CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-08 18:22:47 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #3002 from Security-Onion-Solutions/feature/sigma-tweaks

Browse Source 
Update .security analyzer
This commit is contained in:
Josh Brower
2021-02-17 16:38:22 -05:00
committed by GitHub
parent 741f674a4c d2a74c80e2
commit b5087b815a
1 changed files with 18 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

33
salt/elasticsearch/templates/so/so-common-template.json
View File

@@ -12,18 +12,16 @@
"analyzer": { "analyzer": {
"es_security_analyzer": { "es_security_analyzer": {
"type": "custom", "type": "custom",
"filter": [ "path_hierarchy_pattern_filter", "lowercase" ], "char_filter": [ "whitespace_no_way" ],
"tokenizer": "whitespace" "filter": [ "lowercase", "trim" ],
}, "tokenizer": "keyword"
"es_security_search_analyzer": { }
"type": "custom", },
"filter": [ "lowercase" ], "char_filter": {
"tokenizer": "whitespace" "whitespace_no_way": {
}, "type": "pattern_replace",
"es_security_search_quote_analyzer": { "pattern": "(\\s)+",
"type": "custom", "replacement": "$1"
"filter": [ "lowercase" ],
"tokenizer": "whitespace"
} }
}, },
"filter" : { "filter" : {
@@ -35,6 +33,12 @@
"((?:[^/]*/)*)(.*)" "((?:[^/]*/)*)(.*)"
] ]
} }
},
"tokenizer": {
"path_tokenizer": {
"type": "path_hierarchy",
"delimiter": "\\"
}
} }
} }
}, },
@@ -67,13 +71,12 @@
"type": "text", "type": "text",
"fields": { "fields": {
"keyword": { "keyword": {
"ignore_above": 32765,
"type": "keyword" "type": "keyword"
}, },
"security": { "security": {
"type": "text", "type": "text",
"analyzer": "es_security_analyzer", "analyzer": "es_security_analyzer"
"search_analyzer": "es_security_search_analyzer",
"search_quote_analyzer": "es_security_search_quote_analyzer"
} }
} }
} }