GatewayIPAddress", "gateway_ip" ]
rename => [ "IPAddress", "client_ip" ]
rename => [ "Ipaddress", "client_ip" ]
rename => [ "IpAddress", "client_ip" ]
rename => [ "IPPort", "source_port" ]
rename => [ "OpcodeValue", "opcode_value" ]
rename => [ "PreAuthType", "preauthentication_type" ]
rename => [ "PrincipleSAMName", "user" ]
rename => [ "ProcessID", "process_id" ]
rename => [ "ProviderGUID", "providerguid" ]
rename => [ "RecordNumber", "record_number" ]
rename => [ "RemoteAddress", "destination_ip" ]
rename => [ "ServiceName", "service_name" ]
rename => [ "ServiceID", "service_id" ]
rename => [ "SeverityValue", "severity_value" ]
rename => [ "SourceAddress", "client_ip" ]
rename => [ "SourceModuleName", "source_module_name" ]
rename => [ "SourceModuleType", "source_module_type" ]
rename => [ "SourceName", "source_name" ]
rename => [ "SubjectUserName", "user" ]
rename => [ "TaskName", "task_name" ]
rename => [ "TargetDomainName", "target_domain_name" ]
rename => [ "TargetUserName", "user" ]
rename => [ "ThreadID", "thread_id" ]
rename => [ "User_ID", "user" ]
rename => [ "UserID", "user" ]
rename => [ "username", "user" ]
}
# For any accounts that are service accounts or special accounts add the tag of service_account
# This example applies the tag to any username that starts with SVC_. If you use a different
# standard change this.
if [user] =~ "^DWM-*" or [user] == "SYSTEM" or [user] == "NETWORK SERVICE" or [user] == "LOCAL SERVICE" or [user] =~ "^SVC_*" {
mutate {
add_tag => [ "service_account" ]
}
}
# This looks for events that are typically noisy but may be of use for deep dive investigations
# A tag of noise is added to quickly filter out noise
if [event_id] == 7036 or [source_name] == "Desktop Window Manager" or [category] == "Engine Lifecycle" or [category] == "Provider Lifecycle" {
mutate {
add_tag => [ "noise" ]
}
}
#Identify machine accounts
if [user] =~ /\$/ {
mutate {
add_tag => [ "machine", "noise" ]
}
}
# Lower case all field names
ruby {
code => "
event_hash = event.to_hash
new_event = {}
event_hash.keys.each do |key|
new_event[key.downcase] = event[key]
end
event.instance_variable_set(:@data, new_event)"
}
mutate {
#add_tag => [ "conf_file_6300"]
}
}
}

49
salt/logstash/files/conf.d/6301_dns_windows.conf
View File

@@ -1,49 +0,0 @@
# Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Email: justin@hasecuritysolution.com
# Last Update: 12/9/2016
filter {
if [type] == "dns" and "bro" not in [tags] {
json {
source => "message"
}
# strip whitespace from message field
mutate {
strip => "message"
}
# If the message is blank, drop the log
if [Message] =~ /^$/ {
drop { }
} else {
if [type] == "dns" {
# This section is lookup for a match against the log and parsing out the fields
grok {
match => { "Message" => "(?<timestamp>%{DATE_US} %{TIME} (?:AM|PM))\s+%{DATA:thread_id}\s+%{WORD:dns_type}\s+ %{BASE16NUM:packet_id}\s+%{WORD:dns_protocol}\s+%{WORD:dns_direction}\s+%{IP:dns_ip}\s+ %{BASE16NUM:xid}\s+%{DATA:response}\s+%{WORD:dns_query_type}\s+\[%{BASE16NUM:hex_flags}\s+%{WORD:flags}\s+ %{WORD:rcode_name}\]\s+%{WORD:query_type_name}\s+%{GREEDYDATA:dns_domain}"}
match => { "Message" => "(?<timestamp>%{DATE_US} %{TIME} (?:AM|PM))\s+%{DATA:thread_id}\s+%{WORD:dns_type}\s+ %{BASE16NUM:packet_id}\s+%{WORD:dns_protocol}\s+%{WORD:dns_direction}\s+%{IP:dns_ip}\s+ %{BASE16NUM:xid}\s+%{DATA:response}\s+%{WORD:dns_query_type}\s+\[%{BASE16NUM:hex_flags}\s+%{WORD:flags}\s+%{WORD:recursion}\s+%{WORD:rcode_name}\]\s+%{WORD:query_type_name}\s+%{GREEDYDATA:dns_domain}"}
match => { "Message" => "(?<timestamp>%{DATE_US} %{TIME} (?:AM|PM))\s+%{DATA:thread_id}\s+%{WORD:dns_type}\s+ %{BASE16NUM:packet_id}\s+%{WORD:dns_protocol}\s+%{WORD:dns_direction}\s+%{IP:dns_ip}\s+ %{BASE16NUM:xid}\s+%{DATA:response}\s+%{WORD:dns_query_type}\s+\[%{BASE16NUM:hex_flags}\s+%{WORD:recursion}\s+%{WORD:rcode_name}\]\s+%{WORD:query_type_name}\s+%{GREEDYDATA:dns_domain}"}
match => { "Message" => "(?<timestamp>%{DATE_US} %{TIME} (?:AM|PM))\s+%{DATA:thread_id}\s+%{WORD:dns_type}\s+ %{BASE16NUM:packet_id}\s+%{WORD:dns_protocol}\s+%{WORD:dns_direction}\s+%{IP:dns_ip}\s+ %{BASE16NUM:xid}\s+%{DATA:response}\s+%{WORD:dns_query_type}\s+\[%{BASE16NUM:hex_flags}\s+%{WORD:rcode_name}\]\s+%{WORD:query_type_name}\s+%{GREEDYDATA:dns_domain}"}
match => { "Message" => "(?<timestamp>%{DATE_US} %{TIME} (?:AM|PM))\s+%{DATA:thread_id}\s+%{WORD:dns_type}\s+ %{BASE16NUM:packet_id}\s+%{WORD:dns_protocol}\s+%{WORD:dns_direction}\s+%{IP:dns_ip}\s+ %{BASE16NUM:xid}\s+%{WORD:dns_query_type}\s+\[%{BASE16NUM:hex_flags}\s+%{WORD:flags}\s+ %{WORD:rcode_name}\]\s+%{WORD:query_type_name}\s+%{GREEDYDATA:dns_domain}"}
# Server 2003 DNS logs do not include slashes or AM/PM in timestamp
match => { "Message" => "(?<timestamp>%{YEAR}%{MONTHNUM}%{MONTHDAY} %{TIME})\s+%{DATA:thread_id}\s+%{WORD:dns_type}\s+ %{BASE16NUM:packet_id}\s+%{WORD:dns_protocol}\s+%{WORD:dns_direction}\s+%{IP:dns_ip}\s+ %{BASE16NUM:xid}\s+%{DATA:response}\s+%{WORD:dns_query_type}\s+\[%{BASE16NUM:hex_flags}\s+%{WORD:flags}\s+ %{WORD:rcode_name}\]\s+%{WORD:query_type_name}\s+%{GREEDYDATA:dns_domain}"}
match => { "Message" => "(?<timestamp>%{YEAR}%{MONTHNUM}%{MONTHDAY} %{TIME})\s+%{DATA:thread_id}\s+%{WORD:dns_type}\s+ %{BASE16NUM:packet_id}\s+%{WORD:dns_protocol}\s+%{WORD:dns_direction}\s+%{IP:dns_ip}\s+ %{BASE16NUM:xid}\s+%{DATA:response}\s+%{WORD:dns_query_type}\s+\[%{BASE16NUM:hex_flags}\s+%{WORD:flags}\s+%{WORD:recursion}\s+%{WORD:rcode_name}\]\s+%{WORD:query_type_name}\s+%{GREEDYDATA:dns_domain}"}
match => { "Message" => "(?<timestamp>%{YEAR}%{MONTHNUM}%{MONTHDAY} %{TIME})\s+%{DATA:thread_id}\s+%{WORD:dns_type}\s+ %{BASE16NUM:packet_id}\s+%{WORD:dns_protocol}\s+%{WORD:dns_direction}\s+%{IP:dns_ip}\s+ %{BASE16NUM:xid}\s+%{DATA:response}\s+%{WORD:dns_query_type}\s+\[%{BASE16NUM:hex_flags}\s+%{WORD:recursion}\s+%{WORD:rcode_name}\]\s+%{WORD:query_type_name}\s+%{GREEDYDATA:dns_domain}"}
match => { "Message" => "(?<timestamp>%{YEAR}%{MONTHNUM}%{MONTHDAY} %{TIME})\s+%{DATA:thread_id}\s+%{WORD:dns_type}\s+ %{BASE16NUM:packet_id}\s+%{WORD:dns_protocol}\s+%{WORD:dns_direction}\s+%{IP:dns_ip}\s+ %{BASE16NUM:xid}\s+%{DATA:response}\s+%{WORD:dns_query_type}\s+\[%{BASE16NUM:hex_flags}\s+%{WORD:rcode_name}\]\s+%{WORD:query_type_name}\s+%{GREEDYDATA:dns_domain}"}
match => { "Message" => "(?<timestamp>%{YEAR}%{MONTHNUM}%{MONTHDAY} %{TIME})\s+%{DATA:thread_id}\s+%{WORD:dns_type}\s+ %{BASE16NUM:packet_id}\s+%{WORD:dns_protocol}\s+%{WORD:dns_direction}\s+%{IP:dns_ip}\s+ %{BASE16NUM:xid}\s+%{WORD:dns_query_type}\s+\[%{BASE16NUM:hex_flags}\s+%{WORD:flags}\s+ %{WORD:rcode_name}\]\s+%{WORD:query_type_name}\s+%{GREEDYDATA:dns_domain}"}
remove_field => [ "Message" ]
}
# This section attempts to convert the dns_domain into the traditional domain.com format
mutate {
gsub => [ "dns_domain", "(\(\d+\))", "." ]
}
grok {
match => { "dns_domain" => "\.%{DATA:query}\.$" }
remove_field => [ "dns_domain" ]
}
}
}
mutate {
#add_tag => [ "conf_file_6301"]
}
}
}

92
salt/logstash/files/conf.d/6400_suricata.conf
View File

@@ -1,92 +0,0 @@
# Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Email: justin@hasecuritysolution.com
# Last Update: 12/9/2016
#
# This conf file is based on accepting logs for suricata json events
filter {
if [type] == "suricata" {
if "test_data" not in [tags] {
date {
match => [ "timestamp", "ISO8601" ]
}
} else {
mutate {
remove_field => [ "netflow.start","netflow.end","timestamp" ]
}
}
if [event_type] == "fileinfo" {
ruby {
code => "if event['event_type'] == 'fileinfo'; event['fileinfo']['type']=event['fileinfo']['magic'].to_s.split(',')[0]; end;"
}
}
# I recommend renaming the fields below to be consistent with other log sources. This makes it easy to "pivot" between logs
mutate {
rename => [ "src_ip", "source_ip" ]
rename => [ "dest_ip", "destination_ip" ]
rename => [ "src_port", "source_port" ]
rename => [ "dest_port", "destination_port" ]
}
# This will translate the alert.severity field into a severity field of either High, Medium, or Low
if [event_type] == "alert" {
if [alert][severity] == 1 {
mutate {
add_field => { "severity" => "High" }
}
}
if [alert][severity] == 2 {
mutate {
add_field => { "severity" => "Medium" }
}
}
if [alert][severity] == 3 {
mutate {
add_field => { "severity" => "Low" }
}
}
# If the alert is a Snort GPL alert break it apart for easier reading and categorization
if [alert][signature] =~ "GPL " {
# This will parse out the category type from the alert
grok {
match => { "[alert][signature]" => "GPL\s+%{DATA:category}\s" }
}
# This will store the category
mutate {
add_field => { "rule_type" => "Snort GPL" }
lowercase => [ "category" ]
}
}
# If the alert is an Emerging Threat alert break it apart for easier reading and categorization
if [alert][signature] =~ "ET " {
# This will parse out the category type from the alert
grok {
match => { "[alert][signature]" => "ET\s+%{DATA:category}\s" }
}
# This will store the category
mutate {
add_field => { "rule_type" => "Emerging Threats" }
lowercase => [ "category" ]
}
}
# This section adds URLs to lookup information about a rule online
if [rule_type] == "Snort GPL" {
mutate {
add_field => [ "signature_info", "https://www.snort.org/search?query=%{[alert][gid]}-%{[alert][signature_id]}" ]
}
}
if [rule_type] == "Emerging Threats" {
mutate {
add_field => [ "signature_info", "http://doc.emergingthreats.net/%{[alert][signature_id]}" ]
}
}
}
if "_grokparsefailure" not in [tags] and "_csvparsefailure" not in [tags] and "_jsonparsefailure" not in [tags] {
# mutate {
# remove_field => [ "message" ]
# }
}
mutate {
#add_tag => [ "conf_file_6400"]
}
}
}

83
salt/logstash/files/conf.d/6500_ossec.conf
View File

@@ -1,83 +0,0 @@
# Author: Wes Lambert
# wlambertts@gmail.com
#
# Last Update: 05/21/2017
#
# This conf file is based on accepting logs from OSSEC
#
# Parse using grok
filter {
# OSSEC Logs and Alerts
if [type] == "ossec" {
grok {
match => ["message", "Alert Level: %{NONNEGINT;alert_level}; Rule: %{NONNEGINT:rule} - %{DATA:description}; Location: %{DATA:location}; user: +%{DATA:user}; %{SYSLOGTIMESTAMP} %{DATA:host} %{DATA:process}\[%{INT:pid}]: %{GREEDYDATA:details}",
"message", "Alert Level: %{NONNEGINT:alert_level}; Rule: %{NONNEGINT:rule} - %{DATA:description}; Location: %{DATA:location}; %{SYSLOGTIMESTAMP:timestamp} %{DATA:host} %{DATA:process}\[%{NONNEGINT:pid}]: %{GREEDYDATA:details}",
"message", "Alert Level: %{NONNEGINT:alert_level}; Rule: %{NONNEGINT:rule} - %{DATA:description}; Location: %{DATA:location}; %{SYSLOGTIMESTAMP} %{DATA:host} %{DATA:process}\[%{NONNEGINT:pid}]: %{GREEDYDATA:details}",
"message", "Alert Level: %{NONNEGINT:alert_level}; Rule: %{NONNEGINT:rule} - %{DATA:description}; Location: %{DATA:location}; %{SYSLOGTIMESTAMP:timestamp} %{DATA:host} %{DATA:program}: +%{DATA:user} : TTY=%{DATA:tty} ; PWD=%{DATA:dir} ; USER=%{DATA:escalated_user} ; COMMAND=%{GREEDYDATA:command}",
"message", "Alert Level: %{NONNEGINT:alert_level}; Rule: %{NONNEGINT:rule} - %{DATA:description}; Location: %{DATA:location}; %{SYSLOGTIMESTAMP:timestamp} %{DATA:host} %{DATA:program}: %{GREEDYDATA:details}",
"message", "Alert Level: %{NONNEGINT:alert_level}; Rule: %{NONNEGINT:rule} - %{DATA:description}; Location: %{DATA:location}; %{SYSLOGTIMESTAMP:timestamp} %{DATA:host} %{DATA:program}: +%{DATA:user} : %{GREEDYDATA:details}",
"message", "Alert Level: %{NONNEGINT:alert_level}; Rule: %{NONNEGINT:rule} - %{DATA:description}; Location: %{DATA:location}; srcip: %{IP:source_ip};%{GREEDYDATA:details}",
"message", "Alert Level: %{NONNEGINT:alert_level}; Rule: %{NONNEGINT:rule} - %{DATA:description}; Location: %{DATA:location}; %{DATA:user}: %{DATA}: \'%{DATA}': %{DATA:interface}: %{INT:num_packets}",
"message", "Alert Level: %{NONNEGINT:alert_level}; Rule: %{NONNEGINT:rule} - %{DATA:description}; Location: %{DATA:location}; %{DATA:user}: %{GREEDYDATA:details}.",
"message", "Alert Level: %{NONNEGINT:alert_Level}; Rule: %{NONNEGINT:Rule} - %{DATA:Description}; Location: %{DATA:location}; user: +%{DATA:user};",
"message", "Alert Level: %{NONNEGINT:alert_level}; Rule: %{NONNEGINT:rule} - %{DATA:description}; Location: %{DATA:location}; %{DATA}: %{DATA}: \'%{DATA}': %{DATA:interface}: %{NONNEGINT:num_packets}",
"message", "Alert Level: %{NONNEGINT:alert_level}; Rule: %{NONNEGINT:rule} - %{DATA:description}; Location: %{DATA:location}; %{GREEDYDATA:details}"]
# Add tag for OSSEC alerts
add_tag => [ "alert" ]
}
translate {
field => "alert_level"
destination => "classification"
dictionary => [
"1", "None",
"2", "System low priority notification",
"3", "Successful/authorized event",
"4", "System low priority error",
"5", "User generated error",
"6", "Low relevance attack",
"7", '"Bad word" matching',
"8", "First time seen",
"9", "Error from invalid source",
"10", "Multiple user generated errors",
"11", "Integrity checking warning",
"12", "High importance event",
"13", "Unusal error (high importance)",
"14", "High importance security event",
"15", "Severe attack"
]
}
}
if [type] == "ossec" and "alert" not in [tags] {
grok {
match => ["message", "%{DATA:user} : TTY=%{DATA:tty} ; PWD=%{DATA:dir} ; USER=%{DATA:escalated_user} ; COMMAND=%{GREEDYDATA:command}"]
}
}
# OSSEC Archive Logs
if [type] == "ossec_archive" {
grok {
match => ["message",'%{YEAR:year} %{SYSLOGTIMESTAMP:timestamp} %{DATA:location} %{IP:source_ip} - %{DATA:user} \[%{DATA:request_timestamp}] "%{DATA:method} %{DATA:requested_resource} %{DATA:protocol}\/%{DATA:protocol_version}" %{NONNEGINT:status_code} %{NONNEGINT:object_size} "%{DATA:referrer}" "%{DATA:user_agent}"',
"message","%{YEAR:year} %{SYSLOGTIMESTAMP:timestamp} %{DATA:location} %{SYSLOGTIMESTAMP:ossec_timestamp} %{DATA:host} %{DATA:process}\[%{NONNEGINT:pid}]: \(%{DATA:user}\) CMD \(%{DATA:command}\)",
"message", "%{YEAR:year} %{SYSLOGTIMESTAMP:timestamp} %{DATA:location} %{GREEDYDATA:details}","message","%{YEAR:year} %{SYSLOGTIMESTAMP:timestamp} %{DATA:location} %{SYSLOGTIMESTAMP:ossec_timestamp} %{DATA:ossec_host} %{DATA:process}\[%{NONNEGINT:pid}]: %{GREEDYDATA:details}",
"message","%{DATA:age} %{DATA:program} %{DATA} '%{DATA:checksum}'"]
remove_field => [ "ossec_timestamp" ]
}
mutate {
convert => [ "status_code", "integer" ]
}
}
# Sysmon logs transported by OSSEC
if [type] =~ "ossec" {
if [message] =~ "WinEvtLog: Microsoft-Windows-Sysmon" {
mutate { replace => { "type" => "sysmon" } }
}
if [message] =~ "AR-LOG" {
mutate { replace => { "type" => "autoruns" } }
}
}
}

81
salt/logstash/files/conf.d/6501_ossec_sysmon.conf
View File

@@ -1,81 +0,0 @@
# Author: Wes Lambert
# wlambertts@gmail.com
#
# Last Update: 07/14/2017
#
# This conf file is based on accepting Sysmon logs from OSSEC
#
# Parse using grok
filter {
# OSSEC Logs and Alerts
if [type] == "sysmon" {
#mutate { replace => { "type" => "sysmon" } }
grok {
# match => ["message","%{YEAR:year} %{SYSLOGTIMESTAMP:timestamp} %{DATA:location} %{IP:source_ip}->WinEvtLog %{YEAR:year} %{SYSLOGTIMESTAMP:ossec_timestamp} WinEvtLog: Microsoft-Windows-Sysmon/Operational: INFORMATION\(%{INT:sysmon_event_id}\):"]
match => ["message", "%{YEAR:year}%{SPACE}%{SYSLOGTIMESTAMP:timestamp}%{SPACE}%{DATA:location}%{SPACE}(any|%{IP:source_ip})->WinEvtLog%{SPACE}%{YEAR:year}%{SPACE}%{SYSLOGTIMESTAMP:ossec_timestamp}%{SPACE}WinEvtLog:%{SPACE}Microsoft-Windows-Sysmon/Operational:%{SPACE}INFORMATION\(%{INT:event_id}\):%{SPACE}%{GREEDYDATA:rest_of_msg}"]
}
mutate {
convert => ["event_id", "integer"]
remove_field => ["timestamp"]
remove_field => ["year"]
}
}
if [event_id] == 1 {
grok {
match => ["rest_of_msg", "Microsoft-Windows-Sysmon:%{SPACE}SYSTEM:%{SPACE}NT%{SPACE}AUTHORITY:%{SPACE}%{DATA:hostname}:%{SPACE}%{DATA:event_type}:%{SPACE}UtcTime:%{SPACE}%{DATA:sysmon_timestamp}%{SPACE}ProcessGuid:%{SPACE}\{%{DATA:process_guid}\}%{SPACE}ProcessId:%{SPACE}%{INT:process_id}%{SPACE}Image:%{SPACE}%{DATA:image_path}%{SPACE}CommandLine:%{SPACE}%{DATA:process_name} %{DATA:process_arguments}%{SPACE}CurrentDirectory:%{SPACE}%{DATA:current_directory}%{SPACE}User:%{SPACE}%{DATA:user}%{SPACE}LogonGuid:%{SPACE}\{%{DATA:logon_guid}\}%{SPACE}LogonId:%{SPACE}%{DATA:logon_id}%{SPACE}TerminalSessionId:%{SPACE}%{INT:terminal_id}%{SPACE}IntegrityLevel:%{SPACE}%{DATA:integrity_level}%{SPACE}Hashes:%{SPACE}MD5=%{DATA:md5},SHA256=%{DATA:sha256}%{SPACE}ParentProcessGuid:%{SPACE}\{%{DATA:parent_process_guid}\}%{SPACE}ParentProcessId:%{SPACE}%{NONNEGINT:parent_process_id}%{SPACE}ParentImage:%{SPACE}%{DATA:parent_image_path}%{SPACE}ParentCommandLine:%{SPACE}%{GREEDYDATA:parent_process_name}",
"rest_of_msg", 'Microsoft-Windows-Sysmon:%{SPACE}SYSTEM:%{SPACE}NT%{SPACE}AUTHORITY:%{SPACE}%{DATA:hostname}:%{SPACE}%{DATA:event_type}:%{SPACE}UtcTime:%{SPACE}%{DATA:sysmon_timestamp}%{SPACE}ProcessGuid:%{SPACE}\{%{DATA:process_guid}\}%{SPACE}ProcessId:%{SPACE}%{INT:process_id}%{SPACE}Image:%{SPACE}%{DATA:image_path}%{SPACE}CommandLine:%{SPACE}"%{DATA:process_name}"%{SPACE}%{DATA:process_arguments}%{SPACE}CurrentDirectory:%{SPACE}%{DATA:current_directory}%{SPACE}User:%{SPACE}%{DATA:user}%{SPACE}LogonGuid:%{SPACE}\{%{DATA:logon_guid}\}%{SPACE}LogonId:%{SPACE}%{DATA:logon_id}%{SPACE}TerminalSessionId:%{SPACE}%{INT:terminal_id}%{SPACE}IntegrityLevel:%{DATA:integrity_level}',
"rest_of_msg", "Microsoft-Windows-Sysmon/Operational:%{SPACE}INFORMATION(%{INT:event_id}):%{SPACE}Microsoft-Windows-Sysmon:%{SPACE}SYSTEM:%{SPACE}NT AUTHORITY:%{SPACE}%{DATA:hostname}:%{SPACE}%{DATA:event_type}:%{SPACE}UtcTime:%{SPACE}%{DATA:sysmon_timestamp}%{SPACE}ProcessGuid:%{SPACE}{%{DATA:process_guid}}%{SPACE}ProcessId:%{SPACE}%{INT:process_id}%{SPACE}Image:%{SPACE}%{DATA:image_path}%{SPACE}CommandLine:%{SPACE}%{DATA:process_name}%{SPACE}%{DATA:process_arguments}CurrentDirectory:%{SPACE}%{DATA:current_directory}%{SPACE}User:%{SPACE}%{DATA:user}%{SPACE}LogonGuid:%{SPACE}{%{DATA:logon_guid}}%{SPACE}LogonId:%{SPACE}%{DATA:logon_id}%{SPACE}TerminalSessionId:%{SPACE}%{INT:terminal_id}%{SPACE}IntegrityLevel:%{SPACE}%{DATA:integrity_level}%{SPACE}Hashes:%{SPACE}MD5=%{DATA:md5},SHA256=%{DATA:sha256}%{SPACE}ParentProcessGuid:%{SPACE}{%{DATA:parent_process_guid}}%{SPACE}ParentProcessId:%{SPACE}%{NONNEGINT:parent_process_id}%{SPACE}ParentImage:%{SPACE}%{DATA:parent_image_path}%{SPACE}ParentCommandLine:%{SPACE}%{GREEDYDATA:parent_process_name}"]
}
mutate {
convert => ["process_guid", "integer"]
convert => ["process_id", "integer"]
remove_field => ["rest_of_msg"]
add_tag => ["process_creation"]
}
}
if [event_id] == 3 {
mutate {
remove_field => ["source_ip"]
}
grok {
match => ["rest_of_msg", "Microsoft-Windows-Sysmon:%{SPACE}SYSTEM:%{SPACE}NT%{SPACE}AUTHORITY:%{SPACE}%{DATA:hostname}:%{SPACE}%{DATA:event_type}:%{SPACE}UtcTime:%{SPACE}%{DATA:sysmon_timestamp}%{SPACE}ProcessGuid:%{SPACE}\{%{DATA:process_guid}\}%{SPACE}ProcessId:%{SPACE}%{NONNEGINT:process_id}%{SPACE}Image:%{SPACE}%{DATA:image_path}%{SPACE}User:%{SPACE}%{DATA:user}%{SPACE}Protocol:%{SPACE}%{DATA:protocol}%{SPACE}Initiated:%{SPACE}%{DATA:initiated}%{SPACE}SourceIsIpv6:%{SPACE}%{DATA:is_source_ipv6}%{SPACE}SourceIp:%{SPACE}%{IP:source_ip}%{SPACE}SourceHostname:%{SPACE}%{DATA:source_hostname}%{SPACE}SourcePort:%{SPACE}%{NONNEGINT:source_port}%{SPACE}SourcePortName:%{SPACE}%{DATA:source_port_name}%{SPACE}DestinationIsIpv6:%{SPACE}%{DATA:dest_is_ipv6}%{SPACE}DestinationIp:%{SPACE}%{IP:destination_ip}%{SPACE}DestinationHostname:%{SPACE}%{DATA:destination_hostname}%{SPACE}DestinationPort:%{SPACE}%{NONNEGINT:destination_port}%{SPACE}DestinationPortName:%{SPACE}%{GREEDYDATA:destination_port_name}"]
}
mutate {
convert => ["process_guid", "integer"]
convert => ["process_id", "integer"]
convert => ["source_port", "integer"]
convert => ["destination_port", "integer"]
remove_field => ["rest_of_msg"]
add_tag => ["network_connection"]
}
}
if [event_id] == 5 {
grok {
match => ["rest_of_msg", "Microsoft-Windows-Sysmon:%{SPACE}SYSTEM:%{SPACE}NT%{SPACE}AUTHORITY:%{SPACE}%{DATA:hostname}:%{SPACE}%{DATA:event_type}:%{SPACE}UtcTime:%{SPACE}%{DATA:sysmon_timestamp}%{SPACE}ProcessGuid:%{SPACE}\{%{DATA:process_guid}\}%{SPACE}ProcessId:%{SPACE}%{NONNEGINT:process_id}%{SPACE}Image:%{SPACE}%{GREEDYDATA:image_path}"]
}
mutate {
convert => ["process_guid", "integer"]
convert => ["process_id", "integer"]
remove_field => ["rest_of_msg"]
add_tag => ["process_termination"]
}
}
if [event_id] == 11 {
grok {
match => ["rest_of_msg","Microsoft-Windows-Sysmon:%{SPACE}SYSTEM:%{SPACE}NT%{SPACE}AUTHORITY:%{SPACE}%{DATA:hostname}:%{SPACE}%{DATA:event_type}:%{SPACE}UtcTime:%{SPACE}%{DATA:sysmon_timestamp}%{SPACE}ProcessGuid:%{SPACE}\{%{DATA:process_guid}\}%{SPACE}ProcessId:%{SPACE}%{NONNEGINT:process_id}%{SPACE}Image:%{SPACE}%{DATA:image_path}%{SPACE}TargetFilename:%{SPACE}%{DATA:target_filename}%{SPACE}CreationUtcTime:%{SPACE}%{DATA:creation_time}%{SPACE}"]
}
mutate {
convert => ["process_guid", "integer"]
convert => ["process_id", "integer"]
remove_field => ["rest_of_msg"]
add_tag => ["file_created"]
}
}
# if [sysmon_event_id] == "16" {
# grok {
# }
# mutate {
# add_tag => ["sysmon_config_changed"]
# }
# }
}

23
salt/logstash/files/conf.d/6502_ossec_autoruns.conf
View File

@@ -1,23 +0,0 @@
# Author: Wes Lambert
# wlambertts@gmail.com
#
# Last Update: 07/17/2017
#
# This conf file is based on accepting Autoruns logs from OSSEC
#
# Parse using grok
filter {
if [type] == "autoruns" {
grok {
match => ["message", "%{YEAR:year} %{SYSLOGTIMESTAMP:ossec_timestamp} \(%{DATA:ossec_agent_name}\) %{IP:source_ip}->%{DATA:location} %{DATA:log_name}\|%{DATA:hostname}\|%{DATESTAMP:log_timestamp}\|%{DATA:event_timestamp}\|%{DATA:entry_location}\|%{DATA:entry}\|%{DATA:enabled}\|%{DATA:category}\|%{DATA:profile}\|%{DATA:description}\|%{DATA:signer}\|%{DATA:company}\|%{DATA:image_path}\|%{DATA:version}\|%{DATA:launch_string}\|%{DATA:md5}\|%{DATA:sha1}\|%{DATA:pesha1}\|%{DATA:pesha256}\|%{DATA:sha256}\|%{DATA:imphash}"]
}
#csv {
# columns => ["log_name","entry_location","entry","enabled","category","autoruns_description","signer","company","image_path","version","launch_string","md5","sha1","pesha1","pesha256","sha256","imphash"]
# separator => "|"
# }
mutate {
remove_field => [ "year" ]
remove_field => [ "timestamp" ]
}
}
}

17
salt/logstash/files/conf.d/8000_postprocess_bro_cleanup.conf
View File

@@ -1,17 +0,0 @@
# Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Email: justin@hasecuritysolution.com
# Last Update: 12/9/2016
filter {
if "bro" in [tags] {
if "_grokparsefailure" not in [tags] and "_csvparsefailure" not in [tags] and "_jsonparsefailure" not in [tags] {
#mutate {
# remove_field => [ "message" ]
#}
}
mutate {
#add_tag => [ "conf_file_8000"]
}
}
}

58
salt/logstash/files/conf.d/8001_postprocess_common_ip_augmentation.conf
View File

@@ -1,58 +0,0 @@
# Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Updated by: Doug Burks
# Last Update: 5/20/2017
filter {
if [source_ip] {
if [source_ip] == "-" {
mutate {
replace => { "source_ip" => "0.0.0.0" }
}
}
if [source_ip] =~ "10\." or [source_ip] =~ "192\.168\." or [source_ip] =~ "172\.(1[6-9]|2[0-9]|3[0-1])\." or [source_ip] =~ "fe80::20c:29ff:fe19:f7d" or [source_ip] =~ "::1" {
mutate {
}
} else {
geoip {
source => "[source_ip]"
target => "source_geo"
}
}
if [source_ip] {
mutate {
add_field => { "ips" => "%{source_ip}" }
add_field => { "source_ips" => [ "%{source_ip}" ] }
}
}
}
if [destination_ip] {
if [destination_ip] == "-" {
mutate {
replace => { "destination_ip" => "0.0.0.0" }
}
}
if [destination_ip] =~ "10\." or [destination_ip] =~ "192\.168\." or [destination_ip] =~ "172\.(1[6-9]|2[0-9]|3[0-1])\." or [destination_ip] =~ "239.255.255.250" or [destination_ip] =~ "224\.0\.0\." or [destination_ip] =~ "255.255.255.255" or [destination_ip] =~ "ff02::fb" or [destination_ip] =~ "fe80::20c:29ff:fe19:f7d" or [destination_ip] =~ "224\.0\.1\." {
mutate {
}
}
else {
geoip {
source => "[destination_ip]"
target => "destination_geo"
}
}
}
if [destination_ip] {
mutate {
add_field => { "ips" => "%{destination_ip}" }
add_field => { "destination_ips" => [ "%{destination_ip}" ] }
}
}
}
#if [source_ip] or [destination_ip] {
# mutate {
#add_tag => [ "conf_file_8001"]
# }
#}

47
salt/logstash/files/conf.d/8006_postprocess_dns.conf
View File

@@ -1,47 +0,0 @@
# Original Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Updated by: Doug Burks
# Last Update: 5/13/2017
filter {
if [type] == "bro_dns" or "dns" in [tags] {
# Used for whois lookups - can create log loop
if [query] =~ "^whois\." {
drop { }
}
# REPLACE test.int with your internal domain
if [query] and [query] !~ "\.test\.int$" {
mutate {
lowercase => [ "query" ]
}
if [query_type_name] != "NB" and [query_type_name] != "TKEY" and [query_type_name] != "NBSTAT" and [query_type_name] != "PTR" {
tld {
source => "query"
}
ruby {
code => "event.set('query_length', event.get('query').length)"
}
mutate {
rename => { "[SubLog][sessionid]" => "sub_session_id" }
rename => { "[tld][domain]" => "highest_registered_domain" }
rename => { "[tld][trd]" => "subdomain" }
rename => { "[tld][tld]" => "top_level_domain" }
rename => { "[tld][sld]" => "parent_domain" }
}
if [parent_domain] {
ruby {
code => "event.set('parent_domain_length', event.get('parent_domain').length)"
}
}
if [subdomain] {
ruby {
code => "event.set('subdomain_length', event.get('subdomain').length)"
}
}
}
}
mutate {
#add_tag => [ "conf_file_8006"]
}
}
}

27
salt/logstash/files/conf.d/8007_postprocess_http.conf
View File

@@ -1,27 +0,0 @@
# Original Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Updated by: Doug Burks
# Last Update: 5/13/2017
filter {
if [type] == "bro_http" {
if [uri] {
ruby {
code => "event.set('uri_length', event.get('uri').length)"
}
}
if [virtual_host] {
ruby {
code => "event.set('virtual_host_length', event.get('virtual_host').length)"
}
}
if [useragent] {
ruby {
code => "event.set('useragent_length', event.get('useragent').length)"
}
}
mutate {
##add_tag => [ "conf_file_8007"]
}
}
}

58
salt/logstash/files/conf.d/8200_postprocess_tagging.conf
View File

@@ -1,58 +0,0 @@
# Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Email: justin@hasecuritysolution.com
# Last Update: 12/9/2016
filter {
if [destination_ip] {
if [destination_ip] =~ "10\." or [destination_ip] =~ "192\.168\." or [destination_ip] =~ "172\.(1[6-9]|2[0-9]|3[0-1])\." {
mutate {
add_tag => [ "internal_destination" ]
}
} else {
mutate {
add_tag => [ "external_destination" ]
}
}
if "internal_destination" not in [tags] {
if [destination_ip] == "198.41.0.4" or [destination_ip] == "192.228.79.201" or [destination_ip] == "192.33.4.12" or [destination_ip] == "199.7.91.13" or [destination_ip] == "192.203.230.10" or [destination_ip] == "192.5.5.241" or [destination_ip] == "192.112.36.4" or [destination_ip] == "198.97.190.53" or [destination_ip] == "192.36.148.17" or [destination_ip] == "192.58.128.30" or [destination_ip] == "193.0.14.129" or [destination_ip] == "199.7.83.42" or [destination_ip] == "202.12.27.33" {
mutate {
add_tag => [ "root_dns_server" ]
}
}
}
# Customize this section to your environment
if [destination_ip] == "74.40.74.40" or [destination_ip] == "74.40.74.41" {
mutate {
add_tag => [ "authorized_dns_server" ]
}
}
}
if [source_ip] {
if [source_ip] =~ "10\." or [source_ip] =~ "192\.168\." or [source_ip] =~ "172\.(1[6-9]|2[0-9]|3[0-1])\." {
mutate {
add_tag => [ "internal_source" ]
}
} else {
mutate {
add_tag => [ "external_source" ]
}
}
if "internal_source" not in [tags] {
if [source_ip] == "198.41.0.4" or [source_ip] == "192.228.79.201" or [source_ip] == "192.33.4.12" or [source_ip] == "199.7.91.13" or [source_ip] == "192.203.230.10" or [source_ip] == "192.5.5.241" or [source_ip] == "192.112.36.4" or [source_ip] == "198.97.190.53" or [source_ip] == "192.36.148.17" or [source_ip] == "192.58.128.30" or [source_ip] == "193.0.14.129" or [source_ip] == "199.7.83.42" or [source_ip] == "202.12.27.33" {
mutate {
add_tag => [ "root_dns_server" ]
}
}
}
# Customize this section to your environment
if [destination_ip] == "74.40.74.40" and "authorized_dns_server" not in [tags] or [destination_ip] == "74.40.74.41" and "authorized_dns_server" not in [tags] {
mutate {
add_tag => [ "authorized_dns_server" ]
}
}
mutate {
##add_tag => [ "conf_file_8200"]
}
}
}

19
salt/logstash/files/conf.d/8998_postprocess_log_elapsed.conf
View File

@@ -1,19 +0,0 @@
# Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Email: justin@hasecuritysolution.com
# Last Update: 12/9/2016
filter {
ruby {
code => "event.set('task_end', Time.now.to_f)"
}
ruby {
code => "event.set('logstash_time', event.get('task_end') - event.get('task_start'))"
}
mutate {
remove_field => [ 'task_start', 'task_end' ]
}
mutate {
#add_tag => [ "conf_file_8998"]
}
}

8
salt/logstash/files/conf.d/8999_postprocess_rename_type.conf
View File

@@ -1,8 +0,0 @@
# Author: Doug Burks
# Last Update: 12/10/2017
filter {
mutate {
rename => [ "type", "event_type" ]
}
}

22
salt/logstash/files/conf.d/9000_output_bro.conf
View File

@@ -1,22 +0,0 @@
# Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Email: justin@hasecuritysolution.com
# Last Update: 12/9/2016
filter {
if "bro" in [tags] and "test_data" not in [tags] and "import" not in [tags] {
mutate {
##add_tag => [ "conf_file_9000"]
}
}
}
output {
if "bro" in [tags] and "test_data" not in [tags] and "import" not in [tags] {
# stdout { codec => rubydebug }
elasticsearch {
hosts => elasticsearch
index => "logstash-bro-%{+YYYY.MM.dd}"
template => "/logstash-template.json"
}
}
}

22
salt/logstash/files/conf.d/9001_output_switch.conf
View File

@@ -1,22 +0,0 @@
# Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Email: justin@hasecuritysolution.com
# Last Update: 12/9/2016
filter {
if "switch" in [tags] and "test_data" not in [tags] {
mutate {
##add_tag => [ "conf_file_9001"]
}
}
}
output {
if "switch" in [tags] and "test_data" not in [tags] {
#stdout { codec => rubydebug }
elasticsearch {
hosts => elasticsearch
index => "logstash-switch-%{+YYYY.MM.dd}"
template => "/logstash-template.json"
}
}
}

20
salt/logstash/files/conf.d/9002_output_import.conf
View File

@@ -1,20 +0,0 @@
# Updated by: Doug Burks
# Last Update: 5/16/2017
filter {
if "import" in [tags] and "test_data" not in [tags] {
mutate {
##add_tag => [ "conf_file_9002"]
}
}
}
output {
if "import" in [tags] and "test_data" not in [tags] {
# stdout { codec => rubydebug }
elasticsearch {
hosts => elasticsearch
index => "logstash-import-%{+YYYY.MM.dd}"
template => "/logstash-template.json"
}
}
}

22
salt/logstash/files/conf.d/9004_output_flow.conf
View File

@@ -1,22 +0,0 @@
# Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Email: justin@hasecuritysolution.com
# Last Update: 12/9/2016
filter {
if [event_type] == "sflow" and "test_data" not in [tags] {
mutate {
##add_tag => [ "conf_file_9004"]
}
}
}
output {
if [event_type] == "sflow" and "test_data" not in [tags] {
#stdout { codec => rubydebug }
elasticsearch {
hosts => elasticsearch
index => "logstash-flow-%{+YYYY.MM.dd}"
template => "/logstash-template.json"
}
}
}

21
salt/logstash/files/conf.d/9026_output_dhcp.conf
View File

@@ -1,21 +0,0 @@
# Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Email: justin@hasecuritysolution.com
# Last Update: 12/9/2016
filter {
if [event_type] == "dhcp" and "test_data" not in [tags] {
mutate {
##add_tag => [ "conf_file_9026"]
}
}
}
output {
if [event_type] == "dhcp" and "test_data" not in [tags] {
#stdout { codec => rubydebug }
elasticsearch {
hosts => elasticsearch
template => "/logstash-template.json"
}
}
}

20
salt/logstash/files/conf.d/9029_output_esxi.conf
View File

@@ -1,20 +0,0 @@
# Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Email: justin@hasecuritysolution.com
# Last Update: 12/9/2016
filter {
if [event_type] == "esxi" and "test_data" not in [tags] {
mutate {
##add_tag => [ "conf_file_9029"]
}
}
}
output {
if [event_type] == "esxi" and "test_data" not in [tags] {
elasticsearch {
hosts => elasticsearch
template => "/logstash-template.json"
}
}
}

20
salt/logstash/files/conf.d/9030_output_greensql.conf
View File

@@ -1,20 +0,0 @@
# Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Email: justin@hasecuritysolution.com
# Last Update: 12/9/2016
filter {
if [event_type] == "greensql" and "test_data" not in [tags] {
mutate {
##add_tag => [ "conf_file_9030"]
}
}
}
output {
if [event_type] == "greensql" and "test_data" not in [tags] {
elasticsearch {
hosts => elasticsearch
template => "/logstash-template.json"
}
}
}

21
salt/logstash/files/conf.d/9031_output_iis.conf
View File

@@ -1,21 +0,0 @@
# Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Email: justin@hasecuritysolution.com
# Last Update: 12/9/2016
filter {
if [event_type] == "iis" and "test_data" not in [tags] {
mutate {
##add_tag => [ "conf_file_9031"]
}
}
}
output {
if [event_type] == "iis" and "test_data" not in [tags] {
#stdout { codec => rubydebug }
elasticsearch {
hosts => elasticsearch
template => "/logstash-template.json"
}
}
}

21
salt/logstash/files/conf.d/9032_output_mcafee.conf
View File

@@ -1,21 +0,0 @@
# Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Email: justin@hasecuritysolution.com
# Last Update: 12/9/2016
filter {
if [event_type] == "mcafee" and "test_data" not in [tags] {
mutate {
##add_tag => [ "conf_file_9032"]
}
}
}
output {
if [event_type] == "mcafee" and "test_data" not in [tags] {
#stdout { codec => rubydebug }
elasticsearch {
hosts => elasticsearch
template => "/logstash-template.json"
}
}
}

22
salt/logstash/files/conf.d/9033_output_snort.conf
View File

@@ -1,22 +0,0 @@
# Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Email: justin@hasecuritysolution.com
# Last Update: 12/9/2016
filter {
if [event_type] == "snort" and "test_data" not in [tags] {
mutate {
##add_tag => [ "conf_file_9033"]
}
}
}
output {
if [event_type] == "snort" and "test_data" not in [tags] {
#stdout { codec => rubydebug }
elasticsearch {
hosts => elasticsearch
index => "logstash-ids-%{+YYYY.MM.dd}"
template => "/logstash-template.json"
}
}
}

21
salt/logstash/files/conf.d/9034_output_syslog.conf
View File

@@ -1,21 +0,0 @@
# Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Updated by: Doug Burks
# Last Update: 5/15/2017
filter {
if "syslog" in [tags] and "test_data" not in [tags] {
mutate {
##add_tag => [ "conf_file_9034"]
}
}
}
output {
if "syslog" in [tags] and "test_data" not in [tags] {
elasticsearch {
hosts => elasticsearch
index => "logstash-syslog-%{+YYYY.MM.dd}"
template => "/logstash-template.json"
}
}
}

22
salt/logstash/files/conf.d/9200_output_firewall.conf
View File

@@ -1,22 +0,0 @@
# Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Email: justin@hasecuritysolution.com
# Last Update: 12/9/2016
filter {
if "firewall" in [tags] and "test_data" not in [tags] {
mutate {
##add_tag => [ "conf_file_9200"]
}
}
}
output {
if "firewall" in [tags] and "test_data" not in [tags] {
# stdout { codec => rubydebug }
elasticsearch {
hosts => elasticsearch
index => "logstash-firewall-%{+YYYY.MM.dd}"
template => "/logstash-template.json"
}
}
}

23
salt/logstash/files/conf.d/9300_output_windows.conf
View File

@@ -1,23 +0,0 @@
# Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Email: justin@hasecuritysolution.com
# Last Update: 12/9/2016
filter {
if [event_type] == "windows" and "test_data" not in [tags] {
mutate {
##add_tag => [ "conf_file_9300"]
}
}
}
output {
if [event_type] == "windows" and "test_data" not in [tags] {
#stdout { codec => rubydebug }
elasticsearch {
hosts => elasticsearch
index => "logstash-windows-%{+YYYY.MM.dd}"
template => "/logstash-template.json"
}
}
}

23
salt/logstash/files/conf.d/9301_output_dns_windows.conf
View File

@@ -1,23 +0,0 @@
# Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Email: justin@hasecuritysolution.com
# Last Update: 12/9/2016
filter {
if [event_type] == "dns" and "test_data" not in [tags] {
mutate {
##add_tag => [ "conf_file_9301"]
}
}
}
output {
if [event_type] == "dns" and "test_data" not in [tags] {
#stdout { codec => rubydebug }
elasticsearch {
hosts => elasticsearch
index => "logstash-%{+YYYY.MM.dd}"
template => "/logstash-template.json"
}
}
}

22
salt/logstash/files/conf.d/9400_output_suricata.conf
View File

@@ -1,22 +0,0 @@
# Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Email: justin@hasecuritysolution.com
# Last Update: 12/9/2016
filter {
if [event_type] == "suricata" and "test_data" not in [tags] {
mutate {
##add_tag => [ "conf_file_9400"]
}
}
}
output {
if [event_type] == "suricata" and "test_data" not in [tags] {
#stdout { codec => rubydebug }
elasticsearch {
hosts => elasticsearch
index => "logstash-ids-%{+YYYY.MM.dd}"
template => "/logstash-template.json"
}
}
}

18
salt/logstash/files/conf.d/9500_output_beats.conf
View File

@@ -1,18 +0,0 @@
# Author: Wes Lambert
# Last Update: 12/11/2017
filter {
if "beat" in [tags] {
mutate {
##add_tag => [ "conf_file_9000"]
}
}
}
output {
if "beat" in [tags] {
elasticsearch {
hosts => elasticsearch
index => "logstash-beats-%{+YYYY.MM.dd}"
template => "/beats-template.json"
}
}
}

21
salt/logstash/files/conf.d/9998_output_test_data.conf
View File

@@ -1,21 +0,0 @@
# Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Email: justin@hasecuritysolution.com
# Last Update: 12/9/2016
filter {
if "test_data" in [tags] {
mutate {
#add_tag => [ "conf_file_9998"]
}
}
}
output {
if "test_data" in [tags] {
elasticsearch {
hosts => elasticsearch
index => "logstash-test-%{+YYYY.MM.dd}"
template => "/logstash-template.json"
}
}
}

256
salt/logstash/files/dictionaries/iana_protocols.yaml
View File

@@ -1,256 +0,0 @@
"0": HOPOPT
"1": ICMP
"2": IGMP
"3": GGP
"4": IPv4
"5": ST
"6": TCP
"7": CBT
"8": EGP
"9": IGP
"10": BBN-RCC-MON
"11": NVP-II
"12": PUP
"13": ARGUS
"14": EMCON
"15": XNET
"16": CHAOS
"17": UDP
"18": MUX
"19": DCN-MEAS
"20": HMP
"21": PRM
"22": XNS-IDP
"23": TRUNK-1
"24": TRUNK-2
"25": LEAF-1
"26": LEAF-2
"27": RDP
"28": IRTP
"29": ISO-TP4
"30": NETBLT
"31": MFE-NSP
"32": MERIT-INP
"33": DCCP
"34": 3PC
"35": IDPR
"36": XTP
"37": DDP
"38": IDPR-CMTP
"39": TP++
"40": IL
"41": IPv6
"42": SDRP
"43": IPv6-Route
"44": IPv6-Frag
"45": IDRP
"46": RSVP
"47": GRE
"48": DSR
"49": BNA
"50": ESP
"51": AH
"52": I-NLSP
"53": SWIPE
"54": NARP
"55": MOBILE
"56": TLSP
"57": SKIP
"58": IPv6-ICMP
"59": IPv6-NoNxt
"60": IPv6-Opts
"61": Undefined
"62": CFTP
"63": Undefined
"64": SAT-EXPAK
"65": KRYPTOLAN
"66": RVD
"67": IPPC
"68": Undefined
"69": SAT-MON
"70": VISA
"71": IPCV
"72": CPNX
"73": CPHB
"74": WSN
"75": PVP
"76": BR-SAT-MON
"77": SUN-ND
"78": WB-MON
"79": WB-EXPAK
"80": ISO-IP
"81": VMTP
"82": SECURE-VMTP
"83": VINES
"84": TTP/IPTM
"85": NSFNET-IGP
"86": DGP
"87": TCF
"88": EIGRP
"89": OSPFIGP
"90": Sprite-RPC
"91": LARP
"92": MTP
"93": AX.25
"94": IPIP
"95": MICP
"96": SCC-SP
"97": ETHERIP
"98": ENCAP
"99": Undefined
"100": GMTP
"101": IFMP
"102": PNNI
"103": PIM
"104": ARIS
"105": SCPS
"106": QNX
"107": A/N
"108": IPComp
"109": SNP
"110": Compaq-Peer
"111": IPX-in-IP
"112": VRRP
"113": PGM
"114": Undefined
"115": L2TP
"116": DDX
"117": IATP
"118": STP
"119": SRP
"120": UTI
"121": SMP
"122": SM
"123": PTP
"124": ISIS over IPv4
"125": FIRE
"126": CRTP
"127": CRUDP
"128": SSCOPMCE
"129": IPLT
"130": SPS
"131": PIPE
"132": SCTP
"133": FC
"134": RSVP-E2E-IGNORE
"135": Mobility Header
"136": UDPLite
"137": MPLS-in-IP
"138": manet
"139": HIP
"140": Shim6
"141": WESP
"142": ROHC
"143": Undefined
"144": Undefined
"145": Undefined
"146": Undefined
"147": Undefined
"148": Undefined
"149": Undefined
"150": Undefined
"151": Undefined
"152": Undefined
"153": Undefined
"154": Undefined
"155": Undefined
"156": Undefined
"157": Undefined
"158": Undefined
"159": Undefined
"160": Undefined
"161": Undefined
"162": Undefined
"163": Undefined
"164": Undefined
"165": Undefined
"166": Undefined
"167": Undefined
"168": Undefined
"169": Undefined
"170": Undefined
"171": Undefined
"172": Undefined
"173": Undefined
"174": Undefined
"175": Undefined
"176": Undefined
"177": Undefined
"178": Undefined
"179": Undefined
"180": Undefined
"181": Undefined
"182": Undefined
"183": Undefined
"184": Undefined
"185": Undefined
"186": Undefined
"187": Undefined
"188": Undefined
"189": Undefined
"190": Undefined
"191": Undefined
"192": Undefined
"193": Undefined
"194": Undefined
"195": Undefined
"196": Undefined
"197": Undefined
"198": Undefined
"199": Undefined
"200": Undefined
"201": Undefined
"202": Undefined
"203": Undefined
"204": Undefined
"205": Undefined
"206": Undefined
"207": Undefined
"208": Undefined
"209": Undefined
"210": Undefined
"211": Undefined
"212": Undefined
"213": Undefined
"214": Undefined
"215": Undefined
"216": Undefined
"217": Undefined
"218": Undefined
"219": Undefined
"220": Undefined
"221": Undefined
"222": Undefined
"223": Undefined
"224": Undefined
"225": Undefined
"226": Undefined
"227": Undefined
"228": Undefined
"229": Undefined
"230": Undefined
"231": Undefined
"232": Undefined
"233": Undefined
"234": Undefined
"235": Undefined
"236": Undefined
"237": Undefined
"238": Undefined
"239": Undefined
"240": Undefined
"241": Undefined
"242": Undefined
"243": Undefined
"244": Undefined
"245": Undefined
"246": Undefined
"247": Undefined
"248": Undefined
"249": Undefined
"250": Undefined
"251": Undefined
"252": Undefined
"253": Undefined
"254": Undefined
"255": Reserved

345
salt/logstash/files/dictionaries/iana_services.yaml
View File

@@ -1,345 +0,0 @@
"1": tcpmux
"2": nbp
"4": echo
"6": zip
"7": echo
"9": discard
"11": systat
"13": daytime
"15": netstat
"17": qotd
"18": msp
"19": chargen
"20": ftp-data
"21": ftp
"22": ssh
"23": telnet
"25": smtp
"37": time
"39": rlp
"42": nameserver
"43": whois
"49": tacacs
"50": re-mail-ck
"53": domain
"57": mtp
"65": tacacs-ds
"67": bootps
"68": bootpc
"69": tftp
"70": gopher
"77": rje
"79": finger
"80": http
"87": link
"88": kerberos
"95": supdup
"98": linuxconf
"101": hostnames
"102": iso-tsap
"104": acr-nema
"105": csnet-ns
"106": poppassd
"107": rtelnet
"109": pop2
"110": pop3
"111": sunrpc
"113": auth
"115": sftp
"117": uucp-path
"119": nntp
"123": ntp
"129": pwdgen
"135": loc-srv
"137": netbios-ns
"138": netbios-dgm
"139": netbios-ssn
"143": imap2
"161": snmp
"162": snmp-trap
"163": cmip-man
"164": cmip-agent
"174": mailq
"177": xdmcp
"178": nextstep
"179": bgp
"191": prospero
"194": irc
"199": smux
"201": at-rtmp
"202": at-nbp
"204": at-echo
"206": at-zis
"209": qmtp
"210": z3950
"213": ipx
"220": imap3
"345": pawserv
"346": zserv
"347": fatserv
"369": rpc2portmap
"370": codaauth2
"371": clearcase
"372": ulistserv
"389": ldap
"406": imsp
"427": svrloc
"443": https
"444": snpp
"445": microsoft-ds
"464": kpasswd
"465": urd
"487": saft
"500": isakmp
"512": exec
"512": biff
"513": login
"513": who
"514": shell
"514": syslog
"515": printer
"517": talk
"518": ntalk
"520": route
"525": timed
"526": tempo
"530": courier
"531": conference
"532": netnews
"533": netwall
"538": gdomap
"540": uucp
"543": klogin
"544": kshell
"546": dhcpv6-client
"547": dhcpv6-server
"548": afpovertcp
"549": idfp
"554": rtsp
"556": remotefs
"563": nntps
"587": submission
"607": nqs
"610": npmp-local
"611": npmp-gui
"612": hmmp-ind
"623": asf-rmcp
"628": qmqp
"631": ipp
"636": ldaps
"655": tinc
"706": silc
"749": kerberos-adm
"750": kerberos4
"751": kerberos-master
"752": passwd-server
"754": krb-prop
"760": krbupdate
"765": webster
"775": moira-db
"777": moira-update
"779": moira-ureg
"783": spamd
"808": omirr
"871": supfilesrv
"873": rsync
"901": swat
"989": ftps-data
"990": ftps
"992": telnets
"993": imaps
"994": ircs
"995": pop3s
"1001": customs
"1080": socks
"1093": proofd
"1094": rootd
"1099": rmiregistry
"1109": kpop
"1127": supfiledbg
"1178": skkserv
"1194": openvpn
"1210": predict
"1214": kazaa
"1236": rmtcfg
"1241": nessus
"1300": wipld
"1313": xtel
"1314": xtelw
"1352": lotusnote
"1433": ms-sql-s
"1434": ms-sql-m
"1524": ingreslock
"1525": prospero-np
"1529": support
"1645": datametrics
"1646": sa-msg-port
"1649": kermit
"1677": groupwise
"1701": l2f
"1812": radius
"1813": radius-acct
"1863": msnp
"1957": unix-status
"1958": log-server
"1959": remoteping
"2000": cisco-sccp
"2003": cfinger
"2010": search
"2010": pipe-server
"2049": nfs
"2053": knetd
"2086": gnunet
"2101": rtcm-sc104
"2102": zephyr-srv
"2103": zephyr-clt
"2104": zephyr-hm
"2105": eklogin
"2111": kx
"2119": gsigatekeeper
"2121": iprop
"2121": frox
"2135": gris
"2150": ninstall
"2401": cvspserver
"2430": venus
"2431": venus-se
"2432": codasrv
"2433": codasrv-se
"2583": mon
"2600": zebrasrv
"2601": zebra
"2602": ripd
"2603": ripngd
"2604": ospfd
"2605": bgpd
"2606": ospf6d
"2607": ospfapi
"2608": isisd
"2628": dict
"2792": f5-globalsite
"2811": gsiftp
"2947": gpsd
"2988": afbackup
"2989": afmbackup
"3050": gds-db
"3130": icpv2
"3260": iscsi-target
"3306": mysql
"3493": nut
"3632": distcc
"3689": daap
"3690": svn
"4031": suucp
"4094": sysrqd
"4190": sieve
"4224": xtell
"4353": f5-iquery
"4369": epmd
"4373": remctl
"4500": ipsec-nat-t
"4557": fax
"4559": hylafax
"4569": iax
"4600": distmp3
"4691": mtn
"4899": radmin-port
"4949": munin
"5002": rfe
"5050": mmcc
"5051": enbd-cstatd
"5052": enbd-sstatd
"5060": sip
"5061": sip-tls
"5151": pcrd
"5190": aol
"5222": xmpp-client
"5269": xmpp-server
"5308": cfengine
"5353": mdns
"5354": noclog
"5355": hostmon
"5432": postgresql
"5555": rplay
"5556": freeciv
"5666": nrpe
"5667": nsca
"5672": amqp
"5674": mrtd
"5675": bgpsim
"5680": canna
"5688": ggz
"6000": x11
"6001": x11-1
"6002": x11-2
"6003": x11-3
"6004": x11-4
"6005": x11-5
"6006": x11-6
"6007": x11-7
"6346": gnutella-svc
"6347": gnutella-rtr
"6444": sge-qmaster
"6445": sge-execd
"6446": mysql-proxy
"6514": syslog-tls
"6566": sane-port
"6667": ircd
"7000": afs3-fileserver
"7001": afs3-callback
"7002": afs3-prserver
"7003": afs3-vlserver
"7004": afs3-kaserver
"7005": afs3-volser
"7006": afs3-errors
"7007": afs3-bos
"7008": afs3-update
"7009": afs3-rmtsys
"7100": font-service
"8021": zope-ftp
"8080": http-alt
"8081": tproxy
"8088": omniorb
"8990": clc-build-daemon
"9098": xinetd
"9101": bacula-dir
"9102": bacula-fd
"9103": bacula-sd
"9359": mandelspawn
"9418": git
"9667": xmms2
"9673": zope
"10000": webmin
"10050": zabbix-agent
"10051": zabbix-trapper
"10080": amanda
"10081": kamanda
"10082": amandaidx
"10083": amidxtape
"10809": nbd
"11112": dicom
"11201": smsqp
"11371": hkp
"13720": bprd
"13721": bpdbm
"13722": bpjava-msvc
"13724": vnetd
"13782": bpcd
"13783": vopied
"15345": xpilot
"17001": sgi-cmsd
"17002": sgi-crsd
"17003": sgi-gcd
"17004": sgi-cad
"17500": db-lsp
"20011": isdnlog
"20012": vboxd
"22125": dcap
"22128": gsidcap
"22273": wnn6
"24554": binkp
"27374": asp
"30865": csync2
"57000": dircproxy
"60177": tfido
"60179": fido

3
salt/logstash/files/dictionaries/services.yaml
View File

@@ -1,3 +0,0 @@
"Windows Update": whitelist
"SEC555 Service": whitelist
"Evil Service": blacklist

64
salt/logstash/files/dictionaries/tcp_flags.yaml
View File

@@ -1,64 +0,0 @@
"0x00": NULL
"0x01": FIN
"0x02": SYN
"0x03": FIN-SYN
"0x08": PSH
"0x09": FIN-PSH
"0x0A": SYN-PSH
"0x0B": FIN-SYN-PSH
"0x10": ACK
"0x11": FIN-ACK
"0x12": SYN-ACK
"0x13": FIN-SYN-ACK
"0x18": PSH-ACK
"0x19": FIN-PSH-ACK
"0x1A": SYN-PSH-ACK
"0x1B": FIN-SYN-PSH-ACK
"0x40": ECE
"0x41": FIN-ECE
"0x42": SYN-ECE
"0x43": FIN-SYN-ECE
"0x48": PSH-ECE
"0x49": FIN-PSH-ECE
"0x4A": SYN-PSH-ECE
"0x4B": FIN-SYN-PSH-ECE
"0x50": ACK-ECE
"0x51": FIN-ACK-ECE
"0x52": SYN-ACK-ECE
"0x53": FIN-SYN-ACK-ECE
"0x58": PSH-ACK-ECE
"0x59": FIN-PSH-ACK-ECE
"0x5A": SYN-PSH-ACK-ECE
"0x5B": FIN-SYN-PSH-ACK-ECE
"0x80": CWR
"0x81": FIN-CWR
"0x82": SYN-CWR
"0x83": FIN-SYN-CWR
"0x88": PSH-CWR
"0x89": FIN-PSH-CWR
"0x8A": SYN-PSH-CWR
"0x8B": FIN-SYN-PSH-CWR
"0x90": ACK-CWR
"0x91": FIN-ACK-CWR
"0x92": SYN-ACK-CWR
"0x93": FIN-SYN-ACK-CWR
"0x98": PSH-ACK-CWR
"0x99": FIN-PSH-ACK-CWR
"0x9A": SYN-PSH-ACK-CWR
"0x9B": FIN-SYN-PSH-ACK-CWR
"0xC0": ECE-CWR
"0xC1": FIN-ECE-CWR
"0xC2": SYN-ECE-CWR
"0xC3": FIN-SYN-ECE-CWR
"0xC8": PSH-ECE-CWR
"0xC9": FIN-PSH-ECE-CWR
"0xCA": SYN-PSH-ECE-CWR
"0xCB": FIN-SYN-PSH-ECE-CWR
"0xD0": ACK-ECE-CWR
"0xD1": FIN-ACK-ECE-CWR
"0xD2": SYN-ACK-ECE-CWR
"0xD3": FIN-SYN-ACK-ECE-CWR
"0xD8": PSH-ACK-ECE-CWR
"0xD9": FIN-PSH-ACK-ECE-CWR
"0xDA": SYN-PSH-ACK-ECE-CWR
"0xDB": FIN-SYN-PSH-ACK-ECE-CWR

12
salt/logstash/files/logstash.yml
View File

@@ -1,4 +1,14 @@
path.config: /usr/share/logstash/pipeline
{%- set freq = salt['pillar.get']('master:freq', '0') %}
{%- set domainstats = salt['pillar.get']('master:domainstats', '0') %}
{%- if freq == '0' and domainstats == '0' }
path.config: {/usr/share/logstash/pipeline,/usr/share/logstash/custom}
{%- if freq == '1' and domainstats == '0' }
path.config: {/usr/share/logstash/pipeline,/usr/share/logstash/custom,/usr/share/logstash/freq}
{%- if freq == '0' and domainstats == '1' }
path.config: {/usr/share/logstash/pipeline,/usr/share/logstash/custom,/usr/share/logstash/domainstats}
{%- if freq == '1' and domainstats == '1' }
path.config: {/usr/share/logstash/pipeline,/usr/share/logstash/custom,/usr/share/logstash/freq,/usr/share/logstash/domainstats}
{%- endif %}
http.host: 0.0.0.0
queue.type: persisted
queue.max_bytes: 1gb

4
salt/logstash/init.sls
View File

@@ -75,8 +75,8 @@ so-logstash:
- hostname: logstash
- user: logstash
- environment:
- LS_JAVA_OPTS="-Xms{{ lsheap }} -Xmx{{ lsheap }}"
- ports:
- LS_JAVA_OPTS=-Xms{{ lsheap }} -Xmx{{ lsheap }}
- port_bindings:
- 5044
- 6050
- 6051