CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-22 08:53:06 +01:00
Code Issues Packages Projects Releases Wiki Activity

Add logscan.source.ips field

Browse Source
This commit is contained in:
William Wernert
2021-07-09 10:55:11 -04:00
parent 80525ee736
commit bac7ef71d8
1 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
salt/elasticsearch/files/ingest/logscan
View File

@@ -8,6 +8,8 @@
{ "date": { "field": "start_time", "target_field": "event.start", "formats": [ "ISO8601", "UNIX" ], "ignore_failures": true } },
{ "date": { "field": "end_time", "target_field": "event.end", "formats": [ "ISO8601", "UNIX" ], "ignore_failures": true } },
{ "rename": { "field": "source_ip", "target_field": "source.ip" } },
{ "append": { "field": "logsscan.source.ips", "value": "{{{source.ip}}}" } },
{ "rename": { "field": "source_ips", "target_field": "logscan.source.ips" } },
{ "set": { "if": "model == kff", "field": "rule.name", "value": "LOGSCAN KFF MODEL THRESHOLD" } },
{ "set": { "if": "model == kff", "field": "rule.description", "value": "High ratio of login failures in 5 minute window" } },
{ "set": { "if": "model == kl", "field": "rule.name", "value": "LOGSCAN KL MODEL THRESHOLD" } },