diff --git a/salt/elasticsearch/files/ingest/suricata.alert b/salt/elasticsearch/files/ingest/suricata.alert index 3d0241e48..ca5bef437 100644 --- a/salt/elasticsearch/files/ingest/suricata.alert +++ b/salt/elasticsearch/files/ingest/suricata.alert @@ -1,15 +1,79 @@ { - "description" : "suricata.alert", - "processors" : [ - { "set": { "if": "ctx.event?.imported != true", "field": "_index", "value": "logs-suricata.alerts-so" } }, - { "set": { "field": "tags","value": "alert" }}, - { "rename":{ "field": "message2.alert", "target_field": "rule", "ignore_failure": true } }, - { "rename":{ "field": "rule.signature", "target_field": "rule.name", "ignore_failure": true } }, - { "rename":{ "field": "rule.ref", "target_field": "rule.version", "ignore_failure": true } }, - { "rename":{ "field": "rule.signature_id", "target_field": "rule.uuid", "ignore_failure": true } }, - { "rename":{ "field": "rule.signature_id", "target_field": "rule.signature", "ignore_failure": true } }, - { "rename":{ "field": "message2.payload_printable", "target_field": "network.data.decoded", "ignore_failure": true } }, - { "dissect": { "field": "rule.rule", "pattern": "%{?prefix}content:\"%{dns.query_name}\"%{?remainder}", "ignore_missing": true, "ignore_failure": true } }, - { "pipeline": { "name": "common.nids" } } - ] + "description": "suricata.alert", + "processors": [ + { + "set": { + "if": "ctx.event?.imported != true", + "field": "_index", + "value": "logs-suricata.alerts-so" + } + }, + { + "set": { + "field": "tags", + "value": "alert" + } + }, + { + "rename": { + "field": "message2.alert", + "target_field": "rule", + "ignore_missing": true, + "ignore_failure": true + } + }, + { + "rename": { + "field": "rule.signature", + "target_field": "rule.name", + "ignore_missing": true, + "ignore_failure": true + } + }, + { + "rename": { + "field": "rule.ref", + "target_field": "rule.version", + "ignore_missing": true, + "ignore_failure": true + } + }, + { + "rename": { + "field": "rule.signature_id", + "target_field": "rule.uuid", + "ignore_missing": true, + "ignore_failure": true + } + }, + { + "rename": { + "field": "rule.signature_id", + "target_field": "rule.signature", + "ignore_missing": true, + "ignore_failure": true + } + }, + { + "rename": { + "field": "message2.payload_printable", + "target_field": "network.data.decoded", + "ignore_missing": true, + "ignore_failure": true + } + }, + { + "dissect": { + "field": "rule.rule", + "pattern": "%{?prefix}content:\"%{dns.query_name}\"%{?remainder}", + "ignore_missing": true, + "ignore_failure": true + } + }, + { + "pipeline": { + "name": "common.nids" + } + } + ] } \ No newline at end of file diff --git a/salt/elasticsearch/files/ingest/suricata.dns b/salt/elasticsearch/files/ingest/suricata.dns index 3ef68f28b..94ae5f73b 100644 --- a/salt/elasticsearch/files/ingest/suricata.dns +++ b/salt/elasticsearch/files/ingest/suricata.dns @@ -1,21 +1,136 @@ { - "description" : "suricata.dns", - "processors" : [ - { "rename": { "field": "message2.proto", "target_field": "network.transport", "ignore_missing": true } }, - { "rename": { "field": "message2.app_proto", "target_field": "network.protocol", "ignore_missing": true } }, - { "rename": { "field": "message2.dns.type", "target_field": "dns.query.type", "ignore_missing": true } }, - { "rename": { "field": "message2.dns.tx_id", "target_field": "dns.id", "ignore_missing": true } }, - { "rename": { "field": "message2.dns.version", "target_field": "dns.version", "ignore_missing": true } }, - { "rename": { "field": "message2.dns.rrname", "target_field": "dns.query.name", "ignore_missing": true } }, - { "rename": { "field": "message2.dns.rrtype", "target_field": "dns.query.type_name", "ignore_missing": true } }, - { "rename": { "field": "message2.dns.flags", "target_field": "dns.flags", "ignore_missing": true } }, - { "rename": { "field": "message2.dns.qr", "target_field": "dns.qr", "ignore_missing": true } }, - { "rename": { "field": "message2.dns.rd", "target_field": "dns.recursion.desired", "ignore_missing": true } }, - { "rename": { "field": "message2.dns.ra", "target_field": "dns.recursion.available", "ignore_missing": true } }, - { "rename": { "field": "message2.dns.rcode", "target_field": "dns.response.code_name", "ignore_missing": true } }, - { "rename": { "field": "message2.dns.grouped.A", "target_field": "dns.answers.data", "ignore_missing": true } }, - { "rename": { "field": "message2.dns.grouped.CNAME", "target_field": "dns.answers.name", "ignore_missing": true } }, - { "pipeline": { "if": "ctx.dns.query?.name != null && ctx.dns.query.name.contains('.')", "name": "dns.tld" } }, - { "pipeline": { "name": "common" } } - ] -} + "description": "suricata.dns", + "processors": [ + { + "rename": { + "field": "message2.proto", + "target_field": "network.transport", + "ignore_missing": true + } + }, + { + "rename": { + "field": "message2.app_proto", + "target_field": "network.protocol", + "ignore_missing": true + } + }, + { + "rename": { + "field": "message2.dns.type", + "target_field": "dns.query.type", + "ignore_missing": true + } + }, + { + "rename": { + "field": "message2.dns.tx_id", + "target_field": "dns.tx_id", + "ignore_missing": true + } + }, + { + "rename": { + "field": "message2.dns.id", + "target_field": "dns.id", + "ignore_missing": true + } + }, + { + "rename": { + "field": "message2.dns.version", + "target_field": "dns.version", + "ignore_missing": true + } + }, + { + "pipeline": { + "name": "suricata.dnsv3", + "ignore_missing_pipeline": true, + "if": "ctx?.dns?.version != null && ctx?.dns?.version == 3", + "ignore_failure": true + } + }, + { + "rename": { + "field": "message2.dns.rrname", + "target_field": "dns.query.name", + "ignore_missing": true + } + }, + { + "rename": { + "field": "message2.dns.rrtype", + "target_field": "dns.query.type_name", + "ignore_missing": true + } + }, + { + "rename": { + "field": "message2.dns.flags", + "target_field": "dns.flags", + "ignore_missing": true + } + }, + { + "rename": { + "field": "message2.dns.qr", + "target_field": "dns.qr", + "ignore_missing": true + } + }, + { + "rename": { + "field": "message2.dns.rd", + "target_field": "dns.recursion.desired", + "ignore_missing": true + } + }, + { + "rename": { + "field": "message2.dns.ra", + "target_field": "dns.recursion.available", + "ignore_missing": true + } + }, + { + "rename": { + "field": "message2.dns.opcode", + "target_field": "dns.opcode", + "ignore_missing": true + } + }, + { + "rename": { + "field": "message2.dns.rcode", + "target_field": "dns.response.code_name", + "ignore_missing": true + } + }, + { + "rename": { + "field": "message2.dns.grouped.A", + "target_field": "dns.answers.data", + "ignore_missing": true + } + }, + { + "rename": { + "field": "message2.dns.grouped.CNAME", + "target_field": "dns.answers.name", + "ignore_missing": true + } + }, + { + "pipeline": { + "if": "ctx.dns.query?.name != null && ctx.dns.query.name.contains('.')", + "name": "dns.tld" + } + }, + { + "pipeline": { + "name": "common" + } + } + ] +} \ No newline at end of file diff --git a/salt/elasticsearch/files/ingest/suricata.dnsv3 b/salt/elasticsearch/files/ingest/suricata.dnsv3 new file mode 100644 index 000000000..0e804364b --- /dev/null +++ b/salt/elasticsearch/files/ingest/suricata.dnsv3 @@ -0,0 +1,56 @@ +{ + "processors": [ + { + "rename": { + "field": "message2.dns.queries", + "target_field": "dns.queries", + "ignore_missing": true, + "ignore_failure": true + } + }, + { + "script": { + "source": "if (ctx?.dns?.queries != null && ctx?.dns?.queries.length > 0) {\n if (ctx.dns == null) {\n ctx.dns = new HashMap();\n }\n if (ctx.dns.query == null) {\n ctx.dns.query = new HashMap();\n }\n ctx.dns.query.name = ctx?.dns?.queries[0].rrname;\n}" + } + }, + { + "script": { + "source": "if (ctx?.dns?.queries != null && ctx?.dns?.queries.length > 0) {\n if (ctx.dns == null) {\n ctx.dns = new HashMap();\n }\n if (ctx.dns.query == null) {\n ctx.dns.query = new HashMap();\n }\n ctx.dns.query.type_name = ctx?.dns?.queries[0].rrtype;\n}" + } + }, + { + "foreach": { + "field": "dns.queries", + "processor": { + "rename": { + "field": "_ingest._value.rrname", + "target_field": "_ingest._value.name", + "ignore_missing": true + } + }, + "ignore_failure": true + } + }, + { + "foreach": { + "field": "dns.queries", + "processor": { + "rename": { + "field": "_ingest._value.rrtype", + "target_field": "_ingest._value.type_name", + "ignore_missing": true + } + }, + "ignore_failure": true + } + }, + { + "pipeline": { + "name": "suricata.tld", + "ignore_missing_pipeline": true, + "if": "ctx?.dns?.queries != null && ctx?.dns?.queries.length > 0", + "ignore_failure": true + } + } + ] +} \ No newline at end of file diff --git a/salt/elasticsearch/files/ingest/suricata.tld b/salt/elasticsearch/files/ingest/suricata.tld new file mode 100644 index 000000000..aa0d67e1e --- /dev/null +++ b/salt/elasticsearch/files/ingest/suricata.tld @@ -0,0 +1,52 @@ +{ + "processors": [ + { + "script": { + "source": "if (ctx.dns != null && ctx.dns.queries != null) {\n for (def q : ctx.dns.queries) {\n if (q.name != null && q.name.contains('.')) {\n q.top_level_domain = q.name.substring(q.name.lastIndexOf('.') + 1);\n }\n }\n}", + "ignore_failure": true + } + }, + { + "script": { + "source": "if (ctx.dns != null && ctx.dns.queries != null) {\n for (def q : ctx.dns.queries) {\n if (q.name != null && q.name.contains('.')) {\n q.query_without_tld = q.name.substring(0, q.name.lastIndexOf('.'));\n }\n }\n}", + "ignore_failure": true + } + }, + { + "script": { + "source": "if (ctx.dns != null && ctx.dns.queries != null) {\n for (def q : ctx.dns.queries) {\n if (q.query_without_tld != null && q.query_without_tld.contains('.')) {\n q.parent_domain = q.query_without_tld.substring(q.query_without_tld.lastIndexOf('.') + 1);\n }\n }\n}", + "ignore_failure": true + } + }, + { + "script": { + "source": "if (ctx.dns != null && ctx.dns.queries != null) {\n for (def q : ctx.dns.queries) {\n if (q.query_without_tld != null && q.query_without_tld.contains('.')) {\n q.subdomain = q.query_without_tld.substring(0, q.query_without_tld.lastIndexOf('.'));\n }\n }\n}", + "ignore_failure": true + } + }, + { + "script": { + "source": "if (ctx.dns != null && ctx.dns.queries != null) {\n for (def q : ctx.dns.queries) {\n if (q.parent_domain != null && q.top_level_domain != null) {\n q.highest_registered_domain = q.parent_domain + \".\" + q.top_level_domain;\n }\n }\n}", + "ignore_failure": true + } + }, + { + "script": { + "source": "if (ctx.dns != null && ctx.dns.queries != null) {\n for (def q : ctx.dns.queries) {\n if (q.subdomain != null) {\n q.subdomain_length = q.subdomain.length();\n }\n }\n}", + "ignore_failure": true + } + }, + { + "script": { + "source": "if (ctx.dns != null && ctx.dns.queries != null) {\n for (def q : ctx.dns.queries) {\n if (q.parent_domain != null) {\n q.parent_domain_length = q.parent_domain.length();\n }\n }\n}", + "ignore_failure": true + } + }, + { + "script": { + "source": "if (ctx.dns != null && ctx.dns.queries != null) {\n for (def q : ctx.dns.queries) {\n q.remove('query_without_tld');\n }\n}", + "ignore_failure": true + } + } + ] +} \ No newline at end of file diff --git a/salt/suricata/suricata_mdengine.yaml b/salt/suricata/suricata_mdengine.yaml index 1c3855501..8a0c502fc 100644 --- a/salt/suricata/suricata_mdengine.yaml +++ b/salt/suricata/suricata_mdengine.yaml @@ -29,7 +29,7 @@ suricata: #custom: [Accept-Encoding, Accept-Language, Authorization] # dump-all-headers: none - dns: - version: 2 + version: 3 enabled: "yes" #requests: "no" #responses: "no"