CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 17:22:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

Revert to SO taxonomy for zeek and suricata

Browse Source
This commit is contained in:
Mike Reeves
2021-06-08 13:23:31 -04:00
parent 3e138cbc6d
commit a959ec1eb1
2 changed files with 17 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
salt/logstash/pipelines/config/so/9050_output_elasticsearch.jinja
View File

@@ -4,13 +4,15 @@
{%- set ES = salt['pillar.get']('elasticsearch:mainip', '') -%} {%- set ES = salt['pillar.get']('elasticsearch:mainip', '') -%}
{%- endif %} {%- endif %}
output { output {
if [module] =~ "suricata" and "import" not in [tags] { if [event][module] == 'elasticsearch' {
elasticsearch { elasticsearch {
pipeline => "%{module}.%{dataset}" id => "elastic_logs"
pipeline => "filebeat-%{[agent][version]}-elasticsearch-%{[fileset][name]}-pipeline"
hosts => "{{ ES }}" hosts => "{{ ES }}"
index => "so-ids" index => "so-grid-%{+YYYY.MM.dd}"
template_name => "so-ids" template_name => "so-common"
template => "/templates/so-ids-template.json" template => "/templates/so-common-template.json"
template_overwrite => true
ssl => true ssl => true
ssl_certificate_verification => false ssl_certificate_verification => false
} }

6
salt/logstash/pipelines/config/so/9400_output_suricata.conf.jinja
View File

@@ -4,12 +4,12 @@
{%- set ES = salt['pillar.get']('elasticsearch:mainip', '') -%} {%- set ES = salt['pillar.get']('elasticsearch:mainip', '') -%}
{%- endif %} {%- endif %}
output { output {
if [event][module] =~ "suricata" and "import" not in [tags] { if [module] =~ "suricata" and "import" not in [tags] {
elasticsearch { elasticsearch {
pipeline => "filebeat-%{[agent][version]}-suricata-%{[fileset][name]}-pipeline" pipeline => "%{module}.%{dataset}"
hosts => "{{ ES }}" hosts => "{{ ES }}"
index => "so-ids" index => "so-ids"
template_name => "so-ids-%{+YYYY.MM.dd}" template_name => "so-ids"
template => "/templates/so-ids-template.json" template => "/templates/so-ids-template.json"
ssl => true ssl => true
ssl_certificate_verification => false ssl_certificate_verification => false