CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2026-03-23 21:12:39 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #15656 from Security-Onion-Solutions/zeek-websocket

Browse Source 
Add support for websockets
This commit is contained in:
Josh Brower
2026-03-23 08:21:08 -04:00
committed by GitHub
parent 07580c3afd 165e69cd11
commit a4fcf4ddf2
2 changed files with 30 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
salt/elasticsearch/files/ingest/zeek.websocket Normal file
View File

@@ -0,0 +1,18 @@
{
"description" : "zeek.websocket",
"processors" : [
{ "set": { "field": "event.dataset", "value": "websocket" } },
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
{ "rename": { "field": "message2.host", "target_field": "websocket.host", "ignore_missing": true } },
{ "rename": { "field": "message2.uri", "target_field": "websocket.uri", "ignore_missing": true } },
{ "rename": { "field": "message2.user_agent", "target_field": "websocket.user_agent", "ignore_missing": true } },
{ "rename": { "field": "message2.subprotocol", "target_field": "websocket.subprotocol", "ignore_missing": true } },
{ "rename": { "field": "message2.client_protocols", "target_field": "websocket.client_protocols", "ignore_missing": true } },
{ "rename": { "field": "message2.client_extensions", "target_field": "websocket.client_extensions", "ignore_missing": true } },
{ "rename": { "field": "message2.server_extensions", "target_field": "websocket.server_extensions", "ignore_missing": true } },
{ "remove": { "field": "message2.tags", "ignore_failure": true } },
{ "set": { "field": "network.transport", "value": "tcp" } },
{ "pipeline": { "name": "zeek.common" } }
]
}

12
salt/soc/defaults.yaml
View File

@@ -584,6 +584,18 @@ soc:
- destination.port
- event.action
- tunnel.type
'::websocket':
- soc_timestamp
- event.dataset
- source.ip
- source.port
- destination.ip
- destination.port
- websocket.host
- websocket.uri
- websocket.user_agent
- log.id.uid
- network.community_id
'::weird':
- soc_timestamp
- event.dataset