securityonion/salt/elasticsearch/files/ingest/kismet.ap

{
  "processors": [
    {
      "rename": {
        "field": "message2.dot11_device.dot11_device_last_beaconed_ssid_record.dot11_advertisedssid_cloaked",
        "target_field": "wireless.ssid_cloaked",
        "if": "ctx?.message2?.dot11_device?.dot11_device_last_beaconed_ssid_record?.dot11_advertisedssid_cloaked != null"
      }
    },
    {
      "rename": {
        "field": "message2.dot11_device.dot11_device_last_beaconed_ssid_record.dot11_advertisedssid_ssid",
        "target_field": "wireless.ssid",
        "if": "ctx?.message2?.dot11_device?.dot11_device_last_beaconed_ssid_record?.dot11_advertisedssid_ssid != null"
      }
    },
    {
      "set": {
        "field": "wireless.ssid",
        "value": "Hidden",
        "if": "ctx?.wireless?.ssid_cloaked != null && ctx?.wireless?.ssid_cloaked == 1"
      }
    },
    {
      "rename": {
        "field": "message2.dot11_device.dot11_device_last_beaconed_ssid_record.dot11_advertisedssid_dot11e_channel_utilization_perc",
        "target_field": "wireless.channel_utilization",
        "if": "ctx?.message2?.dot11_device?.dot11_device_last_beaconed_ssid_record?.dot11_advertisedssid_dot11e_channel_utilization_perc != null"
      }
    },
    {
      "rename": {
        "field": "message2.dot11_device.dot11_device_last_bssid",
        "target_field": "wireless.bssid"
      }
    },
    {
      "foreach": {
        "field": "message2.dot11_device.dot11_device_associated_client_map",
        "processor": {
          "append": {
            "field": "wireless.associated_clients",
            "value": "{{_ingest._key}}"
          }
        },
        "if": "ctx?.message2?.dot11_device?.dot11_device_associated_client_map != null"
      }
    }
  ]
}