Merge pull request #9273 from Security-Onion-Solutions/dev

2.3.190

.github/workflows/contrib.yml

@@ -0,0 +1,24 @@
+name: contrib
+on:
+  issue_comment:
+    types: [created]
+  pull_request_target:
+    types: [opened,closed,synchronize]
+
+jobs:
+  CLAssistant:
+    runs-on: ubuntu-latest
+    steps:
+      - name: "Contributor Check"
+        if: (github.event.comment.body == 'recheck' || github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA') || github.event_name == 'pull_request_target'
+        uses: cla-assistant/github-action@v2.1.3-beta
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PERSONAL_ACCESS_TOKEN : ${{ secrets.PERSONAL_ACCESS_TOKEN }}
+        with:
+          path-to-signatures: 'signatures_v1.json'
+          path-to-document: 'https://securityonionsolutions.com/cla' 
+          allowlist: dependabot[bot],jertel,dougburks,TOoSmOotH,weslambert,defensivedepth,m0duspwnens
+          remote-organization-name: Security-Onion-Solutions
+          remote-repository-name: licensing
+

.github/workflows/leaktest.yml

@@ -12,6 +12,6 @@ jobs:
         fetch-depth: '0'
 
     - name: Gitleaks
-      uses: zricethezav/gitleaks-action@master
+      uses: gitleaks/gitleaks-action@v1.6.0
       with:
         config-path: .github/.gitleaks.toml

.github/workflows/pythontest.yml

@@ -0,0 +1,31 @@
+name: python-test
+
+on: [push, pull_request]
+
+jobs:
+  build:
+
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.10"]
+        python-code-path: ["salt/sensoroni/files/analyzers"]
+
+    steps:
+    - uses: actions/checkout@v3
+    - name: Set up Python ${{ matrix.python-version }}
+      uses: actions/setup-python@v3
+      with:
+        python-version: ${{ matrix.python-version }}
+    - name: Install dependencies
+      run: |
+        python -m pip install --upgrade pip
+        python -m pip install flake8 pytest pytest-cov
+        find . -name requirements.txt -exec pip install -r {} \;
+    - name: Lint with flake8
+      run: |
+        flake8 ${{ matrix.python-code-path }} --show-source --max-complexity=12  --doctests --max-line-length=200 --statistics
+    - name: Test with pytest
+      run: |
+        pytest ${{ matrix.python-code-path }} --cov=${{ matrix.python-code-path }} --doctest-modules --cov-report=term --cov-fail-under=100 --cov-config=${{ matrix.python-code-path }}/pytest.ini

.gitignore

@@ -56,4 +56,15 @@ $RECYCLE.BIN/
 # Windows shortcuts
 *.lnk
 
-# End of https://www.gitignore.io/api/macos,windows
+# End of https://www.gitignore.io/api/macos,windows
+
+# Pytest output
+__pycache__
+.pytest_cache
+.coverage
+*.pyc
+.venv
+
+# Analyzer dev/test config files
+*_dev.yaml
+site-packages

HOTFIX

@@ -1 +0,0 @@
-

README.md

@@ -1,14 +1,20 @@
-## Security Onion 2.3.120
+## Security Onion 2.3
 
-Security Onion 2.3.120 is here!
+Security Onion 2.3 is here!
 
 ## Screenshots
 
 Alerts
-![Alerts](./assets/images/screenshots/alerts-1.png)
+![Alerts](./assets/images/screenshots/alerts.png)
+
+Dashboards
+![Dashboards](./assets/images/screenshots/dashboards.png)
 
 Hunt
-![Hunt](./assets/images/screenshots/hunt-1.png)
+![Hunt](./assets/images/screenshots/hunt.png)
+
+Cases
+![Cases](./assets/images/screenshots/cases-comments.png)
 
 ### Release Notes
 

VERIFY_ISO.md

@@ -1,18 +1,18 @@
-### 2.3.120-20220425 ISO image built on 2022/04/25
+### 2.3.190-20221205 ISO image built on 2022/12/05
 
 
 
 ### Download and Verify
 
-2.3.120-20220425 ISO image:  
-https://download.securityonion.net/file/securityonion/securityonion-2.3.120-20220425.iso
+2.3.190-20221205 ISO image:  
+https://download.securityonion.net/file/securityonion/securityonion-2.3.190-20221205.iso
 
-MD5: C99729E452B064C471BEF04532F28556  
-SHA1: 60BF07D5347C24568C7B793BFA9792E98479CFBF  
-SHA256: CD17D0D7CABE21D45FA45E1CF91C5F24EB9608C79FF88480134E5592AFDD696E 
+MD5: E8D0BB6F43F67EC64F04AE239781E674  
+SHA1: BC58236BDF8DBD86870182B6F79009406DC04138  
+SHA256: 34A98078538060486C70A934839A271A5AD66CF50D55EEC04DA0B325B13D56AC 
 
 Signature for ISO image:  
-https://github.com/Security-Onion-Solutions/securityonion/raw/master/sigs/securityonion-2.3.120-20220425.iso.sig
+https://github.com/Security-Onion-Solutions/securityonion/raw/master/sigs/securityonion-2.3.190-20221205.iso.sig
 
 Signing key:  
 https://raw.githubusercontent.com/Security-Onion-Solutions/securityonion/master/KEYS  
@@ -26,22 +26,22 @@ wget https://raw.githubusercontent.com/Security-Onion-Solutions/securityonion/ma
 
 Download the signature file for the ISO:  
 ```
-wget https://github.com/Security-Onion-Solutions/securityonion/raw/master/sigs/securityonion-2.3.120-20220425.iso.sig
+wget https://github.com/Security-Onion-Solutions/securityonion/raw/master/sigs/securityonion-2.3.190-20221205.iso.sig
 ```
 
 Download the ISO image:  
 ```
-wget https://download.securityonion.net/file/securityonion/securityonion-2.3.120-20220425.iso
+wget https://download.securityonion.net/file/securityonion/securityonion-2.3.190-20221205.iso
 ```
 
 Verify the downloaded ISO image using the signature file:  
 ```
-gpg --verify securityonion-2.3.120-20220425.iso.sig securityonion-2.3.120-20220425.iso
+gpg --verify securityonion-2.3.190-20221205.iso.sig securityonion-2.3.190-20221205.iso
 ```
 
 The output should show "Good signature" and the Primary key fingerprint should match what's shown below:
 ```
-gpg: Signature made Mon 25 Apr 2022 08:20:40 AM EDT using RSA key ID FE507013
+gpg: Signature made Mon 05 Dec 2022 12:27:49 PM EST using RSA key ID FE507013
 gpg: Good signature from "Security Onion Solutions, LLC <info@securityonionsolutions.com>"
 gpg: WARNING: This key is not certified with a trusted signature!
 gpg:          There is no indication that the signature belongs to the owner.

VERSION

@@ -1 +1 @@
-2.3.120
+2.3.190

pillar/logstash/nodes.sls

@@ -2,7 +2,7 @@
 {% set cached_grains = salt.saltutil.runner('cache.grains', tgt='*') %}
 {% for minionid, ip in salt.saltutil.runner(
     'mine.get',
-    tgt='G@role:so-manager or G@role:so-managersearch or G@role:so-standalone or G@role:so-node or G@role:so-heavynode or G@role:so-receiver or G@role:so-helix ',
+    tgt='G@role:so-manager or G@role:so-managersearch or G@role:so-standalone or G@role:so-node or G@role:so-heavynode or G@role:so-receiver or G@role:so-helix',
     fun='network.ip_addrs',
     tgt_type='compound') | dictsort()
 %}

pillar/logstash/search.sls

@@ -14,4 +14,5 @@ logstash:
         - so/9700_output_strelka.conf.jinja
         - so/9800_output_logscan.conf.jinja
         - so/9801_output_rita.conf.jinja
+        - so/9802_output_kratos.conf.jinja
         - so/9900_output_endgame.conf.jinja

pillar/zeek/init.sls

@@ -48,6 +48,19 @@ zeek:
       - securityonion/bpfconf
       - securityonion/communityid
       - securityonion/file-extraction
+      - oui-logging
+      - icsnpp-modbus
+      - icsnpp-dnp3
+      - icsnpp-bacnet
+      - icsnpp-ethercat
+      - icsnpp-enip
+      - icsnpp-opcua-binary
+      - icsnpp-bsap
+      - icsnpp-s7comm
+      - zeek-plugin-tds
+      - zeek-plugin-profinet
+      - zeek-spicy-wireguard
+      - zeek-spicy-stun
     '@load-sigs':
       - frameworks/signatures/detect-windows-shells
     redef:

salt/common/files/sensor-rotate.conf

@@ -19,4 +19,17 @@
     extension .log
     dateext
     dateyesterday
-}
+}
+
+/opt/so/log/strelka/filecheck.log
+{
+    daily
+    rotate 14
+    missingok
+    copytruncate
+    compress
+    create
+    extension .log
+    dateext
+    dateyesterday
+}

salt/common/init.sls

@@ -38,15 +38,15 @@ socore:
 soconfperms:
   file.directory:
     - name: /opt/so/conf
-    - uid: 939
-    - gid: 939
+    - user: 939
+    - group: 939
     - dir_mode: 770
 
 sostatusconf:
   file.directory:
     - name: /opt/so/conf/so-status
-    - uid: 939
-    - gid: 939
+    - user: 939
+    - group: 939
     - dir_mode: 770
 
 so-status.conf:
@@ -57,8 +57,8 @@ so-status.conf:
 sosaltstackperms:
   file.directory:
     - name: /opt/so/saltstack
-    - uid: 939
-    - gid: 939
+    - user: 939
+    - group: 939
     - dir_mode: 770
 
 so_log_perms:

salt/common/tools/sbin/so-bpf-compile

@@ -29,7 +29,7 @@ fi
 
 interface="$1"
 shift
-sudo tcpdump -i $interface -ddd $@ | tail -n+2 |
+tcpdump -i $interface -ddd $@ | tail -n+2 |
 while read line; do
   cols=( $line )
   printf "%04x%02x%02x%08x" ${cols[0]} ${cols[1]} ${cols[2]} ${cols[3]}

salt/common/tools/sbin/so-filebeat-module-setup

@@ -49,19 +49,18 @@ if [ "$ELASTICSEARCH_CONNECTED" == "no" ]; then
 fi
 echo "Testing to see if the pipelines are already applied"
 ESVER=$({{ ELASTICCURL }} -sk https://"$ELASTICSEARCH_HOST":"$ELASTICSEARCH_PORT" |jq .version.number |tr -d \")
-PIPELINES=$({{ ELASTICCURL }} -sk https://"$ELASTICSEARCH_HOST":"$ELASTICSEARCH_PORT"/_ingest/pipeline/filebeat-$ESVER-suricata-eve-pipeline | jq . | wc -c)
+PIPELINES=$({{ ELASTICCURL }} -sk https://"$ELASTICSEARCH_HOST":"$ELASTICSEARCH_PORT"/_ingest/pipeline/filebeat-$ESVER-elasticsearch-server-pipeline | jq . | wc -c)
 
-if [[ "$PIPELINES" -lt 5 ]]; then
+if [[ "$PIPELINES" -lt 5 ]] || [ "$2" != "--force" ]; then
   echo "Setting up ingest pipeline(s)"
-
-  for MODULE in activemq apache auditd aws azure barracuda bluecoat cef checkpoint cisco coredns crowdstrike cyberark cylance elasticsearch envoyproxy f5 fortinet gcp google_workspace googlecloud gsuite haproxy ibmmq icinga iis imperva infoblox iptables juniper kafka kibana logstash microsoft mongodb mssql mysql nats netscout nginx o365 okta osquery panw postgresql rabbitmq radware redis santa snort snyk sonicwall sophos squid suricata system threatintel tomcat traefik zeek zscaler
-  do
-    echo "Loading $MODULE"
-    docker exec -i so-filebeat filebeat setup modules -pipelines -modules $MODULE -c $FB_MODULE_YML
-    sleep 2
-  done
+{% from 'filebeat/modules.map.jinja' import MODULESMERGED with context %}
+{%- for module in MODULESMERGED.modules.keys() %}
+  {%- for fileset in MODULESMERGED.modules[module] %}
+      echo "{{ module }}.{{ fileset}}"
+      docker exec -i so-filebeat filebeat setup --pipelines --modules {{ module }} -M "{{ module }}.{{ fileset }}.enabled=true" -c $FB_MODULE_YML
+      sleep 0.5
+  {% endfor %}
+{%- endfor %}
 else
   exit 0
 fi
-
-

salt/common/tools/sbin/so-firewall

@@ -16,6 +16,7 @@
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 import os
+import re
 import subprocess
 import sys
 import time
@@ -26,6 +27,7 @@ hostgroupsFilename = "/opt/so/saltstack/local/salt/firewall/hostgroups.local.yam
 portgroupsFilename = "/opt/so/saltstack/local/salt/firewall/portgroups.local.yaml"
 defaultPortgroupsFilename = "/opt/so/saltstack/default/salt/firewall/portgroups.yaml"
 supportedProtocols = ['tcp', 'udp']
+readonly = False
 
 def showUsage(options, args):
   print('Usage: {} [OPTIONS] <COMMAND> [ARGS...]'.format(sys.argv[0]))
@@ -70,10 +72,26 @@ def checkApplyOption(options):
     return apply(None, None)
 
 def loadYaml(filename):
+  global readonly
+
   file = open(filename, "r")
-  return yaml.safe_load(file.read())
+  content = file.read()
+
+  # Remove Jinja templating (for read-only operations)
+  if "{%" in content or "{{" in content:
+    content = content.replace("{{ ssh_port }}", "22")
+    pattern = r'.*({%|{{|}}|%}).*'
+    content = re.sub(pattern, "", content)
+    readonly = True
+
+  return yaml.safe_load(content)
 
 def writeYaml(filename, content):
+  global readonly
+
+  if readonly:
+    raise Exception("Cannot write yaml file that has been flagged as read-only")  
+
   file = open(filename, "w")
   return yaml.dump(content, file)
 

salt/common/tools/sbin/so-kibana-space-defaults

@@ -1,6 +1,7 @@
+#!/bin/bash
 . /usr/sbin/so-common
 {% set HIGHLANDER = salt['pillar.get']('global:highlander', False) %}
-wait_for_web_response "http://localhost:5601/app/kibana" "Elastic" 300 "{{ ELASTICCURL }}"
+wait_for_web_response "http://localhost:5601/api/spaces/space/default" "default" 300 "{{ ELASTICCURL }}"
 ## This hackery will be removed if using Elastic Auth ##
 
 # Let's snag a cookie from Kibana
@@ -12,6 +13,6 @@ echo "Setting up default Space:"
 {% if HIGHLANDER %}
 {{ ELASTICCURL }} -b "sid=$SESSIONCOOKIE" -L -X PUT "localhost:5601/api/spaces/space/default" -H 'kbn-xsrf: true' -H 'Content-Type: application/json' -d' {"id":"default","name":"Default","disabledFeatures":["enterpriseSearch"]} ' >> /opt/so/log/kibana/misc.log
 {% else %}
-{{ ELASTICCURL }} -b "sid=$SESSIONCOOKIE" -L -X PUT "localhost:5601/api/spaces/space/default" -H 'kbn-xsrf: true' -H 'Content-Type: application/json' -d' {"id":"default","name":"Default","disabledFeatures":["ml","enterpriseSearch","siem","logs","infrastructure","apm","uptime","monitoring","stackAlerts","actions","fleet"]} ' >> /opt/so/log/kibana/misc.log
+{{ ELASTICCURL }} -b "sid=$SESSIONCOOKIE" -L -X PUT "localhost:5601/api/spaces/space/default" -H 'kbn-xsrf: true' -H 'Content-Type: application/json' -d' {"id":"default","name":"Default","disabledFeatures":["ml","enterpriseSearch","siem","logs","infrastructure","apm","uptime","monitoring","stackAlerts","actions","fleet","fleetv2","securitySolutionCases"]} ' >> /opt/so/log/kibana/misc.log
 {% endif %}
 echo

salt/common/tools/sbin/so-pcap-export

@@ -20,7 +20,7 @@ if [ $# -lt 2 ]; then
   exit 1
 fi
 
-docker exec -it so-sensoroni scripts/stenoquery.sh "$1" -w /nsm/pcapout/$2.pcap
+docker exec -t so-sensoroni scripts/stenoquery.sh "$1" -w /nsm/pcapout/$2.pcap
 
 echo ""
 echo "If successful, the output was written to: /nsm/pcapout/$2.pcap"

salt/common/tools/sbin/so-user

@@ -44,7 +44,7 @@ operation=$1
 email=$2
 role=$3
 
-kratosUrl=${KRATOS_URL:-http://127.0.0.1:4434}
+kratosUrl=${KRATOS_URL:-http://127.0.0.1:4434/admin}
 databasePath=${KRATOS_DB_PATH:-/opt/so/conf/kratos/db/db.sqlite}
 databaseTimeout=${KRATOS_DB_TIMEOUT:-5000}
 bcryptRounds=${BCRYPT_ROUNDS:-12}
@@ -238,7 +238,7 @@ function syncElastic() {
   syncElasticSystemUser "$authPillarJson" "so_monitor_user"  "$usersTmpFile"
 
   syncElasticSystemRole "$authPillarJson" "so_elastic_user"  "superuser" "$rolesTmpFile"
-  syncElasticSystemRole "$authPillarJson" "so_kibana_user"   "superuser" "$rolesTmpFile"
+  syncElasticSystemRole "$authPillarJson" "so_kibana_user"   "kibana_system" "$rolesTmpFile"
   syncElasticSystemRole "$authPillarJson" "so_logstash_user" "superuser" "$rolesTmpFile"
   syncElasticSystemRole "$authPillarJson" "so_beats_user"    "superuser" "$rolesTmpFile"
   syncElasticSystemRole "$authPillarJson" "so_monitor_user"  "remote_monitoring_collector" "$rolesTmpFile"
@@ -408,7 +408,7 @@ function migrateLockedUsers() {
   # This is a migration function to convert locked users from prior to 2.3.90
   # to inactive users using the newer Kratos functionality. This should only
   # find locked users once.
-  lockedEmails=$(curl -s http://localhost:4434/identities | jq -r '.[] | select(.traits.status == "locked") | .traits.email')
+  lockedEmails=$(curl -s ${kratosUrl}/identities | jq -r '.[] | select(.traits.status == "locked") | .traits.email')
   if [[ -n "$lockedEmails" ]]; then
     echo "Disabling locked users..."
     for email in $lockedEmails; do
@@ -437,7 +437,7 @@ function updateStatus() {
     state="inactive"
   fi
   body="{ \"schema_id\": \"$schemaId\", \"state\": \"$state\", \"traits\": $traitBlock }"
-  response=$(curl -fSsL -XPUT "${kratosUrl}/identities/$identityId" -d "$body")
+  response=$(curl -fSsL -XPUT -H "Content-Type: application/json" "${kratosUrl}/identities/$identityId" -d "$body")
   [[ $? != 0 ]] && fail "Unable to update user"
 }
 

salt/common/tools/sbin/so-yara-update

@@ -48,7 +48,7 @@ fi
 
 {% else %}
 
-gh_status=$(curl -s -o /dev/null -w "%{http_code}" http://github.com)
+gh_status=$(curl -s -o /dev/null -w "%{http_code}" https://github.com)
 clone_dir="/tmp"
 if [ "$gh_status" == "200" ]  || [ "$gh_status" == "301" ]; then
 

salt/common/tools/sbin/so-zeek-logs

@@ -10,39 +10,118 @@ zeek_logs_enabled() {
 }
 
 whiptail_manager_adv_service_zeeklogs() {
-  BLOGS=$(whiptail --title "so-zeek-logs" --checklist "Please Select Logs to Send:" 24 78 12 \
-  "conn" "Connection Logging" ON \
-  "dce_rpc" "RPC Logs" ON \
-  "dhcp" "DHCP Logs" ON \
-  "dnp3" "DNP3 Logs" ON \
-  "dns" "DNS Logs" ON \
-  "dpd" "DPD Logs" ON \
-  "files" "Files Logs" ON \
-  "ftp" "FTP Logs" ON \
-  "http" "HTTP Logs" ON \
-  "intel" "Intel Hits Logs" ON \
-  "irc" "IRC Chat Logs" ON \
-  "kerberos" "Kerberos Logs" ON \
-  "modbus" "MODBUS Logs" ON \
-  "notice" "Zeek Notice Logs" ON \
-  "ntlm" "NTLM Logs" ON \
-  "pe" "PE Logs" ON \
-  "radius" "Radius Logs" ON \
-  "rfb" "RFB Logs" ON \
-  "rdp" "RDP Logs" ON \
-  "sip" "SIP Logs" ON \
-  "smb_files" "SMB Files Logs" ON \
-  "smb_mapping" "SMB Mapping Logs" ON \
-  "smtp" "SMTP Logs" ON \
-  "snmp" "SNMP Logs" ON \
-  "ssh" "SSH Logs" ON \
-  "ssl" "SSL Logs" ON \
-  "syslog" "Syslog Logs" ON \
-  "tunnel" "Tunnel Logs" ON \
-  "weird" "Zeek Weird Logs" ON \
-  "mysql" "MySQL Logs" ON \
-  "socks" "SOCKS Logs" ON \
-  "x509" "x.509 Logs" ON 3>&1 1>&2 2>&3 )
+  BLOGS=$(whiptail --title "so-zeek-logs" --checklist "Please select logs to send:" 24 78 12 \
+  "conn" "" ON \
+  "dce_rpc" "" ON \
+  "dhcp" "" ON \
+  "dnp3" "" ON \
+  "dns" "" ON \
+  "dpd" "" ON \
+  "files" "" ON \
+  "ftp" "" ON \
+  "http" "" ON \
+  "intel" "" ON \
+  "irc" "" ON \
+  "kerberos" "" ON \
+  "modbus" "" ON \
+  "notice" "" ON \
+  "ntlm" "" ON \
+  "pe" "" ON \
+  "radius" "" ON \
+  "rfb" "" ON \
+  "rdp" "" ON \
+  "sip" "" ON \
+  "smb_files" "" ON \
+  "smb_mapping" "" ON \
+  "smtp" "" ON \
+  "snmp" "" ON \
+  "software" "" ON \
+  "ssh" "" ON \
+  "ssl" "" ON \
+  "syslog" "" ON \
+  "tunnel" "" ON \
+  "weird" "" ON \
+  "mysql" "" ON \
+  "socks" "" ON \
+  "x509" "" ON \
+  "bacnet" "" ON \
+  "bacnet_discovery" "" ON \
+  "bacnet_property" "" ON \
+  "bsap_ip_header" "" ON \
+  "bsap_ip_rdb" "" ON \
+  "bsap_ip_unknown" "" ON \
+  "bsap_serial_header" "" ON \
+  "bsap_serial_rdb" "" ON \
+  "bsap_serial_rdb_ext" "" ON \
+  "bsap_serial_unknown" "" ON \
+  "cip" "" ON \
+  "cip_identity" "" ON \
+  "cip_io" "" ON \
+  "cotp" "" ON \
+  "dnp3_control" "" ON \
+  "dnp3_objects" "" ON \
+  "ecat_aoe_info" "" ON \
+  "ecat_arp_info" "" OFF \
+  "ecat_coe_info" "" ON \
+  "ecat_dev_info" "" ON \
+  "ecat_foe_info" "" ON \
+  "ecat_log_address" "" ON \
+  "ecat_registers" "" ON \
+  "ecat_soe_info" "" ON \
+  "enip" "" ON \
+  "modbus_detailed" "" ON \
+  "modbus_mask_write_register" "" ON \
+  "modbus_read_write_multiple_registers" "" ON \
+  "opcua_binary" "" ON \
+  "opcua_binary_activate_session" "" ON \
+  "opcua_binary_activate_session_client_software_cert" "" ON \
+  "opcua_binary_activate_session_diagnostic_info" "" ON \
+  "opcua_binary_activate_session_locale_id" "" ON \
+  "opcua_binary_browse" "" ON \
+  "opcua_binary_browse_description" "" ON \
+  "opcua_binary_browse_diagnostic_info" "" ON \
+  "opcua_binary_browse_request_continuation_point" "" ON \
+  "opcua_binary_browse_response_references" "" ON \
+  "opcua_binary_browse_result" "" ON \
+  "opcua_binary_create_session" "" ON \
+  "opcua_binary_create_session_discovery" "" ON \
+  "opcua_binary_create_session_endpoints" "" ON \
+  "opcua_binary_create_session_user_token" "" ON \
+  "opcua_binary_create_subscription" "" ON \
+  "opcua_binary_diag_info_detail" "" ON \
+  "opcua_binary_get_endpoints" "" ON \
+  "opcua_binary_get_endpoints_description" "" ON \
+  "opcua_binary_get_endpoints_discovery" "" ON \
+  "opcua_binary_get_endpoints_locale_id" "" ON \
+  "opcua_binary_get_endpoints_profile_uri" "" ON \
+  "opcua_binary_get_endpoints_user_token" "" ON \
+  "opcua_binary_opensecure_channel" "" ON \
+  "opcua_binary_read" "" ON \
+  "opcua_binary_read_array_dims" "" ON \
+  "opcua_binary_read_array_dims_link" "" ON \
+  "opcua_binary_read_diagnostic_info" "" ON \
+  "opcua_binary_read_extension_object" "" ON \
+  "opcua_binary_read_extension_object_link" "" ON \
+  "opcua_binary_read_nodes_to_read" "" ON \
+  "opcua_binary_read_results" "" ON \
+  "opcua_binary_read_results_link" "" ON \
+  "opcua_binary_read_status_code" "" ON \
+  "opcua_binary_read_variant_data" "" ON \
+  "opcua_binary_read_variant_data_link" "" ON \
+  "opcua_binary_status_code_detail" "" ON \
+  "profinet" "" ON \
+  "profinet_dce_rpc" "" ON \
+  "profinet_debug" "" ON \
+  "s7comm" "" ON \
+  "s7comm_plus" "" ON \
+  "s7comm_read_szl" "" ON \
+  "s7comm_upload_download" "" ON \
+  "stun" "" ON \
+  "stun_nat" "" ON \
+  "tds" "" ON \
+  "tds_rpc" "" ON \
+  "tds_sql_batch" "" ON \
+  "wireguard" "" ON 3>&1 1>&2 2>&3 )
   
   local exitstatus=$?
 

salt/common/tools/sbin/soup

@@ -203,7 +203,7 @@ check_airgap() {
 
 check_local_mods() {
   local salt_local=/opt/so/saltstack/local
-
+  local_ignore_arr=("/opt/so/saltstack/local/salt/zeek/policy/intel/intel.dat")
   local_mod_arr=()
 
   while IFS= read -r -d '' local_file; do
@@ -211,8 +211,10 @@ check_local_mods() {
     default_file="${DEFAULT_SALT_DIR}${stripped_path}"
     if [[ -f $default_file ]]; then
       file_diff=$(diff "$default_file" "$local_file" )
-      if [[ $(echo "$file_diff" | grep -c "^<") -gt 0 ]]; then
-        local_mod_arr+=( "$local_file" )
+      if [[ ! " ${local_ignore_arr[*]} " =~ " ${local_file} " ]]; then
+        if [[ $(echo "$file_diff" | grep -c "^<") -gt 0 ]]; then
+          local_mod_arr+=( "$local_file" )
+        fi
       fi
     fi
   done< <(find $salt_local -type f -print0)
@@ -223,11 +225,24 @@ check_local_mods() {
       echo "  $file_str"
     done
     echo ""
-    echo "To reference this list later, check $SOUP_LOG"
-    sleep 10
+    echo "To reference this list later, check $SOUP_LOG".
+    echo
+    if [[ -z $UNATTENDED ]] && ! [[ "${1}" == "skip-prompt" ]]; then
+      while true; do
+        read -p "Please review the local modifications shown above as they may cause problems during or after the update.
+
+Would you like to proceed with the update anyway?
+
+If so, type 'YES'. Otherwise, type anything else to exit SOUP. " yn
+
+        case $yn in
+          [yY][eE][sS] ) echo "Local modifications accepted.  Continuing..."; break;;
+          * ) exit 0;;
+        esac
+      done
+    fi
   fi
 }
-
 # {% endraw %}
 
 check_pillar_items() {
@@ -371,12 +386,116 @@ clone_to_tmp() {
   fi
 }
 
+elastalert_indices_check() {
+  echo "Checking Elastalert indices for compatibility..."
+  # Wait for ElasticSearch to initialize
+  echo -n "Waiting for ElasticSearch..."
+  COUNT=0
+  ELASTICSEARCH_CONNECTED="no"
+  while [[ "$COUNT" -le 240 ]]; do
+    so-elasticsearch-query / -k --output /dev/null
+      if [ $? -eq 0 ]; then
+        ELASTICSEARCH_CONNECTED="yes"
+        echo "connected!"
+          break
+      else
+        ((COUNT+=1))
+        sleep 1
+        echo -n "."
+      fi
+  done
+
+  # Unable to connect to Elasticsearch
+  if [ "$ELASTICSEARCH_CONNECTED" == "no" ]; then
+    echo
+    echo -e "Connection attempt timed out.  Unable to connect to ElasticSearch.  \nPlease try: \n  -checking log(s) in /var/log/elasticsearch/\n  -running 'sudo docker ps' \n  -running 'sudo so-elastic-restart'"
+    echo
+    exit 1
+  fi
+
+  MAJOR_ES_VERSION=$(so-elasticsearch-query / | jq -r .version.number | cut -d '.' -f1)
+  if [[ "$MAJOR_ES_VERSION" -lt "8" ]]; then
+
+    # Stop Elastalert to prevent Elastalert indices from being re-created
+    if grep -q "^so-elastalert$" /opt/so/conf/so-status/so-status.conf ; then
+      so-elastalert-stop || true
+    fi
+
+    # Check Elastalert indices
+    echo "Deleting Elastalert indices to prevent issues with upgrade to Elastic 8..."
+    CHECK_COUNT=0
+    while [[ "$CHECK_COUNT" -le 2 ]]; do
+      # Delete Elastalert indices
+      for i in $(so-elasticsearch-query _cat/indices | grep elastalert | awk '{print $3}'); do
+        so-elasticsearch-query $i -XDELETE;
+         done
+
+      # Check to ensure Elastalert indices are deleted
+      COUNT=0
+      ELASTALERT_INDICES_DELETED="no"
+      while [[ "$COUNT" -le 240 ]]; do
+        RESPONSE=$(so-elasticsearch-query "elastalert*")
+        if [[ "$RESPONSE" == "{}" ]]; then
+          ELASTALERT_INDICES_DELETED="yes"
+          break
+        else
+          ((COUNT+=1))
+          sleep 1
+          echo -n "."
+        fi
+      done
+      ((CHECK_COUNT+=1))
+    done
+
+    # If we were unable to delete the Elastalert indices, exit the script
+    if [ "$ELASTALERT_INDICES_DELETED" == "yes" ]; then
+      echo "Elastalert indices successfully deleted."
+    else
+      echo
+      echo -e "Unable to connect to delete Elastalert indices. Exiting."
+      echo
+      exit 1
+    fi
+  else
+    echo "Major Elasticsearch version is 8 or greater...skipping Elastalert index maintenance."
+  fi
+}
+
 enable_highstate() {
     echo "Enabling highstate."
     salt-call state.enable highstate -l info --local
     echo ""
 }
 
+es_version_check() {
+    CHECK_ES=$(echo $INSTALLEDVERSION | awk -F. '{print $3}')
+  
+    if [[ "$CHECK_ES" -lt "110" ]]; then
+      echo "You are currently running Security Onion $INSTALLEDVERSION. You will need to update to version 2.3.130 before updating to 2.3.140 or higher."
+      echo ""
+      echo "If your deployment has Internet access, you can use the following command to update to 2.3.130:"
+      echo "sudo BRANCH=2.3.130-20220607 soup"
+      echo ""
+      echo "Otherwise, if your deployment is configured for airgap, you can instead download the 2.3.130 ISO image from https://download.securityonion.net/file/securityonion/securityonion-2.3.130-20220607.iso."
+      echo ""
+      echo "*** Once you have updated to 2.3.130, you can then update to 2.3.140 or higher as you would normally. ***"
+      exit 1
+    fi
+}
+
+es_indices_check() {
+  echo "Checking for unsupported Elasticsearch indices..."
+  UNSUPPORTED_INDICES=$(for INDEX in $(so-elasticsearch-indices-list | awk '{print $3}'); do so-elasticsearch-query $INDEX/_settings?human |grep '"created_string":"6' | jq -r 'keys'[0]; done)
+  if [ -z "$UNSUPPORTED_INDICES" ]; then
+    echo "No unsupported indices found."
+  else
+    echo "The following indices were created with Elasticsearch 6, and are not supported when upgrading to Elasticsearch 8. These indices may need to be deleted, migrated, or re-indexed before proceeding with the upgrade. Please see https://docs.securityonion.net/en/2.3/soup.html#elastic-8 for more details."
+    echo
+    echo "$UNSUPPORTED_INDICES"
+    exit 1
+  fi
+}
+
 generate_and_clean_tarballs() {
   local new_version
   new_version=$(cat $UPDATE_DIR/VERSION)
@@ -422,7 +541,16 @@ preupgrade_changes() {
     [[ "$INSTALLEDVERSION" == 2.3.80 ]] && up_to_2.3.90
     [[ "$INSTALLEDVERSION" == 2.3.90 || "$INSTALLEDVERSION" == 2.3.91 ]] && up_to_2.3.100
     [[ "$INSTALLEDVERSION" == 2.3.100 ]] && up_to_2.3.110
-    [[ "$INSTALLEDVERISON" == 2.3.110 ]] && up_to_2.3.120
+    [[ "$INSTALLEDVERSION" == 2.3.110 ]] && up_to_2.3.120
+    [[ "$INSTALLEDVERSION" == 2.3.120 ]] && up_to_2.3.130
+    [[ "$INSTALLEDVERSION" == 2.3.130 ]] && up_to_2.3.140
+    [[ "$INSTALLEDVERSION" == 2.3.140 ]] && up_to_2.3.150
+    [[ "$INSTALLEDVERSION" == 2.3.150 ]] && up_to_2.3.160
+    [[ "$INSTALLEDVERSION" == 2.3.160 ]] && up_to_2.3.170
+    [[ "$INSTALLEDVERSION" == 2.3.170 ]] && up_to_2.3.180
+    [[ "$INSTALLEDVERSION" == 2.3.180 ]] && up_to_2.3.181
+    [[ "$INSTALLEDVERSION" == 2.3.181 ]] && up_to_2.3.182
+    [[ "$INSTALLEDVERSION" == 2.3.182 ]] && up_to_2.3.190
     true
 }
 
@@ -437,6 +565,15 @@ postupgrade_changes() {
     [[ "$POSTVERSION" == 2.3.90 || "$POSTVERSION" == 2.3.91 ]] && post_to_2.3.100
     [[ "$POSTVERSION" == 2.3.100 ]] && post_to_2.3.110
     [[ "$POSTVERSION" == 2.3.110 ]] && post_to_2.3.120
+    [[ "$POSTVERSION" == 2.3.120 ]] && post_to_2.3.130
+    [[ "$POSTVERSION" == 2.3.130 ]] && post_to_2.3.140
+    [[ "$POSTVERSION" == 2.3.140 ]] && post_to_2.3.150
+    [[ "$POSTVERSION" == 2.3.150 ]] && post_to_2.3.160
+    [[ "$POSTVERSION" == 2.3.160 ]] && post_to_2.3.170
+    [[ "$POSTVERSION" == 2.3.170 ]] && post_to_2.3.180
+    [[ "$POSTVERSION" == 2.3.180 ]] && post_to_2.3.181
+    [[ "$POSTVERSION" == 2.3.181 ]] && post_to_2.3.182
+    [[ "$POSTVERSION" == 2.3.182 ]] && post_to_2.3.190
 
     true
 }
@@ -507,7 +644,53 @@ post_to_2.3.120() {
   sed -i '/so-thehive-es/d;/so-thehive/d;/so-cortex/d' /opt/so/conf/so-status/so-status.conf
 }
 
+post_to_2.3.130() {
+  echo "Post Processing for 2.3.130"
+  POSTVERSION=2.3.130
+}
 
+post_to_2.3.140() {
+  echo "Post Processing for 2.3.140"
+  FORCE_SYNC=true so-user sync
+  so-kibana-restart
+  so-kibana-space-defaults
+  POSTVERSION=2.3.140
+}
+
+post_to_2.3.150() {
+  echo "Nothing to do for .150"
+  POSTVERSION=2.3.150
+}
+
+post_to_2.3.160() {
+  echo "Nothing to do for .160"
+  POSTVERSION=2.3.160
+}
+
+post_to_2.3.170() {
+  echo "Nothing to do for .170"
+  POSTVERSION=2.3.170
+}
+
+post_to_2.3.180() {
+  echo "Nothing to do for .180"
+  POSTVERSION=2.3.180
+}
+
+post_to_2.3.181() {
+  echo "Nothing to do for .181"
+  POSTVERSION=2.3.181
+}
+
+post_to_2.3.182() {
+  echo "Nothing to do for .182"
+  POSTVERSION=2.3.182
+}
+
+post_to_2.3.190() {
+  echo "Nothing to do for .190"
+  POSTVERSION=2.3.190
+}
 
 stop_salt_master() {
     # kill all salt jobs across the grid because the hang indefinitely if they are queued and salt-master restarts
@@ -754,10 +937,13 @@ up_to_2.3.100() {
 
   echo "Adding receiver to assigned_hostgroups.local.map.yaml"
   grep -qxF "  receiver:" /opt/so/saltstack/local/salt/firewall/assigned_hostgroups.local.map.yaml || sed -i -e '$a\  receiver:' /opt/so/saltstack/local/salt/firewall/assigned_hostgroups.local.map.yaml
+  
+  INSTALLEDVERSION=2.3.100
 }
 
 up_to_2.3.110() {
   sed -i 's|shards|index_template:\n        template:\n          settings:\n            index:\n              number_of_shards|g' /opt/so/saltstack/local/pillar/global.sls
+  INSTALLEDVERSION=2.3.110
 }
 
 up_to_2.3.120() {
@@ -765,7 +951,59 @@ up_to_2.3.120() {
   so-thehive-stop
   so-thehive-es-stop
   so-cortex-stop
-  }
+  INSTALLEDVERSION=2.3.120
+}
+
+up_to_2.3.130() {
+  # Remove file for nav update
+  rm -f /opt/so/conf/navigator/layers/nav_layer_playbook.json
+  INSTALLEDVERSION=2.3.130
+}
+
+up_to_2.3.140() {
+   elastalert_indices_check
+   ##
+   INSTALLEDVERSION=2.3.140
+}
+
+up_to_2.3.150() {
+  echo "Upgrading to 2.3.150"
+  INSTALLEDVERSION=2.3.150
+}
+
+up_to_2.3.160() {
+  echo "Upgrading to 2.3.160"
+  INSTALLEDVERSION=2.3.160
+}
+
+up_to_2.3.170() {
+  echo "Upgrading to 2.3.170"
+  INSTALLEDVERSION=2.3.170
+}
+
+up_to_2.3.180() {
+  echo "Upgrading to 2.3.180"
+  INSTALLEDVERSION=2.3.180
+}
+
+up_to_2.3.181() {
+  echo "Upgrading to 2.3.181"
+  INSTALLEDVERSION=2.3.181
+}
+
+up_to_2.3.182() {
+  echo "Upgrading to 2.3.182"
+  INSTALLEDVERSION=2.3.182
+}
+
+up_to_2.3.190() {
+  echo "Upgrading to 2.3.190"
+  if [ -d /nsm/zeek/extracted/complete ]; then
+    chown -R zeek:socore /nsm/zeek/extracted/complete
+    chmod 770 /nsm/zeek/extracted/complete
+  fi
+  INSTALLEDVERSION=2.3.190
+}
 
 verify_upgradespace() {
   CURRENTSPACE=$(df -BG / | grep -v Avail | awk '{print $4}' | sed 's/.$//')
@@ -945,7 +1183,7 @@ update_repo() {
     fi
 
     rm -f /etc/apt/sources.list.d/salt.list
-    echo "deb https://repo.securityonion.net/file/securityonion-repo/ubuntu/$ubuntu_version/amd64/salt $OSVER main" > /etc/apt/sources.list.d/saltstack.list
+    echo "deb https://repo.securityonion.net/file/securityonion-repo/ubuntu/$ubuntu_version/amd64/salt3004.2/ $OSVER main" > /etc/apt/sources.list.d/saltstack.list
     apt-get update
   fi
 }
@@ -1080,10 +1318,14 @@ main() {
   fi
   echo "Verifying we have the latest soup script."
   verify_latest_update_script
+  es_version_check
+  es_indices_check
+  elastalert_indices_check
   echo ""
   set_palette
   check_elastic_license
   echo ""
+  check_local_mods
   check_os_updates
 
   echo "Generating new repo archive"
@@ -1248,7 +1490,7 @@ main() {
     fi
 
     echo "Checking for local modifications."
-    check_local_mods
+    check_local_mods skip-prompt
 
     echo "Checking sudoers file."
     check_sudoers

salt/curator/files/action/so-kratos-close.yml

@@ -0,0 +1,29 @@
+{%- set cur_close_days = salt['pillar.get']('elasticsearch:index_settings:so-kratos:close', 30) -%}
+---
+# Remember, leave a key empty if there is no value.  None will be a string,
+# not a Python "NoneType"
+#
+# Also remember that all examples have 'disable_action' set to True.  If you
+# want to use this action as a template, be sure to set this to False after
+# copying it.
+actions:
+  1:
+    action: close
+    description: >-
+      Close kratos indices older than {{cur_close_days}} days.
+    options:
+      delete_aliases: False
+      timeout_override:
+      continue_if_exception: False
+      disable_action: False
+    filters:
+    - filtertype: pattern
+      kind: regex
+      value: '^(logstash-kratos.*|so-kratos.*)$'
+    - filtertype: age
+      source: name
+      direction: older
+      timestring: '%Y.%m.%d'
+      unit: days
+      unit_count: {{cur_close_days}}
+      exclude:

salt/curator/files/action/so-kratos-delete.yml

@@ -0,0 +1,29 @@
+{%- set DELETE_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-kratos:delete', 365) -%}
+---
+# Remember, leave a key empty if there is no value.  None will be a string,
+# not a Python "NoneType"
+#
+# Also remember that all examples have 'disable_action' set to True.  If you
+# want to use this action as a template, be sure to set this to False after
+# copying it.
+actions:
+  1:
+    action: delete_indices
+    description: >-
+      Delete kratos indices when older than {{ DELETE_DAYS }} days.
+    options:
+      ignore_empty_list: True
+      disable_action: False
+    filters:
+    - filtertype: pattern
+      kind: regex
+      value: '^(logstash-kratos.*|so-kratos.*)$'
+    - filtertype: age
+      source: name
+      direction: older
+      timestring: '%Y.%m.%d'
+      unit: days
+      unit_count: {{ DELETE_DAYS }}
+      exclude:
+  
+      

salt/curator/files/action/so-kratos-warm.yml

@@ -0,0 +1,24 @@
+{%- set WARM_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-kratos:warm', 7) -%}
+actions:
+  1:
+    action: allocation
+    description: "Apply shard allocation filtering rules to the specified indices"
+    options:
+      key: box_type
+      value: warm
+      allocation_type: require
+      wait_for_completion: true
+      timeout_override:
+      continue_if_exception: false
+      disable_action: false
+    filters:
+    - filtertype: pattern
+      kind: prefix
+      value: so-kratos
+    - filtertype: age
+      source: name
+      direction: older
+      timestring: '%Y.%m.%d'
+      unit: days
+      unit_count: {{ WARM_DAYS }} 
+

salt/curator/files/bin/so-curator-close

@@ -23,22 +23,21 @@ read lastPID < $lf
 # if lastPID is not null and a process with that pid exists , exit
 [ ! -z "$lastPID" -a -d /proc/$lastPID ] && exit
 echo $$ > $lf
-{% from 'filebeat/map.jinja' import THIRDPARTY with context %}
-{% from 'filebeat/map.jinja' import SO with context %}
+
+{% from 'filebeat/modules.map.jinja' import MODULESMERGED with context %}
 
 /usr/sbin/so-curator-closed-delete > /dev/null 2>&1; 
 docker exec so-curator curator --config /etc/curator/config/curator.yml /etc/curator/action/so-zeek-close.yml > /dev/null 2>&1; 
 docker exec so-curator curator --config /etc/curator/config/curator.yml /etc/curator/action/so-beats-close.yml > /dev/null 2>&1; 
 docker exec so-curator curator --config /etc/curator/config/curator.yml /etc/curator/action/so-firewall-close.yml > /dev/null 2>&1; 
 docker exec so-curator curator --config /etc/curator/config/curator.yml /etc/curator/action/so-ids-close.yml > /dev/null 2>&1; 
-docker exec so-curator curator --config /etc/curator/config/curator.yml /etc/curator/action/so-import-close.yml > /dev/null 2>&1; 
+docker exec so-curator curator --config /etc/curator/config/curator.yml /etc/curator/action/so-import-close.yml > /dev/null 2>&1;
+docker exec so-curator curator --config /etc/curator/config/curator.yml /etc/curator/action/so-kibana-close.yml > /dev/null 2>&1;
+docker exec so-curator curator --config /etc/curator/config/curator.yml /etc/curator/action/so-kratos-close.yml > /dev/null 2>&1;
 docker exec so-curator curator --config /etc/curator/config/curator.yml /etc/curator/action/so-osquery-close.yml > /dev/null 2>&1; 
 docker exec so-curator curator --config /etc/curator/config/curator.yml /etc/curator/action/so-ossec-close.yml > /dev/null 2>&1; 
 docker exec so-curator curator --config /etc/curator/config/curator.yml /etc/curator/action/so-strelka-close.yml > /dev/null 2>&1; 
 docker exec so-curator curator --config /etc/curator/config/curator.yml /etc/curator/action/so-syslog-close.yml > /dev/null 2>&1;
-{% for INDEX in THIRDPARTY.modules.keys() -%}
-docker exec so-curator curator --config /etc/curator/config/curator.yml /etc/curator/action/so-{{ INDEX }}-close.yml > /dev/null 2>&1;
-{% endfor -%}
-{% for INDEX in SO.modules.keys() -%}
+{% for INDEX in MODULESMERGED.modules.keys() -%}
 docker exec so-curator curator --config /etc/curator/config/curator.yml /etc/curator/action/so-{{ INDEX }}-close.yml > /dev/null 2>&1{% if not loop.last %};{% endif %}
 {% endfor -%}

salt/curator/files/bin/so-curator-closed-delete-delete

@@ -29,7 +29,7 @@ LOG="/opt/so/log/curator/so-curator-closed-delete.log"
 
 overlimit() {
 
-        [[ $(du -hs --block-size=1GB /nsm/elasticsearch/nodes | awk '{print $1}' ) -gt "{{LOG_SIZE_LIMIT}}" ]]
+        [[ $(du -hs --block-size=1GB /nsm/elasticsearch/indices | awk '{print $1}' ) -gt "{{LOG_SIZE_LIMIT}}" ]]
 }
 
 closedindices() {

salt/curator/files/bin/so-curator-cluster-close

@@ -24,21 +24,18 @@ read lastPID < $lf
 [ ! -z "$lastPID" -a -d /proc/$lastPID ] && exit
 echo $$ > $lf
 
-{% from 'filebeat/map.jinja' import THIRDPARTY with context %}
-{% from 'filebeat/map.jinja' import SO with context %}
+{% from 'filebeat/modules.map.jinja' import MODULESMERGED with context %}
 
 docker exec so-curator curator --config /etc/curator/config/curator.yml /etc/curator/action/so-zeek-close.yml > /dev/null 2>&1; 
 docker exec so-curator curator --config /etc/curator/config/curator.yml /etc/curator/action/so-beats-close.yml > /dev/null 2>&1; 
 docker exec so-curator curator --config /etc/curator/config/curator.yml /etc/curator/action/so-firewall-close.yml > /dev/null 2>&1; 
 docker exec so-curator curator --config /etc/curator/config/curator.yml /etc/curator/action/so-ids-close.yml > /dev/null 2>&1; 
 docker exec so-curator curator --config /etc/curator/config/curator.yml /etc/curator/action/so-import-close.yml > /dev/null 2>&1; 
+docker exec so-curator curator --config /etc/curator/config/curator.yml /etc/curator/action/so-kratos-close.yml > /dev/null 2>&1;
 docker exec so-curator curator --config /etc/curator/config/curator.yml /etc/curator/action/so-osquery-close.yml > /dev/null 2>&1; 
 docker exec so-curator curator --config /etc/curator/config/curator.yml /etc/curator/action/so-ossec-close.yml > /dev/null 2>&1; 
 docker exec so-curator curator --config /etc/curator/config/curator.yml /etc/curator/action/so-strelka-close.yml > /dev/null 2>&1; 
 docker exec so-curator curator --config /etc/curator/config/curator.yml /etc/curator/action/so-syslog-close.yml > /dev/null 2>&1;
-{% for INDEX in THIRDPARTY.modules.keys() -%}
-docker exec so-curator curator --config /etc/curator/config/curator.yml /etc/curator/action/so-{{ INDEX }}-close.yml > /dev/null 2>&1;
-{% endfor -%}
-{% for INDEX in SO.modules.keys() -%}
+{% for INDEX in MODULESMERGED.modules.keys() -%}
 docker exec so-curator curator --config /etc/curator/config/curator.yml /etc/curator/action/so-{{ INDEX }}-close.yml > /dev/null 2>&1{% if not loop.last %};{% endif %}
 {% endfor -%}

salt/curator/files/bin/so-curator-cluster-delete

@@ -24,21 +24,18 @@ read lastPID < $lf
 [ ! -z "$lastPID" -a -d /proc/$lastPID ] && exit
 echo $$ > $lf
 
-{% from 'filebeat/map.jinja' import THIRDPARTY with context %}
-{% from 'filebeat/map.jinja' import SO with context %}
+{% from 'filebeat/modules.map.jinja' import MODULESMERGED with context %}
 
 docker exec so-curator curator --config /etc/curator/config/curator.yml /etc/curator/action/so-zeek-delete.yml > /dev/null 2>&1; 
 docker exec so-curator curator --config /etc/curator/config/curator.yml /etc/curator/action/so-beats-delete.yml > /dev/null 2>&1; 
 docker exec so-curator curator --config /etc/curator/config/curator.yml /etc/curator/action/so-firewall-delete.yml > /dev/null 2>&1; 
 docker exec so-curator curator --config /etc/curator/config/curator.yml /etc/curator/action/so-ids-delete.yml > /dev/null 2>&1; 
-docker exec so-curator curator --config /etc/curator/config/curator.yml /etc/curator/action/so-import-delete.yml > /dev/null 2>&1; 
+docker exec so-curator curator --config /etc/curator/config/curator.yml /etc/curator/action/so-import-delete.yml > /dev/null 2>&1;
+docker exec so-curator curator --config /etc/curator/config/curator.yml /etc/curator/action/so-kratos-delete.yml > /dev/null 2>&1; 
 docker exec so-curator curator --config /etc/curator/config/curator.yml /etc/curator/action/so-osquery-delete.yml > /dev/null 2>&1; 
 docker exec so-curator curator --config /etc/curator/config/curator.yml /etc/curator/action/so-ossec-delete.yml > /dev/null 2>&1; 
 docker exec so-curator curator --config /etc/curator/config/curator.yml /etc/curator/action/so-strelka-delete.yml > /dev/null 2>&1; 
 docker exec so-curator curator --config /etc/curator/config/curator.yml /etc/curator/action/so-syslog-delete.yml > /dev/null 2>&1;
-{% for INDEX in THIRDPARTY.modules.keys() -%}
-docker exec so-curator curator --config /etc/curator/config/curator.yml /etc/curator/action/so-{{ INDEX }}-delete.yml > /dev/null 2>&1;
-{% endfor -%}
-{% for INDEX in SO.modules.keys() -%}
+{% for INDEX in MODULESMERGED.modules.keys() -%}
 docker exec so-curator curator --config /etc/curator/config/curator.yml /etc/curator/action/so-{{ INDEX }}-delete.yml > /dev/null 2>&1{% if not loop.last %};{% endif %}
 {% endfor -%}

salt/curator/files/bin/so-curator-cluster-warm

@@ -24,21 +24,18 @@ read lastPID < $lf
 [ ! -z "$lastPID" -a -d /proc/$lastPID ] && exit
 echo $$ > $lf
 
-{% from 'filebeat/map.jinja' import THIRDPARTY with context %}
-{% from 'filebeat/map.jinja' import SO with context %}
+{% from 'filebeat/modules.map.jinja' import MODULESMERGED with context %}
 
 docker exec so-curator curator --config /etc/curator/config/curator.yml /etc/curator/action/so-zeek-warm.yml > /dev/null 2>&1; 
 docker exec so-curator curator --config /etc/curator/config/curator.yml /etc/curator/action/so-beats-warm.yml > /dev/null 2>&1; 
 docker exec so-curator curator --config /etc/curator/config/curator.yml /etc/curator/action/so-firewall-warm.yml > /dev/null 2>&1; 
 docker exec so-curator curator --config /etc/curator/config/curator.yml /etc/curator/action/so-ids-warm.yml > /dev/null 2>&1; 
-docker exec so-curator curator --config /etc/curator/config/curator.yml /etc/curator/action/so-import-warm.yml > /dev/null 2>&1; 
+docker exec so-curator curator --config /etc/curator/config/curator.yml /etc/curator/action/so-import-warm.yml > /dev/null 2>&1;
+docker exec so-curator curator --config /etc/curator/config/curator.yml /etc/curator/action/so-kratos-warm.yml > /dev/null 2>&1; 
 docker exec so-curator curator --config /etc/curator/config/curator.yml /etc/curator/action/so-osquery-warm.yml > /dev/null 2>&1; 
 docker exec so-curator curator --config /etc/curator/config/curator.yml /etc/curator/action/so-ossec-warm.yml > /dev/null 2>&1; 
 docker exec so-curator curator --config /etc/curator/config/curator.yml /etc/curator/action/so-strelka-warm.yml > /dev/null 2>&1; 
 docker exec so-curator curator --config /etc/curator/config/curator.yml /etc/curator/action/so-syslog-warm.yml > /dev/null 2>&1;
-{% for INDEX in THIRDPARTY.modules.keys() -%}
-docker exec so-curator curator --config /etc/curator/config/curator.yml /etc/curator/action/so-{{ INDEX }}-warm.yml > /dev/null 2>&1;
-{% endfor -%}
-{% for INDEX in SO.modules.keys() -%}
+{% for INDEX in MODULESMERGED.modules.keys() -%}
 docker exec so-curator curator --config /etc/curator/config/curator.yml /etc/curator/action/so-{{ INDEX }}-warm.yml > /dev/null 2>&1{% if not loop.last %};{% endif %}
 {% endfor -%}

salt/curator/init.sls

@@ -201,8 +201,8 @@ so-curatorclusterclose:
   cron.present:
     - name: /usr/sbin/so-curator-cluster-close > /opt/so/log/curator/cron-close.log 2>&1
     - user: root
-    - minute: '2'
-    - hour: '*/1'
+    - minute: '5'
+    - hour: '1'
     - daymonth: '*'
     - month: '*'
     - dayweek: '*'
@@ -211,8 +211,8 @@ so-curatorclusterdelete:
   cron.present:
     - name: /usr/sbin/so-curator-cluster-delete > /opt/so/log/curator/cron-delete.log 2>&1
     - user: root
-    - minute: '2'
-    - hour: '*/1'
+    - minute: '5'
+    - hour: '1'
     - daymonth: '*'
     - month: '*'
     - dayweek: '*'
@@ -221,8 +221,8 @@ so-curatorclusterwarm:
   cron.present:
     - name: /usr/sbin/so-curator-cluster-warm > /opt/so/log/curator/cron-warm.log 2>&1
     - user: root
-    - minute: '2'
-    - hour: '*/1'
+    - minute: '5'
+    - hour: '1'
     - daymonth: '*'
     - month: '*'
     - dayweek: '*'

salt/elastalert/init.sls

@@ -129,6 +129,9 @@ so-elastalert:
       - file: elastaconf
     - watch:
       - file: elastaconf
+    - onlyif:
+      - "so-elasticsearch-query / | jq -r '.version.number[0:1]' | grep -q 8" {# only run this state if elasticsearch is version 8 #}
+
 
 append_so-elastalert_so-status.conf:
   file.append:

salt/elasticsearch/defaults.yaml

@@ -53,11 +53,12 @@ elasticsearch:
     script:
       max_compilations_rate: 20000/1m
     indices:
-      query:
-        bool:
-          max_clause_count: 3500
       id_field_data:
         enabled: false
+    ingest:
+      geoip:
+        downloader:
+          enabled: false
     logger:
       org:
         elasticsearch:

salt/elasticsearch/files/ingest/filterlog

@@ -51,9 +51,10 @@
      },
      { "set":         { "field": "_index",        "value": "so-firewall", "override": true           } },
      { "set":         { "if": "ctx.network?.transport_id == '0'", "field": "network.transport",        "value": "icmp", "override": true           } },
-     {"community_id": {} },
-     { "set":         { "field": "module",        "value": "pfsense", "override": true           } },
-     { "set":         { "field": "dataset",        "value": "firewall", "override": true           } },
+     { "community_id": {} },
+     { "set":         { "field": "module",	"value": "pfsense",	"override": true	} },
+     { "set":         { "field": "dataset",	"value": "firewall",	"override": true	} },
+     { "set":         { "field": "category",	"value": "network",	"override": true	} },
      { "remove":      { "field": ["real_message", "ip_sub_msg", "firewall.sub_message"],     "ignore_failure": true  } }
   ]
 }

salt/elasticsearch/files/ingest/kratos

@@ -0,0 +1,13 @@
+{
+  "description" : "kratos",
+  "processors" : [
+    {
+      "set": {
+        "field": "_index",
+        "value": "so-kratos",
+        "override": true
+      }
+    },
+    { "pipeline":    { "name": "common" } }
+  ]
+}

salt/elasticsearch/files/ingest/sysmon

@@ -9,61 +9,70 @@
     { "set":           { "if": "ctx.event?.code == '5'",   "field": "event.category", "value": "host,process", "override": true }  },
     { "set":           { "if": "ctx.event?.code == '6'",   "field": "event.category", "value": "host,driver", "override": true }  },
     { "set":           { "if": "ctx.event?.code == '22'",   "field": "event.category", "value": "network", "override": true }  },
-    { "set":          { "if": "ctx.event?.code == '1'",   "field": "event.dataset", "value": "process_creation", "override": true }  },
-    { "set":          { "if": "ctx.event?.code == '2'",   "field": "event.dataset", "value": "process_changed_file", "override": true }  },
-    { "set":          { "if": "ctx.event?.code == '3'",   "field": "event.dataset", "value": "network_connection", "override": true }  },
-    { "set":          { "if": "ctx.event?.code == '5'",   "field": "event.dataset", "value": "process_terminated", "override": true }  },
-    { "set":          { "if": "ctx.event?.code == '6'",   "field": "event.dataset", "value": "driver_loaded", "override": true }  },
-    { "set":          { "if": "ctx.event?.code == '7'",   "field": "event.dataset", "value": "image_loaded", "override": true }  },
-    { "set":          { "if": "ctx.event?.code == '8'",   "field": "event.dataset", "value": "create_remote_thread", "override": true }  },
-    { "set":          { "if": "ctx.event?.code == '9'",   "field": "event.dataset", "value": "raw_file_access_read", "override": true }  },
-    { "set":          { "if": "ctx.event?.code == '10'",   "field": "event.dataset", "value": "process_access", "override": true }  },
-    { "set":          { "if": "ctx.event?.code == '11'",   "field": "event.dataset", "value": "file_create", "override": true }  },
-    { "set":          { "if": "ctx.event?.code == '12'",   "field": "event.dataset", "value": "registry_create_delete", "override": true }  },
-    { "set":          { "if": "ctx.event?.code == '13'",   "field": "event.dataset", "value": "registry_value_set", "override": true }  },
-    { "set":          { "if": "ctx.event?.code == '14'",   "field": "event.dataset", "value": "registry_key_value_rename", "override": true }  },
-    { "set":          { "if": "ctx.event?.code == '15'",   "field": "event.dataset", "value": "file_create_stream_hash", "override": true }  },
-    { "set":          { "if": "ctx.event?.code == '16'",   "field": "event.dataset", "value": "config_change", "override": true }  },
-    { "set":          { "if": "ctx.event?.code == '22'",   "field": "event.dataset", "value": "dns_query", "override": true }  },
-    { "rename": 	   { "field": "winlog.event_data.SubjectUserName", 			  "target_field": "user.name",		"ignore_missing": true 	} },
-    { "rename": 	   { "field": "winlog.event_data.DestinationHostname", 	  "target_field": "destination.hostname",	"ignore_missing": true 	} },
-    { "rename": 	   { "field": "winlog.event_data.DestinationIp", 		      "target_field": "destination.ip",	"ignore_missing": true 	} },
-    { "rename": 	   { "field": "winlog.event_data.DestinationPort", 	      "target_field": "destination.port",	"ignore_missing": true 	} },
-    { "rename":      { "field": "winlog.event_data.image",                  "target_field": "process.executable",               "ignore_missing": true  } }, 
-    { "rename": 	   { "field": "winlog.event_data.Image", 			            "target_field": "process.executable",		"ignore_missing": true 	} },
-    { "rename":      { "field": "winlog.event_data.processID",              "target_field": "process.pid",          "ignore_missing": true  } }, 
-    { "rename": 	   { "field": "winlog.event_data.ProcessId", 			        "target_field": "process.pid",		"ignore_missing": true 	} },
-    { "rename":      { "field": "winlog.event_data.processGuid",            "target_field": "process.entity_id",              "ignore_missing": true  } },
-    { "rename": 	   { "field": "winlog.event_data.ProcessGuid", 			      "target_field": "process.entity_id",		"ignore_missing": true 	} },
-    { "rename":      { "field": "winlog.event_data.commandLine",            "target_field": "process.command_line",           "ignore_missing": true  } },    
-    { "rename": 	   { "field": "winlog.event_data.CommandLine", 			      "target_field": "process.command_line",		"ignore_missing": true 	} },
-    { "rename":      { "field": "winlog.event_data.currentDirectory",       "target_field": "process.working_directory",            "ignore_missing": true  } },
-    { "rename": 	   { "field": "winlog.event_data.CurrentDirectory", 			"target_field": "process.working_directory",		"ignore_missing": true 	} },
-    { "rename":      { "field": "winlog.event_data.description",            "target_field": "process.pe.description",         "ignore_missing": true  } },
-    { "rename": 	   { "field": "winlog.event_data.Description", 			      "target_field": "process.pe.description",		"ignore_missing": true 	} },
-    { "rename":      { "field": "winlog.event_data.product",                "target_field": "process.pe.product",         "ignore_missing": true  } },
-    { "rename": 	   { "field": "winlog.event_data.Product", 			          "target_field": "process.pe.product",		"ignore_missing": true 	} },
-    { "rename":      { "field": "winlog.event_data.company",                "target_field": "process.pe.company",         "ignore_missing": true  } }, 
-    { "rename": 	   { "field": "winlog.event_data.Company", 			          "target_field": "process.pe.company",		"ignore_missing": true 	} },
-    { "rename":      { "field": "winlog.event_data.originalFileName",       "target_field": "process.pe.original_file_name",                "ignore_missing": true  } }, 
-    { "rename": 	   { "field": "winlog.event_data.OriginalFileName", 			"target_field": "process.pe.original_file_name",		"ignore_missing": true 	} },
-    { "rename":      { "field": "winlog.event_data.fileVersion",            "target_field": "process.pe.file_version",                "ignore_missing": true  } },
-    { "rename": 	   { "field": "winlog.event_data.FileVersion", 			      "target_field": "process.pe.file_version",		"ignore_missing": true 	} },
-    { "rename":      { "field": "winlog.event_data.parentCommandLine",      "target_field": "process.parent.command_line",          "ignore_missing": true  } },
-    { "rename": 	   { "field": "winlog.event_data.ParentCommandLine", 			"target_field": "process.parent.command_line",		"ignore_missing": true 	} },
-    { "rename":      { "field": "winlog.event_data.parentImage",            "target_field": "process.parent.executable",              "ignore_missing": true  } },
-    { "rename": 	   { "field": "winlog.event_data.ParentImage", 			      "target_field": "process.parent.executable",		"ignore_missing": true 	} },
-    { "rename":      { "field": "winlog.event_data.parentProcessGuid",      "target_field": "process.parent.entity_id",             "ignore_missing": true  } }, 
-    { "rename": 	   { "field": "winlog.event_data.ParentProcessGuid", 			"target_field": "process.parent.entity_id",		"ignore_missing": true 	} },
-    { "rename":      { "field": "winlog.event_data.parentProcessId",        "target_field": "process.ppid",               "ignore_missing": true  } },
-    { "rename": 	   { "field": "winlog.event_data.ParentProcessId", 			  "target_field": "process.ppid",		"ignore_missing": true 	} },
-    { "rename": 	   { "field": "winlog.event_data.Protocol", 	            "target_field": "network.transport",	"ignore_missing": true 	} },
-    { "rename": 	   { "field": "winlog.event_data.User", 			            "target_field": "user.name",		"ignore_missing": true 	} },
-    { "rename": 	   { "field": "winlog.event_data.SourceHostname", 	      "target_field": "source.hostname",	"ignore_missing": true 	} },
-    { "rename": 	   { "field": "winlog.event_data.SourceIp", 		          "target_field": "source.ip",		"ignore_missing": true 	} },
-    { "rename": 	   { "field": "winlog.event_data.SourcePort", 		        "target_field": "source.port",		"ignore_missing": true 	} },   
-    { "rename": 	   { "field": "winlog.event_data.targetFilename",		      "target_field": "file.target",	"ignore_missing": true 	} },
-    { "rename":      { "field": "winlog.event_data.TargetFilename",         "target_field": "file.target",    "ignore_missing": true  } },
+    { "set":           { "if": "ctx.event?.code == '1'",   "field": "event.dataset", "value": "process_creation", "override": true }  },
+    { "set":           { "if": "ctx.event?.code == '2'",   "field": "event.dataset", "value": "process_changed_file", "override": true }  },
+    { "set":           { "if": "ctx.event?.code == '3'",   "field": "event.dataset", "value": "network_connection", "override": true }  },
+    { "set":           { "if": "ctx.event?.code == '5'",   "field": "event.dataset", "value": "process_terminated", "override": true }  },
+    { "set":           { "if": "ctx.event?.code == '6'",   "field": "event.dataset", "value": "driver_loaded", "override": true }  },
+    { "set":           { "if": "ctx.event?.code == '7'",   "field": "event.dataset", "value": "image_loaded", "override": true }  },
+    { "set":           { "if": "ctx.event?.code == '8'",   "field": "event.dataset", "value": "create_remote_thread", "override": true }  },
+    { "set":           { "if": "ctx.event?.code == '9'",   "field": "event.dataset", "value": "raw_file_access_read", "override": true }  },
+    { "set":           { "if": "ctx.event?.code == '10'",   "field": "event.dataset", "value": "process_access", "override": true }  },
+    { "set":           { "if": "ctx.event?.code == '11'",   "field": "event.dataset", "value": "file_create", "override": true }  },
+    { "set":           { "if": "ctx.event?.code == '12'",   "field": "event.dataset", "value": "registry_create_delete", "override": true }  },
+    { "set":           { "if": "ctx.event?.code == '13'",   "field": "event.dataset", "value": "registry_value_set", "override": true }  },
+    { "set":           { "if": "ctx.event?.code == '14'",   "field": "event.dataset", "value": "registry_key_value_rename", "override": true }  },
+    { "set":           { "if": "ctx.event?.code == '15'",   "field": "event.dataset", "value": "file_create_stream_hash", "override": true }  },
+    { "set":           { "if": "ctx.event?.code == '16'",   "field": "event.dataset", "value": "config_change", "override": true }  },
+    { "set":           { "if": "ctx.event?.code == '22'",   "field": "event.dataset", "value": "dns_query", "override": true }  },
+    { "kv":            {"field":  "winlog.event_data.Hashes",  "target_field": "file.hash",    "field_split": ",",     "value_split": "=",     "ignore_missing": true } },
+    { "kv":            {"field":  "winlog.event_data.Hash",  "target_field": "file.hash",    "field_split": ",",     "value_split": "=",     "ignore_missing": true } },
+    { "rename":      { "field": "file.hash.IMPHASH", "target_field": "hash.imphash",	"ignore_missing":true } },
+    { "rename":      { "field": "file.hash.MD5", "target_field": "hash.md5",    "ignore_missing":true } },
+    { "rename":      { "field": "file.hash.SHA256", "target_field": "hash.sha256",    "ignore_missing":true } },
+    { "rename":      { "field": "winlog.event_data.SubjectUserName",	"target_field": "user.name",		"ignore_missing": true 	} },
+    { "rename":      { "field": "winlog.event_data.DestinationHostname",	"target_field": "destination.hostname",	"ignore_missing": true 	} },
+    { "rename":      { "field": "winlog.event_data.DestinationIp",	"target_field": "destination.ip",	"ignore_missing": true 	} },
+    { "rename":      { "field": "winlog.event_data.DestinationPort",	"target_field": "destination.port",	"ignore_missing": true 	} },
+    { "rename":      { "field": "winlog.event_data.image", 		"target_field": "process.executable",               "ignore_missing": true  } }, 
+    { "rename":      { "field": "winlog.event_data.Image", 		"target_field": "process.executable",		"ignore_missing": true 	} },
+    { "rename":      { "field": "winlog.event_data.processID",          "target_field": "process.pid",          "ignore_missing": true  } }, 
+    { "rename":      { "field": "winlog.event_data.ProcessId", 		"target_field": "process.pid",		"ignore_missing": true 	} },
+    { "rename":      { "field": "winlog.event_data.processGuid",        "target_field": "process.entity_id",              "ignore_missing": true  } },
+    { "rename":      { "field": "winlog.event_data.ProcessGuid", 	"target_field": "process.entity_id",		"ignore_missing": true 	} },
+    { "rename":      { "field": "winlog.event_data.commandLine",        "target_field": "process.command_line",           "ignore_missing": true  } },    
+    { "rename":      { "field": "winlog.event_data.CommandLine", 	"target_field": "process.command_line",		"ignore_missing": true 	} },
+    { "rename":      { "field": "winlog.event_data.currentDirectory",   "target_field": "process.working_directory",            "ignore_missing": true  } },
+    { "rename":      { "field": "winlog.event_data.CurrentDirectory", 	"target_field": "process.working_directory",		"ignore_missing": true 	} },
+    { "rename":      { "field": "winlog.event_data.description",        "target_field": "process.pe.description",         "ignore_missing": true  } },
+    { "rename":      { "field": "winlog.event_data.Description", 	"target_field": "process.pe.description",		"ignore_missing": true 	} },
+    { "rename":      { "field": "winlog.event_data.product",            "target_field": "process.pe.product",         "ignore_missing": true  } },
+    { "rename":      { "field": "winlog.event_data.Product", 		"target_field": "process.pe.product",		"ignore_missing": true 	} },
+    { "rename":      { "field": "winlog.event_data.company",            "target_field": "process.pe.company",         "ignore_missing": true  } }, 
+    { "rename":      { "field": "winlog.event_data.Company", 		"target_field": "process.pe.company",		"ignore_missing": true 	} },
+    { "rename":      { "field": "winlog.event_data.originalFileName",   "target_field": "process.pe.original_file_name",                "ignore_missing": true  } }, 
+    { "rename":      { "field": "winlog.event_data.OriginalFileName", 	"target_field": "process.pe.original_file_name",		"ignore_missing": true 	} },
+    { "rename":      { "field": "winlog.event_data.fileVersion",        "target_field": "process.pe.file_version",                "ignore_missing": true  } },
+    { "rename":      { "field": "winlog.event_data.FileVersion", 	"target_field": "process.pe.file_version",		"ignore_missing": true 	} },
+    { "rename":      { "field": "winlog.event_data.parentCommandLine",  "target_field": "process.parent.command_line",          "ignore_missing": true  } },
+    { "rename":      { "field": "winlog.event_data.ParentCommandLine", 	"target_field": "process.parent.command_line",		"ignore_missing": true 	} },
+    { "rename":      { "field": "winlog.event_data.parentImage",        "target_field": "process.parent.executable",              "ignore_missing": true  } },
+    { "rename":      { "field": "winlog.event_data.ParentImage", 	"target_field": "process.parent.executable",		"ignore_missing": true 	} },
+    { "rename":      { "field": "winlog.event_data.parentProcessGuid",  "target_field": "process.parent.entity_id",             "ignore_missing": true  } }, 
+    { "rename":      { "field": "winlog.event_data.ParentProcessGuid", 	"target_field": "process.parent.entity_id",		"ignore_missing": true 	} },
+    { "rename":      { "field": "winlog.event_data.parentProcessId",    "target_field": "process.ppid",               "ignore_missing": true  } },
+    { "rename":      { "field": "winlog.event_data.ParentProcessId", 	"target_field": "process.ppid",		"ignore_missing": true 	} },
+    { "rename":      { "field": "winlog.event_data.Protocol", 	        "target_field": "network.transport",	"ignore_missing": true 	} },
+    { "rename":      { "field": "winlog.event_data.User", 		"target_field": "user.name",		"ignore_missing": true 	} },
+    { "rename":      { "field": "winlog.event_data.SourceHostname", 	"target_field": "source.hostname",	"ignore_missing": true 	} },
+    { "rename":      { "field": "winlog.event_data.SourceIp", 		"target_field": "source.ip",		"ignore_missing": true 	} },
+    { "rename":      { "field": "winlog.event_data.SourcePort", 	"target_field": "source.port",		"ignore_missing": true 	} },   
+    { "rename":      { "field": "winlog.event_data.targetFilename",	"target_field": "file.target",	"ignore_missing": true 	} },
+    { "rename":      { "field": "winlog.event_data.TargetFilename",     "target_field": "file.target",    "ignore_missing": true  } },
+    { "rename":      { "field": "winlog.event_data.QueryResults",       "target_field": "dns.answers.name",    "ignore_missing": true  } },
+    { "rename":      { "field": "winlog.event_data.QueryName",          "target_field": "dns.query.name",    "ignore_missing": true  } },
+    { "remove":      { "field": "winlog.event_data.Hash",		"ignore_missing": true  } },
+    { "remove":      { "field": "winlog.event_data.Hashes",		"ignore_missing": true  } },
     { "community_id": {} }
   ]
 }

salt/elasticsearch/files/ingest/zeek.bacnet

@@ -0,0 +1,14 @@
+{
+  "description" : "zeek.bacnet",
+  "processors" : [
+    { "remove":         { "field": ["host"],								"ignore_failure": true	} },
+    { "json":		{ "field": "message",			"target_field": "message2",		"ignore_failure": true	} },
+    { "rename": 	{ "field": "message2.is_orig",		"target_field": "bacnet.is_orig",	"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.bvlc_function",	"target_field": "bacnet.bclv.function",	"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.pdu_type",		"target_field": "bacnet.pdu.type",	"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.pdu_service",	"target_field": "bacnet.pdu.service",	"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.invoke_id",	"target_field": "bacnet.invoke.id",	"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.result_code",	"target_field": "bacnet.result.code",	"ignore_missing": true 	} },
+    { "pipeline":       { "name": "zeek.common" } }
+  ]
+}

salt/elasticsearch/files/ingest/zeek.bacnet_discovery

@@ -0,0 +1,15 @@
+{
+  "description" : "zeek.bacnet_discovery",
+  "processors" : [
+    { "remove":         { "field": ["host"],									"ignore_failure": true	} },
+    { "json":		{ "field": "message",			"target_field": "message2",			"ignore_failure": true	} },
+    { "rename":         { "field": "message2.is_orig",		"target_field": "bacnet.is_orig",		"ignore_missing": true  } },
+    { "rename":         { "field": "message2.pdu_service",	"target_field": "bacnet.pdu.service",		"ignore_missing": true  } },
+    { "rename":         { "field": "message2.object_type",	"target_field": "bacnet.object.type",		"ignore_missing": true  } },
+    { "rename":         { "field": "message2.instance_number",	"target_field": "bacnet.instance.number",	"ignore_missing": true  } },
+    { "rename":         { "field": "message2.vendor",		"target_field": "bacnet.vendor",		"ignore_missing": true  } },
+    { "rename":         { "field": "message2.range",		"target_field": "bacnet.range",			"ignore_missing": true  } },
+    { "rename":         { "field": "message2.object_name",	"target_field": "bacnet.object.name",		"ignore_missing": true  } },
+    { "pipeline":       { "name": "zeek.common" } }
+  ]
+}

salt/elasticsearch/files/ingest/zeek.bacnet_property

@@ -0,0 +1,15 @@
+{
+  "description" : "zeek.bacnet_property",
+  "processors" : [
+    { "remove":         { "field": ["host"],									"ignore_failure": true	} },
+    { "json":           { "field": "message",			"target_field": "message2",			"ignore_failure": true  } },
+    { "rename":         { "field": "message2.is_orig",          "target_field": "bacnet.is_orig",         "ignore_missing": true  } },
+    { "rename":         { "field": "message2.instance_number",	"target_field": "bacnet.instance.number",	"ignore_missing": true  } },
+    { "rename":         { "field": "message2.pdu_service",	"target_field": "bacnet.pdu.service",		"ignore_missing": true  } },
+    { "rename":         { "field": "message2.object_type",	"target_field": "bacnet.object.type",		"ignore_missing": true  } },
+    { "rename":         { "field": "message2.property",		"target_field": "bacnet.property",		"ignore_missing": true  } },
+    { "rename":         { "field": "message2.array_index",	"target_field": "bacnet.array.index",		"ignore_missing": true  } },
+    { "rename":         { "field": "message2.value",		"target_field": "bacnet.value",			"ignore_missing": true  } },
+    { "pipeline":       { "name": "zeek.common" } }
+  ]
+}

salt/elasticsearch/files/ingest/zeek.bsap_ip_header

@@ -0,0 +1,10 @@
+{
+  "description" : "zeek.bsap_ip_header",
+  "processors" : [
+    { "remove":         { "field": ["host"],									"ignore_failure": true	} },
+    { "json":		{ "field": "message",			"target_field": "message2",			"ignore_failure": true	} },
+    { "rename": 	{ "field": "message2.num_msg",		"target_field": "bsap.number.messages",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.type_name",	"target_field": "bsap.message.type",		"ignore_missing": true 	} },
+    { "pipeline":       { "name": "zeek.common" } }
+  ]
+}

salt/elasticsearch/files/ingest/zeek.bsap_ip_rdb

@@ -0,0 +1,20 @@
+{
+  "description" : "zeek.bsap_ip_rdb",
+  "processors" : [
+    { "remove":         { "field": ["host"],										"ignore_failure": true	} },
+    { "json":		{ "field": "message",			"target_field": "message2",				"ignore_failure": true	} },
+    { "rename": 	{ "field": "message2.header_size",	"target_field": "bsap.header.length",			"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.mes_seq",		"target_field": "bsap.message.sequence",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.res_seq",		"target_field": "bsap.response.sequence",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.data_len",		"target_field": "bsap.data.length",			"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.sequence",		"target_field": "bsap.function.sequence",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.app_func_code",	"target_field": "bsap.application.function",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.node_status",	"target_field": "bsap.node.status",			"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.func_code",	"target_field": "bsap.application.sub_function",	"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.variable_count",	"target_field": "bsap.variable.count",			"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.variables",	"target_field": "bsap.vector.variables",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.variable_value",	"target_field": "bsap.vector.variable.value",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.value",		"target_field": "bsap.value",				"ignore_missing": true 	} },
+    { "pipeline":       { "name": "zeek.common" } }
+  ]
+}

salt/elasticsearch/files/ingest/zeek.bsap_ip_unknown

@@ -0,0 +1,9 @@
+{
+  "description" : "zeek.bsap_ip_unknown",
+  "processors" : [
+    { "remove":         { "field": ["host"],							"ignore_failure": true	} },
+    { "json":		{ "field": "message",		"target_field": "message2",		"ignore_failure": true	} },
+    { "rename": 	{ "field": "message2.data",	"target_field": "bsap.ip.unknown.data",	"ignore_missing": true 	} },
+    { "pipeline":       { "name": "zeek.common" } }
+  ]
+}

salt/elasticsearch/files/ingest/zeek.bsap_serial_header

@@ -0,0 +1,17 @@
+{
+  "description" : "zeek.bsap_serial_header",
+  "processors" : [
+    { "remove":         { "field": ["host"],									"ignore_failure": true	} },
+    { "json":		{ "field": "message",			"target_field": "message2",			"ignore_failure": true	} },
+    { "rename": 	{ "field": "message2.ser",		"target_field": "bsap.message.serial_number",	"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.dadd",		"target_field": "bsap.destination.address",	"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.sadd",		"target_field": "bsap.source.address",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.ctl",		"target_field": "bsap.control.byte",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.dfun",		"target_field": "bsap.destination.function",	"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.seq",		"target_field": "bsap.message.sequence",	"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.sfun",		"target_field": "bsap.source.function",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.nsb",		"target_field": "bsap.node.status_byte",	"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.type_name",	"target_field": "bsap.message.type",		"ignore_missing": true 	} },
+    { "pipeline":       { "name": "zeek.common" } }
+  ]
+}

salt/elasticsearch/files/ingest/zeek.bsap_serial_rdb

@@ -0,0 +1,11 @@
+{
+  "description" : "zeek.bsap_serial_rdb",
+  "processors" : [
+    { "remove":         { "field": ["host"],									"ignore_failure": true  } },
+    { "json":		{ "field": "message",			"target_field": "message2",			"ignore_failure": true	} },
+    { "rename": 	{ "field": "message2.func_code",	"target_field": "bsap.rdb.function",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.variables",	"target_field": "bsap.vector.variables",	"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.variable_value",	"target_field": "bsap.vector.value",		"ignore_missing": true 	} },
+    { "pipeline":       { "name": "zeek.common" } }
+  ]
+}

salt/elasticsearch/files/ingest/zeek.bsap_serial_rdb_ext

@@ -0,0 +1,13 @@
+{
+  "description" : "zeek.bsap_serial_rdb_ext",
+  "processors" : [
+    { "remove":         { "field": ["host"],								"ignore_failure": true  } },
+    { "json":		{ "field": "message",		"target_field": "message2",			"ignore_failure": true	} },
+    { "rename": 	{ "field": "message2.dfun",	"target_field": "bsap.destination.function",	"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.seq",	"target_field": "bsap.message_sequence",	"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.nsb",	"target_field": "bsap.node_status_byte",	"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.extfun",	"target_field": "bsap.extension.function",	"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.data",	"target_field": "bsap.extension.function_data",	"ignore_missing": true 	} },
+    { "pipeline":       { "name": "zeek.common" } }
+  ]
+}

salt/elasticsearch/files/ingest/zeek.bsap_serial_unknown

@@ -0,0 +1,9 @@
+{
+  "description" : "zeek.bsap_serial_unknown",
+  "processors" : [
+    { "remove":         { "field": ["host"],								"ignore_failure": true  } },
+    { "json":		{ "field": "message",		"target_field": "message2",			"ignore_failure": true	} },
+    { "rename": 	{ "field": "message2.data",	"target_field": "bsap.serial.unknown.data",	"ignore_missing": true 	} },
+    { "pipeline":       { "name": "zeek.common" } }
+  ]
+}

salt/elasticsearch/files/ingest/zeek.cip

@@ -0,0 +1,19 @@
+{
+  "description" : "zeek.cip",
+  "processors" : [
+    { "remove":         { "field": ["host"],											"ignore_failure": true	} },
+    { "json":		{ "field": "message",				"target_field": "message2",				"ignore_failure": true	} },
+    { "rename": 	{ "field": "message2.is_orig",			"target_field": "cip.is_orig",			        "ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.cip_sequence_count",	"target_field": "cip.sequence_count",			"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.direction",		"target_field": "cip.direction",			"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.cip_service_code",		"target_field": "cip.service_code",			"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.cip_service",		"target_field": "cip.service",				"ignore_missing": true 	} },
+    { "convert":	{ "field": "cip.service",			"type": "string",					"ignore_missing": true  } },
+    { "rename": 	{ "field": "message2.cip_status",		"target_field": "cip.status_code",			"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.class_id",			"target_field": "cip.request.path.class.id",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.class_name",		"target_field": "cip.request.path.class.name",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.instance_id",		"target_field": "cip.request.path.instance.id",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.attribute_id",		"target_field": "cip.request.path.attribute.id",	"ignore_missing": true 	} },
+    { "pipeline":       { "name": "zeek.common" } }
+  ]
+}

salt/elasticsearch/files/ingest/zeek.cip_identity

@@ -0,0 +1,21 @@
+{
+  "description" : "zeek.cip_identity",
+  "processors" : [
+    { "remove":         { "field": ["host"],										"ignore_failure": true	} },
+    { "json":		{ "field": "message",				"target_field": "message2",			"ignore_failure": true	} },
+    { "rename": 	{ "field": "message2.encapsulation_version",	"target_field": "cip.encapsulation.version",	"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.socket_address",		"target_field": "cip.socket.address",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.socket_port",		"target_field": "cip.socket.port",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.vendor_id",		"target_field": "cip.vendor.id",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.vendor_name",		"target_field": "cip.vendor.name",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.device_type_id",		"target_field": "cip.device.type.id",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.device_type_name",		"target_field": "cip.device.type.name",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.product_code",		"target_field": "cip.device.product.code",	"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.revision",			"target_field": "cip.device.revision",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.device_status",		"target_field": "cip.device.status",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.serial_number",		"target_field": "cip.device.serial_number",	"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.product_name",		"target_field": "cip.device.product.name",	"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.device_state",		"target_field": "cip.device.state",		"ignore_missing": true 	} },
+    { "pipeline":       { "name": "zeek.common" } }
+  ]
+}

salt/elasticsearch/files/ingest/zeek.cip_io

@@ -0,0 +1,13 @@
+{
+  "description" : "zeek.cip_io",
+  "processors" : [
+    { "remove":         { "field": ["host"],								"ignore_failure": true	} },
+    { "json":		{ "field": "message",			"target_field": "message2",		"ignore_failure": true	} },
+    { "rename": 	{ "field": "message2.is_orig",		"target_field": "cip.is_orig",	"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.connection_id",	"target_field": "cip.connection.id",	"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.sequence_number",	"target_field": "cip.sequence_number",	"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.data_length",	"target_field": "cip.data.length",	"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.io_data",		"target_field": "cip.io.data",		"ignore_missing": true 	} },
+    { "pipeline":       { "name": "zeek.common"	} }
+  ]
+}

salt/elasticsearch/files/ingest/zeek.conn

@@ -17,24 +17,25 @@
     { "rename": 	{ "field": "message2.orig_ip_bytes", 	"target_field": "client.ip_bytes",	"ignore_missing": true 	} },
     { "rename": 	{ "field": "message2.resp_pkts", 	"target_field": "server.packets",	"ignore_missing": true 	} },
     { "rename": 	{ "field": "message2.resp_ip_bytes", 	"target_field": "server.ip_bytes",	"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.orig_mac_oui", 	"target_field": "client.oui",	"ignore_missing": true 	} },
     { "rename": 	{ "field": "message2.tunnel_parents",	"target_field": "log.id.tunnel_parents",	"ignore_missing": true 	} },
     { "rename": 	{ "field": "message2.orig_cc", 		"target_field": "client.country_code","ignore_missing": true 	} },
     { "rename": 	{ "field": "message2.resp_cc", 		"target_field": "server.country_code",	"ignore_missing": true 	} },
     { "rename": 	{ "field": "message2.sensorname", 	"target_field": "observer.name",		"ignore_missing": true 	} },
     { "script":         { "lang": "painless", "source": "ctx.network.bytes = (ctx.client.bytes + ctx.server.bytes)", "ignore_failure": true } },
-    { "set": { "if": "ctx.connection.state == 'S0'",    "field": "connection.state_description", "value": "Connection attempt seen, no reply" } },
-    { "set": { "if": "ctx.connection.state == 'S1'",    "field": "connection.state_description", "value": "Connection established, not terminated" } },
-    { "set": { "if": "ctx.connection.state == 'S2'",    "field": "connection.state_description", "value": "Connection established and close attempt by originator seen (but no reply from responder)" } },
-    { "set": { "if": "ctx.connection.state == 'S3'",    "field": "connection.state_description", "value": "Connection established and close attempt by responder seen (but no reply from originator)" } },
-    { "set": { "if": "ctx.connection.state == 'SF'",    "field": "connection.state_description", "value": "Normal SYN/FIN completion" } },
-    { "set": { "if": "ctx.connection.state == 'REJ'",   "field": "connection.state_description", "value": "Connection attempt rejected" } },
-    { "set": { "if": "ctx.connection.state == 'RSTO'",  "field": "connection.state_description", "value": "Connection established, originator aborted (sent a RST)" } },
-    { "set": { "if": "ctx.connection.state == 'RSTR'",  "field": "connection.state_description", "value": "Established, responder aborted" } },
-    { "set": { "if": "ctx.connection.state == 'RSTOS0'","field": "connection.state_description", "value": "Originator sent a SYN followed by a RST, we never saw a SYN-ACK from the responder" } },
-    { "set": { "if": "ctx.connection.state == 'RSTRH'", "field": "connection.state_description", "value": "Responder sent a SYN ACK followed by a RST, we never saw a SYN from the (purported) originator" } },
-    { "set": { "if": "ctx.connection.state == 'SH'",    "field": "connection.state_description", "value": "Originator sent a SYN followed by a FIN, we never saw a SYN ACK from the responder (hence the connection was 'half' open)" } },
-    { "set": { "if": "ctx.connection.state == 'SHR'",   "field": "connection.state_description", "value": "Responder sent a SYN ACK followed by a FIN, we never saw a SYN from the originator" } },
-    { "set": { "if": "ctx.connection.state == 'OTH'",   "field": "connection.state_description", "value": "No SYN seen, just midstream traffic (a 'partial connection' that was not later closed)" } },
+    { "set": { "if": "ctx.connection?.state == 'S0'",    "field": "connection.state_description", "value": "Connection attempt seen, no reply" } },
+    { "set": { "if": "ctx.connection?.state == 'S1'",    "field": "connection.state_description", "value": "Connection established, not terminated" } },
+    { "set": { "if": "ctx.connection?.state == 'S2'",    "field": "connection.state_description", "value": "Connection established and close attempt by originator seen (but no reply from responder)" } },
+    { "set": { "if": "ctx.connection?.state == 'S3'",    "field": "connection.state_description", "value": "Connection established and close attempt by responder seen (but no reply from originator)" } },
+    { "set": { "if": "ctx.connection?.state == 'SF'",    "field": "connection.state_description", "value": "Normal SYN/FIN completion" } },
+    { "set": { "if": "ctx.connection?.state == 'REJ'",   "field": "connection.state_description", "value": "Connection attempt rejected" } },
+    { "set": { "if": "ctx.connection?.state == 'RSTO'",  "field": "connection.state_description", "value": "Connection established, originator aborted (sent a RST)" } },
+    { "set": { "if": "ctx.connection?.state == 'RSTR'",  "field": "connection.state_description", "value": "Established, responder aborted" } },
+    { "set": { "if": "ctx.connection?.state == 'RSTOS0'","field": "connection.state_description", "value": "Originator sent a SYN followed by a RST, we never saw a SYN-ACK from the responder" } },
+    { "set": { "if": "ctx.connection?.state == 'RSTRH'", "field": "connection.state_description", "value": "Responder sent a SYN ACK followed by a RST, we never saw a SYN from the (purported) originator" } },
+    { "set": { "if": "ctx.connection?.state == 'SH'",    "field": "connection.state_description", "value": "Originator sent a SYN followed by a FIN, we never saw a SYN ACK from the responder (hence the connection was 'half' open)" } },
+    { "set": { "if": "ctx.connection?.state == 'SHR'",   "field": "connection.state_description", "value": "Responder sent a SYN ACK followed by a FIN, we never saw a SYN from the originator" } },
+    { "set": { "if": "ctx.connection?.state == 'OTH'",   "field": "connection.state_description", "value": "No SYN seen, just midstream traffic (a 'partial connection' that was not later closed)" } },
     { "pipeline": 	{ "name": "zeek.common" } }
   ]
 }

salt/elasticsearch/files/ingest/zeek.cotp

@@ -0,0 +1,10 @@
+{
+  "description" : "zeek.cotp",
+  "processors" : [
+    { "remove":         { "field": ["host"],     "ignore_failure": true                                                                  } },
+    { "json":		{ "field": "message",			"target_field": "message2",		"ignore_failure": true	} },
+    { "rename": 	{ "field": "message2.pdu_code", 		"target_field": "cotp.pdu.code",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.pdu_name", 	"target_field": "cotp.pdu.name",		"ignore_missing": true 	} },
+    { "pipeline":       { "name": "zeek.common"                                                                                   } }
+  ]
+}

salt/elasticsearch/files/ingest/zeek.dnp3_control

@@ -0,0 +1,16 @@
+{
+  "description" : "zeek.dnp3_control",
+  "processors" : [
+    { "remove":         { "field": ["host"],     "ignore_failure": true                                                                  } },
+    { "json":		{ "field": "message",			"target_field": "message2",		        "ignore_failure": true	} },
+    { "rename":         { "field": "message2.block_type",       "target_field": "dnp3.block_type",              "ignore_missing": true  } },
+    { "rename": 	{ "field": "message2.function_code",	"target_field": "dnp3.function_code",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.index_number", 	"target_field": "dnp3.index_number",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.trip_control_code","target_field": "dnp3.trip_control_code",	"ignore_missing": true 	} },
+    { "rename":  	{ "field": "message2.operation_type",	"target_field": "dnp3.operation_type",  	"ignore_missing": true  } },
+    { "rename": 	{ "field": "message2.execute_count", 	"target_field": "dnp3.execute_count",  		"ignore_missing": true  } },
+    { "rename":         { "field": "message2.on_time",          "target_field": "dnp3.on_time",                 "ignore_missing": true  } },
+    { "rename":         { "field": "message2.off_time",         "target_field": "dnp3.off_time",                "ignore_missing": true  } },
+    { "pipeline":       { "name": "zeek.common"                                                                                   } }
+  ]
+}

salt/elasticsearch/files/ingest/zeek.dnp3_objects

@@ -0,0 +1,13 @@
+{
+  "description" : "zeek.dnp3_objects",
+  "processors" : [
+    { "remove":         { "field": ["host"],     "ignore_failure": true                                                                  } },
+    { "json":		{ "field": "message",			"target_field": "message2",		"ignore_failure": true	} },
+    { "rename": 	{ "field": "message2.function_code",	"target_field": "dnp3.function_code",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.object_type", 	"target_field": "dnp3.object_type",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.object_count", 	"target_field": "dnp3.object_count",		"ignore_missing": true 	} },
+    { "rename":  	{ "field": "message2.range_low",	"target_field": "dnp3.range_low",  		"ignore_missing": true  } },
+    { "rename": 	{ "field": "message2.range_high", 	"target_field": "dnp3.range_high",  		"ignore_missing": true  } },
+    { "pipeline":       { "name": "zeek.common"                                                                                   } }
+  ]
+}

salt/elasticsearch/files/ingest/zeek.ecat_aoe_info

@@ -0,0 +1,17 @@
+{
+  "description" : "zeek.ecat_aoe_info",
+  "processors" : [
+    { "remove":         { "field": ["host"],     "ignore_failure": true                                                                  } },
+    { "json":		{ "field": "message",			"target_field": "message2",		"ignore_failure": true	} },
+    { "rename": 	{ "field": "message2.targetid", 		"target_field": "destination.mac",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.targetport", 	"target_field": "destination.port",		"ignore_missing": true 	} },
+    { "convert":        { "field": "destination.port",       "type": "integer",                     "ignore_missing": true  } },
+    { "rename": 	{ "field": "message2.senderid", 		"target_field": "source.mac",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.senderport", 	"target_field": "source.port",		"ignore_missing": true 	} },
+    { "convert":        { "field": "source.port",       "type": "integer",                     "ignore_missing": true  } },
+    { "rename": 	{ "field": "message2.cmd", 		"target_field": "ecat.command",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.stateflags", 	"target_field": "ecat.state.flags",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.data", 		"target_field": "ecat.data",		"ignore_missing": true 	} },
+    { "pipeline":       { "name": "zeek.common"                                                                                   } }
+  ]
+}

salt/elasticsearch/files/ingest/zeek.ecat_arp_info

@@ -0,0 +1,15 @@
+{
+  "description" : "zeek.ecat_arp_info",
+  "processors" : [
+    { "remove":         { "field": ["host"],     "ignore_failure": true                                                                  } },
+    { "json":		{ "field": "message",			"target_field": "message2",		"ignore_failure": true	} },
+    { "rename": 	{ "field": "message2.arp_type", 		"target_field": "ecat.arp.type",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.mac_src", 	"target_field": "source.mac",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.mac_dst", 		"target_field": "destination.mac",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.SPA", 	"target_field": "source.ip",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.SHA", 		"target_field": "ecat.sender.hardware.address",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.TPA", 	"target_field": "destination.ip",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.THA", 		"target_field": "ecat.target.hardware.address",		"ignore_missing": true 	} },
+    { "pipeline":       { "name": "zeek.common"                                                                                   } }
+  ]
+}

salt/elasticsearch/files/ingest/zeek.ecat_coe_info

@@ -0,0 +1,14 @@
+{
+  "description" : "zeek.ecat_coe_info",
+  "processors" : [
+    { "remove":         { "field": ["host"],     "ignore_failure": true                                                                  } },
+    { "json":		{ "field": "message",			"target_field": "message2",		"ignore_failure": true	} },
+    { "rename": 	{ "field": "message2.number", 		"target_field": "ecat.message.number",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.Type", 	"target_field": "ecat.message.type",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.req_resp", 		"target_field": "ecat.request.response_type",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.index", 	"target_field": "ecat.index",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.subindex", 		"target_field": "ecat.sub.index",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.dataoffset", 	"target_field": "ecat.data_offset",		"ignore_missing": true 	} },
+    { "pipeline":       { "name": "zeek.common"                                                                                   } }
+  ]
+}

salt/elasticsearch/files/ingest/zeek.ecat_dev_info

@@ -0,0 +1,18 @@
+{
+  "description" : "zeek.ecat_dev_info",
+  "processors" : [
+    { "remove":         { "field": ["host"],     "ignore_failure": true                                                                  } },
+    { "json":		{ "field": "message",			"target_field": "message2",		          "ignore_failure": true	} },
+    { "rename": 	{ "field": "message2.slave_id",         "target_field": "ecat.slave.address",		  "ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.revision", 	"target_field": "ecat.revision",		  "ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.dev_type",         "target_field": "ecat.device.type",		  "ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.build", 	        "target_field": "ecat.build.version",		  "ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.fmmucnt", 		"target_field": "ecat.fieldbus.memory_mgmt_unit", "ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.smcount", 	        "target_field": "ecat.sync.manager_count",	  "ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.ports", 		"target_field": "ecat.port",		          "ignore_missing": true 	} },
+    { "convert":        { "field": "ecat.port",                 "type": "integer",                                "ignore_missing": true  } },
+    { "rename": 	{ "field": "message2.dpram", 	        "target_field": "ecat.ram.size",		  "ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.features", 	"target_field": "ecat.features",		"ignore_missing": true 	} },
+    { "pipeline":       { "name": "zeek.common"                                                                                   } }
+  ]
+}

salt/elasticsearch/files/ingest/zeek.ecat_foe_info

@@ -0,0 +1,14 @@
+{
+  "description" : "zeek.ecat_foe_info",
+  "processors" : [
+    { "remove":         { "field": ["host"],     "ignore_failure": true                                                                  } },
+    { "json":		{ "field": "message",			"target_field": "message2",		"ignore_failure": true	} },
+    { "rename": 	{ "field": "message2.opcode", 		"target_field": "ecat.operation.code",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.reserved", 	"target_field": "ecat.reserved",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.packet_num", 		"target_field": "ecat.packet_number",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.error_code", 	"target_field": "ecat.error_code",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.filename", 		"target_field": "ecat.filename",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.data", 		"target_field": "ecat.data",		"ignore_missing": true 	} },
+    { "pipeline":       { "name": "zeek.common"                                                                                   } }
+  ]
+}

salt/elasticsearch/files/ingest/zeek.ecat_log_address

@@ -0,0 +1,14 @@
+{
+  "description" : "zeek.ecat_log_address",
+  "processors" : [
+    { "remove":         { "field": ["host"],     "ignore_failure": true                                                                  } },
+    { "json":		{ "field": "message",			"target_field": "message2",		"ignore_failure": true	} },
+    { "rename": 	{ "field": "message2.srcmac", 		"target_field": "source.mac",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.dstmac", 	"target_field": "destination.mac",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.Log_Addr", 	"target_field": "ecat.log.address",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.Length", 		"target_field": "ecat.length",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.Command", 		"target_field": "ecat.command",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.data", 		"target_field": "ecat.data",		"ignore_missing": true 	} },
+    { "pipeline":       { "name": "zeek.common"                                                                                   } }
+  ]
+}

salt/elasticsearch/files/ingest/zeek.ecat_registers

@@ -0,0 +1,15 @@
+{
+  "description" : "zeek.ecat_registers",
+  "processors" : [
+    { "remove":         { "field": ["host"],     "ignore_failure": true                                                                  } },
+    { "json":		{ "field": "message",			"target_field": "message2",		"ignore_failure": true	} },
+    { "rename": 	{ "field": "message2.srcmac", 		"target_field": "source.mac",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.dstmac", 	"target_field": "destination.mac",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.Command", 		"target_field": "ecat.command",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.Slave_Addr", 	"target_field": "ecat.slave.address",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.Register_Type", 		"target_field": "ecat.register.type",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.Register_Addr", 	"target_field": "ecat.register.address",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.data", 		"target_field": "ecat.data",		"ignore_missing": true 	} },
+    { "pipeline":       { "name": "zeek.common"                                                                                   } }
+  ]
+}

salt/elasticsearch/files/ingest/zeek.ecat_soe_info

@@ -0,0 +1,14 @@
+{
+  "description" : "zeek.ecat_soe_info",
+  "processors" : [
+    { "remove":         { "field": ["host"],     "ignore_failure": true                                                                  } },
+    { "json":		{ "field": "message",			"target_field": "message2",		"ignore_failure": true	} },
+    { "rename": 	{ "field": "message2.opcode", 		"target_field": "ecat.operation.code",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.incomplete", 	"target_field": "ecat.function.check",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.error", 		"target_field": "ecat.error",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.drive_num", 	"target_field": "ecat.drive.number",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.element_flags", 		"target_field": "ecat.element.flags",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.index", 	"target_field": "ecat.index",		"ignore_missing": true 	} },
+    { "pipeline":       { "name": "zeek.common"                                                                                   } }
+  ]
+}

salt/elasticsearch/files/ingest/zeek.enip

@@ -0,0 +1,16 @@
+{
+  "description" : "zeek.enip",
+  "processors" : [
+    { "remove":         { "field": ["host"],     "ignore_failure": true                                                                  } },
+    { "json":		{ "field": "message",			"target_field": "message2",		"ignore_failure": true	} },
+    { "rename": 	{ "field": "message2.is_orig", 		"target_field": "enip.is_orig",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.enip_command_code", 	"target_field": "enip.command_code",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.enip_command", 		"target_field": "enip.command",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.length", 	"target_field": "enip.length",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.session_handle", 		"target_field": "enip.session.handle",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.enip_status", 	"target_field": "enip.status_code",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.sender_context", 		"target_field": "enip.sender.context",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.options", 		"target_field": "enip.options",		"ignore_missing": true 	} },
+    { "pipeline":       { "name": "zeek.common"                                                                                   } }
+  ]
+}

salt/elasticsearch/files/ingest/zeek.modbus_detailed

@@ -0,0 +1,14 @@
+{
+  "description" : "zeek.modbus_detailed",
+  "processors" : [
+    { "remove":         { "field": ["host"],     "ignore_failure": true                                                                  } },
+    { "json":		{ "field": "message",			"target_field": "message2",		"ignore_failure": true	} },
+    { "rename": 	{ "field": "message2.unit_id", 		"target_field": "modbus.unit_id",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.func", 		"target_field": "modbus.function",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.network_direction", "target_field": "modbus.network.direction",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.address",	        "target_field": "modbus.address",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.quality", 	        "target_field": "modbus.quality",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.values", 	"target_field": "modbus.values",		"ignore_missing": true 	} },
+    { "pipeline":       { "name": "zeek.common"                                                                                   } }
+  ]
+}

salt/elasticsearch/files/ingest/zeek.modbus_mask_write_register

@@ -0,0 +1,14 @@
+{
+  "description" : "zeek.modbus_mask_write_register",
+  "processors" : [
+    { "remove":         { "field": ["host"],     "ignore_failure": true                                                                  } },
+    { "json":		{ "field": "message",			 "target_field": "message2",		        "ignore_failure": true	} },
+    { "rename": 	{ "field": "message2.unit_id", 		 "target_field": "modbus.unit_id",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.func", 		 "target_field": "modbus.function",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.network_direction", "target_field": "modbus.network.direction",    "ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.address",	         "target_field": "modbus.address",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.and_mask",	         "target_field": "modbus.and_mask",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.or_mask", 	         "target_field": "modbus.or_mask",		"ignore_missing": true 	} },
+    { "pipeline":       { "name": "zeek.common"                                                                                   } }
+  ]
+}

salt/elasticsearch/files/ingest/zeek.modbus_read_write_multiple_registers

@@ -0,0 +1,16 @@
+{
+  "description" : "zeek.read_write_multiple_registers",
+  "processors" : [
+    { "remove":         { "field": ["host"],     "ignore_failure": true                                                                  } },
+    { "json":		{ "field": "message",			"target_field": "message2",		"ignore_failure": true	} },
+    { "rename": 	{ "field": "message2.unit_id", 		"target_field": "modbus.unit_id",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.func", 		"target_field": "modbus.function",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.network_direction", "target_field": "modbus.network.direction",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.write_start_address",	"target_field": "modbus.write.start.address",		"ignore_missing": true 	} },
+     { "rename":         { "field": "message2.write_registers",  "target_field": "modbus.write.registers",         "ignore_missing": true  } },
+     { "rename":         { "field": "message2.read_start_address",  "target_field": "modbus.read.start.address",         "ignore_missing": true  } },
+    { "rename": 	{ "field": "message2.read.quality", 	  "target_field": "modbus.read.quality",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.read_registers", 	"target_field": "modbus.read.registers",		"ignore_missing": true 	} },
+    { "pipeline":       { "name": "zeek.common"                                                                                   } }
+  ]
+}

salt/elasticsearch/files/ingest/zeek.opcua_binary

@@ -0,0 +1,32 @@
+{
+  "description" : "zeek.opcua_binary",
+  "processors" : [
+    { "remove":   { "field": ["host"],												"ignore_failure": true } },
+    { "json":     { "field": "message",					"target_field": "message2",				"ignore_failure": true } },
+    { "rename":   { "field": "message2.msg_type",			"target_field": "opcua.message_type",			"ignore_missing": true } },
+    { "rename":   { "field": "message2.is_final",			"target_field": "opcua.final",				"ignore_missing": true } },
+    { "rename":   { "field": "message2.msg_size",			"target_field": "opcua.message_size",			"ignore_missing": true } },
+    { "rename":   { "field": "message2.snd_buf_size",			"target_field": "opcua.sender.buffer_size",		"ignore_missing": true } },
+    { "rename":   { "field": "message2.seq_number",			"target_field": "opcua.sequence_number",		"ignore_missing": true } },
+    { "rename":   { "field": "message2.sec_channel_id",			"target_field": "opcua.secure_channel_id",		"ignore_missing": true } },
+    { "rename":   { "field": "message2.seq_number",			"target_field": "opcua.sequence_number",		"ignore_missing": true } },
+    { "rename":   { "field": "message2.opcua_link_id",			"target_field": "opcua.link_id",			"ignore_missing": true } },
+    { "rename":   { "field": "message2.request_id",			"target_field": "opcua.request_id",			"ignore_missing": true } },
+    { "rename":   { "field": "message2.namespace_idx",			"target_field": "opcua.namespace_index",		"ignore_missing": true } },
+    { "rename":   { "field": "message2.encoding_mask",			"target_field": "opcua.encoding_mask",			"ignore_missing": true } },
+    { "convert":  { "field": "opcua.encoding_mask", 			"type": "string",
+ "ignore_missing": true } },
+    { "rename":   { "field": "message2.identifier",			"target_field": "opcua.identifier",			"ignore_missing": true } },
+    { "rename":   { "field": "message2.identifier_str",			"target_field": "opcua.identifier_string",		"ignore_missing": true } },
+    { "rename":   { "field": "message2.req_hdr_node_id_type",		"target_field": "opcua.request.header.node.id_type",	"ignore_missing": true } },
+    { "rename":   { "field": "message2.req_hdr_node_id_numeric",	"target_field": "opcua.request.header.node.id_numeric",	"ignore_missing": true } },
+    { "rename":   { "field": "message2.req_hdr_timestamp",		"target_field": "opcua.request.header.timestamp",	"ignore_missing": true } },
+    { "rename":   { "field": "message2.req_hdr_request_handle",		"target_field": "opcua.request.handle",			"ignore_missing": true } },
+    { "rename":   { "field": "message2.req_hdr_return_diag",		"target_field": "opcua.request.header.return_diag",	"ignore_missing": true } },
+    { "rename":   { "field": "message2.req_hdr_audit_entry_id",		"target_field": "opcua.request.header.audit_entry_id",	"ignore_missing": true } },
+    { "rename":   { "field": "message2.req_hdr_timeout_hint",		"target_field": "opcua.request.header.timeout_hint",	"ignore_missing": true } },
+    { "rename":   { "field": "message2.req_hdr_add_hdr_type_id",	"target_field": "opcua.request.header.type_id",		"ignore_missing": true } },
+    { "rename":   { "field": "message2.req_hdr_add_hdr_enc_mask",	"target_field": "opcua.request.header.enc_mask",	"ignore_missing": true } },
+    { "pipeline": { "name": "zeek.common" } }
+  ]
+}

salt/elasticsearch/files/ingest/zeek.opcua_binary_activate_session

@@ -0,0 +1,19 @@
+{
+  "description" : "zeek.opcua_binary_activate_session",
+  "processors" : [
+    { "remove":   { "field": ["host"],                                                                                  "ignore_failure": true } },
+    { "json":     { "field": "message",			               "target_field": "message2",		        "ignore_failure": true} },
+    { "rename":   { "field": "message2.opcua_link_id",                 "target_field": "opcua.link_id",                 "ignore_missing": true } },
+    { "rename":   { "field": "message2.ext_obj_type_id_namespace_idx", "target_field": "opcua.namespace_index",         "ignore_missing": true } },
+    { "rename":   { "field": "message2.ext_obj_type_id_encoding_mask", "target_field": "opcua.encoding_mask",           "ignore_missing": true } },
+    { "convert":  { "field": "opcua.encoding_mask",                    "type": "string",                                "ignore_missing": true } },
+    { "rename":   { "field": "message2.ext_obj_type_id_numeric",       "target_field": "opcua.identifier_numeric",      "ignore_missing": true } },
+    { "rename":   { "field": "message2.ext_obj_type_id_str",           "target_field": "opcua.identifier_string",       "ignore_missing": true } },
+    { "rename":   { "field": "message2.ext_obj_encoding",              "target_field": "opcua.encoding",                "ignore_missing": true } },
+    { "rename":   { "field": "message2.ext_obj_policy_id",             "target_field": "opcua.policy_id",               "ignore_missing": true } },
+    { "rename":   { "field": "message2.ext_obj_user_name",             "target_field": "opcua.user_name",               "ignore_missing": true } }, 
+    { "rename":   { "field": "message2.ext_obj_password",              "target_field": "opcua.password",                "ignore_missing": true } },
+    { "rename":   { "field": "message2.server_nonce",                  "target_field": "opcua.server_nonce",            "ignore_missing": true } },
+    { "pipeline": { "name": "zeek.common" } }
+  ]
+}

salt/elasticsearch/files/ingest/zeek.opcua_binary_activate_session_client_software_cert

@@ -0,0 +1,11 @@
+{
+  "description" : "zeek.opcua_binary_activate_session_client_software_cert",
+  "processors" : [
+    { "remove":   { "field": ["host"],												"ignore_failure": true } },
+    { "json":     { "field": "message",					"target_field": "message2",				"ignore_failure": true } },
+    { "rename":   { "field": "message2.client_software_cert_link_id",	"target_field": "opcua.client_software_cert_link_id",	"ignore_missing": true } },
+    { "rename":   { "field": "message2.cert_data", 			"target_field": "opcua.certificate.data",		"ignore_missing": true } },
+    { "rename":   { "field": "message2.cert_signature",			"target_field": "opcua.certificate.signature",		"ignore_missing": true } },
+    { "pipeline": { "name": "zeek.common" } }
+  ]
+}

salt/elasticsearch/files/ingest/zeek.opcua_binary_activate_session_diagnostic_info

@@ -0,0 +1,10 @@
+{
+  "description" : "zeek.opcua_binary_activate_session_diagnostic_info",
+  "processors" : [
+    { "remove":   { "field": ["host"],														"ignore_failure": true } },
+    { "json":     { "field": "message",						"target_field": "message2",					"ignore_failure": true } },
+    { "rename":   { "field": "message2.activate_session_diag_info_link_id",	"target_field": "opcua.activate_session_diag_info_link_id",	"ignore_missing": true } },
+    { "rename":   { "field": "message2.diag_info_link_id",			"target_field": "opcua.diag_info_link_id",			"ignore_missing": true } },
+    { "pipeline": { "name": "zeek.common" } }
+  ]
+}

salt/elasticsearch/files/ingest/zeek.opcua_binary_activate_session_locale_id

@@ -0,0 +1,10 @@
+{
+  "description" : "zeek.opcua_binary_activate_session_locale_id",
+  "processors" : [
+    { "remove":   { "field": ["host"],									"ignore_failure": true } },
+    { "json":     { "field": "message",				"target_field": "message2",		"ignore_failure": true } },
+    { "rename":   { "field": "message2.opcua_locale_link_id",	"target_field": "opcua.locale_link_id",	"ignore_missing": true } },
+    { "rename":   { "field": "message2.local_id",		"target_field": "opcua.local_id",	"ignore_missing": true } },
+    { "pipeline": { "name": "zeek.common" } }
+  ]
+}

salt/elasticsearch/files/ingest/zeek.opcua_binary_browse

@@ -0,0 +1,18 @@
+{
+  "description" : "zeek.opcua_binary_browse",
+  "processors" : [
+    { "remove":   { "field": ["host"],													"ignore_failure": true } },
+    { "json":     { "field": "message",						"target_field": "message2",				"ignore_failure": true } },
+    { "rename":   { "field": "message2.opcua_link_id",				"target_field": "opcua.link_id",			"ignore_missing": true } },
+    { "rename":   { "field": "message2.browse_service_type",			"target_field": "opcua.service_type",			"ignore_missing": true } },
+    { "rename":   { "field": "message2.browse_view_id_encoding_mask",		"target_field": "opcua.encoding_mask",			"ignore_missing": true } },
+    { "convert":  { "field": "opcua.encoding_mask",                             "type": "string",
+         "ignore_missing": true } },
+    { "rename":   { "field": "message2.browse_view_id_numeric",			"target_field": "opcua.identifier_numeric",		"ignore_missing": true } },
+    { "rename":   { "field": "message2.browse_view_description_timestamp",	"target_field": "opcua.view_description_timestamp",	"ignore_missing": true } },
+    { "rename":   { "field": "message2.browse_view_description_view_version",	"target_field": "opcua.description_view_version",	"ignore_missing": true } },
+    { "rename":   { "field": "message2.browse_description_link_id",		"target_field": "opcua.description_link_id",		"ignore_missing": true } },
+    { "rename":   { "field": "message2.req_max_ref_nodes",			"target_field": "opcua.request.max_ref_nodes",		"ignore_missing": true } },  
+    { "pipeline": { "name": "zeek.common" } }
+  ]
+}

salt/elasticsearch/files/ingest/zeek.opcua_binary_browse_description

@@ -0,0 +1,17 @@
+{
+  "description" : "zeek.opcua_binary_browse_description",
+  "processors" : [
+    { "remove":   { "field": ["host"],														"ignore_failure": true } },
+    { "json":     { "field": "message",						"target_field": "message2",					"ignore_failure": true } },
+    { "rename":   { "field": "message2.browse_description_link_id",     	"target_field": "opcua.browse_description_link_id",		"ignore_missing": true } },
+    { "rename":   { "field": "message2.browse_description_encoding_mask",     	"target_field": "opcua.browse_description_encoding_mask",	"ignore_missing": true } },
+    { "rename":   { "field": "message2.browse_description_numeric",           	"target_field": "opcua.browse_description_numeric",		"ignore_missing": true } },
+    { "rename":   { "field": "message2.browse_direction",                     	"target_field": "opcua.browse_direction",			"ignore_missing": true } },
+    { "rename":   { "field": "message2.browse_description_ref_encoding_mask", 	"target_field": "opcua.browse_description_ref_encoding_mask",	"ignore_missing": true } },
+    { "rename":   { "field": "message2.browse_description_ref_numeric",       	"target_field": "opcua.browse_description_ref_numeric",		"ignore_missing": true } },
+    { "rename":   { "field": "message2.browse_description_include_subtypes",  	"target_field": "opcua.browse_description_include_subtypes",	"ignore_missing": true } },  
+    { "rename":   { "field": "message2.browse_node_class_mask",               	"target_field": "opcua.browse_node_class_mask",			"ignore_missing": true } },
+    { "rename":   { "field": "message2.browse_result_mask",                   	"target_field": "opcua.browse_result_mask",			"ignore_missing": true } },
+    { "pipeline": { "name": "zeek.common" } }
+  ]
+}

salt/elasticsearch/files/ingest/zeek.opcua_binary_browse_diagnostic_info

@@ -0,0 +1,10 @@
+{
+  "description" : "zeek.opcua_binary_browse_diagnostic_info",
+  "processors" : [
+    { "remove":   { "field": ["host"],													"ignore_failure": true } },
+    { "json":     { "field": "message",					"target_field": "message2",					"ignore_failure": true } },
+    { "rename":   { "field": "message2.browse_diag_info_link_id",	"target_field": "opcua.browse_session_diag_info_link_id",	"ignore_missing": true } },
+    { "rename":   { "field": "message2.diag_info_link_id", 		"target_field": "opcua.diag_info_link_id",			"ignore_missing": true } },
+    { "pipeline": { "name": "zeek.common" } }
+  ]
+}

salt/elasticsearch/files/ingest/zeek.opcua_binary_browse_request_continuation_point

@@ -0,0 +1,10 @@
+{
+  "description" : "zeek.opcua_binary_browse_request_continuation_point",
+  "processors" : [
+    { "remove":   { "field": ["host"],										"ignore_failure": true } },
+    { "json":     { "field": "message",				"target_field": "message2",			"ignore_failure": true } },
+    { "rename":   { "field": "message2.browse_next_link_id",	"target_field": "opcua.browse_next_link_id",	"ignore_missing": true } },
+    { "rename":   { "field": "message2.continuation_point", 	"target_field": "opcua.continuation_point",	"ignore_missing": true } },
+    { "pipeline": { "name": "zeek.common" } }
+  ]
+}

salt/elasticsearch/files/ingest/zeek.opcua_binary_browse_response_references

@@ -0,0 +1,22 @@
+{
+  "description" : "zeek.opcua_binary_browse_response_references",
+  "processors" : [
+    { "remove":   { "field": ["host"],													"ignore_failure": true } },
+    { "json":     { "field": "message",			                        "target_field": "message2",				"ignore_failure": true } },
+    { "rename":   { "field": "message2.browse_reference_link_id",               "target_field": "opcua.link_id",			"ignore_missing": true } },
+    { "rename":   { "field": "message2.browse_response_ref_encoding_mask",      "target_field": "opcua.reference_encoding_mask",	"ignore_missing": true } },
+    { "rename":   { "field": "message2.browse_response_ref_numeric",            "target_field": "opcua.reference_numeric",		"ignore_missing": true } },
+    { "rename":   { "field": "message2.browse_response_is_forward",             "target_field": "opcua.is_forward",			"ignore_missing": true } },
+    { "rename":   { "field": "message2.response_ref_type_encoding_mask",	"target_field": "opcua.reference_type_encoding_mask",	"ignore_missing": true } },
+    { "rename":   { "field": "message2.browse_response_ref_type_namespace_idx", "target_field": "opcua.namespace_index",		"ignore_missing": true } },
+    { "rename":   { "field": "message2.browse_response_ref_type_numeric",       "target_field": "opcua.reference_type_numeric",		"ignore_missing": true } },
+    { "rename":   { "field": "message2.browse_response_ref_name",               "target_field": "opcua.reference_name",			"ignore_missing": true } },
+    { "rename":   { "field": "message2.browse_response_display_name_mask",      "target_field": "opcua.display_name_mask",		"ignore_missing": true } },
+    { "rename":   { "field": "message2.browse_response_display_name_locale",    "target_field": "opcua.display_name_local",		"ignore_missing": true } },
+    { "rename":   { "field": "message2.browse_response_display_name_text",      "target_field": "opcua.display_name_text",		"ignore_missing": true } },
+    { "rename":   { "field": "message2.browse_response_node_class",             "target_field": "opcua.node_class",			"ignore_missing": true } }, 
+    { "rename":   { "field": "message2.browse_response_type_def_encoding_mask",	"target_field": "opcua.type_def_encoding_mask",		"ignore_missing": true } },
+    { "rename":   { "field": "message2.browse_response_type_def_numeric",	"target_field": "opcua.type_def_numeric",		"ignore_missing": true } },
+    { "pipeline": { "name": "zeek.common" } }
+  ]
+}

salt/elasticsearch/files/ingest/zeek.opcua_binary_browse_result

@@ -0,0 +1,11 @@
+{
+  "description" : "zeek.opcua_binary_browse_result",
+  "processors" : [
+    { "remove":   { "field": ["host"],											"ignore_failure": true } },
+    { "json":     { "field": "message",					"target_field": "message2",			"ignore_failure": true } },
+    { "rename":   { "field": "message2.browse_response_link_id",	"target_field": "opcua.response_link_id",	"ignore_missing": true } },
+    { "rename":   { "field": "message2.browse_reference_link_id",	"target_field": "opcua.reference_link_id",	"ignore_missing": true } },
+    { "rename":   { "field": "message2.status_code_link_id",		"target_field": "opcua.status_code_link_id",	"ignore_missing": true } },
+    { "pipeline": { "name": "zeek.common" } }
+  ]
+}

salt/elasticsearch/files/ingest/zeek.opcua_binary_create_session

@@ -0,0 +1,19 @@
+{
+  "description" : "zeek.opcua_binary_create_session",
+  "processors" : [
+    { "remove":   { "field": ["host"],                                                                                      "ignore_failure": true } },
+    { "json":     { "field": "message",			            "target_field": "message2",		                    "ignore_failure": true} },
+    { "rename":   { "field": "message2.opcua_link_id",              "target_field": "opcua.link_id",                        "ignore_missing": true } },
+    { "rename":   { "field": "message2.session_id_encoding_mask",   "target_field": "opcua.session_id_encoding_mask",       "ignore_missing": true } },
+    { "rename":   { "field": "message2.session_id_namespace_idx",   "target_field": "opcua.session_id_namespace_index",     "ignore_missing": true } },
+    { "rename":   { "field": "message2.session_id_guid",            "target_field": "opcua.session_id_guid",                "ignore_missing": true } },
+    { "rename":   { "field": "message2.auth_token_encoding_mask",   "target_field": "opcua.auth_token_encoding_mask",       "ignore_missing": true } },
+    { "rename":   { "field": "message2.auth_token_namespace_idx",   "target_field": "opcua.auth_token_namespace_index",     "ignore_missing": true } },
+    { "rename":   { "field": "message2.auth_token_guid",            "target_field": "opcua.auth_token_guid",                "ignore_missing": true } },
+    { "rename":   { "field": "message2.revised_session_timeout",    "target_field": "opcua.revised_session_timeout",        "ignore_missing": true } },
+    { "rename":   { "field": "message2.server_nonce",               "target_field": "opcua.server_nonce",                   "ignore_missing": true } },
+    { "rename":   { "field": "message2.endpoint_link_id",           "target_field": "opcua.endpoint_link_id",               "ignore_missing": true } },
+    { "rename":   { "field": "message2.max_req_msg_size",           "target_field": "opcua.request.max_message_size",       "ignore_missing": true } },
+    { "pipeline": { "name": "zeek.common" } }
+  ]
+}

salt/elasticsearch/files/ingest/zeek.opcua_binary_create_session_discovery

@@ -0,0 +1,11 @@
+{
+  "description" : "zeek.opcua_binary_create_session_discovery",
+  "processors" : [
+    { "remove":   { "field": ["host"],												"ignore_failure": true } },
+    { "json":     { "field": "message",					"target_field": "message2",				"ignore_failure": true } },
+    { "rename":   { "field": "message2.discovery_profile_link_id",	"target_field": "opcua.discovery_profile_link_id",	"ignore_missing": true } },
+    { "rename":   { "field": "message2.discovery_profile_uri", 		"target_field": "opcua.discovery_profile_uri",		"ignore_missing": true } },
+    { "rename":   { "field": "message2.discovery_profile_url", 		"target_field": "opcua.discovery_profile_url",		"ignore_missing": true } },
+    { "pipeline": { "name": "zeek.common" } }
+  ]
+}

salt/elasticsearch/files/ingest/zeek.opcua_binary_create_session_endpoints

@@ -0,0 +1,22 @@
+{
+  "description" : "zeek.opcua_binary_create_session_endpoints",
+  "processors" : [
+    { "remove":   { "field": ["host"],										"ignore_failure": true } },
+    { "json":     { "field": "message",				"target_field": "message2",			"ignore_failure": true } },
+    { "rename":   { "field": "message2.endpoint_link_id",	"target_field": "opcua.endpoint_link_id",	"ignore_missing": true } },
+    { "rename":   { "field": "message2.endpoint_url",		"target_field": "opcua.endpoint_url",		"ignore_missing": true } },
+    { "rename":   { "field": "message2.application_uri",	"target_field": "opcua.application_uri",	"ignore_missing": true } },
+    { "rename":   { "field": "message2.product_uri",		"target_field": "opcua.product_uri",		"ignore_missing": true } },
+    { "rename":   { "field": "message2.encoding_mask",		"target_field": "opcua.encoding_mask",		"ignore_missing": true } },
+    { "convert":  { "field": "opcua.encoding_mask",             "type": "string",                               "ignore_missing": true } },
+    { "rename":   { "field": "message2.locale",			"target_field": "opcua.locale",			"ignore_missing": true } },
+    { "rename":   { "field": "message2.text",			"target_field": "opcua.text",			"ignore_missing": true } },
+    { "rename":   { "field": "message2.application_type",	"target_field": "opcua.application_type",	"ignore_missing": true } },
+    { "rename":   { "field": "message2.message_security_mode",	"target_field": "opcua.message_security_mode",	"ignore_missing": true } },
+    { "rename":   { "field": "message2.security_policy_uri",	"target_field": "opcua.security_policy_uri",	"ignore_missing": true } },
+    { "rename":   { "field": "message2.user_token_link_id",	"target_field": "opcua.user_token_link_id",	"ignore_missing": true } },
+    { "rename":   { "field": "message2.transport_profile_uri",	"target_field": "opcua.transport_profile_uri",	"ignore_missing": true } },
+    { "rename":   { "field": "message2.security_level",		"target_field": "opcua.security_level",		"ignore_missing": true } },
+    { "pipeline": { "name": "zeek.common" } }
+  ]
+}

salt/elasticsearch/files/ingest/zeek.opcua_binary_create_session_user_token

@@ -0,0 +1,11 @@
+{
+  "description" : "zeek.opcua_binary_create_session_user_token",
+  "processors" : [
+    { "remove":   { "field": ["host"],										"ignore_failure": true } },
+    { "json":     { "field": "message",				"target_field": "message2",			"ignore_failure": true } },
+    { "rename":   { "field": "message2.user_token_link_id",	"target_field": "opcua.user_token_link_id",	"ignore_missing": true } },
+    { "rename":   { "field": "message2.user_token_link_id",	"target_field": "opcua.user_token_policy_id",	"ignore_missing": true } },
+    { "rename":   { "field": "message2.user_token_link_id",	"target_field": "opcua.user_token_type",	"ignore_missing": true } },
+    { "pipeline": { "name": "zeek.common" } }
+  ]
+}

salt/elasticsearch/files/ingest/zeek.opcua_binary_create_subscription

@@ -0,0 +1,15 @@
+{
+  "description" : "zeek.opcua_binary_create_subscription",
+  "processors" : [
+    { "remove":   { "field": ["host"],                                                                                              "ignore_failure": true } },
+    { "json":     { "field": "message",			                 "target_field": "message2",		                    "ignore_failure": true } },
+    { "rename":   { "field": "message2.opcua_link_id",                   "target_field": "opcua.link_id",                           "ignore_missing": true } },
+    { "rename":   { "field": "message2.requested_publishing_interval",   "target_field": "opcua.publish_interval",                  "ignore_missing": true } },
+    { "rename":   { "field": "message2.requested_lifetime_count",        "target_field": "opcua.lifetime_count",                    "ignore_missing": true } },
+    { "rename":   { "field": "message2.requested_max_keep_alive_count",  "target_field": "opcua.max_keepalive",                     "ignore_missing": true } },
+    { "rename":   { "field": "message2.max_notifications_per_publish",   "target_field": "opcua.max_notifications",                 "ignore_missing": true } },
+    { "rename":   { "field": "message2.publishing_enabled",              "target_field": "opcua.publish_enabled",                   "ignore_missing": true } },
+    { "rename":   { "field": "message2.priority",                        "target_field": "opcua.priority",                          "ignore_missing": true } },
+    { "pipeline": { "name": "zeek.common" } }
+  ]
+}

salt/elasticsearch/files/ingest/zeek.opcua_binary_diag_info_detail

@@ -0,0 +1,21 @@
+{
+  "description" : "zeek.opcua_binary_diag_info_detail",
+  "processors" : [
+    { "remove":   { "field": ["host"],										"ignore_failure": true } },
+    { "json":     { "field": "message",				"target_field": "message2",			"ignore_failure": true } },
+    { "rename":   { "field": "message2.diag_info_link_id",	"target_field": "opcua.diag_info_link_id",	"ignore_missing": true } },
+    { "rename":   { "field": "message2.source", 		"target_field": "opcua.source",			"ignore_missing": true } },
+    { "rename":   { "field": "message2.source_str", 		"target_field": "opcua.source_string",		"ignore_missing": true } },
+    { "rename":   { "field": "message2.inner_diag_level",	"target_field": "opcua.inner_diag_level",	"ignore_missing": true } },
+    { "rename":   { "field": "message2.has_symbolic_id",	"target_field": "opcua.has_symbolic_id",	"ignore_missing": true } },
+    { "rename":   { "field": "message2.has_namespace_uri",	"target_field": "opcua.has_namespace_uri",	"ignore_missing": true } },
+    { "rename":   { "field": "message2.has_locale",		"target_field": "opcua.has_locale",		"ignore_missing": true } },
+    { "rename":   { "field": "message2.has_locale_txt",		"target_field": "opcua.has_locale_txt",		"ignore_missing": true } },
+    { "rename":   { "field": "message2.has_addl_info",		"target_field": "opcua.has_addl_info",		"ignore_missing": true } },
+    { "rename":   { "field": "message2.addl_info",		"target_field": "opcua.addl_info",		"ignore_missing": true } },
+    { "rename":   { "field": "message2.has_inner_stat_code",	"target_field": "opcua.has_inner_stat_code",	"ignore_missing": true } },
+    { "rename":   { "field": "message2.inner_stat_code",	"target_field": "opcua.inner_stat_code",	"ignore_missing": true } },
+    { "rename":   { "field": "message2.has_inner_diag_info",	"target_field": "opcua.has_inner_diag_info",	"ignore_missing": true } },
+    { "pipeline": { "name": "zeek.common" } }
+  ]
+}

salt/elasticsearch/files/ingest/zeek.opcua_binary_get_endpoints

@@ -0,0 +1,10 @@
+{
+  "description" : "zeek.opcua_binary_get_endpoints",
+  "processors" : [
+    { "remove":   { "field": ["host"],								"ignore_failure": true } },
+    { "json":     { "field": "message",			"target_field": "message2",		"ignore_failure": true } },
+    { "rename":   { "field": "message2.opcua_link_id",	"target_field": "opcua.link_id",	"ignore_missing": true } },
+    { "rename":   { "field": "message2.endpoint_url",	"target_field": "opcua.endpoint_url",	"ignore_missing": true } },
+    { "pipeline": { "name": "zeek.common" } }
+  ]
+}

salt/elasticsearch/files/ingest/zeek.opcua_binary_get_endpoints_description

@@ -0,0 +1,23 @@
+{
+  "description" : "zeek.opcua_binary_get_endpoints_description",
+  "processors" : [
+    { "remove":   { "field": ["host"],												"ignore_failure": true } },
+    { "json":     { "field": "message",					"target_field": "message2",				"ignore_failure": true } },
+    { "rename":   { "field": "message2.endpoint_description_link_id",	"target_field": "opcua.endpoint_description_link_id",	"ignore_missing": true } },
+    { "rename":   { "field": "message2.application_uri",		"target_field": "opcua.application_uri",		"ignore_missing": true } },
+    { "rename":   { "field": "message2.endpoint_uri",			"target_field": "opcua.endpoint_uri",			"ignore_missing": true } },
+    { "rename":   { "field": "message2.product_uri",			"target_field": "opcua.product_uri",			"ignore_missing": true } },
+    { "rename":   { "field": "message2.encoding_mask",			"target_field": "opcua.encoding_mask",			"ignore_missing": true } },
+    { "convert":  { "field": "opcua.encoding_mask",                     "type": "string",
+ "ignore_missing": true } },
+    { "rename":   { "field": "message2.locale",				"target_field": "opcua.locale",				"ignore_missing": true } },
+    { "rename":   { "field": "message2.text",				"target_field": "opcua.text",				"ignore_missing": true } },
+    { "rename":   { "field": "message2.application_type",		"target_field": "opcua.application_type",		"ignore_missing": true } },
+    { "rename":   { "field": "message2.message_security_mode",		"target_field": "opcua.message_security_mode",		"ignore_missing": true } },
+    { "rename":   { "field": "message2.security_policy_uri",		"target_field": "opcua.security_policy_uri",		"ignore_missing": true } },
+    { "rename":   { "field": "message2.user_token_link_id",		"target_field": "opcua.user_token_link_id",		"ignore_missing": true } },
+    { "rename":   { "field": "message2.transport_profile_uri",		"target_field": "opcua.transport_profile_uri",		"ignore_missing": true } },
+    { "rename":   { "field": "message2.security_level",			"target_field": "opcua.security_level",			"ignore_missing": true } },
+    { "pipeline": { "name": "zeek.common" } }
+  ]
+}

salt/elasticsearch/files/ingest/zeek.opcua_binary_get_endpoints_discovery

@@ -0,0 +1,10 @@
+{
+  "description" : "zeek.opcua_binary_get_endpoints_discovery",
+  "processors" : [
+    { "remove":   { "field": ["host"],												"ignore_failure": true } },
+    { "json":     { "field": "message",					"target_field": "message2",				"ignore_failure": true } },
+    { "rename":   { "field": "message2.discovery_profile_link_id",	"target_field": "opcua.discovery_profile_link_id",	"ignore_missing": true } },
+    { "rename":   { "field": "message2.discovery_profile_url", 		"target_field": "opcua.discovery_profile_url",		"ignore_missing": true } },
+    { "pipeline": { "name": "zeek.common" } }
+  ]
+}

salt/elasticsearch/files/ingest/zeek.opcua_binary_get_endpoints_locale_id

@@ -0,0 +1,10 @@
+{
+  "description" : "zeek.opcua_binary_get_endpoints_locale_id",
+  "processors" : [
+    { "remove":   { "field": ["host"],									"ignore_failure": true } },
+    { "json":     { "field": "message",				"target_field": "message2",		"ignore_failure": true } },
+    { "rename":   { "field": "message2.opcua_locale_link_id",	"target_field": "opcua.locale_link_id",	"ignore_missing": true } },
+    { "rename":   { "field": "message2.local_id", 		"target_field": "opcua.local_id",	"ignore_missing": true } },
+    { "pipeline": { "name": "zeek.common" } }
+  ]
+}

salt/elasticsearch/files/ingest/zeek.opcua_binary_get_endpoints_profile_uri

@@ -0,0 +1,10 @@
+{
+  "description" : "zeek.opcua_binary_get_endpoints_profile_uri",
+  "processors" : [
+    { "remove":   { "field": ["host"],										"ignore_failure": true } },
+    { "json":     { "field": "message",				"target_field": "message2",			"ignore_failure": true } },
+    { "rename":   { "field": "message2.profile_uri_link_id",	"target_field": "opcua.profile_uri_link_id",	"ignore_missing": true } },
+    { "rename":   { "field": "message2.profile_uri",		"target_field": "opcua.profile_uri",		"ignore_missing": true } },
+    { "pipeline": { "name": "zeek.common" } }
+  ]
+}

salt/elasticsearch/files/ingest/zeek.opcua_binary_get_endpoints_user_token

@@ -0,0 +1,11 @@
+{
+  "description" : "zeek.opcua_binary_get_endpoints_user_token",
+  "processors" : [
+    { "remove":   { "field": ["host"],                                                                                                         "ignore_failure": true } },
+    { "json":     { "field": "message",			                 "target_field": "message2",		                               "ignore_failure": true } },
+    { "rename":   { "field": "message2.user_token_link_id", 	         "target_field": "opcua.user_token_link_id",		               "ignore_missing": true } },
+    { "rename":   { "field": "message2.user_token_type",                 "target_field": "opcua.user_token_type",                              "ignore_missing": true } },
+    { "rename":   { "field": "message2.user_token_sec_policy_uri",       "target_field": "opcua.user_token_security_policy_uri",               "ignore_missing": true } },
+    { "pipeline": { "name": "zeek.common" } }
+  ]
+}

salt/elasticsearch/files/ingest/zeek.opcua_binary_opensecure_channel

@@ -0,0 +1,15 @@
+{
+  "description" : "zeek.opcua_binary_opensecure_channel",
+  "processors" : [
+    { "remove":   { "field": ["host"],												"ignore_failure": true } },
+    { "json":     { "field": "message",					"target_field": "message2",				"ignore_failure": true } },
+    { "rename":   { "field": "message2.opcua_link_id",			"target_field": "opcua.link_id",			"ignore_missing": true } },
+    { "rename":   { "field": "message2.server_proto_ver",		"target_field": "opcua.server_proto_ver",		"ignore_missing": true } },
+    { "rename":   { "field": "message2.sec_token_sec_channel_id",	"target_field": "opcua.sec_token_sec_channel_id",	"ignore_missing": true } },
+    { "rename":   { "field": "message2.sec_token_id",			"target_field": "opcua.sec_token_id",			"ignore_missing": true } },
+    { "rename":   { "field": "message2.sec_token_created_at",		"target_field": "opcua.sec_token_created_at",		"ignore_missing": true } },
+    { "rename":   { "field": "message2.sec_token_revised_time",		"target_field": "opcua.sec_token_revised_time",		"ignore_missing": true } },
+    { "rename":   { "field": "message2.server_nonce",			"target_field": "opcua.server_nonce",			"ignore_missing": true } },
+    { "pipeline": { "name": "zeek.common" } }
+  ]
+}

salt/elasticsearch/files/ingest/zeek.opcua_binary_read

@@ -0,0 +1,10 @@
+{
+  "description" : "zeek.opcua_binary_read",
+  "processors" : [
+    { "remove":   { "field": ["host"],										"ignore_failure": true } },
+    { "json":     { "field": "message",				"target_field": "message2",			"ignore_failure": true } },
+    { "rename":   { "field": "message2.opcua_link_id",		"target_field": "opcua.link_id",		"ignore_missing": true } },
+    { "rename":   { "field": "message2.read_results_link_id",	"target_field": "opcua.read_results_link_id",	"ignore_missing": true } },
+    { "pipeline": { "name": "zeek.common" } }
+  ]
+}

salt/elasticsearch/files/ingest/zeek.opcua_binary_read_array_dims

@@ -0,0 +1,10 @@
+{
+  "description" : "zeek.opcua_binary_read_array_dims",
+  "processors" : [
+    { "remove":   { "field": ["host"],										"ignore_failure": true } },
+    { "json":     { "field": "message",				"target_field": "message2",			"ignore_failure": true } },
+    { "rename":   { "field": "message2.array_dim_link_id",	"target_field": "opcua.array_dim_link_id",	"ignore_missing": true } },
+    { "rename":   { "field": "message2.dimension",		"target_field": "opcua.dimension",		"ignore_missing": true } },
+    { "pipeline": { "name": "zeek.common" } }
+  ]
+}

salt/elasticsearch/files/ingest/zeek.opcua_binary_read_array_dims_link

@@ -0,0 +1,10 @@
+{
+  "description" : "zeek.opcua_binary_read_array_dims_link",
+  "processors" : [
+    { "remove":   { "field": ["host"],												"ignore_failure": true } },
+    { "json":     { "field": "message",					"target_field": "message2",				"ignore_failure": true } },
+    { "rename":   { "field": "message2.variant_data_array_dim_link_id",	"target_field": "opcua.variant_data_array_dim_link_id",	"ignore_missing": true } },
+    { "rename":   { "field": "message2.array_dim_link_id",		"target_field": "opcua.array_dim_link_id",		"ignore_missing": true } },
+    { "pipeline": { "name": "zeek.common" } }
+  ]
+}

salt/elasticsearch/files/ingest/zeek.opcua_binary_read_diagnostic_info

@@ -0,0 +1,10 @@
+{
+  "description" : "zeek.opcua_binary_read_diagnostic_info",
+  "processors" : [
+    { "remove":   { "field": ["host"],										"ignore_failure": true } },
+    { "json":     { "field": "message",				"target_field": "message2",			"ignore_failure": true } },
+    { "rename":   { "field": "message2.read_diag_info_link_id",	"target_field": "opcua.read_diag_info_link_id",	"ignore_missing": true } },
+    { "rename":   { "field": "message2.diag_info_link_id",	"target_field": "opcua.diag_info_link_id",	"ignore_missing": true } },
+    { "pipeline": { "name": "zeek.common" } }
+  ]
+}

salt/elasticsearch/files/ingest/zeek.opcua_binary_read_extension_object

@@ -0,0 +1,14 @@
+{
+  "description" : "zeek.opcua_binary_read_extension_object",
+  "processors" : [
+    { "remove":   { "field": ["host"],													"ignore_failure": true } },
+    { "json":     { "field": "message",					"target_field": "message2",					"ignore_failure": true } },
+    { "rename":   { "field": "message2.ext_obj_link_id",		"target_field": "opcua.ext_obj_link_id",			"ignore_missing": true } },
+    { "rename":   { "field": "message2.ext_obj_node_id_encoding_mask",	"target_field": "opcua.ext_obj_node_id_encoding_mask",		"ignore_missing": true } },
+    { "rename":   { "field": "message2.ext_obj_node_id_namespace_idx",	"target_field": "opcua.ext_obj_node_id_namespace_index",	"ignore_missing": true } },
+    { "rename":   { "field": "message2.ext_obj_node_id_numeric",	"target_field": "opcua.ext_obj_node_id_numeric",		"ignore_missing": true } },
+    { "rename":   { "field": "message2.ext_obj_type_id_str",		"target_field": "opcua.ext_obj_type_id_string",			"ignore_missing": true } },
+    { "rename":   { "field": "message2.ext_obj_encoding",		"target_field": "opcua.ext_obj_encoding",			"ignore_missing": true } },
+    { "pipeline": { "name": "zeek.common" } }
+  ]
+}