securityonion/salt/logstash/files/conf.d/1033_preprocess_snort.conf

# Author: Justin Henderson
#         SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Updated by: Wes Lambert
# Last Update: 12/15/2017

filter {
  if [type] == "snort" {
    # This is the initial parsing of the log
    grok {
      match => ["message", "\[%{INT:gid}:%{INT:sid}:%{INT:rev}\]\s%{DATA:alert}\[Classification:\s+%{DATA:classification}\]\s+\[Priority:\s+%{INT:priority}\]:\s+<%{DATA:interface}>\s+{%{DATA:protocol}}\s+(?:%{IPV4:source_ip}|%{IPV6:source_ip}):%{INT:source_port}\s+->\s+(?:%{IPV4:destination_ip}|%{IPV6:destination_ip}):%{INT:destination_port}",
		"message", "\[%{INT:gid}:%{INT:sid}:%{INT:rev}\]\s%{DATA:alert}\[Classification:\s+%{DATA:classification}\]\s+\[Priority:\s+%{INT:priority}\]:\s+<%{DATA:interface}>\s+{%{DATA:protocol}}\s(?:%{IPV4:source_ip}|%{IPV6:source_ip})\s+->\s+(?:%{IPV4:destination_ip}|%{IPV6:destination_ip})", 
		"message", "\[%{INT:gid}:%{INT:sid}:%{INT:rev}\]\s%{DATA:alert}\[Classification:\s+%{DATA:classification}\]\s+\[Priority:\s+%{INT:priority}\]:\s+{%{DATA:protocol}}\s+(?:%{IPV4:source_ip}|%{IPV6:source_ip}):%{INT:source_port}\s+->\s+%{IPV4:destination_ip}:%{INT:destination_port}", 
		"message", "\[%{INT:gid}:%{INT:sid}:%{INT:rev}\]\s%{DATA:alert}\[Classification:\s+%{DATA:classification}\]\s+\[Priority:\s+%{INT:priority}\]:\s+{%{DATA:protocol}}\s(?:%{IPV4:source_ip}|%{IPV6:source_ip})\s+->\s+(?:%{IPV4:destination_ip}|%{IPV6:destination_ip})",
		"message", "\[%{INT:gid}:%{INT:sid}:%{INT:rev}\]\s%{DATA:alert}\[Classification:\s+%{DATA:classification}\]\s+\[Priority:\s+%{INT:priority}\]:\s+{%{DATA:protocol}}\s+(?:%{IPV4:source_ip}|%{IPV6:source_ip}):%{INT:source_port}\s+->\s+(?:%{IPV4:destination_ip}|%{IPV6:destination_ip}):%{INT:destination_port}",
               "message", "\[%{INT:gid}:%{INT:sid}:%{INT:rev}\]\s%{DATA:alert}\[Classification:\s+%{DATA:classification}\]\s+\[Priority:\s+%{INT:priority}\]:\s+{%{DATA:protocol}}\s(?:%{IPV4:source_ip}|%{IPV6:source_ip})\s+->\s+(?:%{IPV4:source_ip}|%{IPV6:source_ip})",
		"message", "\[%{INT:gid}:%{INT:sid}:%{INT:rev}\]\s%{DATA:alert}\[Classification:\s+%{DATA:classification}\]\s+\[Priority:\s+%{INT:priority}\]:\s+{%{DATA:protocol}}",
		"message", "%{GREEDYDATA:alert}"]
    }
	
	# If the alert is a Snort GPL alert break it apart for easier reading and categorization
    if [alert] =~ "GPL " {
	  # This will parse out the category type from the alert
      grok {
        match => { "alert" => "GPL\s+%{DATA:category}\s" }
      }
	  # This will store the category
      mutate {
        add_field => { "rule_type" => "Snort GPL" }
        lowercase => [ "category"]
        }
    }
	# If the alert is an Emerging Threat alert break it apart for easier reading and categorization
    if [alert] =~ "ET " {
	  # This will parse out the category type from the alert
      grok {
        match => { "alert" => "ET\s+%{DATA:category}\s" }
      }
	  # This will store the category
      mutate {
        add_field => { "rule_type" => "Emerging Threats" }
        lowercase => [ "category"]
      }
    }
	# I recommend changing the field types below to integer so searches can do greater than or less than
	# and also so math functions can be ran against them
    mutate {
      convert => [ "source_port", "integer" ]
      convert => [ "destination_port", "integer" ]
      convert => [ "gid", "integer" ]
      convert => [ "sid", "integer" ]
    #  remove_field => [ "message"]
    }
	# This will translate the priority field into a severity field of either High, Medium, or Low
	if [priority] == 1 {
      mutate {
        add_field => { "severity" => "High" }
      }
    }
    if [priority] == 2 {
      mutate {
        add_field => { "severity" => "Medium" }
      }
    }
    if [priority] == 3 {
      mutate {
        add_field => { "severity" => "Low" }
      }
    }
    # This section adds URLs to lookup information about a rule online
    if [sid] and [sid] > 0 and [sid] < 1000000 {
      mutate {
        add_field => [ "signature_info", "https://www.snort.org/search?query=%{gid}-%{sid}" ]
      }
    }
    if [sid] and [sid] > 1999999 and [sid] < 2999999 {
      mutate {
        add_field => [ "signature_info", "http://doc.emergingthreats.net/%{sid}" ]
      }
    }
    if [gid] and [gid] == 1 and [sid] and [sid] > 0 and [sid] < 1000000000 {
      ruby {
         code => "sid = event.get('sid'); event.set('rule', `grep -h sid:#{sid} /etc/nsm/rules/*.rules | sort -u`)"
	}
    }
#	mutate {
		#add_tag => [ "conf_file_1033"]
#	}
  }
}