CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-30 21:03:10 +01:00
Code Issues Packages Projects Releases Wiki Activity

Moved to dynamic

Browse Source
This commit is contained in:
Josh Brower
2019-01-01 11:20:01 -05:00
committed by GitHub
parent bc7bf5774a
commit b9f6269925
1 changed files with 0 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
salt/logstash/files/custom/parsers/7100_osquery_wel.conf
View File

@@ -1,23 +0,0 @@
# Author: Josh Brower
# Last Update: 12/28/2018
# If log is tagged osquery and there is an eventid column, then cleanup and parse out the EventData column
filter {
if "osquery" in [tags] and [osquery][columns][eventid] {
mutate {
gsub => ["[osquery][columns][data]", "\\x0A", ""]
}
json {
source => "[osquery][columns][data]"
target => "[osquery][columns][data]"
}
mutate {
merge => { "[osquery][columns]" => "[osquery][columns][data]" }
remove_field => ["[osquery][columns][data]"]
}
}
}