update config

salt/logstash/pipelines/config/so/0800_input_eval.conf

@@ -9,182 +9,182 @@ input {
 	}
 	file {
 		path => "/nsm/zeek/logs/current/conn*.log"
-		type => "bro_conn"
+		type => "zeek.conn"
-	    	tags => ["bro"]
+	    	tags => ["zeek"]
 	}
 	file {
 		path => "/nsm/zeek/logs/current/dce_rpc*.log"
-		type => "bro_dce_rpc"
+		type => "zeek.dce_rpc"
-	    	tags => ["bro"]
+	    	tags => ["zeek"]
 	}
 	file {
 		path => "/nsm/zeek/logs/current/dhcp*.log"
-		type => "bro_dhcp"
+		type => "zeek.dhcp"
-	    	tags => ["bro"]
+	    	tags => ["zeek"]
 	}
 	file {
 		path => "/nsm/zeek/logs/current/dnp3*.log"
-		type => "bro_dnp3"
+		type => "zeek.dnp3"
-	    	tags => ["bro"]
+	    	tags => ["zeek"]
 	}
 	file {
 		path => "/nsm/zeek/logs/current/dns*.log"
-		type => "bro_dns"
+		type => "zeek.dns"
-	    	tags => ["bro"]
+	    	tags => ["zeek"]
 	}
 	file {
 		path => "/nsm/zeek/logs/current/dpd*.log"
-		type => "bro_dpd"
+		type => "zeek.dpd"
-	    	tags => ["bro"]
+	    	tags => ["zeek"]
 	}
 	file {
 		path => "/nsm/zeek/logs/current/files*.log"
-		type => "bro_files"
+		type => "zeek.files"
-	    	tags => ["bro"]
+	    	tags => ["zeek"]
 	}
 	file {
 		path => "/nsm/zeek/logs/current/ftp*.log"
-		type => "bro_ftp"
+		type => "zeek.ftp"
-	    	tags => ["bro"]
+	    	tags => ["zeek"]
 	}
 	file {
 		path => "/nsm/zeek/logs/current/http*.log"
-		type => "bro_http"
+		type => "zeek.http"
-	    	tags => ["bro"]
+	    	tags => ["zeek"]
 	}
 	file {
 		path => "/nsm/zeek/logs/current/intel*.log"
-		type => "bro_intel"
+		type => "zeek.intel"
-	    	tags => ["bro"]
+	    	tags => ["zeek"]
 	}
 	file {
 		path => "/nsm/zeek/logs/current/irc*.log"
-		type => "bro_irc"
+		type => "zeek.irc"
-	    	tags => ["bro"]
+	    	tags => ["zeek"]
 	}
 	file {
 		path => "/nsm/zeek/logs/current/kerberos*.log"
-		type => "bro_kerberos"
+		type => "zeek.kerberos"
-	    	tags => ["bro"]
+	    	tags => ["zeek"]
 	}
 	file {
 		path => "/nsm/zeek/logs/current/modbus*.log"
-		type => "bro_modbus"
+		type => "zeek.modbus"
-	    	tags => ["bro"]
+	    	tags => ["zeek"]
 	}
 	file {
 		path => "/nsm/zeek/logs/current/mysql*.log"
-		type => "bro_mysql"
+		type => "zeek.mysql"
-	    	tags => ["bro"]
+	    	tags => ["zeek"]
 	}
 	file {
 		path => "/nsm/zeek/logs/current/notice*.log"
-		type => "bro_notice"
+		type => "zeek.notice"
-	    	tags => ["bro"]
+	    	tags => ["zeek"]
 	}
 	file {
 		path => "/nsm/zeek/logs/current/ntlm*.log"
-		type => "bro_ntlm"
+		type => "zeek.ntlm"
-	    	tags => ["bro"]
+	    	tags => ["zeek"]
 	}
 	file {
 		path => "/nsm/zeek/logs/current/pe*.log"
-		type => "bro_pe"
+		type => "zeek.pe"
-	    	tags => ["bro"]
+	    	tags => ["zeek"]
 	}
 	file {
 		path => "/nsm/zeek/logs/current/radius*.log"
-		type => "bro_radius"
+		type => "zeek.radius"
-	    	tags => ["bro"]
+	    	tags => ["zeek"]
 	}
 	file {
 		path => "/nsm/zeek/logs/current/rdp*.log"
-		type => "bro_rdp"
+		type => "zeek.rdp"
-	    	tags => ["bro"]
+	    	tags => ["zeek"]
 	}
 	file {
 		path => "/nsm/zeek/logs/current/rfb*.log"
-		type => "bro_rfb"
+		type => "zeek.rfb"
-	    	tags => ["bro"]
+	    	tags => ["zeek"]
 	}
 	file {
 		path => "/nsm/zeek/logs/current/signatures*.log"
-		type => "bro_signatures"
+		type => "zeek.signatures"
-	    	tags => ["bro"]
+	    	tags => ["zeek"]
 	}
 	file {
 		path => "/nsm/zeek/logs/current/sip*.log"
-		type => "bro_sip"
+		type => "zeek.sip"
-	    	tags => ["bro"]
+	    	tags => ["zeek"]
 	}
 	file {
 		path => "/nsm/zeek/logs/current/smb_files*.log"
-		type => "bro_smb_files"
+		type => "zeek.smb_files"
-	    	tags => ["bro"]
+	    	tags => ["zeek"]
 	}
 	file {
 		path => "/nsm/zeek/logs/current/smb_mapping*.log"
-		type => "bro_smb_mapping"
+		type => "zeek.smb_mapping"
-	    	tags => ["bro"]
+	    	tags => ["zeek"]
 	}
 	file {
 		path => "/nsm/zeek/logs/current/smtp*.log"
-		type => "bro_smtp"
+		type => "zeek.smtp"
-	    	tags => ["bro"]
+	    	tags => ["zeek"]
 	}
 	file {
 		path => "/nsm/zeek/logs/current/snmp*.log"
-		type => "bro_snmp"
+		type => "zeek.snmp"
-	    	tags => ["bro"]
+	    	tags => ["zeek"]
 	}
 	file {
 		path => "/nsm/zeek/logs/current/socks*.log"
-		type => "bro_socks"
+		type => "zeek.socks"
-	    	tags => ["bro"]
+	    	tags => ["zeek"]
 	}
 	file {
 		path => "/nsm/zeek/logs/current/software*.log"
-		type => "bro_software"
+		type => "zeek.software"
-	    	tags => ["bro"]
+	    	tags => ["zeek"]
 	}
 	file {
 		path => "/nsm/zeek/logs/current/ssh*.log"
-		type => "bro_ssh"
+		type => "zeek.ssh"
-	    	tags => ["bro"]
+	    	tags => ["zeek"]
 	}
 	file {
 		path => "/nsm/zeek/logs/current/ssl*.log"
-		type => "bro_ssl"
+		type => "zeek.ssl"
-	    	tags => ["bro"]
+	    	tags => ["zeek"]
 	}
 	file {
 		path => "/nsm/zeek/logs/current/syslog*.log"
-		type => "bro_syslog"
+		type => "zeek.syslog"
-	    	tags => ["bro"]
+	    	tags => ["zeek"]
 	}
 	file {
 		path => "/nsm/zeek/logs/current/tunnel*.log"
-		type => "bro_tunnels"
+		type => "zeek.tunnels"
-	    	tags => ["bro"]
+	    	tags => ["zeek"]
 	}
 	file {
 		path => "/nsm/zeek/logs/current/weird*.log"
-		type => "bro_weird"
+		type => "zeek.weird"
-	    	tags => ["bro"]
+	    	tags => ["zeek"]
 	}
 	file {
 		path => "/nsm/zeek/logs/current/x509*.log"
-		type => "bro_x509"
+		type => "zeek.x509"
-	    	tags => ["bro"]
+	    	tags => ["zeek"]
 	}
   file {
     path => "/wazuh/alerts/alerts.json"
     type => "ossec"
   }
-  file {
+#  file {
-    path => "/wazuh/archives/archives.json"
+#    path => "/wazuh/archives/archives.json"
-    type => "ossec_archive"
+#    type => "ossec_archive"
-  }
+#  }
   file {
     path => "/osquery/logs/result.log"
     type => "osquery"

salt/logstash/pipelines/config/so/8999_postprocess_rename_type.conf

@@ -4,5 +4,6 @@
 filter {
     mutate {
 	  rename => [ "type", "event_type" ]
+          remove_field => [ "host" ]
 	}
 }

salt/logstash/pipelines/config/so/9000_output_bro.conf.jinja

@@ -10,21 +10,21 @@
 
 
 filter {
-  if "bro" in [tags] and "test_data" not in [tags] and "import" not in [tags] {
+  if "zeek" in [tags] and "test_data" not in [tags] and "import" not in [tags] {
     mutate {
 	  ##add_tag => [ "conf_file_9000"]
 	}
   }
 }
 output {
-  if "bro" in [tags] and "test_data" not in [tags] and "import" not in [tags] {
+  if "zeek" in [tags] and "test_data" not in [tags] and "import" not in [tags] {
 #    stdout { codec => rubydebug }
     elasticsearch {
       pipeline => "%{event_type}"
       hosts => "{{ ES }}"
-      index => "logstash-bro-%{+YYYY.MM.dd}"
+      index => "so-zeek-%{+YYYY.MM.dd}"
-      template_name => "logstash-bro"
+      template_name => "so-zeek"
-      template => "/logstash-bro-template.json"
+      template => "/so-zeek-template.json"
       template_overwrite => true
     }
   }

salt/logstash/pipelines/config/so/9001_output_switch.conf.jinja

@@ -20,8 +20,8 @@ output {
     #stdout { codec => rubydebug }
     elasticsearch {
       hosts => "{{ ES }}"
-      index => "logstash-switch-%{+YYYY.MM.dd}"
+      index => "so-switch-%{+YYYY.MM.dd}"
-      template => "/logstash-template.json"
+      template => "/so-template.json"
     }
   }
 }

salt/logstash/pipelines/config/so/9002_output_import.conf.jinja

@@ -18,9 +18,9 @@ output {
 #    stdout { codec => rubydebug }
     elasticsearch {
       hosts => "{{ ES }}"
-      index => "logstash-import-%{+YYYY.MM.dd}"
+      index => "so-import-%{+YYYY.MM.dd}"
       template_name => "logstash"
-      template => "/logstash-template.json"
+      template => "/so-template.json"
       template_overwrite => true
     }
   }

salt/logstash/pipelines/config/so/9004_output_flow.conf.jinja

@@ -20,8 +20,8 @@ output {
     #stdout { codec => rubydebug }
     elasticsearch {
       hosts => "{{ ES }}"
-      index => "logstash-flow-%{+YYYY.MM.dd}"
+      index => "so-flow-%{+YYYY.MM.dd}"
-      template => "/logstash-template.json"
+      template => "/so-template.json"
     }
   }
 }

salt/logstash/pipelines/config/so/9026_output_dhcp.conf.jinja

@@ -20,7 +20,7 @@ output {
     #stdout { codec => rubydebug }
     elasticsearch {
       hosts => "{{ ES }}"
-      template => "/logstash-template.json"
+      template => "/so-template.json"
     }
   }
 }

salt/logstash/pipelines/config/so/9029_output_esxi.conf.jinja

@@ -19,7 +19,7 @@ output {
   if [event_type] == "esxi" and "test_data" not in [tags] {
     elasticsearch {
       hosts => "{{ ES }}"
-      template => "/logstash-template.json"
+      template => "/so-template.json"
     }
   }
 }

salt/logstash/pipelines/config/so/9030_output_greensql.conf.jinja

@@ -19,7 +19,7 @@ output {
   if [event_type] == "greensql" and "test_data" not in [tags] {
     elasticsearch {
       hosts => "{{ ES }}"
-      template => "/logstash-template.json"
+      template => "/so-template.json"
     }
   }
 }

salt/logstash/pipelines/config/so/9031_output_iis.conf.jinja

@@ -20,7 +20,7 @@ output {
     #stdout { codec => rubydebug }
     elasticsearch {
       hosts => "{{ ES }}"
-      template => "/logstash-template.json"
+      template => "/so-template.json"
     }
   }
 }

salt/logstash/pipelines/config/so/9032_output_mcafee.conf.jinja

@@ -20,7 +20,7 @@ output {
     #stdout { codec => rubydebug }
     elasticsearch {
       hosts => "{{ ES }}"
-      template => "/logstash-template.json"
+      template => "/so-template.json"
     }
   }
 }

salt/logstash/pipelines/config/so/9033_output_snort.conf.jinja

@@ -20,9 +20,9 @@ output {
     #stdout { codec => rubydebug }
     elasticsearch {
       hosts => "{{ ES }}"
-      index => "logstash-ids-%{+YYYY.MM.dd}"
+      index => "so-ids-%{+YYYY.MM.dd}"
       template_name => "logstash"
-      template => "/logstash-template.json"
+      template => "/so-template.json"
       template_overwrite => true
     }
   }

salt/logstash/pipelines/config/so/9034_output_syslog.conf.jinja

@@ -19,9 +19,9 @@ output {
   if "syslog" in [tags] and "test_data" not in [tags] {
     elasticsearch {
       hosts => "{{ ES }}"
-      index => "logstash-syslog-%{+YYYY.MM.dd}"
+      index => "so-syslog-%{+YYYY.MM.dd}"
       template_name => "logstash"
-      template => "/logstash-template.json"
+      template => "/so-template.json"
       template_overwrite => true
     }
   }

salt/logstash/pipelines/config/so/9100_output_osquery.conf.jinja

@@ -12,8 +12,8 @@ output {
   if "osquery" in [tags] {
     elasticsearch {
       hosts => "{{ ES }}"
-      index => "logstash-osquery-%{+YYYY.MM.dd}"
+      index => "so-osquery-%{+YYYY.MM.dd}"
-      template => "/logstash-template.json"
+      template => "/so-template.json"
     }
   }
 }

salt/logstash/pipelines/config/so/9200_output_firewall.conf.jinja

@@ -20,9 +20,9 @@ output {
 #    stdout { codec => rubydebug }
     elasticsearch {
       hosts => "{{ ES }}"
-      index => "logstash-firewall-%{+YYYY.MM.dd}"
+      index => "so-firewall-%{+YYYY.MM.dd}"
       template_name => "logstash"
-      template => "/logstash-template.json"
+      template => "/so-template.json"
       template_overwrite => true
     }
   }

salt/logstash/pipelines/config/so/9300_output_windows.conf.jinja

@@ -20,8 +20,8 @@ output {
     #stdout { codec => rubydebug }
     elasticsearch {
       hosts => "{{ ES }}"
-      index => "logstash-windows-%{+YYYY.MM.dd}"
+      index => "so-windows-%{+YYYY.MM.dd}"
-      template => "/logstash-template.json"
+      template => "/so-template.json"
     }
   }
 }

salt/logstash/pipelines/config/so/9301_output_dns_windows.conf.jinja

@@ -20,8 +20,8 @@ output {
     #stdout { codec => rubydebug }
     elasticsearch {
       hosts => "{{ ES }}"
-      index => "logstash-%{+YYYY.MM.dd}"
+      index => "so-%{+YYYY.MM.dd}"
-      template => "/logstash-template.json"
+      template => "/so-template.json"
     }
   }
 }

salt/logstash/pipelines/config/so/9400_output_suricata.conf.jinja

@@ -20,8 +20,8 @@ output {
     #stdout { codec => rubydebug }
     elasticsearch {
       hosts => "{{ ES }}"
-      index => "logstash-ids-%{+YYYY.MM.dd}"
+      index => "so-ids-%{+YYYY.MM.dd}"
-      template => "/logstash-template.json"
+      template => "/so-template.json"
     }
   }
 }

salt/logstash/pipelines/config/so/9500_output_beats.conf.jinja

@@ -16,9 +16,9 @@ output {
   if "beat" in [tags] {
     elasticsearch {
       hosts => "{{ ES }}"
-      index => "logstash-beats-%{+YYYY.MM.dd}"
+      index => "so-beats-%{+YYYY.MM.dd}"
-      template_name => "logstash-beats"
+      template_name => "so-beats"
-      template => "/beats-template.json"
+      template => "/so-beats-template.json"
       template_overwrite => true
     }
   }

salt/logstash/pipelines/config/so/9600_output_ossec.conf.jinja

@@ -19,10 +19,11 @@ filter {
 output {
   if [event_type] =~ "ossec" or "ossec" in [tags] {
     elasticsearch {
+      pipeline => "%{event_type}"
       hosts => "{{ ES }}"
-      index => "logstash-ossec-%{+YYYY.MM.dd}"
+      index => "so-ossec-%{+YYYY.MM.dd}"
-      template_name => "logstash-ossec"
+      template_name => "so-ossec"
-      template => "/logstash-ossec-template.json"
+      template => "/so-ossec-template.json"
       template_overwrite => true
     }
   }

salt/logstash/pipelines/config/so/9700_output_strelka.conf.jinja

@@ -20,9 +20,9 @@ output {
   if [event_type] =~ "strelka" {
     elasticsearch {
       hosts => "{{ ES }}"
-      index => "logstash-strelka-%{+YYYY.MM.dd}"
+      index => "so-strelka-%{+YYYY.MM.dd}"
-      template_name => "logstash-strelka"
+      template_name => "so-strelka"
-      template => "/logstash-strelka-template.json"
+      template => "/so-strelka-template.json"
       template_overwrite => true
     }
   }