{
  "description" : "common_nids",
  "processors" : [
    { "convert": 	{ "field": "sid", 			"type": "integer" 										} },
    { "set": 		{ "if": "ctx.sid < 1000000",		"field": "signature_info", "value": "https://www.snort.org/search?query={{gid}}-{{sid}}"	} },
    { "set": 		{ "if": "ctx.sid > 1999999",		"field": "signature_info", "value": "https://doc.emergingthreats.net/{{sid}}"			} },
    { "remove":		{ "if": "ctx.sid > 2999999",		"field": "signature_info" 									} },
    { "set": 		{ "if": "ctx.priority == '1'",		"field": "severity", "value": "High"	 							} },
    { "set": 		{ "if": "ctx.priority == '2'",		"field": "severity", "value": "Medium" 								} },
    { "set": 		{ "if": "ctx.priority == '3'",		"field": "severity", "value": "Low" 								} },
    { "dissect": 	{ "field": "alert",			"pattern" : "%{rule_type} %{category} ",				"ignore_failure": true 	} },
    { "set": 		{ "if": "ctx.rule_type == 'GPL'",	"field": "rule_type", "value": "Snort GPL"							} },
    { "set": 		{ "if": "ctx.rule_type == 'ET'",	"field": "rule_type", "value": "Emerging Threats"						} },
    { "lowercase": 	{ "field": "category",												"ignore_failure": true	} },
    { "pipeline":       { "name": "common"															} }
  ]
}