CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2026-01-03 06:43:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

Logstash Module - Disable freq and modify some configs

Browse Source
This commit is contained in:
Mike Reeves
2018-10-16 14:53:48 -04:00
parent ff98cdb30b
commit b0293c24b5
5 changed files with 11 additions and 411 deletions
Download Patch File Download Diff File Expand all files Collapse all files

304
salt/logstash/files/dynamic/0006_input_beats.conf
View File

@@ -11,313 +11,15 @@ input {
filter {
if "ids" in [tags] {
mutate {
replace => ["type" => "snort"]
add_tag => ["snort"]
remove_tag => ["beat"]
rename => { "host" => "beat_host" }
}
}
if "bro_conn" in [tags] {
if "bro" in [tags] {
mutate {
replace => ["type" => "bro_conn"]
add_tag => ["bro"]
remove_tag => ["beat"]
}
}
if "bro_dhcp" in [tags] {
mutate {
replace => ["type" => "bro_dhcp"]
add_tag => ["bro"]
remove_tag => ["beat"]
}
}
if "bro_dns" in [tags] {
mutate {
replace => ["type" => "bro_dns"]
add_tag => ["bro"]
remove_tag => ["beat"]
}
}
if "bro_dpd" in [tags] {
mutate {
replace => ["type" => "bro_dpd"]
add_tag => ["bro"]
remove_tag => ["beat"]
}
}
if "bro_files" in [tags] {
mutate {
replace => ["type" => "bro_files"]
add_tag => ["bro"]
remove_tag => ["beat"]
}
}
if "bro_ftp" in [tags] {
mutate {
replace => ["type" => "bro_ftp"]
add_tag => ["bro"]
remove_tag => ["beat"]
}
}
if "bro_http" in [tags] {
mutate {
replace => ["type" => "bro_http"]
add_tag => ["bro"]
remove_tag => ["beat"]
}
}
if "bro_irc" in [tags] {
mutate {
replace => ["type" => "bro_irc"]
add_tag => ["bro"]
remove_tag => ["beat"]
}
}
if "bro_kerberos" in [tags] {
mutate {
replace => ["type" => "bro_kerberos"]
add_tag => ["bro"]
remove_tag => ["beat"]
}
}
if "bro_notice" in [tags] {
mutate {
replace => ["type" => "bro_notice"]
add_tag => ["bro"]
remove_tag => ["beat"]
}
}
if "bro_rdp" in [tags] {
mutate {
replace => ["type" => "bro_rdp"]
add_tag => ["bro"]
remove_tag => ["beat"]
}
}
if "bro_signatures" in [tags] {
mutate {
replace => ["type" => "bro_signatures"]
add_tag => ["bro"]
remove_tag => ["beat"]
}
}
if "bro_smtp" in [tags] {
mutate {
replace => ["type" => "bro_smtp"]
add_tag => ["bro"]
remove_tag => ["beat"]
}
}
if "bro_snmp" in [tags] {
mutate {
replace => ["type" => "bro_snmp"]
add_tag => ["bro"]
remove_tag => ["beat"]
}
}
if "bro_software" in [tags] {
mutate {
replace => ["type" => "bro_software"]
add_tag => ["bro"]
remove_tag => ["beat"]
}
}
if "bro_ssh" in [tags] {
mutate {
replace => ["type" => "bro_ssh"]
add_tag => ["bro"]
remove_tag => ["beat"]
}
}
if "bro_ssl" in [tags] {
mutate {
replace => ["type" => "bro_ssl"]
add_tag => ["bro"]
remove_tag => ["beat"]
}
}
if "bro_syslog" in [tags] {
mutate {
replace => ["type" => "bro_syslog"]
add_tag => ["bro"]
remove_tag => ["beat"]
}
}
if "bro_tunnel" in [tags] {
mutate {
replace => ["type" => "bro_tunnel"]
add_tag => ["bro"]
remove_tag => ["beat"]
}
}
if "bro_weird" in [tags] {
mutate {
replace => ["type" => "bro_weird"]
add_tag => ["bro"]
remove_tag => ["beat"]
}
}
if "bro_mysql" in [tags] {
mutate {
replace => ["type" => "bro_mysql"]
add_tag => ["bro"]
remove_tag => ["beat"]
}
}
if "bro_socks" in [tags] {
mutate {
replace => ["type" => "bro_socks"]
add_tag => ["bro"]
remove_tag => ["beat"]
}
}
if "bro_x509" in [tags] {
mutate {
replace => ["type" => "bro_x509"]
add_tag => ["bro"]
remove_tag => ["beat"]
}
}
if "bro_intel" in [tags] {
mutate {
replace => ["type" => "bro_intel"]
add_tag => ["bro"]
remove_tag => ["beat"]
}
}
if "bro_modbus" in [tags] {
mutate {
replace => ["type" => "bro_modbus"]
add_tag => ["bro"]
remove_tag => ["beat"]
}
}
if "bro_sip" in [tags] {
mutate {
replace => ["type" => "bro_sip"]
add_tag => ["bro"]
remove_tag => ["beat"]
}
}
if "bro_radius" in [tags] {
mutate {
replace => ["type" => "bro_radius"]
add_tag => ["bro"]
remove_tag => ["beat"]
}
}
if "bro_pe" in [tags] {
mutate {
replace => ["type" => "bro_pe"]
add_tag => ["bro"]
remove_tag => ["beat"]
}
}
if "bro_rfb" in [tags] {
mutate {
replace => ["type" => "bro_rfb"]
add_tag => ["bro"]
remove_tag => ["beat"]
}
}
if "bro_dnp3" in [tags] {
mutate {
replace => ["type" => "bro_dnp3"]
add_tag => ["bro"]
remove_tag => ["beat"]
}
}
if "bro_smb_files" in [tags] {
mutate {
replace => ["type" => "bro_smb_files"]
add_tag => ["bro"]
remove_tag => ["beat"]
}
}
if "bro_smb_mapping" in [tags] {
mutate {
replace => ["type" => "bro_smb_mapping"]
add_tag => ["bro"]
remove_tag => ["beat"]
}
}
if "bro_ntlm" in [tags] {
mutate {
replace => ["type" => "bro_ntlm"]
add_tag => ["bro"]
remove_tag => ["beat"]
}
}
if "bro_dce_rpc" in [tags] {
mutate {
replace => ["type" => "bro_dce_rpc"]
add_tag => ["bro"]
remove_tag => ["beat"]
}
}
if "bro_telnet" in [tags] {
mutate {
replace => ["type" => "bro_telnet"]
add_tag => ["bro"]
remove_tag => ["beat"]
}
}
if "bro_openvpn" in [tags] {
mutate {
replace => ["type" => "bro_openvpn"]
add_tag => ["bro"]
remove_tag => ["beat"]
}
}
if "bro_mqtt" in [tags] {
mutate {
replace => ["type" => "bro_mqtt"]
add_tag => ["bro"]
remove_tag => ["beat"]
}
}
if "bro_dhcpv6" in [tags] {
mutate {
replace => ["type" => "bro_dhcpv6"]
add_tag => ["bro"]
remove_tag => ["beat"]
rename => { "host" => "beat_host" }
}
}
}