CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 17:22:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

Update event, file, and host mappings to include .security

Browse Source
This commit is contained in:
Wes Lambert
2022-03-02 14:33:52 +00:00
parent 496b161253
commit e925d435ff
4 changed files with 36 additions and 161 deletions
Download Patch File Download Diff File Expand all files Collapse all files

137
salt/elasticsearch/templates/component/so/dtc-event-mappings
View File

@@ -1,137 +0,0 @@
{
"_meta": {
"documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-event.html",
"ecs_version": "1.12.2"
},
"template": {
"mappings": {
"properties": {
"event": {
"properties": {
"action": {
"ignore_above": 1024,
"type": "keyword"
},
"agent_id_status": {
"ignore_above": 1024,
"type": "keyword"
},
"category": {
"ignore_above": 1024,
"type": "keyword",
"fields": {
"keyword": {
"type": "keyword"
}
}
},
"code": {
"ignore_above": 1024,
"type": "keyword"
},
"created": {
"type": "date",
"fields": {
"keyword": {
"type": "keyword"
}
}
},
"dataset": {
"ignore_above": 1024,
"type": "keyword",
"fields": {
"keyword": {
"type": "keyword"
}
}
},
"duration": {
"type": "long"
},
"end": {
"type": "date"
},
"hash": {
"ignore_above": 1024,
"type": "keyword"
},
"id": {
"ignore_above": 1024,
"type": "keyword"
},
"ingested": {
"type": "date",
"fields": {
"keyword": {
"type": "keyword"
}
}
},
"kind": {
"ignore_above": 1024,
"type": "keyword"
},
"module": {
"ignore_above": 1024,
"type": "keyword",
"fields": {
"keyword": {
"type": "keyword"
}
}
},
"original": {
"doc_values": false,
"index": false,
"type": "keyword"
},
"outcome": {
"ignore_above": 1024,
"type": "keyword"
},
"provider": {
"ignore_above": 1024,
"type": "keyword"
},
"reason": {
"ignore_above": 1024,
"type": "keyword"
},
"reference": {
"ignore_above": 1024,
"type": "keyword"
},
"risk_score": {
"type": "float"
},
"risk_score_norm": {
"type": "float"
},
"sequence": {
"type": "long"
},
"severity": {
"type": "long"
},
"start": {
"type": "date"
},
"timezone": {
"ignore_above": 1024,
"type": "keyword"
},
"type": {
"ignore_above": 1024,
"type": "keyword"
},
"url": {
"ignore_above": 1024,
"type": "keyword"
}
}
}
}
}
}
}

40
salt/elasticsearch/templates/component/so/dtc-event-mappings.json
View File

@@ -12,8 +12,9 @@
"ignore_above": 1024, "ignore_above": 1024,
"type": "keyword", "type": "keyword",
"fields": { "fields": {
"text": { "security": {
"type": "match_only_text" "type": "text",
"analyzer": "es_security_analyzer"
}, },
"keyword": { "keyword": {
"type": "keyword" "type": "keyword"
@@ -23,8 +24,9 @@
"created": { "created": {
"type": "date", "type": "date",
"fields": { "fields": {
"text": { "security": {
"type": "match_only_text" "type": "text",
"analyzer": "es_security_analyzer"
}, },
"keyword": { "keyword": {
"type": "keyword" "type": "keyword"
@@ -35,8 +37,9 @@
"ignore_above": 1024, "ignore_above": 1024,
"type": "keyword", "type": "keyword",
"fields": { "fields": {
"text": { "security": {
"type": "match_only_text" "type": "text",
"analyzer": "es_security_analyzer"
}, },
"keyword": { "keyword": {
"type": "keyword" "type": "keyword"
@@ -46,8 +49,9 @@
"ingested": { "ingested": {
"type": "date", "type": "date",
"fields": { "fields": {
"text": { "security": {
"type": "match_only_text" "type": "text",
"analyzer": "es_security_analyzer"
}, },
"keyword": { "keyword": {
"type": "keyword" "type": "keyword"
@@ -58,8 +62,9 @@
"ignore_above": 1024, "ignore_above": 1024,
"type": "keyword", "type": "keyword",
"fields": { "fields": {
"text": { "security": {
"type": "match_only_text" "type": "text",
"analyzer": "es_security_analyzer"
}, },
"keyword": { "keyword": {
"type": "keyword" "type": "keyword"
@@ -70,8 +75,9 @@
"ignore_above": 1024, "ignore_above": 1024,
"type": "keyword", "type": "keyword",
"fields": { "fields": {
"text": { "security": {
"type": "match_only_text" "type": "text",
"analyzer": "es_security_analyzer"
}, },
"keyword": { "keyword": {
"type": "keyword" "type": "keyword"
@@ -82,8 +88,9 @@
"ignore_above": 1024, "ignore_above": 1024,
"type": "keyword", "type": "keyword",
"fields": { "fields": {
"text": { "security": {
"type": "match_only_text" "type": "text",
"analyzer": "es_security_analyzer"
}, },
"keyword": { "keyword": {
"type": "keyword" "type": "keyword"
@@ -94,8 +101,9 @@
"ignore_above": 1024, "ignore_above": 1024,
"type": "keyword", "type": "keyword",
"fields": { "fields": {
"text": { "security": {
"type": "match_only_text" "type": "text",
"analyzer": "es_security_analyzer"
}, },
"keyword": { "keyword": {
"type": "keyword" "type": "keyword"

10
salt/elasticsearch/templates/component/so/dtc-file-mappings.json
View File

@@ -12,8 +12,9 @@
"ignore_above": 1024, "ignore_above": 1024,
"type": "keyword", "type": "keyword",
"fields": { "fields": {
"text": { "security": {
"type": "match_only_text" "type": "text",
"analyzer": "es_security_analyzer"
}, },
"keyword": { "keyword": {
"type": "keyword" "type": "keyword"
@@ -24,8 +25,9 @@
"ignore_above": 1024, "ignore_above": 1024,
"type": "keyword", "type": "keyword",
"fields": { "fields": {
"text": { "security": {
"type": "match_only_text" "type": "text",
"analyzer": "es_security_analyzer"
}, },
"keyword": { "keyword": {
"type": "keyword" "type": "keyword"

10
salt/elasticsearch/templates/component/so/dtc-host-mappings.json
View File

@@ -12,8 +12,9 @@
"ignore_above": 1024, "ignore_above": 1024,
"type": "keyword", "type": "keyword",
"fields": { "fields": {
"text": { "security": {
"type": "match_only_text" "type": "text",
"analyzer": "es_security_analyzer"
}, },
"keyword": { "keyword": {
"type": "keyword" "type": "keyword"
@@ -24,8 +25,9 @@
"ignore_above": 1024, "ignore_above": 1024,
"type": "keyword", "type": "keyword",
"fields": { "fields": {
"text": { "security": {
"type": "match_only_text" "type": "match_only_text",
"analyzer": "es_security_analyzer"
}, },
"keyword": { "keyword": {
"type": "keyword" "type": "keyword"