CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-07 09:42:46 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #3002 from Security-Onion-Solutions/feature/sigma-tweaks

Browse Source 
Update .security analyzer
This commit is contained in:
Josh Brower
2021-02-17 16:38:22 -05:00
committed by GitHub
parent 741f674a4c d2a74c80e2
commit b5087b815a
1 changed files with 18 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

33
salt/elasticsearch/templates/so/so-common-template.json
View File

@@ -12,20 +12,18 @@
"analyzer": {
"es_security_analyzer": {
"type": "custom",
"filter": [ "path_hierarchy_pattern_filter", "lowercase" ],
"tokenizer": "whitespace"
},
"es_security_search_analyzer": {
"type": "custom",
"filter": [ "lowercase" ],
"tokenizer": "whitespace"
},
"es_security_search_quote_analyzer": {
"type": "custom",
"filter": [ "lowercase" ],
"tokenizer": "whitespace"
"char_filter": [ "whitespace_no_way" ],
"filter": [ "lowercase", "trim" ],
"tokenizer": "keyword"
}
},
"char_filter": {
"whitespace_no_way": {
"type": "pattern_replace",
"pattern": "(\\s)+",
"replacement": "$1"
}
},
"filter" : {
"path_hierarchy_pattern_filter": {
"type" : "pattern_capture",
@@ -35,6 +33,12 @@
"((?:[^/]*/)*)(.*)"
]
}
},
"tokenizer": {
"path_tokenizer": {
"type": "path_hierarchy",
"delimiter": "\\"
}
}
}
},
@@ -67,13 +71,12 @@
"type": "text",
"fields": {
"keyword": {
"ignore_above": 32765,
"type": "keyword"
},
"security": {
"type": "text",
"analyzer": "es_security_analyzer",
"search_analyzer": "es_security_search_analyzer",
"search_quote_analyzer": "es_security_search_quote_analyzer"
"analyzer": "es_security_analyzer"
}
}
}