CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 09:12:45 +01:00
Code Issues Packages Projects Releases Wiki Activity

Ensure Filebeat defaults file is updated with ICS/SCADA log references

Browse Source
This commit is contained in:
Wes
2022-12-06 16:15:09 +00:00
parent 499b5d95f2
commit be5775e4a0
1 changed files with 65 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files

96
salt/filebeat/defaults.yaml
View File

@@ -14,6 +14,7 @@ filebeat:
- irc - irc
- kerberos - kerberos
- modbus - modbus
- mysql
- notice - notice
- ntlm - ntlm
- pe - pe
@@ -25,20 +26,20 @@ filebeat:
- smb_mapping - smb_mapping
- smtp - smtp
- snmp - snmp
- socks
- ssh - ssh
- ssl - ssl
- tunnel - tunnel
- weird - weird
- mysql
- socks
- x509 - x509
- dnp3_objects
- modbus_detailed
- modbus_mask_write_single_register
- modbus_read_write_multiple_registers
- bacnet - bacnet
- bacnet_discovery - bacnet_discovery
- bacnet_property - bacnet_property
- cip
- cip_io
- cip_identity
- cotp
- dnp3_objects
- ecat_registers - ecat_registers
- ecat_log_address - ecat_log_address
- ecat_dev_info - ecat_dev_info
@@ -48,45 +49,78 @@ filebeat:
- ecat_soe_info - ecat_soe_info
- ecat_arp_info - ecat_arp_info
- enip - enip
- cip - modbus_detailed
- cip_io - modbus_mask_write_single_register
- cip_identity - modbus_read_write_multiple_registers
- opcua
- opcua_activate_session
- opcua_activate_session_client_software_cert
- opcua_activate_session_diagnostic_info
- opcua_activate_session_locale_id
- opcua_binary - opcua_binary
- opcua_binary_status_code_detail
- opcua_binary_diag_info_detail
- opcua_binary_get_endpoints
- opcua_binary_get_endpoints_discovery
- opcua_binary_get_endpoints_user_token
- opcua_binary_get_endpoints_description
- opcua_binary_get_endpoints_locale_id
- opcua_binary_get_endpoints_profile_uri
- opcua_binary_create_session
- opcua_binary_create_session_user_token
- opcua_binary_create_session_endpoints
- opcua_binary_create_session_discovery
- opcua_binary_activate_session - opcua_binary_activate_session
- opcua_binary_activate_session_client_software_cert - opcua_binary_activate_session_client_software_cert
- opcua_binary_activate_session_locale_id
- opcua_binary_activate_session_diagnostic_info - opcua_binary_activate_session_diagnostic_info
- opcua_binary_activate_session_locale_id
- opcua_binary_browse - opcua_binary_browse
- opcua_binary_browse_description - opcua_binary_browse_description
- opcua_binary_browse_request_continuation_point
- opcua_binary_browse_result
- opcua_binary_browse_response_references
- opcua_binary_browse_diagnostic_info - opcua_binary_browse_diagnostic_info
- opcua_binary_browse_request_continuation_point
- opcua_binary_browse_response_references
- opcua_binary_browse_result
- opcua_binary_create_session
- opcua_binary_create_session_discovery
- opcua_binary_create_session_endpoints
- opcua_binary_create_session_user_token
- opcua_binary_create_subscription - opcua_binary_create_subscription
- opcua_binary_diag_info_detail
- opcua_binary_get_endpoints
- opcua_binary_get_endpoints_description
- opcua_binary_get_endpoints_discovery
- opcua_binary_get_endpoints_locale_id
- opcua_binary_get_endpoints_profile_uri
- opcua_binary_get_endpoints_user_token
- opcua_binary_opensecure_channel
- opcua_binary_read - opcua_binary_read
- cotp - opcua_binary_read_array_dims
- opcua_binary_read_array_dims_link
- opcua_binary_read_diagnostic_info
- opcua_binary_read_extension_object
- opcua_binary_read_extension_object_link
- opcua_binary_read_nodes_to_read
- opcua_binary_read_results
- opcua_binary_read_results_link
- opcua_binary_read_status_code
- opcua_binary_read_variant_data
- opcua_binary_read_variant_data_link
- opcua_binary_status_code_detail
- opcua_browse
- opcua_browse_description
- opcua_browse_response_references
- opcua_browse_result
- opcua_create_session
- opcua_create_session_endpoints
- opcua_create_session_user_token
- opcua_create_subscription
- opcua_get_endpoints
- opcua_get_endpoints_description
- opcua_get_endpoints_user_token
- opcua_opensecure_channel
- opcua_read
- opcua_read_nodes_to_read
- opcua_read_results
- opcua_read_results_link
- opcua_status_code_detail
- profinet_dce_rpc
- profinet
- profinet_debug
- s7comm - s7comm
- s7comm_read_szl - s7comm_read_szl
- s7comm_upload_download - s7comm_upload_download
- s7comm_plus - s7comm_plus
- stun
- stun_nat
- tds - tds
- tds_rpc - tds_rpc
- tds_sql_batch - tds_sql_batch
- profinet_dce_rpc
- profinet
- profinet_debug
- stun
- stun_nat
- wireguard - wireguard