CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 17:22:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

Add missing OPCUA 'activate_session' pipelines

Browse Source
This commit is contained in:
Wes
2022-11-22 20:51:44 +00:00
parent 090f8309c2
commit a6bc5b108f
3 changed files with 31 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
salt/elasticsearch/files/ingest/zeek.opcua_activate_session_client_software_cert Normal file
View File

@@ -0,0 +1,11 @@
{
"description" : "zeek.opcua.activate_session_client_software_cert",
"processors" : [
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true} },
{ "rename": { "field": "message2.client_software_cert_link_id", "target_field": "opcua.client_software_cert.link_id", "ignore_missing": true } },
{ "rename": { "field": "message2.cert_data", "target_field": "opcua.certificate.data", "ignore_missing": true } },
{ "rename": { "field": "message2.cert_signature", "target_field": "opcua.certificate.signature", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}

10
salt/elasticsearch/files/ingest/zeek.opcua_activate_session_diagnostic_info Normal file
View File

@@ -0,0 +1,10 @@
{
"description" : " zeek.opcua.activate_session_diagnostic_info",
"processors" : [
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true} },
{ "rename": { "field": "message2.activate_session_diag_info_link_id", "target_field": "opcua.activate_session_diag_info.link_id", "ignore_missing": true } },
{ "rename": { "field": "message2.diag_info_link_id", "target_field": "opcua.diag_info.link_id", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}

10
salt/elasticsearch/files/ingest/zeek.opcua_activate_session_locale_id Normal file
View File

@@ -0,0 +1,10 @@
{
"description" : "zeek.opcua.activate_session_locale_id",
"processors" : [
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true} },
{ "rename": { "field": "message2.opcua_locale_link_id", "target_field": "opcua.locale.link_id", "ignore_missing": true } },
{ "rename": { "field": "message2.local_id", "target_field": "opcua.local_id", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}