From e5f76a9c6e272f30afd0ede17604d76dbf0d1348 Mon Sep 17 00:00:00 2001 From: Doug Burks Date: Thu, 8 Jun 2023 12:31:31 -0400 Subject: [PATCH] change suricata parsers from dataset to event.dataset --- .../files/ingest/suricata.fileinfo | 4 +-- salt/elasticsearch/files/ingest/suricata.flow | 8 ++--- salt/elasticsearch/files/ingest/suricata.krb5 | 20 +++++------ salt/elasticsearch/files/ingest/suricata.tls | 2 +- salt/elasticsearch/files/ingest/zeek.files | 33 +++++++++---------- 5 files changed, 33 insertions(+), 34 deletions(-) diff --git a/salt/elasticsearch/files/ingest/suricata.fileinfo b/salt/elasticsearch/files/ingest/suricata.fileinfo index fe9e4b109..4f6182139 100644 --- a/salt/elasticsearch/files/ingest/suricata.fileinfo +++ b/salt/elasticsearch/files/ingest/suricata.fileinfo @@ -1,7 +1,7 @@ { "description" : "suricata.fileinfo", "processors" : [ - { "set": { "field": "dataset", "value": "file" } }, + { "set": { "field": "event.dataset", "value": "file" } }, { "rename": { "field": "message2.proto", "target_field": "network.transport", "ignore_missing": true } }, { "rename": { "field": "message2.app_proto", "target_field": "network.protocol", "ignore_missing": true } }, { "rename": { "field": "message2.fileinfo.filename", "target_field": "file.name", "ignore_missing": true } }, @@ -13,7 +13,7 @@ { "rename": { "field": "message2.fileinfo.size", "target_field": "file.size", "ignore_missing": true } }, { "rename": { "field": "message2.fileinfo.state", "target_field": "file.state", "ignore_missing": true } }, { "rename": { "field": "message2.fileinfo.stored", "target_field": "file.saved", "ignore_missing": true } }, - { "rename": { "field": "message2.fileinfo.sha256", "target_field": "hash.sha256", "ignore_missing": true } }, + { "rename": { "field": "message2.fileinfo.sha256", "target_field": "hash.sha256", "ignore_missing": true } }, { "set": { "if": "ctx.network?.protocol != null", "field": "file.source", "value": "{{network.protocol}}" } }, { "pipeline": { "name": "common" } } ] diff --git a/salt/elasticsearch/files/ingest/suricata.flow b/salt/elasticsearch/files/ingest/suricata.flow index 47bec3a60..03fcc7277 100644 --- a/salt/elasticsearch/files/ingest/suricata.flow +++ b/salt/elasticsearch/files/ingest/suricata.flow @@ -1,12 +1,12 @@ { "description" : "suricata.flow", "processors" : [ - { "set": { "field": "dataset", "value": "conn" } }, - { "rename": { "field": "message2.proto", "target_field": "network.transport", "ignore_missing": true } }, + { "set": { "field": "event.dataset", "value": "conn" } }, + { "rename": { "field": "message2.proto", "target_field": "network.transport", "ignore_missing": true } }, { "rename": { "field": "message2.app_proto", "target_field": "network.protocol", "ignore_missing": true } }, { "rename": { "field": "message2.flow.state", "target_field": "connection.state", "ignore_missing": true } }, - { "rename": { "field": "message2.flow.bytes_toclient", "target_field": "server.ip_bytes", "ignore_missing": true } }, - { "rename": { "field": "message2.flow.bytes_toserver", "target_field": "client.ip_bytes", "ignore_missing": true } }, + { "rename": { "field": "message2.flow.bytes_toclient", "target_field": "server.ip_bytes", "ignore_missing": true } }, + { "rename": { "field": "message2.flow.bytes_toserver", "target_field": "client.ip_bytes", "ignore_missing": true } }, { "rename": { "field": "message2.flow.start", "target_field": "connection.start", "ignore_missing": true } }, { "rename": { "field": "message2.flow.end", "target_field": "connection.end", "ignore_missing": true } }, { "pipeline": { "name": "common" } } diff --git a/salt/elasticsearch/files/ingest/suricata.krb5 b/salt/elasticsearch/files/ingest/suricata.krb5 index 1e3039830..9f5a643db 100644 --- a/salt/elasticsearch/files/ingest/suricata.krb5 +++ b/salt/elasticsearch/files/ingest/suricata.krb5 @@ -1,15 +1,15 @@ { "description" : "suricata.krb5", "processors" : [ - { "set": { "field": "dataset", "value": "kerberos" } }, - { "rename": { "field": "message2.proto", "target_field": "network.transport", "ignore_missing": true } }, - { "rename": { "field": "message2.app_proto", "target_field": "network.protocol", "ignore_missing": true } }, - { "rename": { "field": "message2.krb5.msg_type", "target_field": "kerberos.request_type", "ignore_missing": true } }, - { "rename": { "field": "message2.krb5.cname", "target_field": "kerberos.client", "ignore_missing": true } }, - { "rename": { "field": "message2.krb5.realm", "target_field": "kerberos.realm", "ignore_missing": true } }, - { "rename": { "field": "message2.krb5.sname", "target_field": "kerberos.service", "ignore_missing": true } }, - { "rename": { "field": "message2.krb5.encryption", "target_field": "kerberos.ticket.cipher", "ignore_missing": true } }, - { "rename": { "field": "message2.krb.weak_encryption", "target_field": "kerberos.weak_encryption", "ignore_missing": true } }, + { "set": { "field": "event.dataset", "value": "kerberos" } }, + { "rename": { "field": "message2.proto", "target_field": "network.transport", "ignore_missing": true } }, + { "rename": { "field": "message2.app_proto", "target_field": "network.protocol", "ignore_missing": true } }, + { "rename": { "field": "message2.krb5.msg_type", "target_field": "kerberos.request_type", "ignore_missing": true } }, + { "rename": { "field": "message2.krb5.cname", "target_field": "kerberos.client", "ignore_missing": true } }, + { "rename": { "field": "message2.krb5.realm", "target_field": "kerberos.realm", "ignore_missing": true } }, + { "rename": { "field": "message2.krb5.sname", "target_field": "kerberos.service", "ignore_missing": true } }, + { "rename": { "field": "message2.krb5.encryption", "target_field": "kerberos.ticket.cipher", "ignore_missing": true } }, + { "rename": { "field": "message2.krb.weak_encryption", "target_field": "kerberos.weak_encryption", "ignore_missing": true } }, { "pipeline": { "name": "common" } } ] -} \ No newline at end of file +} diff --git a/salt/elasticsearch/files/ingest/suricata.tls b/salt/elasticsearch/files/ingest/suricata.tls index 6fb0aa5ad..3d738c75e 100644 --- a/salt/elasticsearch/files/ingest/suricata.tls +++ b/salt/elasticsearch/files/ingest/suricata.tls @@ -1,7 +1,7 @@ { "description" : "suricata.tls", "processors" : [ - { "set": { "field": "dataset", "value": "ssl" } }, + { "set": { "field": "event.dataset", "value": "ssl" } }, { "rename": { "field": "message2.proto", "target_field": "network.transport", "ignore_missing": true } }, { "rename": { "field": "message2.app_proto", "target_field": "network.protocol", "ignore_missing": true } }, { "rename": { "field": "message2.tls.subject", "target_field": "ssl.certificate.subject", "ignore_missing": true } }, diff --git a/salt/elasticsearch/files/ingest/zeek.files b/salt/elasticsearch/files/ingest/zeek.files index 7ce7f9ed5..f95ff3d46 100644 --- a/salt/elasticsearch/files/ingest/zeek.files +++ b/salt/elasticsearch/files/ingest/zeek.files @@ -1,36 +1,35 @@ { "description" : "zeek.files", "processors" : [ - { "set": { "field": "event.dataset", "value": "file" } }, - { "remove": { "field": ["host"], "ignore_failure": true } }, - { "json": { "field": "message", "target_field": "message2", "ignore_failure": true } }, + { "set": { "field": "event.dataset", "value": "file" } }, + { "remove": { "field": ["host"], "ignore_failure": true } }, + { "json": { "field": "message", "target_field": "message2", "ignore_failure": true } }, { "rename": { "field": "message2.fuid", "target_field": "log.id.fuid", "ignore_missing": true } }, - { "remove": { "field": "source", "ignore_missing": true } }, - { "rename": { "field": "message2.rx_hosts.0", "target_field": "destination.ip", "ignore_missing": true } }, - { "rename": { "field": "message2.tx_hosts.0", "target_field": "source.ip", "ignore_missing": true } }, - { "remove": { "field": "message2.rx_hosts", "ignore_missing": true } }, - { "remove": { "field": "message2.tx_hosts", "ignore_missing": true } }, + { "remove": { "field": "source", "ignore_missing": true } }, + { "rename": { "field": "message2.rx_hosts.0", "target_field": "destination.ip", "ignore_missing": true } }, + { "rename": { "field": "message2.tx_hosts.0", "target_field": "source.ip", "ignore_missing": true } }, + { "remove": { "field": "message2.rx_hosts", "ignore_missing": true } }, + { "remove": { "field": "message2.tx_hosts", "ignore_missing": true } }, { "rename": { "field": "message2.conn_uids", "target_field": "log.id.uid", "ignore_missing": true } }, - { "rename": { "field": "message2.source", "target_field": "file.source", "ignore_missing": true } }, - { "rename": { "field": "message2.depth", "target_field": "file.depth", "ignore_missing": true } }, + { "rename": { "field": "message2.source", "target_field": "file.source", "ignore_missing": true } }, + { "rename": { "field": "message2.depth", "target_field": "file.depth", "ignore_missing": true } }, { "rename": { "field": "message2.analyzers", "target_field": "file.analyzer", "ignore_missing": true } }, { "rename": { "field": "message2.mime_type", "target_field": "file.mime_type", "ignore_missing": true } }, - { "rename": { "field": "message2.filename", "target_field": "file.name", "ignore_missing": true } }, + { "rename": { "field": "message2.filename", "target_field": "file.name", "ignore_missing": true } }, { "rename": { "field": "message2.duration", "target_field": "event.duration", "ignore_missing": true } }, { "rename": { "field": "message2.local_orig", "target_field": "file.local_orig", "ignore_missing": true } }, - { "rename": { "field": "message2.is_orig", "target_field": "file.is_orig", "ignore_missing": true } }, + { "rename": { "field": "message2.is_orig", "target_field": "file.is_orig", "ignore_missing": true } }, { "rename": { "field": "message2.seen_bytes", "target_field": "file.bytes.seen", "ignore_missing": true } }, { "rename": { "field": "message2.total_bytes", "target_field": "file.bytes.total", "ignore_missing": true } }, - { "rename": { "field": "message2.missing_bytes", "target_field": "file.bytes.missing", "ignore_missing": true } }, - { "rename": { "field": "message2.overflow_bytes", "target_field": "file.bytes.overflow", "ignore_missing": true } }, + { "rename": { "field": "message2.missing_bytes", "target_field": "file.bytes.missing", "ignore_missing": true } }, + { "rename": { "field": "message2.overflow_bytes", "target_field": "file.bytes.overflow", "ignore_missing": true } }, { "rename": { "field": "message2.timedout", "target_field": "file.timed_out", "ignore_missing": true } }, { "rename": { "field": "message2.parent_fuid", "target_field": "log.id.parent_fuid", "ignore_missing": true } }, { "rename": { "field": "message2.md5", "target_field": "hash.md5", "ignore_missing": true } }, { "rename": { "field": "message2.sha1", "target_field": "hash.sha1", "ignore_missing": true } }, - { "rename": { "field": "message2.extracted", "target_field": "file.extracted.filename", "ignore_missing": true } }, + { "rename": { "field": "message2.extracted", "target_field": "file.extracted.filename", "ignore_missing": true } }, { "rename": { "field": "message2.extracted_cutoff", "target_field": "file.extracted.cutoff", "ignore_missing": true } }, - { "rename": { "field": "message2.extracted_size", "target_field": "file.extracted.size", "ignore_missing": true } }, - { "set": { "field": "dataset", "value": "file" } }, + { "rename": { "field": "message2.extracted_size", "target_field": "file.extracted.size", "ignore_missing": true } }, { "pipeline": { "name": "zeek.common" } } ] }