From a6bc5b108f3ac609d528107da12979a048395ab9 Mon Sep 17 00:00:00 2001 From: Wes Date: Tue, 22 Nov 2022 20:51:44 +0000 Subject: [PATCH] Add missing OPCUA 'activate_session' pipelines --- .../zeek.opcua_activate_session_client_software_cert | 11 +++++++++++ .../zeek.opcua_activate_session_diagnostic_info | 10 ++++++++++ .../ingest/zeek.opcua_activate_session_locale_id | 10 ++++++++++ 3 files changed, 31 insertions(+) create mode 100644 salt/elasticsearch/files/ingest/zeek.opcua_activate_session_client_software_cert create mode 100644 salt/elasticsearch/files/ingest/zeek.opcua_activate_session_diagnostic_info create mode 100644 salt/elasticsearch/files/ingest/zeek.opcua_activate_session_locale_id diff --git a/salt/elasticsearch/files/ingest/zeek.opcua_activate_session_client_software_cert b/salt/elasticsearch/files/ingest/zeek.opcua_activate_session_client_software_cert new file mode 100644 index 000000000..2f2bb1196 --- /dev/null +++ b/salt/elasticsearch/files/ingest/zeek.opcua_activate_session_client_software_cert @@ -0,0 +1,11 @@ +{ + "description" : "zeek.opcua.activate_session_client_software_cert", + "processors" : [ + { "remove": { "field": ["host"], "ignore_failure": true } }, + { "json": { "field": "message", "target_field": "message2", "ignore_failure": true} }, + { "rename": { "field": "message2.client_software_cert_link_id", "target_field": "opcua.client_software_cert.link_id", "ignore_missing": true } }, + { "rename": { "field": "message2.cert_data", "target_field": "opcua.certificate.data", "ignore_missing": true } }, + { "rename": { "field": "message2.cert_signature", "target_field": "opcua.certificate.signature", "ignore_missing": true } }, + { "pipeline": { "name": "zeek.common" } } + ] +} diff --git a/salt/elasticsearch/files/ingest/zeek.opcua_activate_session_diagnostic_info b/salt/elasticsearch/files/ingest/zeek.opcua_activate_session_diagnostic_info new file mode 100644 index 000000000..6b77ce8ef --- /dev/null +++ b/salt/elasticsearch/files/ingest/zeek.opcua_activate_session_diagnostic_info @@ -0,0 +1,10 @@ +{ + "description" : " zeek.opcua.activate_session_diagnostic_info", + "processors" : [ + { "remove": { "field": ["host"], "ignore_failure": true } }, + { "json": { "field": "message", "target_field": "message2", "ignore_failure": true} }, + { "rename": { "field": "message2.activate_session_diag_info_link_id", "target_field": "opcua.activate_session_diag_info.link_id", "ignore_missing": true } }, + { "rename": { "field": "message2.diag_info_link_id", "target_field": "opcua.diag_info.link_id", "ignore_missing": true } }, + { "pipeline": { "name": "zeek.common" } } + ] +} diff --git a/salt/elasticsearch/files/ingest/zeek.opcua_activate_session_locale_id b/salt/elasticsearch/files/ingest/zeek.opcua_activate_session_locale_id new file mode 100644 index 000000000..42674c864 --- /dev/null +++ b/salt/elasticsearch/files/ingest/zeek.opcua_activate_session_locale_id @@ -0,0 +1,10 @@ +{ + "description" : "zeek.opcua.activate_session_locale_id", + "processors" : [ + { "remove": { "field": ["host"], "ignore_failure": true } }, + { "json": { "field": "message", "target_field": "message2", "ignore_failure": true} }, + { "rename": { "field": "message2.opcua_locale_link_id", "target_field": "opcua.locale.link_id", "ignore_missing": true } }, + { "rename": { "field": "message2.local_id", "target_field": "opcua.local_id", "ignore_missing": true } }, + { "pipeline": { "name": "zeek.common" } } + ] +}