From cc7a244d0b8416231f93790998a16cbcd1573407 Mon Sep 17 00:00:00 2001 From: Doug Burks Date: Fri, 15 May 2020 15:32:25 -0400 Subject: [PATCH] Create zeek.dns.tld https://github.com/Security-Onion-Solutions/securityonion-saltstack/issues/599 --- salt/elasticsearch/files/ingest/zeek.dns.tld | 13 +++++++++++++ 1 file changed, 13 insertions(+) create mode 100644 salt/elasticsearch/files/ingest/zeek.dns.tld diff --git a/salt/elasticsearch/files/ingest/zeek.dns.tld b/salt/elasticsearch/files/ingest/zeek.dns.tld new file mode 100644 index 000000000..f82cc628a --- /dev/null +++ b/salt/elasticsearch/files/ingest/zeek.dns.tld @@ -0,0 +1,13 @@ +{ + "description" : "zeek.dns.tld", + "processors" : [ + { "script": { "lang": "painless", "source": "ctx.top_level_domain = ctx.dns.query.name.substring(ctx.dns.query.name.lastIndexOf('.') + 1)", "ignore_failure": true } }, + { "script": { "lang": "painless", "source": "ctx.query_without_tld = ctx.dns.query.name.substring(0, (ctx.dns.query.name.lastIndexOf('.')))", "ignore_failure": true } }, + { "script": { "lang": "painless", "source": "ctx.parent_domain = ctx.query_without_tld.substring(ctx.query_without_tld.lastIndexOf('.') + 1)", "ignore_failure": true } }, + { "script": { "lang": "painless", "source": "ctx.subdomain = ctx.query_without_tld.substring(0, (ctx.query_without_tld.lastIndexOf('.')))", "ignore_failure": true } }, + { "script": { "lang": "painless", "source": "ctx.highest_registered_domain = ctx.parent_domain + '.' + ctx.top_level_domain", "ignore_failure": true } }, + { "script": { "lang": "painless", "source": "ctx.subdomain_length = ctx.subdomain.length()", "ignore_failure": true } }, + { "script": { "lang": "painless", "source": "ctx.parent_domain_length = ctx.parent_domain.length()", "ignore_failure": true } }, + { "remove": { "field": "query_without_tld", "ignore_failure": true } } + ] +}