CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 17:22:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

change suricata parsers from dataset to event.dataset

Browse Source
This commit is contained in:
Doug Burks
2023-06-08 12:31:31 -04:00
parent d1c86cb9ff
commit e5f76a9c6e
5 changed files with 33 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
salt/elasticsearch/files/ingest/suricata.fileinfo
View File

@@ -1,7 +1,7 @@
{
"description" : "suricata.fileinfo",
"processors" : [
{ "set": { "field": "dataset", "value": "file" } },
{ "set": { "field": "event.dataset", "value": "file" } },
{ "rename": { "field": "message2.proto", "target_field": "network.transport", "ignore_missing": true } },
{ "rename": { "field": "message2.app_proto", "target_field": "network.protocol", "ignore_missing": true } },
{ "rename": { "field": "message2.fileinfo.filename", "target_field": "file.name", "ignore_missing": true } },
@@ -13,7 +13,7 @@
{ "rename": { "field": "message2.fileinfo.size", "target_field": "file.size", "ignore_missing": true } },
{ "rename": { "field": "message2.fileinfo.state", "target_field": "file.state", "ignore_missing": true } },
{ "rename": { "field": "message2.fileinfo.stored", "target_field": "file.saved", "ignore_missing": true } },
{ "rename": { "field": "message2.fileinfo.sha256", "target_field": "hash.sha256", "ignore_missing": true } },
{ "rename": { "field": "message2.fileinfo.sha256", "target_field": "hash.sha256", "ignore_missing": true } },
{ "set": { "if": "ctx.network?.protocol != null", "field": "file.source", "value": "{{network.protocol}}" } },
{ "pipeline": { "name": "common" } }
]

8
salt/elasticsearch/files/ingest/suricata.flow
View File

@@ -1,12 +1,12 @@
{
"description" : "suricata.flow",
"processors" : [
{ "set": { "field": "dataset", "value": "conn" } },
{ "rename": { "field": "message2.proto", "target_field": "network.transport", "ignore_missing": true } },
{ "set": { "field": "event.dataset", "value": "conn" } },
{ "rename": { "field": "message2.proto", "target_field": "network.transport", "ignore_missing": true } },
{ "rename": { "field": "message2.app_proto", "target_field": "network.protocol", "ignore_missing": true } },
{ "rename": { "field": "message2.flow.state", "target_field": "connection.state", "ignore_missing": true } },
{ "rename": { "field": "message2.flow.bytes_toclient", "target_field": "server.ip_bytes", "ignore_missing": true } },
{ "rename": { "field": "message2.flow.bytes_toserver", "target_field": "client.ip_bytes", "ignore_missing": true } },
{ "rename": { "field": "message2.flow.bytes_toclient", "target_field": "server.ip_bytes", "ignore_missing": true } },
{ "rename": { "field": "message2.flow.bytes_toserver", "target_field": "client.ip_bytes", "ignore_missing": true } },
{ "rename": { "field": "message2.flow.start", "target_field": "connection.start", "ignore_missing": true } },
{ "rename": { "field": "message2.flow.end", "target_field": "connection.end", "ignore_missing": true } },
{ "pipeline": { "name": "common" } }

20
salt/elasticsearch/files/ingest/suricata.krb5
View File

@@ -1,15 +1,15 @@
{
"description" : "suricata.krb5",
"processors" : [
{ "set": { "field": "dataset", "value": "kerberos" } },
{ "rename": { "field": "message2.proto", "target_field": "network.transport", "ignore_missing": true } },
{ "rename": { "field": "message2.app_proto", "target_field": "network.protocol", "ignore_missing": true } },
{ "rename": { "field": "message2.krb5.msg_type", "target_field": "kerberos.request_type", "ignore_missing": true } },
{ "rename": { "field": "message2.krb5.cname", "target_field": "kerberos.client", "ignore_missing": true } },
{ "rename": { "field": "message2.krb5.realm", "target_field": "kerberos.realm", "ignore_missing": true } },
{ "rename": { "field": "message2.krb5.sname", "target_field": "kerberos.service", "ignore_missing": true } },
{ "rename": { "field": "message2.krb5.encryption", "target_field": "kerberos.ticket.cipher", "ignore_missing": true } },
{ "rename": { "field": "message2.krb.weak_encryption", "target_field": "kerberos.weak_encryption", "ignore_missing": true } },
{ "set": { "field": "event.dataset", "value": "kerberos" } },
{ "rename": { "field": "message2.proto", "target_field": "network.transport", "ignore_missing": true } },
{ "rename": { "field": "message2.app_proto", "target_field": "network.protocol", "ignore_missing": true } },
{ "rename": { "field": "message2.krb5.msg_type", "target_field": "kerberos.request_type", "ignore_missing": true } },
{ "rename": { "field": "message2.krb5.cname", "target_field": "kerberos.client", "ignore_missing": true } },
{ "rename": { "field": "message2.krb5.realm", "target_field": "kerberos.realm", "ignore_missing": true } },
{ "rename": { "field": "message2.krb5.sname", "target_field": "kerberos.service", "ignore_missing": true } },
{ "rename": { "field": "message2.krb5.encryption", "target_field": "kerberos.ticket.cipher", "ignore_missing": true } },
{ "rename": { "field": "message2.krb.weak_encryption", "target_field": "kerberos.weak_encryption", "ignore_missing": true } },
{ "pipeline": { "name": "common" } }
]
}
}

2
salt/elasticsearch/files/ingest/suricata.tls
View File

@@ -1,7 +1,7 @@
{
"description" : "suricata.tls",
"processors" : [
{ "set": { "field": "dataset", "value": "ssl" } },
{ "set": { "field": "event.dataset", "value": "ssl" } },
{ "rename": { "field": "message2.proto", "target_field": "network.transport", "ignore_missing": true } },
{ "rename": { "field": "message2.app_proto", "target_field": "network.protocol", "ignore_missing": true } },
{ "rename": { "field": "message2.tls.subject", "target_field": "ssl.certificate.subject", "ignore_missing": true } },

33
salt/elasticsearch/files/ingest/zeek.files
View File

@@ -1,36 +1,35 @@
{
"description" : "zeek.files",
"processors" : [
{ "set": { "field": "event.dataset", "value": "file" } },
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
{ "set": { "field": "event.dataset", "value": "file" } },
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
{ "rename": { "field": "message2.fuid", "target_field": "log.id.fuid", "ignore_missing": true } },
{ "remove": { "field": "source", "ignore_missing": true } },
{ "rename": { "field": "message2.rx_hosts.0", "target_field": "destination.ip", "ignore_missing": true } },
{ "rename": { "field": "message2.tx_hosts.0", "target_field": "source.ip", "ignore_missing": true } },
{ "remove": { "field": "message2.rx_hosts", "ignore_missing": true } },
{ "remove": { "field": "message2.tx_hosts", "ignore_missing": true } },
{ "remove": { "field": "source", "ignore_missing": true } },
{ "rename": { "field": "message2.rx_hosts.0", "target_field": "destination.ip", "ignore_missing": true } },
{ "rename": { "field": "message2.tx_hosts.0", "target_field": "source.ip", "ignore_missing": true } },
{ "remove": { "field": "message2.rx_hosts", "ignore_missing": true } },
{ "remove": { "field": "message2.tx_hosts", "ignore_missing": true } },
{ "rename": { "field": "message2.conn_uids", "target_field": "log.id.uid", "ignore_missing": true } },
{ "rename": { "field": "message2.source", "target_field": "file.source", "ignore_missing": true } },
{ "rename": { "field": "message2.depth", "target_field": "file.depth", "ignore_missing": true } },
{ "rename": { "field": "message2.source", "target_field": "file.source", "ignore_missing": true } },
{ "rename": { "field": "message2.depth", "target_field": "file.depth", "ignore_missing": true } },
{ "rename": { "field": "message2.analyzers", "target_field": "file.analyzer", "ignore_missing": true } },
{ "rename": { "field": "message2.mime_type", "target_field": "file.mime_type", "ignore_missing": true } },
{ "rename": { "field": "message2.filename", "target_field": "file.name", "ignore_missing": true } },
{ "rename": { "field": "message2.filename", "target_field": "file.name", "ignore_missing": true } },
{ "rename": { "field": "message2.duration", "target_field": "event.duration", "ignore_missing": true } },
{ "rename": { "field": "message2.local_orig", "target_field": "file.local_orig", "ignore_missing": true } },
{ "rename": { "field": "message2.is_orig", "target_field": "file.is_orig", "ignore_missing": true } },
{ "rename": { "field": "message2.is_orig", "target_field": "file.is_orig", "ignore_missing": true } },
{ "rename": { "field": "message2.seen_bytes", "target_field": "file.bytes.seen", "ignore_missing": true } },
{ "rename": { "field": "message2.total_bytes", "target_field": "file.bytes.total", "ignore_missing": true } },
{ "rename": { "field": "message2.missing_bytes", "target_field": "file.bytes.missing", "ignore_missing": true } },
{ "rename": { "field": "message2.overflow_bytes", "target_field": "file.bytes.overflow", "ignore_missing": true } },
{ "rename": { "field": "message2.missing_bytes", "target_field": "file.bytes.missing", "ignore_missing": true } },
{ "rename": { "field": "message2.overflow_bytes", "target_field": "file.bytes.overflow", "ignore_missing": true } },
{ "rename": { "field": "message2.timedout", "target_field": "file.timed_out", "ignore_missing": true } },
{ "rename": { "field": "message2.parent_fuid", "target_field": "log.id.parent_fuid", "ignore_missing": true } },
{ "rename": { "field": "message2.md5", "target_field": "hash.md5", "ignore_missing": true } },
{ "rename": { "field": "message2.sha1", "target_field": "hash.sha1", "ignore_missing": true } },
{ "rename": { "field": "message2.extracted", "target_field": "file.extracted.filename", "ignore_missing": true } },
{ "rename": { "field": "message2.extracted", "target_field": "file.extracted.filename", "ignore_missing": true } },
{ "rename": { "field": "message2.extracted_cutoff", "target_field": "file.extracted.cutoff", "ignore_missing": true } },
{ "rename": { "field": "message2.extracted_size", "target_field": "file.extracted.size", "ignore_missing": true } },
{ "set": { "field": "dataset", "value": "file" } },
{ "rename": { "field": "message2.extracted_size", "target_field": "file.extracted.size", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}