CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 09:12:45 +01:00
Code Issues Packages Projects Releases Wiki Activity

Update RITA beacon parsing

Browse Source
This commit is contained in:
Wes
2023-01-03 16:01:35 +00:00
parent 55c6fc422b
commit bd114eb1c4
1 changed files with 36 additions and 71 deletions
Download Patch File Download Diff File Expand all files Collapse all files

107
salt/elasticsearch/files/ingest/rita.beacon
View File

@@ -17,98 +17,63 @@
"destination.ip", "destination.ip",
"network.connections", "network.connections",
"network.average_bytes", "network.average_bytes",
"beacon.interval.range", "network.bytes",
"beacon.size.range", "beacon.ts_score",
"beacon.interval.top", "beacon.ds_score",
"beacon.size.top", "beacon.duration_score",
"beacon.interval.top_count", "beacon.historical_score",
"beacon.size.top_count", "beacon.interval.top"
"beacon.interval.skew",
"beacon.size.skew",
"beacon.interval.dispersion",
"beacon.size.dispersion",
"network.bytes"
] ]
} }
}, },
{
"convert": {
"field": "beacon.ds_score",
"type": "float"
}
},
{
"convert": {
"field": "beacon.duration_score",
"type": "float"
}
},
{
"convert": {
"field": "beacon.historical_score",
"type": "float"
}
},
{ {
"convert": { "convert": {
"field": "beacon.score", "field": "beacon.score",
"type": "float" "type": "float"
} }
}, },
{
"convert": {
"field": "beacon.ts_score",
"type": "float"
}
},
{
"convert": {
"field": "network.average_bytes",
"type": "float"
}
},
{ {
"convert": { "convert": {
"field": "network.connections", "field": "network.connections",
"type": "integer" "type": "integer"
} }
}, },
{
"convert": {
"field": "network.average_bytes",
"type": "integer"
}
},
{
"convert": {
"field": "beacon.interval.range",
"type": "integer"
}
},
{
"convert": {
"field": "beacon.size.range",
"type": "integer"
}
},
{ {
"convert": { "convert": {
"field": "beacon.interval.top", "field": "beacon.interval.top",
"type": "integer" "type": "integer"
} }
}, },
{
"convert": {
"field": "beacon.size.top",
"type": "integer"
}
},
{
"convert": {
"field": "beacon.interval.top_count",
"type": "integer"
}
},
{
"convert": {
"field": "beacon.size.top_count",
"type": "integer"
}
},
{
"convert": {
"field": "beacon.interval.skew",
"type": "float"
}
},
{
"convert": {
"field": "beacon.size.skew",
"type": "float"
}
},
{
"convert": {
"field": "beacon.interval.dispersion",
"type": "integer"
}
},
{
"convert": {
"field": "beacon.size.dispersion",
"type": "integer"
}
},
{ {
"convert": { "convert": {
"field": "network.bytes", "field": "network.bytes",