CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 17:22:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #12250 from Security-Onion-Solutions/fix/scan_pe_flags

Browse Source 
Fix PE Flags
This commit is contained in:
weslambert
2024-01-24 14:29:23 -05:00
committed by GitHub
parent e53030feef 8426aad56d
commit d2d70d1c5b
2 changed files with 11 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
salt/elasticsearch/files/ingest/strelka.file
View File

@@ -67,6 +67,7 @@
{ "set": { "if": "ctx.scan?.pe?.image_version == '0'", "field": "scan.pe.image_version", "value": "0.0", "override": true } }, { "set": { "if": "ctx.scan?.pe?.image_version == '0'", "field": "scan.pe.image_version", "value": "0.0", "override": true } },
{ "set": { "field": "observer.name", "value": "{{agent.name}}" }}, { "set": { "field": "observer.name", "value": "{{agent.name}}" }},
{ "convert" : { "field" : "scan.exiftool","type": "string", "ignore_missing":true }}, { "convert" : { "field" : "scan.exiftool","type": "string", "ignore_missing":true }},
{ "convert" : { "field" : "scan.pe.flags","type": "string", "ignore_missing":true }},
{ "remove": { "field": ["host", "path", "message", "exiftool", "scan.yara.meta"], "ignore_missing": true } }, { "remove": { "field": ["host", "path", "message", "exiftool", "scan.yara.meta"], "ignore_missing": true } },
{ "pipeline": { "name": "common" } } { "pipeline": { "name": "common" } }
] ]

9
salt/elasticsearch/templates/component/so/so-scan-mappings.json
View File

@@ -14,15 +14,18 @@
}, },
"pe": { "pe": {
"properties": { "properties": {
"flags": {
"type": "text"
},
"image_version": {
"type": "float"
},
"sections": { "sections": {
"properties": { "properties": {
"entropy": { "entropy": {
"type": "float" "type": "float"
} }
} }
},
"image_version": {
"type": "float"
} }
} }
}, },