CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 17:22:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

change suricata parsers from dataset to event.dataset

Browse Source
This commit is contained in:
Doug Burks
2023-06-08 12:31:31 -04:00
parent d1c86cb9ff
commit e5f76a9c6e
5 changed files with 33 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
salt/elasticsearch/files/ingest/suricata.fileinfo
View File

@@ -1,7 +1,7 @@
{ {
"description" : "suricata.fileinfo", "description" : "suricata.fileinfo",
"processors" : [ "processors" : [
{ "set": { "field": "dataset", "value": "file" } }, { "set": { "field": "event.dataset", "value": "file" } },
{ "rename": { "field": "message2.proto", "target_field": "network.transport", "ignore_missing": true } }, { "rename": { "field": "message2.proto", "target_field": "network.transport", "ignore_missing": true } },
{ "rename": { "field": "message2.app_proto", "target_field": "network.protocol", "ignore_missing": true } }, { "rename": { "field": "message2.app_proto", "target_field": "network.protocol", "ignore_missing": true } },
{ "rename": { "field": "message2.fileinfo.filename", "target_field": "file.name", "ignore_missing": true } }, { "rename": { "field": "message2.fileinfo.filename", "target_field": "file.name", "ignore_missing": true } },

2
salt/elasticsearch/files/ingest/suricata.flow
View File

@@ -1,7 +1,7 @@
{ {
"description" : "suricata.flow", "description" : "suricata.flow",
"processors" : [ "processors" : [
{ "set": { "field": "dataset", "value": "conn" } }, { "set": { "field": "event.dataset", "value": "conn" } },
{ "rename": { "field": "message2.proto", "target_field": "network.transport", "ignore_missing": true } }, { "rename": { "field": "message2.proto", "target_field": "network.transport", "ignore_missing": true } },
{ "rename": { "field": "message2.app_proto", "target_field": "network.protocol", "ignore_missing": true } }, { "rename": { "field": "message2.app_proto", "target_field": "network.protocol", "ignore_missing": true } },
{ "rename": { "field": "message2.flow.state", "target_field": "connection.state", "ignore_missing": true } }, { "rename": { "field": "message2.flow.state", "target_field": "connection.state", "ignore_missing": true } },

2
salt/elasticsearch/files/ingest/suricata.krb5
View File

@@ -1,7 +1,7 @@
{ {
"description" : "suricata.krb5", "description" : "suricata.krb5",
"processors" : [ "processors" : [
{ "set": { "field": "dataset", "value": "kerberos" } }, { "set": { "field": "event.dataset", "value": "kerberos" } },
{ "rename": { "field": "message2.proto", "target_field": "network.transport", "ignore_missing": true } }, { "rename": { "field": "message2.proto", "target_field": "network.transport", "ignore_missing": true } },
{ "rename": { "field": "message2.app_proto", "target_field": "network.protocol", "ignore_missing": true } }, { "rename": { "field": "message2.app_proto", "target_field": "network.protocol", "ignore_missing": true } },
{ "rename": { "field": "message2.krb5.msg_type", "target_field": "kerberos.request_type", "ignore_missing": true } }, { "rename": { "field": "message2.krb5.msg_type", "target_field": "kerberos.request_type", "ignore_missing": true } },

2
salt/elasticsearch/files/ingest/suricata.tls
View File

@@ -1,7 +1,7 @@
{ {
"description" : "suricata.tls", "description" : "suricata.tls",
"processors" : [ "processors" : [
{ "set": { "field": "dataset", "value": "ssl" } }, { "set": { "field": "event.dataset", "value": "ssl" } },
{ "rename": { "field": "message2.proto", "target_field": "network.transport", "ignore_missing": true } }, { "rename": { "field": "message2.proto", "target_field": "network.transport", "ignore_missing": true } },
{ "rename": { "field": "message2.app_proto", "target_field": "network.protocol", "ignore_missing": true } }, { "rename": { "field": "message2.app_proto", "target_field": "network.protocol", "ignore_missing": true } },
{ "rename": { "field": "message2.tls.subject", "target_field": "ssl.certificate.subject", "ignore_missing": true } }, { "rename": { "field": "message2.tls.subject", "target_field": "ssl.certificate.subject", "ignore_missing": true } },

1
salt/elasticsearch/files/ingest/zeek.files
View File

@@ -30,7 +30,6 @@
{ "rename": { "field": "message2.extracted", "target_field": "file.extracted.filename", "ignore_missing": true } }, { "rename": { "field": "message2.extracted", "target_field": "file.extracted.filename", "ignore_missing": true } },
{ "rename": { "field": "message2.extracted_cutoff", "target_field": "file.extracted.cutoff", "ignore_missing": true } }, { "rename": { "field": "message2.extracted_cutoff", "target_field": "file.extracted.cutoff", "ignore_missing": true } },
{ "rename": { "field": "message2.extracted_size", "target_field": "file.extracted.size", "ignore_missing": true } }, { "rename": { "field": "message2.extracted_size", "target_field": "file.extracted.size", "ignore_missing": true } },
{ "set": { "field": "dataset", "value": "file" } },
{ "pipeline": { "name": "zeek.common" } } { "pipeline": { "name": "zeek.common" } }
] ]
} }