mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2025-12-06 09:12:45 +01:00
4061 lines
115 KiB
YAML
4061 lines
115 KiB
YAML
elasticsearch:
|
|
config:
|
|
node:
|
|
name: {{ grains.host }}
|
|
attr:
|
|
box_type: hot
|
|
cluster:
|
|
name: {{ grains.host }}
|
|
routing:
|
|
allocation:
|
|
disk:
|
|
threshold_enabled: true
|
|
watermark:
|
|
low: 95%
|
|
high: 98%
|
|
flood_stage: 98%
|
|
network:
|
|
host: 0.0.0.0
|
|
path:
|
|
logs: /var/log/elasticsearch
|
|
action:
|
|
destructive_requires_name: true
|
|
transport:
|
|
bind_host: 0.0.0.0
|
|
publish_host: {{ grains.host }}
|
|
publish_port: 9300
|
|
xpack:
|
|
ml:
|
|
enabled: false
|
|
security:
|
|
enabled: true
|
|
authc:
|
|
anonymous:
|
|
authz_exception: true
|
|
roles: []
|
|
username: _anonymous
|
|
transport:
|
|
ssl:
|
|
enabled: true
|
|
verification_mode: none
|
|
key: /usr/share/elasticsearch/config/elasticsearch.key
|
|
certificate: /usr/share/elasticsearch/config/elasticsearch.crt
|
|
certificate_authorities:
|
|
- /usr/share/elasticsearch/config/ca.crt
|
|
http:
|
|
ssl:
|
|
enabled: true
|
|
client_authentication: none
|
|
key: /usr/share/elasticsearch/config/elasticsearch.key
|
|
certificate: /usr/share/elasticsearch/config/elasticsearch.crt
|
|
certificate_authorities:
|
|
- /usr/share/elasticsearch/config/ca.crt
|
|
script:
|
|
max_compilations_rate: 20000/1m
|
|
indices:
|
|
query:
|
|
bool:
|
|
max_clause_count: 3000
|
|
id_field_data:
|
|
enabled: false
|
|
logger:
|
|
org:
|
|
elasticsearch:
|
|
deprecation: ERROR
|
|
index_settings:
|
|
so-aws:
|
|
warm: 7
|
|
close: 30
|
|
delete: 365
|
|
index_sorting: False
|
|
index_template:
|
|
index_patterns:
|
|
- so-aws-*
|
|
template:
|
|
mappings:
|
|
dynamic_templates:
|
|
- strings_as_keyword:
|
|
mapping:
|
|
ignore_above: 1024
|
|
type: keyword
|
|
match_mapping_type: string
|
|
date_detection: false
|
|
settings:
|
|
index:
|
|
mapping:
|
|
total_fields:
|
|
limit: 3000
|
|
sort:
|
|
field: "@timestamp"
|
|
order: desc
|
|
refresh_interval: 30s
|
|
number_of_shards: 1
|
|
number_of_replicas: 0
|
|
composed_of:
|
|
- agent-mappings
|
|
- aws-mappings
|
|
- dtc-agent-mappings
|
|
- base-mappings
|
|
- dtc-base-mappings
|
|
- client-mappings
|
|
- cloud-mappings
|
|
- container-mappings
|
|
- data_stream-mappings
|
|
- destination-mappings
|
|
- pb-override-destination-mappings
|
|
- dll-mappings
|
|
- dns-mappings
|
|
- dtc-dns-mappings
|
|
- ecs-mappings
|
|
- dtc-ecs-mappings
|
|
- error-mappings
|
|
- event-mappings
|
|
- dtc-event-mappings
|
|
- file-mappings
|
|
- dtc-file-mappings
|
|
- group-mappings
|
|
- host-mappings
|
|
- dtc-host-mappings
|
|
- http-mappings
|
|
- dtc-http-mappings
|
|
- log-mappings
|
|
- network-mappings
|
|
- dtc-network-mappings
|
|
- observer-mappings
|
|
- dtc-observer-mappings
|
|
- orchestrator-mappings
|
|
- organization-mappings
|
|
- package-mappings
|
|
- process-mappings
|
|
- dtc-process-mappings
|
|
- registry-mappings
|
|
- related-mappings
|
|
- rule-mappings
|
|
- dtc-rule-mappings
|
|
- server-mappings
|
|
- service-mappings
|
|
- dtc-service-mappings
|
|
- source-mappings
|
|
- pb-override-source-mappings
|
|
- threat-mappings
|
|
- tls-mappings
|
|
- tracing-mappings
|
|
- url-mappings
|
|
- user_agent-mappings
|
|
- dtc-user_agent-mappings
|
|
- vulnerability-mappings
|
|
- common-settings
|
|
- common-dynamic-mappings
|
|
priority: 500
|
|
so-azure:
|
|
warm: 7
|
|
close: 30
|
|
delete: 365
|
|
index_sorting: False
|
|
index_template:
|
|
index_patterns:
|
|
- so-azure-*
|
|
template:
|
|
mappings:
|
|
dynamic_templates:
|
|
- strings_as_keyword:
|
|
mapping:
|
|
ignore_above: 1024
|
|
type: keyword
|
|
match_mapping_type: string
|
|
date_detection: false
|
|
settings:
|
|
index:
|
|
mapping:
|
|
total_fields:
|
|
limit: 3000
|
|
sort:
|
|
field: "@timestamp"
|
|
order: desc
|
|
refresh_interval: 30s
|
|
number_of_shards: 1
|
|
number_of_replicas: 0
|
|
composed_of:
|
|
- agent-mappings
|
|
- azure-mappings
|
|
- dtc-agent-mappings
|
|
- base-mappings
|
|
- dtc-base-mappings
|
|
- client-mappings
|
|
- cloud-mappings
|
|
- container-mappings
|
|
- data_stream-mappings
|
|
- destination-mappings
|
|
- pb-override-destination-mappings
|
|
- dll-mappings
|
|
- dns-mappings
|
|
- dtc-dns-mappings
|
|
- ecs-mappings
|
|
- dtc-ecs-mappings
|
|
- error-mappings
|
|
- event-mappings
|
|
- dtc-event-mappings
|
|
- file-mappings
|
|
- dtc-file-mappings
|
|
- group-mappings
|
|
- host-mappings
|
|
- dtc-host-mappings
|
|
- http-mappings
|
|
- dtc-http-mappings
|
|
- log-mappings
|
|
- network-mappings
|
|
- dtc-network-mappings
|
|
- observer-mappings
|
|
- dtc-observer-mappings
|
|
- orchestrator-mappings
|
|
- organization-mappings
|
|
- package-mappings
|
|
- process-mappings
|
|
- dtc-process-mappings
|
|
- registry-mappings
|
|
- related-mappings
|
|
- rule-mappings
|
|
- dtc-rule-mappings
|
|
- server-mappings
|
|
- service-mappings
|
|
- dtc-service-mappings
|
|
- source-mappings
|
|
- pb-override-source-mappings
|
|
- threat-mappings
|
|
- tls-mappings
|
|
- tracing-mappings
|
|
- url-mappings
|
|
- user_agent-mappings
|
|
- dtc-user_agent-mappings
|
|
- vulnerability-mappings
|
|
- common-settings
|
|
- common-dynamic-mappings
|
|
priority: 500
|
|
so-barracuda:
|
|
warm: 7
|
|
close: 30
|
|
delete: 365
|
|
index_sorting: False
|
|
index_template:
|
|
index_patterns:
|
|
- so-barracuda-*
|
|
template:
|
|
mappings:
|
|
dynamic_templates:
|
|
- strings_as_keyword:
|
|
mapping:
|
|
ignore_above: 1024
|
|
type: keyword
|
|
match_mapping_type: string
|
|
date_detection: false
|
|
settings:
|
|
index:
|
|
mapping:
|
|
total_fields:
|
|
limit: 3000
|
|
sort:
|
|
field: "@timestamp"
|
|
order: desc
|
|
refresh_interval: 30s
|
|
number_of_shards: 1
|
|
number_of_replicas: 0
|
|
composed_of:
|
|
- agent-mappings
|
|
- dtc-agent-mappings
|
|
- base-mappings
|
|
- dtc-base-mappings
|
|
- client-mappings
|
|
- cloud-mappings
|
|
- container-mappings
|
|
- data_stream-mappings
|
|
- destination-mappings
|
|
- pb-override-destination-mappings
|
|
- dll-mappings
|
|
- dns-mappings
|
|
- dtc-dns-mappings
|
|
- ecs-mappings
|
|
- dtc-ecs-mappings
|
|
- error-mappings
|
|
- event-mappings
|
|
- dtc-event-mappings
|
|
- file-mappings
|
|
- dtc-file-mappings
|
|
- group-mappings
|
|
- host-mappings
|
|
- dtc-host-mappings
|
|
- http-mappings
|
|
- dtc-http-mappings
|
|
- log-mappings
|
|
- network-mappings
|
|
- dtc-network-mappings
|
|
- observer-mappings
|
|
- dtc-observer-mappings
|
|
- orchestrator-mappings
|
|
- organization-mappings
|
|
- package-mappings
|
|
- process-mappings
|
|
- dtc-process-mappings
|
|
- registry-mappings
|
|
- related-mappings
|
|
- rule-mappings
|
|
- dtc-rule-mappings
|
|
- server-mappings
|
|
- service-mappings
|
|
- dtc-service-mappings
|
|
- source-mappings
|
|
- pb-override-source-mappings
|
|
- threat-mappings
|
|
- tls-mappings
|
|
- tracing-mappings
|
|
- url-mappings
|
|
- user_agent-mappings
|
|
- dtc-user_agent-mappings
|
|
- vulnerability-mappings
|
|
- common-settings
|
|
- common-dynamic-mappings
|
|
priority: 500
|
|
so-beats:
|
|
warm: 7
|
|
close: 30
|
|
delete: 365
|
|
index_sorting: False
|
|
index_template:
|
|
index_patterns:
|
|
- so-beats-*
|
|
template:
|
|
mappings:
|
|
dynamic_templates:
|
|
- strings_as_keyword:
|
|
mapping:
|
|
ignore_above: 1024
|
|
type: keyword
|
|
match_mapping_type: string
|
|
date_detection: false
|
|
settings:
|
|
index:
|
|
mapping:
|
|
total_fields:
|
|
limit: 3000
|
|
sort:
|
|
field: "@timestamp"
|
|
order: desc
|
|
refresh_interval: 30s
|
|
number_of_shards: 1
|
|
number_of_replicas: 0
|
|
composed_of:
|
|
- agent-mappings
|
|
- dtc-agent-mappings
|
|
- base-mappings
|
|
- dtc-base-mappings
|
|
- client-mappings
|
|
- cloud-mappings
|
|
- container-mappings
|
|
- data_stream-mappings
|
|
- destination-mappings
|
|
- pb-override-destination-mappings
|
|
- dll-mappings
|
|
- dns-mappings
|
|
- dtc-dns-mappings
|
|
- ecs-mappings
|
|
- dtc-ecs-mappings
|
|
- error-mappings
|
|
- event-mappings
|
|
- dtc-event-mappings
|
|
- file-mappings
|
|
- dtc-file-mappings
|
|
- group-mappings
|
|
- host-mappings
|
|
- dtc-host-mappings
|
|
- http-mappings
|
|
- dtc-http-mappings
|
|
- log-mappings
|
|
- network-mappings
|
|
- dtc-network-mappings
|
|
- observer-mappings
|
|
- dtc-observer-mappings
|
|
- orchestrator-mappings
|
|
- organization-mappings
|
|
- package-mappings
|
|
- process-mappings
|
|
- dtc-process-mappings
|
|
- registry-mappings
|
|
- related-mappings
|
|
- rule-mappings
|
|
- dtc-rule-mappings
|
|
- server-mappings
|
|
- service-mappings
|
|
- dtc-service-mappings
|
|
- source-mappings
|
|
- pb-override-source-mappings
|
|
- threat-mappings
|
|
- tls-mappings
|
|
- tracing-mappings
|
|
- url-mappings
|
|
- user_agent-mappings
|
|
- dtc-user_agent-mappings
|
|
- vulnerability-mappings
|
|
- common-settings
|
|
- common-dynamic-mappings
|
|
- winlog-mappings
|
|
priority: 500
|
|
so-bluecoat:
|
|
warm: 7
|
|
close: 30
|
|
delete: 365
|
|
index_sorting: False
|
|
index_template:
|
|
index_patterns:
|
|
- so-bluecoat-*
|
|
template:
|
|
mappings:
|
|
dynamic_templates:
|
|
- strings_as_keyword:
|
|
mapping:
|
|
ignore_above: 1024
|
|
type: keyword
|
|
match_mapping_type: string
|
|
date_detection: false
|
|
settings:
|
|
index:
|
|
mapping:
|
|
total_fields:
|
|
limit: 3000
|
|
sort:
|
|
field: "@timestamp"
|
|
order: desc
|
|
refresh_interval: 30s
|
|
number_of_shards: 1
|
|
number_of_replicas: 0
|
|
composed_of:
|
|
- agent-mappings
|
|
- dtc-agent-mappings
|
|
- base-mappings
|
|
- dtc-base-mappings
|
|
- client-mappings
|
|
- cloud-mappings
|
|
- container-mappings
|
|
- data_stream-mappings
|
|
- destination-mappings
|
|
- pb-override-destination-mappings
|
|
- dll-mappings
|
|
- dns-mappings
|
|
- dtc-dns-mappings
|
|
- ecs-mappings
|
|
- dtc-ecs-mappings
|
|
- error-mappings
|
|
- event-mappings
|
|
- dtc-event-mappings
|
|
- file-mappings
|
|
- dtc-file-mappings
|
|
- group-mappings
|
|
- host-mappings
|
|
- dtc-host-mappings
|
|
- http-mappings
|
|
- dtc-http-mappings
|
|
- log-mappings
|
|
- network-mappings
|
|
- dtc-network-mappings
|
|
- observer-mappings
|
|
- dtc-observer-mappings
|
|
- orchestrator-mappings
|
|
- organization-mappings
|
|
- package-mappings
|
|
- process-mappings
|
|
- dtc-process-mappings
|
|
- registry-mappings
|
|
- related-mappings
|
|
- rule-mappings
|
|
- dtc-rule-mappings
|
|
- server-mappings
|
|
- service-mappings
|
|
- dtc-service-mappings
|
|
- source-mappings
|
|
- pb-override-source-mappings
|
|
- threat-mappings
|
|
- tls-mappings
|
|
- tracing-mappings
|
|
- url-mappings
|
|
- user_agent-mappings
|
|
- dtc-user_agent-mappings
|
|
- vulnerability-mappings
|
|
- common-settings
|
|
- common-dynamic-mappings
|
|
priority: 500
|
|
so-case:
|
|
index_sorting: False
|
|
index_template:
|
|
index_patterns:
|
|
- so-case*
|
|
template:
|
|
mappings:
|
|
dynamic_templates:
|
|
- strings_as_keyword:
|
|
mapping:
|
|
ignore_above: 1024
|
|
type: keyword
|
|
match_mapping_type: string
|
|
date_detection: false
|
|
settings:
|
|
index:
|
|
mapping:
|
|
total_fields:
|
|
limit: 1500
|
|
sort:
|
|
field: "@timestamp"
|
|
order: desc
|
|
refresh_interval: 30s
|
|
number_of_shards: 1
|
|
number_of_replicas: 0
|
|
composed_of:
|
|
- case-mappings
|
|
- case-settings
|
|
priority: 500
|
|
so-cef:
|
|
index_sorting: False
|
|
index_template:
|
|
index_patterns:
|
|
- so-cef*
|
|
template:
|
|
mappings:
|
|
dynamic_templates:
|
|
- strings_as_keyword:
|
|
mapping:
|
|
ignore_above: 1024
|
|
type: keyword
|
|
match_mapping_type: string
|
|
date_detection: false
|
|
settings:
|
|
index:
|
|
mapping:
|
|
total_fields:
|
|
limit: 3000
|
|
sort:
|
|
field: "@timestamp"
|
|
order: desc
|
|
refresh_interval: 30s
|
|
number_of_shards: 1
|
|
number_of_replicas: 0
|
|
composed_of:
|
|
- agent-mappings
|
|
- cef-mappings
|
|
- dtc-agent-mappings
|
|
- base-mappings
|
|
- dtc-base-mappings
|
|
- client-mappings
|
|
- cloud-mappings
|
|
- container-mappings
|
|
- data_stream-mappings
|
|
- destination-mappings
|
|
- pb-override-destination-mappings
|
|
- dll-mappings
|
|
- dns-mappings
|
|
- dtc-dns-mappings
|
|
- ecs-mappings
|
|
- dtc-ecs-mappings
|
|
- error-mappings
|
|
- event-mappings
|
|
- dtc-event-mappings
|
|
- file-mappings
|
|
- dtc-file-mappings
|
|
- group-mappings
|
|
- host-mappings
|
|
- dtc-host-mappings
|
|
- http-mappings
|
|
- dtc-http-mappings
|
|
- log-mappings
|
|
- network-mappings
|
|
- dtc-network-mappings
|
|
- observer-mappings
|
|
- dtc-observer-mappings
|
|
- orchestrator-mappings
|
|
- organization-mappings
|
|
- package-mappings
|
|
- process-mappings
|
|
- dtc-process-mappings
|
|
- registry-mappings
|
|
- related-mappings
|
|
- rule-mappings
|
|
- dtc-rule-mappings
|
|
- server-mappings
|
|
- service-mappings
|
|
- dtc-service-mappings
|
|
- source-mappings
|
|
- pb-override-source-mappings
|
|
- threat-mappings
|
|
- tls-mappings
|
|
- tracing-mappings
|
|
- url-mappings
|
|
- user_agent-mappings
|
|
- dtc-user_agent-mappings
|
|
- vulnerability-mappings
|
|
- common-settings
|
|
- common-dynamic-mappings
|
|
priority: 500
|
|
so-checkpoint:
|
|
index_sorting: False
|
|
index_template:
|
|
index_patterns:
|
|
- so-checkpoint*
|
|
template:
|
|
mappings:
|
|
dynamic_templates:
|
|
- strings_as_keyword:
|
|
mapping:
|
|
ignore_above: 1024
|
|
type: keyword
|
|
match_mapping_type: string
|
|
date_detection: false
|
|
settings:
|
|
index:
|
|
mapping:
|
|
total_fields:
|
|
limit: 3000
|
|
sort:
|
|
field: "@timestamp"
|
|
order: desc
|
|
refresh_interval: 30s
|
|
number_of_shards: 1
|
|
number_of_replicas: 0
|
|
composed_of:
|
|
- agent-mappings
|
|
- dtc-agent-mappings
|
|
- base-mappings
|
|
- dtc-base-mappings
|
|
- checkpoint-mappings
|
|
- client-mappings
|
|
- cloud-mappings
|
|
- container-mappings
|
|
- data_stream-mappings
|
|
- destination-mappings
|
|
- pb-override-destination-mappings
|
|
- dll-mappings
|
|
- dns-mappings
|
|
- dtc-dns-mappings
|
|
- ecs-mappings
|
|
- dtc-ecs-mappings
|
|
- error-mappings
|
|
- event-mappings
|
|
- dtc-event-mappings
|
|
- file-mappings
|
|
- dtc-file-mappings
|
|
- group-mappings
|
|
- host-mappings
|
|
- dtc-host-mappings
|
|
- http-mappings
|
|
- dtc-http-mappings
|
|
- log-mappings
|
|
- network-mappings
|
|
- dtc-network-mappings
|
|
- observer-mappings
|
|
- dtc-observer-mappings
|
|
- orchestrator-mappings
|
|
- organization-mappings
|
|
- package-mappings
|
|
- process-mappings
|
|
- dtc-process-mappings
|
|
- registry-mappings
|
|
- related-mappings
|
|
- rule-mappings
|
|
- dtc-rule-mappings
|
|
- server-mappings
|
|
- service-mappings
|
|
- dtc-service-mappings
|
|
- source-mappings
|
|
- pb-override-source-mappings
|
|
- threat-mappings
|
|
- tls-mappings
|
|
- tracing-mappings
|
|
- url-mappings
|
|
- user_agent-mappings
|
|
- dtc-user_agent-mappings
|
|
- vulnerability-mappings
|
|
- common-settings
|
|
- common-dynamic-mappings
|
|
priority: 500
|
|
so-cisco:
|
|
index_sorting: False
|
|
index_template:
|
|
index_patterns:
|
|
- so-cisco*
|
|
template:
|
|
mappings:
|
|
dynamic_templates:
|
|
- strings_as_keyword:
|
|
mapping:
|
|
ignore_above: 1024
|
|
type: keyword
|
|
match_mapping_type: string
|
|
date_detection: false
|
|
settings:
|
|
index:
|
|
mapping:
|
|
total_fields:
|
|
limit: 3000
|
|
sort:
|
|
field: "@timestamp"
|
|
order: desc
|
|
refresh_interval: 30s
|
|
number_of_shards: 1
|
|
number_of_replicas: 0
|
|
composed_of:
|
|
- agent-mappings
|
|
- dtc-agent-mappings
|
|
- base-mappings
|
|
- dtc-base-mappings
|
|
- cisco-mappings
|
|
- client-mappings
|
|
- cloud-mappings
|
|
- container-mappings
|
|
- data_stream-mappings
|
|
- destination-mappings
|
|
- pb-override-destination-mappings
|
|
- dll-mappings
|
|
- dns-mappings
|
|
- dtc-dns-mappings
|
|
- ecs-mappings
|
|
- dtc-ecs-mappings
|
|
- error-mappings
|
|
- event-mappings
|
|
- dtc-event-mappings
|
|
- file-mappings
|
|
- dtc-file-mappings
|
|
- group-mappings
|
|
- host-mappings
|
|
- dtc-host-mappings
|
|
- http-mappings
|
|
- dtc-http-mappings
|
|
- log-mappings
|
|
- network-mappings
|
|
- dtc-network-mappings
|
|
- observer-mappings
|
|
- dtc-observer-mappings
|
|
- orchestrator-mappings
|
|
- organization-mappings
|
|
- package-mappings
|
|
- process-mappings
|
|
- dtc-process-mappings
|
|
- registry-mappings
|
|
- related-mappings
|
|
- rule-mappings
|
|
- dtc-rule-mappings
|
|
- server-mappings
|
|
- service-mappings
|
|
- dtc-service-mappings
|
|
- source-mappings
|
|
- pb-override-source-mappings
|
|
- threat-mappings
|
|
- tls-mappings
|
|
- tracing-mappings
|
|
- url-mappings
|
|
- user_agent-mappings
|
|
- dtc-user_agent-mappings
|
|
- vulnerability-mappings
|
|
- common-settings
|
|
- common-dynamic-mappings
|
|
priority: 500
|
|
so-common:
|
|
warm: 7
|
|
close: 30
|
|
delete: 365
|
|
index_sorting: False
|
|
index_template:
|
|
index_patterns:
|
|
- so-*
|
|
template:
|
|
mappings:
|
|
dynamic_templates:
|
|
- strings_as_keyword:
|
|
mapping:
|
|
ignore_above: 1024
|
|
type: keyword
|
|
match_mapping_type: string
|
|
date_detection: false
|
|
settings:
|
|
index:
|
|
mapping:
|
|
total_fields:
|
|
limit: 3000
|
|
sort:
|
|
field: "@timestamp"
|
|
order: desc
|
|
refresh_interval: 30s
|
|
number_of_shards: 1
|
|
number_of_replicas: 0
|
|
composed_of:
|
|
- agent-mappings
|
|
- dtc-agent-mappings
|
|
- base-mappings
|
|
- dtc-base-mappings
|
|
- client-mappings
|
|
- cloud-mappings
|
|
- container-mappings
|
|
- data_stream-mappings
|
|
- destination-mappings
|
|
- pb-override-destination-mappings
|
|
- dll-mappings
|
|
- dns-mappings
|
|
- dtc-dns-mappings
|
|
- ecs-mappings
|
|
- dtc-ecs-mappings
|
|
- error-mappings
|
|
- event-mappings
|
|
- dtc-event-mappings
|
|
- file-mappings
|
|
- dtc-file-mappings
|
|
- group-mappings
|
|
- host-mappings
|
|
- dtc-host-mappings
|
|
- http-mappings
|
|
- dtc-http-mappings
|
|
- log-mappings
|
|
- network-mappings
|
|
- dtc-network-mappings
|
|
- observer-mappings
|
|
- dtc-observer-mappings
|
|
- orchestrator-mappings
|
|
- organization-mappings
|
|
- package-mappings
|
|
- process-mappings
|
|
- dtc-process-mappings
|
|
- registry-mappings
|
|
- related-mappings
|
|
- rule-mappings
|
|
- dtc-rule-mappings
|
|
- server-mappings
|
|
- service-mappings
|
|
- dtc-service-mappings
|
|
- source-mappings
|
|
- pb-override-source-mappings
|
|
- threat-mappings
|
|
- tls-mappings
|
|
- tracing-mappings
|
|
- url-mappings
|
|
- user_agent-mappings
|
|
- dtc-user_agent-mappings
|
|
- vulnerability-mappings
|
|
- common-settings
|
|
- common-dynamic-mappings
|
|
- winlog-mappings
|
|
priority: 1
|
|
so-cyberark:
|
|
index_sorting: False
|
|
index_template:
|
|
index_patterns:
|
|
- so-cyberark*
|
|
template:
|
|
mappings:
|
|
dynamic_templates:
|
|
- strings_as_keyword:
|
|
mapping:
|
|
ignore_above: 1024
|
|
type: keyword
|
|
match_mapping_type: string
|
|
date_detection: false
|
|
settings:
|
|
index:
|
|
mapping:
|
|
total_fields:
|
|
limit: 3000
|
|
sort:
|
|
field: "@timestamp"
|
|
order: desc
|
|
refresh_interval: 30s
|
|
number_of_shards: 1
|
|
number_of_replicas: 0
|
|
composed_of:
|
|
- agent-mappings
|
|
- dtc-agent-mappings
|
|
- base-mappings
|
|
- dtc-base-mappings
|
|
- client-mappings
|
|
- cloud-mappings
|
|
- cyberark-mappings
|
|
- container-mappings
|
|
- data_stream-mappings
|
|
- destination-mappings
|
|
- pb-override-destination-mappings
|
|
- dll-mappings
|
|
- dns-mappings
|
|
- dtc-dns-mappings
|
|
- ecs-mappings
|
|
- dtc-ecs-mappings
|
|
- error-mappings
|
|
- event-mappings
|
|
- dtc-event-mappings
|
|
- file-mappings
|
|
- dtc-file-mappings
|
|
- group-mappings
|
|
- host-mappings
|
|
- dtc-host-mappings
|
|
- http-mappings
|
|
- dtc-http-mappings
|
|
- log-mappings
|
|
- network-mappings
|
|
- dtc-network-mappings
|
|
- observer-mappings
|
|
- dtc-observer-mappings
|
|
- orchestrator-mappings
|
|
- organization-mappings
|
|
- package-mappings
|
|
- process-mappings
|
|
- dtc-process-mappings
|
|
- registry-mappings
|
|
- related-mappings
|
|
- rule-mappings
|
|
- dtc-rule-mappings
|
|
- server-mappings
|
|
- service-mappings
|
|
- dtc-service-mappings
|
|
- source-mappings
|
|
- pb-override-source-mappings
|
|
- threat-mappings
|
|
- tls-mappings
|
|
- tracing-mappings
|
|
- url-mappings
|
|
- user_agent-mappings
|
|
- dtc-user_agent-mappings
|
|
- vulnerability-mappings
|
|
- common-settings
|
|
- common-dynamic-mappings
|
|
priority: 500
|
|
so-cylance:
|
|
index_sorting: False
|
|
index_template:
|
|
index_patterns:
|
|
- so-cylance*
|
|
template:
|
|
mappings:
|
|
dynamic_templates:
|
|
- strings_as_keyword:
|
|
mapping:
|
|
ignore_above: 1024
|
|
type: keyword
|
|
match_mapping_type: string
|
|
date_detection: false
|
|
settings:
|
|
index:
|
|
mapping:
|
|
total_fields:
|
|
limit: 3000
|
|
sort:
|
|
field: "@timestamp"
|
|
order: desc
|
|
refresh_interval: 30s
|
|
number_of_shards: 1
|
|
number_of_replicas: 0
|
|
composed_of:
|
|
- agent-mappings
|
|
- dtc-agent-mappings
|
|
- base-mappings
|
|
- dtc-base-mappings
|
|
- client-mappings
|
|
- cloud-mappings
|
|
- container-mappings
|
|
- data_stream-mappings
|
|
- destination-mappings
|
|
- pb-override-destination-mappings
|
|
- dll-mappings
|
|
- dns-mappings
|
|
- dtc-dns-mappings
|
|
- ecs-mappings
|
|
- dtc-ecs-mappings
|
|
- error-mappings
|
|
- event-mappings
|
|
- dtc-event-mappings
|
|
- file-mappings
|
|
- dtc-file-mappings
|
|
- group-mappings
|
|
- host-mappings
|
|
- dtc-host-mappings
|
|
- http-mappings
|
|
- dtc-http-mappings
|
|
- log-mappings
|
|
- network-mappings
|
|
- dtc-network-mappings
|
|
- observer-mappings
|
|
- dtc-observer-mappings
|
|
- orchestrator-mappings
|
|
- organization-mappings
|
|
- package-mappings
|
|
- process-mappings
|
|
- dtc-process-mappings
|
|
- registry-mappings
|
|
- related-mappings
|
|
- rule-mappings
|
|
- dtc-rule-mappings
|
|
- server-mappings
|
|
- service-mappings
|
|
- dtc-service-mappings
|
|
- source-mappings
|
|
- pb-override-source-mappings
|
|
- threat-mappings
|
|
- tls-mappings
|
|
- tracing-mappings
|
|
- url-mappings
|
|
- user_agent-mappings
|
|
- dtc-user_agent-mappings
|
|
- vulnerability-mappings
|
|
- common-settings
|
|
- common-dynamic-mappings
|
|
priority: 500
|
|
so-elasticsearch:
|
|
index_sorting: False
|
|
index_template:
|
|
index_patterns:
|
|
- so-elasticsearch*
|
|
template:
|
|
mappings:
|
|
dynamic_templates:
|
|
- strings_as_keyword:
|
|
mapping:
|
|
ignore_above: 1024
|
|
type: keyword
|
|
match_mapping_type: string
|
|
date_detection: false
|
|
settings:
|
|
index:
|
|
mapping:
|
|
total_fields:
|
|
limit: 3000
|
|
sort:
|
|
field: "@timestamp"
|
|
order: desc
|
|
refresh_interval: 30s
|
|
number_of_shards: 1
|
|
number_of_replicas: 0
|
|
composed_of:
|
|
- agent-mappings
|
|
- dtc-agent-mappings
|
|
- base-mappings
|
|
- dtc-base-mappings
|
|
- client-mappings
|
|
- cloud-mappings
|
|
- container-mappings
|
|
- data_stream-mappings
|
|
- destination-mappings
|
|
- pb-override-destination-mappings
|
|
- dll-mappings
|
|
- dns-mappings
|
|
- dtc-dns-mappings
|
|
- ecs-mappings
|
|
- dtc-ecs-mappings
|
|
- elasticsearch-mappings
|
|
- error-mappings
|
|
- event-mappings
|
|
- dtc-event-mappings
|
|
- file-mappings
|
|
- dtc-file-mappings
|
|
- group-mappings
|
|
- host-mappings
|
|
- dtc-host-mappings
|
|
- http-mappings
|
|
- dtc-http-mappings
|
|
- log-mappings
|
|
- network-mappings
|
|
- dtc-network-mappings
|
|
- observer-mappings
|
|
- dtc-observer-mappings
|
|
- orchestrator-mappings
|
|
- organization-mappings
|
|
- package-mappings
|
|
- process-mappings
|
|
- dtc-process-mappings
|
|
- registry-mappings
|
|
- related-mappings
|
|
- rule-mappings
|
|
- dtc-rule-mappings
|
|
- server-mappings
|
|
- service-mappings
|
|
- dtc-service-mappings
|
|
- source-mappings
|
|
- pb-override-source-mappings
|
|
- threat-mappings
|
|
- tls-mappings
|
|
- tracing-mappings
|
|
- url-mappings
|
|
- user_agent-mappings
|
|
- dtc-user_agent-mappings
|
|
- vulnerability-mappings
|
|
- common-settings
|
|
- common-dynamic-mappings
|
|
priority: 500
|
|
so-endgame:
|
|
index_sorting: False
|
|
index_template:
|
|
index_patterns:
|
|
- endgame*
|
|
template:
|
|
mappings:
|
|
dynamic_templates:
|
|
- strings_as_keyword:
|
|
mapping:
|
|
ignore_above: 1024
|
|
type: keyword
|
|
match_mapping_type: string
|
|
date_detection: false
|
|
settings:
|
|
index:
|
|
mapping:
|
|
total_fields:
|
|
limit: 3000
|
|
sort:
|
|
field: "@timestamp"
|
|
order: desc
|
|
refresh_interval: 30s
|
|
number_of_shards: 1
|
|
number_of_replicas: 0
|
|
composed_of:
|
|
- agent-mappings
|
|
- dtc-agent-mappings
|
|
- base-mappings
|
|
- dtc-base-mappings
|
|
- client-mappings
|
|
- cloud-mappings
|
|
- container-mappings
|
|
- data_stream-mappings
|
|
- destination-mappings
|
|
- pb-override-destination-mappings
|
|
- dll-mappings
|
|
- dns-mappings
|
|
- dtc-dns-mappings
|
|
- ecs-mappings
|
|
- dtc-ecs-mappings
|
|
- endgame-mappings
|
|
- error-mappings
|
|
- event-mappings
|
|
- dtc-event-mappings
|
|
- file-mappings
|
|
- dtc-file-mappings
|
|
- group-mappings
|
|
- host-mappings
|
|
- dtc-host-mappings
|
|
- http-mappings
|
|
- dtc-http-mappings
|
|
- log-mappings
|
|
- network-mappings
|
|
- dtc-network-mappings
|
|
- observer-mappings
|
|
- dtc-observer-mappings
|
|
- orchestrator-mappings
|
|
- organization-mappings
|
|
- package-mappings
|
|
- process-mappings
|
|
- dtc-process-mappings
|
|
- registry-mappings
|
|
- related-mappings
|
|
- rule-mappings
|
|
- dtc-rule-mappings
|
|
- server-mappings
|
|
- service-mappings
|
|
- dtc-service-mappings
|
|
- source-mappings
|
|
- pb-override-source-mappings
|
|
- threat-mappings
|
|
- tls-mappings
|
|
- tracing-mappings
|
|
- url-mappings
|
|
- user_agent-mappings
|
|
- dtc-user_agent-mappings
|
|
- vulnerability-mappings
|
|
- common-settings
|
|
- common-dynamic-mappings
|
|
- winlog-mappings
|
|
priority: 500
|
|
so-f5:
|
|
index_sorting: False
|
|
index_template:
|
|
index_patterns:
|
|
- so-f5*
|
|
template:
|
|
mappings:
|
|
dynamic_templates:
|
|
- strings_as_keyword:
|
|
mapping:
|
|
ignore_above: 1024
|
|
type: keyword
|
|
match_mapping_type: string
|
|
date_detection: false
|
|
settings:
|
|
index:
|
|
mapping:
|
|
total_fields:
|
|
limit: 3000
|
|
sort:
|
|
field: "@timestamp"
|
|
order: desc
|
|
refresh_interval: 30s
|
|
number_of_shards: 1
|
|
number_of_replicas: 0
|
|
composed_of:
|
|
- agent-mappings
|
|
- dtc-agent-mappings
|
|
- base-mappings
|
|
- dtc-base-mappings
|
|
- client-mappings
|
|
- cloud-mappings
|
|
- container-mappings
|
|
- data_stream-mappings
|
|
- destination-mappings
|
|
- pb-override-destination-mappings
|
|
- dll-mappings
|
|
- dns-mappings
|
|
- dtc-dns-mappings
|
|
- ecs-mappings
|
|
- dtc-ecs-mappings
|
|
- error-mappings
|
|
- event-mappings
|
|
- dtc-event-mappings
|
|
- file-mappings
|
|
- dtc-file-mappings
|
|
- group-mappings
|
|
- host-mappings
|
|
- dtc-host-mappings
|
|
- http-mappings
|
|
- dtc-http-mappings
|
|
- log-mappings
|
|
- network-mappings
|
|
- dtc-network-mappings
|
|
- observer-mappings
|
|
- dtc-observer-mappings
|
|
- orchestrator-mappings
|
|
- organization-mappings
|
|
- package-mappings
|
|
- process-mappings
|
|
- dtc-process-mappings
|
|
- registry-mappings
|
|
- related-mappings
|
|
- rule-mappings
|
|
- dtc-rule-mappings
|
|
- server-mappings
|
|
- service-mappings
|
|
- dtc-service-mappings
|
|
- source-mappings
|
|
- pb-override-source-mappings
|
|
- threat-mappings
|
|
- tls-mappings
|
|
- tracing-mappings
|
|
- url-mappings
|
|
- user_agent-mappings
|
|
- dtc-user_agent-mappings
|
|
- vulnerability-mappings
|
|
- common-settings
|
|
- common-dynamic-mappings
|
|
priority: 500
|
|
so-firewall:
|
|
index_sorting: False
|
|
index_template:
|
|
index_patterns:
|
|
- so-firewall*
|
|
template:
|
|
mappings:
|
|
dynamic_templates:
|
|
- strings_as_keyword:
|
|
mapping:
|
|
ignore_above: 1024
|
|
type: keyword
|
|
match_mapping_type: string
|
|
date_detection: false
|
|
settings:
|
|
index:
|
|
mapping:
|
|
total_fields:
|
|
limit: 3000
|
|
sort:
|
|
field: "@timestamp"
|
|
order: desc
|
|
refresh_interval: 30s
|
|
number_of_shards: 1
|
|
number_of_replicas: 0
|
|
composed_of:
|
|
- agent-mappings
|
|
- dtc-agent-mappings
|
|
- base-mappings
|
|
- dtc-base-mappings
|
|
- client-mappings
|
|
- cloud-mappings
|
|
- container-mappings
|
|
- data_stream-mappings
|
|
- destination-mappings
|
|
- pb-override-destination-mappings
|
|
- dll-mappings
|
|
- dns-mappings
|
|
- dtc-dns-mappings
|
|
- ecs-mappings
|
|
- dtc-ecs-mappings
|
|
- error-mappings
|
|
- event-mappings
|
|
- dtc-event-mappings
|
|
- file-mappings
|
|
- dtc-file-mappings
|
|
- group-mappings
|
|
- host-mappings
|
|
- dtc-host-mappings
|
|
- http-mappings
|
|
- dtc-http-mappings
|
|
- log-mappings
|
|
- network-mappings
|
|
- dtc-network-mappings
|
|
- observer-mappings
|
|
- dtc-observer-mappings
|
|
- orchestrator-mappings
|
|
- organization-mappings
|
|
- package-mappings
|
|
- process-mappings
|
|
- dtc-process-mappings
|
|
- registry-mappings
|
|
- related-mappings
|
|
- rule-mappings
|
|
- dtc-rule-mappings
|
|
- server-mappings
|
|
- service-mappings
|
|
- dtc-service-mappings
|
|
- source-mappings
|
|
- pb-override-source-mappings
|
|
- threat-mappings
|
|
- tls-mappings
|
|
- tracing-mappings
|
|
- url-mappings
|
|
- user_agent-mappings
|
|
- dtc-user_agent-mappings
|
|
- vulnerability-mappings
|
|
- common-settings
|
|
- common-dynamic-mappings
|
|
priority: 500
|
|
so-flow:
|
|
index_sorting: False
|
|
index_template:
|
|
index_patterns:
|
|
- so-flow*
|
|
template:
|
|
mappings:
|
|
dynamic_templates:
|
|
- strings_as_keyword:
|
|
mapping:
|
|
ignore_above: 1024
|
|
type: keyword
|
|
match_mapping_type: string
|
|
date_detection: false
|
|
settings:
|
|
index:
|
|
mapping:
|
|
total_fields:
|
|
limit: 3000
|
|
sort:
|
|
field: "@timestamp"
|
|
order: desc
|
|
refresh_interval: 30s
|
|
number_of_shards: 1
|
|
number_of_replicas: 0
|
|
composed_of:
|
|
- agent-mappings
|
|
- dtc-agent-mappings
|
|
- base-mappings
|
|
- dtc-base-mappings
|
|
- client-mappings
|
|
- cloud-mappings
|
|
- container-mappings
|
|
- data_stream-mappings
|
|
- destination-mappings
|
|
- pb-override-destination-mappings
|
|
- dll-mappings
|
|
- dns-mappings
|
|
- dtc-dns-mappings
|
|
- ecs-mappings
|
|
- dtc-ecs-mappings
|
|
- error-mappings
|
|
- event-mappings
|
|
- dtc-event-mappings
|
|
- file-mappings
|
|
- dtc-file-mappings
|
|
- group-mappings
|
|
- host-mappings
|
|
- dtc-host-mappings
|
|
- http-mappings
|
|
- dtc-http-mappings
|
|
- log-mappings
|
|
- network-mappings
|
|
- dtc-network-mappings
|
|
- observer-mappings
|
|
- dtc-observer-mappings
|
|
- orchestrator-mappings
|
|
- organization-mappings
|
|
- package-mappings
|
|
- process-mappings
|
|
- dtc-process-mappings
|
|
- registry-mappings
|
|
- related-mappings
|
|
- rule-mappings
|
|
- dtc-rule-mappings
|
|
- server-mappings
|
|
- service-mappings
|
|
- dtc-service-mappings
|
|
- source-mappings
|
|
- pb-override-source-mappings
|
|
- threat-mappings
|
|
- tls-mappings
|
|
- tracing-mappings
|
|
- url-mappings
|
|
- user_agent-mappings
|
|
- dtc-user_agent-mappings
|
|
- vulnerability-mappings
|
|
- common-settings
|
|
- common-dynamic-mappings
|
|
priority: 500
|
|
so-fortinet:
|
|
index_sorting: False
|
|
index_template:
|
|
index_patterns:
|
|
- so-fortinet*
|
|
template:
|
|
mappings:
|
|
dynamic_templates:
|
|
- strings_as_keyword:
|
|
mapping:
|
|
ignore_above: 1024
|
|
type: keyword
|
|
match_mapping_type: string
|
|
date_detection: false
|
|
settings:
|
|
index:
|
|
mapping:
|
|
total_fields:
|
|
limit: 3000
|
|
sort:
|
|
field: "@timestamp"
|
|
order: desc
|
|
refresh_interval: 30s
|
|
number_of_shards: 1
|
|
number_of_replicas: 0
|
|
composed_of:
|
|
- agent-mappings
|
|
- dtc-agent-mappings
|
|
- base-mappings
|
|
- dtc-base-mappings
|
|
- client-mappings
|
|
- cloud-mappings
|
|
- container-mappings
|
|
- data_stream-mappings
|
|
- destination-mappings
|
|
- pb-override-destination-mappings
|
|
- dll-mappings
|
|
- dns-mappings
|
|
- dtc-dns-mappings
|
|
- ecs-mappings
|
|
- dtc-ecs-mappings
|
|
- error-mappings
|
|
- event-mappings
|
|
- dtc-event-mappings
|
|
- file-mappings
|
|
- dtc-file-mappings
|
|
- fortinet-mappings
|
|
- group-mappings
|
|
- host-mappings
|
|
- dtc-host-mappings
|
|
- http-mappings
|
|
- dtc-http-mappings
|
|
- log-mappings
|
|
- network-mappings
|
|
- dtc-network-mappings
|
|
- observer-mappings
|
|
- dtc-observer-mappings
|
|
- orchestrator-mappings
|
|
- organization-mappings
|
|
- package-mappings
|
|
- process-mappings
|
|
- dtc-process-mappings
|
|
- registry-mappings
|
|
- related-mappings
|
|
- rule-mappings
|
|
- dtc-rule-mappings
|
|
- server-mappings
|
|
- service-mappings
|
|
- dtc-service-mappings
|
|
- source-mappings
|
|
- pb-override-source-mappings
|
|
- threat-mappings
|
|
- tls-mappings
|
|
- tracing-mappings
|
|
- url-mappings
|
|
- user_agent-mappings
|
|
- dtc-user_agent-mappings
|
|
- vulnerability-mappings
|
|
- common-settings
|
|
- common-dynamic-mappings
|
|
priority: 500
|
|
so-gcp:
|
|
index_sorting: False
|
|
index_template:
|
|
index_patterns:
|
|
- so-gcp*
|
|
template:
|
|
mappings:
|
|
dynamic_templates:
|
|
- strings_as_keyword:
|
|
mapping:
|
|
ignore_above: 1024
|
|
type: keyword
|
|
match_mapping_type: string
|
|
date_detection: false
|
|
settings:
|
|
index:
|
|
mapping:
|
|
total_fields:
|
|
limit: 3000
|
|
sort:
|
|
field: "@timestamp"
|
|
order: desc
|
|
refresh_interval: 30s
|
|
number_of_shards: 1
|
|
number_of_replicas: 0
|
|
composed_of:
|
|
- agent-mappings
|
|
- dtc-agent-mappings
|
|
- base-mappings
|
|
- dtc-base-mappings
|
|
- client-mappings
|
|
- cloud-mappings
|
|
- container-mappings
|
|
- data_stream-mappings
|
|
- destination-mappings
|
|
- pb-override-destination-mappings
|
|
- dll-mappings
|
|
- dns-mappings
|
|
- dtc-dns-mappings
|
|
- ecs-mappings
|
|
- dtc-ecs-mappings
|
|
- error-mappings
|
|
- event-mappings
|
|
- dtc-event-mappings
|
|
- file-mappings
|
|
- dtc-file-mappings
|
|
- gcp-mappings
|
|
- group-mappings
|
|
- host-mappings
|
|
- dtc-host-mappings
|
|
- http-mappings
|
|
- dtc-http-mappings
|
|
- log-mappings
|
|
- network-mappings
|
|
- dtc-network-mappings
|
|
- observer-mappings
|
|
- dtc-observer-mappings
|
|
- orchestrator-mappings
|
|
- organization-mappings
|
|
- package-mappings
|
|
- process-mappings
|
|
- dtc-process-mappings
|
|
- registry-mappings
|
|
- related-mappings
|
|
- rule-mappings
|
|
- dtc-rule-mappings
|
|
- server-mappings
|
|
- service-mappings
|
|
- dtc-service-mappings
|
|
- source-mappings
|
|
- pb-override-source-mappings
|
|
- threat-mappings
|
|
- tls-mappings
|
|
- tracing-mappings
|
|
- url-mappings
|
|
- user_agent-mappings
|
|
- dtc-user_agent-mappings
|
|
- vulnerability-mappings
|
|
- common-settings
|
|
- common-dynamic-mappings
|
|
priority: 500
|
|
so-google_workspace:
|
|
index_sorting: False
|
|
index_template:
|
|
index_patterns:
|
|
- so-google_workspace*
|
|
template:
|
|
mappings:
|
|
dynamic_templates:
|
|
- strings_as_keyword:
|
|
mapping:
|
|
ignore_above: 1024
|
|
type: keyword
|
|
match_mapping_type: string
|
|
date_detection: false
|
|
settings:
|
|
index:
|
|
mapping:
|
|
total_fields:
|
|
limit: 3000
|
|
sort:
|
|
field: "@timestamp"
|
|
order: desc
|
|
refresh_interval: 30s
|
|
number_of_shards: 1
|
|
number_of_replicas: 0
|
|
composed_of:
|
|
- agent-mappings
|
|
- dtc-agent-mappings
|
|
- base-mappings
|
|
- dtc-base-mappings
|
|
- client-mappings
|
|
- cloud-mappings
|
|
- container-mappings
|
|
- data_stream-mappings
|
|
- destination-mappings
|
|
- pb-override-destination-mappings
|
|
- dll-mappings
|
|
- dns-mappings
|
|
- dtc-dns-mappings
|
|
- ecs-mappings
|
|
- dtc-ecs-mappings
|
|
- error-mappings
|
|
- event-mappings
|
|
- dtc-event-mappings
|
|
- file-mappings
|
|
- dtc-file-mappings
|
|
- google_workspace-mappings
|
|
- group-mappings
|
|
- host-mappings
|
|
- dtc-host-mappings
|
|
- http-mappings
|
|
- dtc-http-mappings
|
|
- log-mappings
|
|
- network-mappings
|
|
- dtc-network-mappings
|
|
- observer-mappings
|
|
- dtc-observer-mappings
|
|
- orchestrator-mappings
|
|
- organization-mappings
|
|
- package-mappings
|
|
- process-mappings
|
|
- dtc-process-mappings
|
|
- registry-mappings
|
|
- related-mappings
|
|
- rule-mappings
|
|
- dtc-rule-mappings
|
|
- server-mappings
|
|
- service-mappings
|
|
- dtc-service-mappings
|
|
- source-mappings
|
|
- pb-override-source-mappings
|
|
- threat-mappings
|
|
- tls-mappings
|
|
- tracing-mappings
|
|
- url-mappings
|
|
- user_agent-mappings
|
|
- dtc-user_agent-mappings
|
|
- vulnerability-mappings
|
|
- common-settings
|
|
- common-dynamic-mappings
|
|
priority: 500
|
|
so-idh:
|
|
warm: 7
|
|
close: 30
|
|
delete: 365
|
|
index_sorting: False
|
|
index_template:
|
|
index_patterns:
|
|
- so-idh-*
|
|
template:
|
|
mappings:
|
|
dynamic_templates:
|
|
- strings_as_keyword:
|
|
mapping:
|
|
ignore_above: 1024
|
|
type: keyword
|
|
match_mapping_type: string
|
|
date_detection: false
|
|
settings:
|
|
index:
|
|
mapping:
|
|
total_fields:
|
|
limit: 3000
|
|
sort:
|
|
field: "@timestamp"
|
|
order: desc
|
|
refresh_interval: 30s
|
|
number_of_shards: 1
|
|
number_of_replicas: 0
|
|
composed_of:
|
|
- agent-mappings
|
|
- dtc-agent-mappings
|
|
- base-mappings
|
|
- dtc-base-mappings
|
|
- client-mappings
|
|
- container-mappings
|
|
- destination-mappings
|
|
- pb-override-destination-mappings
|
|
- dll-mappings
|
|
- dns-mappings
|
|
- dtc-dns-mappings
|
|
- ecs-mappings
|
|
- dtc-ecs-mappings
|
|
- error-mappings
|
|
- event-mappings
|
|
- dtc-event-mappings
|
|
- file-mappings
|
|
- dtc-file-mappings
|
|
- group-mappings
|
|
- host-mappings
|
|
- dtc-host-mappings
|
|
- http-mappings
|
|
- dtc-http-mappings
|
|
- log-mappings
|
|
- network-mappings
|
|
- dtc-network-mappings
|
|
- observer-mappings
|
|
- dtc-observer-mappings
|
|
- organization-mappings
|
|
- package-mappings
|
|
- process-mappings
|
|
- dtc-process-mappings
|
|
- related-mappings
|
|
- rule-mappings
|
|
- dtc-rule-mappings
|
|
- server-mappings
|
|
- service-mappings
|
|
- dtc-service-mappings
|
|
- source-mappings
|
|
- pb-override-source-mappings
|
|
- threat-mappings
|
|
- tls-mappings
|
|
- url-mappings
|
|
- user_agent-mappings
|
|
- dtc-user_agent-mappings
|
|
- common-settings
|
|
- common-dynamic-mappings
|
|
priority: 500
|
|
so-ids:
|
|
index_sorting: False
|
|
index_template:
|
|
index_patterns:
|
|
- so-ids*
|
|
template:
|
|
mappings:
|
|
dynamic_templates:
|
|
- strings_as_keyword:
|
|
mapping:
|
|
ignore_above: 1024
|
|
type: keyword
|
|
match_mapping_type: string
|
|
date_detection: false
|
|
settings:
|
|
index:
|
|
mapping:
|
|
total_fields:
|
|
limit: 3000
|
|
sort:
|
|
field: "@timestamp"
|
|
order: desc
|
|
refresh_interval: 30s
|
|
number_of_shards: 1
|
|
number_of_replicas: 0
|
|
composed_of:
|
|
- agent-mappings
|
|
- dtc-agent-mappings
|
|
- base-mappings
|
|
- dtc-base-mappings
|
|
- client-mappings
|
|
- cloud-mappings
|
|
- container-mappings
|
|
- data_stream-mappings
|
|
- destination-mappings
|
|
- pb-override-destination-mappings
|
|
- dll-mappings
|
|
- dns-mappings
|
|
- dtc-dns-mappings
|
|
- ecs-mappings
|
|
- dtc-ecs-mappings
|
|
- error-mappings
|
|
- event-mappings
|
|
- dtc-event-mappings
|
|
- file-mappings
|
|
- dtc-file-mappings
|
|
- group-mappings
|
|
- host-mappings
|
|
- dtc-host-mappings
|
|
- http-mappings
|
|
- dtc-http-mappings
|
|
- log-mappings
|
|
- network-mappings
|
|
- dtc-network-mappings
|
|
- observer-mappings
|
|
- dtc-observer-mappings
|
|
- orchestrator-mappings
|
|
- organization-mappings
|
|
- package-mappings
|
|
- process-mappings
|
|
- dtc-process-mappings
|
|
- registry-mappings
|
|
- related-mappings
|
|
- rule-mappings
|
|
- dtc-rule-mappings
|
|
- server-mappings
|
|
- service-mappings
|
|
- dtc-service-mappings
|
|
- source-mappings
|
|
- pb-override-source-mappings
|
|
- suricata-mappings
|
|
- threat-mappings
|
|
- tls-mappings
|
|
- tracing-mappings
|
|
- url-mappings
|
|
- user_agent-mappings
|
|
- dtc-user_agent-mappings
|
|
- vulnerability-mappings
|
|
- common-settings
|
|
- common-dynamic-mappings
|
|
priority: 500
|
|
so-imperva:
|
|
index_sorting: False
|
|
index_template:
|
|
index_patterns:
|
|
- so-imperva*
|
|
template:
|
|
mappings:
|
|
dynamic_templates:
|
|
- strings_as_keyword:
|
|
mapping:
|
|
ignore_above: 1024
|
|
type: keyword
|
|
match_mapping_type: string
|
|
date_detection: false
|
|
settings:
|
|
index:
|
|
mapping:
|
|
total_fields:
|
|
limit: 3000
|
|
sort:
|
|
field: "@timestamp"
|
|
order: desc
|
|
refresh_interval: 30s
|
|
number_of_shards: 1
|
|
number_of_replicas: 0
|
|
composed_of:
|
|
- agent-mappings
|
|
- dtc-agent-mappings
|
|
- base-mappings
|
|
- dtc-base-mappings
|
|
- client-mappings
|
|
- cloud-mappings
|
|
- container-mappings
|
|
- data_stream-mappings
|
|
- destination-mappings
|
|
- pb-override-destination-mappings
|
|
- dll-mappings
|
|
- dns-mappings
|
|
- dtc-dns-mappings
|
|
- ecs-mappings
|
|
- dtc-ecs-mappings
|
|
- error-mappings
|
|
- event-mappings
|
|
- dtc-event-mappings
|
|
- file-mappings
|
|
- dtc-file-mappings
|
|
- group-mappings
|
|
- host-mappings
|
|
- dtc-host-mappings
|
|
- http-mappings
|
|
- dtc-http-mappings
|
|
- log-mappings
|
|
- network-mappings
|
|
- dtc-network-mappings
|
|
- observer-mappings
|
|
- dtc-observer-mappings
|
|
- orchestrator-mappings
|
|
- organization-mappings
|
|
- package-mappings
|
|
- process-mappings
|
|
- dtc-process-mappings
|
|
- registry-mappings
|
|
- related-mappings
|
|
- rule-mappings
|
|
- dtc-rule-mappings
|
|
- server-mappings
|
|
- service-mappings
|
|
- dtc-service-mappings
|
|
- source-mappings
|
|
- pb-override-source-mappings
|
|
- threat-mappings
|
|
- tls-mappings
|
|
- tracing-mappings
|
|
- url-mappings
|
|
- user_agent-mappings
|
|
- dtc-user_agent-mappings
|
|
- vulnerability-mappings
|
|
- common-settings
|
|
- common-dynamic-mappings
|
|
priority: 500
|
|
so-import:
|
|
index_sorting: False
|
|
index_template:
|
|
index_patterns:
|
|
- so-import*
|
|
template:
|
|
mappings:
|
|
dynamic_templates:
|
|
- strings_as_keyword:
|
|
mapping:
|
|
ignore_above: 1024
|
|
type: keyword
|
|
match_mapping_type: string
|
|
date_detection: false
|
|
settings:
|
|
index:
|
|
mapping:
|
|
total_fields:
|
|
limit: 3000
|
|
sort:
|
|
field: "@timestamp"
|
|
order: desc
|
|
refresh_interval: 30s
|
|
number_of_shards: 1
|
|
number_of_replicas: 0
|
|
composed_of:
|
|
- agent-mappings
|
|
- dtc-agent-mappings
|
|
- base-mappings
|
|
- dtc-base-mappings
|
|
- client-mappings
|
|
- cloud-mappings
|
|
- container-mappings
|
|
- data_stream-mappings
|
|
- destination-mappings
|
|
- pb-override-destination-mappings
|
|
- dll-mappings
|
|
- dns-mappings
|
|
- dtc-dns-mappings
|
|
- ecs-mappings
|
|
- dtc-ecs-mappings
|
|
- error-mappings
|
|
- event-mappings
|
|
- dtc-event-mappings
|
|
- file-mappings
|
|
- dtc-file-mappings
|
|
- group-mappings
|
|
- host-mappings
|
|
- dtc-host-mappings
|
|
- http-mappings
|
|
- dtc-http-mappings
|
|
- log-mappings
|
|
- network-mappings
|
|
- dtc-network-mappings
|
|
- observer-mappings
|
|
- dtc-observer-mappings
|
|
- orchestrator-mappings
|
|
- organization-mappings
|
|
- package-mappings
|
|
- process-mappings
|
|
- dtc-process-mappings
|
|
- registry-mappings
|
|
- related-mappings
|
|
- rule-mappings
|
|
- dtc-rule-mappings
|
|
- server-mappings
|
|
- service-mappings
|
|
- dtc-service-mappings
|
|
- source-mappings
|
|
- pb-override-source-mappings
|
|
- threat-mappings
|
|
- tls-mappings
|
|
- tracing-mappings
|
|
- url-mappings
|
|
- user_agent-mappings
|
|
- dtc-user_agent-mappings
|
|
- vulnerability-mappings
|
|
- common-settings
|
|
- common-dynamic-mappings
|
|
- winlog-mappings
|
|
priority: 500
|
|
so-infoblox:
|
|
index_sorting: False
|
|
index_template:
|
|
index_patterns:
|
|
- so-infoblox*
|
|
template:
|
|
mappings:
|
|
dynamic_templates:
|
|
- strings_as_keyword:
|
|
mapping:
|
|
ignore_above: 1024
|
|
type: keyword
|
|
match_mapping_type: string
|
|
date_detection: false
|
|
settings:
|
|
index:
|
|
mapping:
|
|
total_fields:
|
|
limit: 3000
|
|
sort:
|
|
field: "@timestamp"
|
|
order: desc
|
|
refresh_interval: 30s
|
|
number_of_shards: 1
|
|
number_of_replicas: 0
|
|
composed_of:
|
|
- agent-mappings
|
|
- dtc-agent-mappings
|
|
- base-mappings
|
|
- dtc-base-mappings
|
|
- client-mappings
|
|
- cloud-mappings
|
|
- container-mappings
|
|
- data_stream-mappings
|
|
- destination-mappings
|
|
- pb-override-destination-mappings
|
|
- dll-mappings
|
|
- dns-mappings
|
|
- dtc-dns-mappings
|
|
- ecs-mappings
|
|
- dtc-ecs-mappings
|
|
- error-mappings
|
|
- event-mappings
|
|
- dtc-event-mappings
|
|
- file-mappings
|
|
- dtc-file-mappings
|
|
- group-mappings
|
|
- host-mappings
|
|
- dtc-host-mappings
|
|
- http-mappings
|
|
- dtc-http-mappings
|
|
- log-mappings
|
|
- network-mappings
|
|
- dtc-network-mappings
|
|
- observer-mappings
|
|
- dtc-observer-mappings
|
|
- orchestrator-mappings
|
|
- organization-mappings
|
|
- package-mappings
|
|
- process-mappings
|
|
- dtc-process-mappings
|
|
- registry-mappings
|
|
- related-mappings
|
|
- rule-mappings
|
|
- dtc-rule-mappings
|
|
- server-mappings
|
|
- service-mappings
|
|
- dtc-service-mappings
|
|
- source-mappings
|
|
- pb-override-source-mappings
|
|
- threat-mappings
|
|
- tls-mappings
|
|
- tracing-mappings
|
|
- url-mappings
|
|
- user_agent-mappings
|
|
- dtc-user_agent-mappings
|
|
- vulnerability-mappings
|
|
- common-settings
|
|
- common-dynamic-mappings
|
|
- winlog-mappings
|
|
priority: 500
|
|
so-juniper:
|
|
index_sorting: False
|
|
index_template:
|
|
index_patterns:
|
|
- so-juniper*
|
|
template:
|
|
mappings:
|
|
dynamic_templates:
|
|
- strings_as_keyword:
|
|
mapping:
|
|
ignore_above: 1024
|
|
type: keyword
|
|
match_mapping_type: string
|
|
date_detection: false
|
|
settings:
|
|
index:
|
|
mapping:
|
|
total_fields:
|
|
limit: 3000
|
|
sort:
|
|
field: "@timestamp"
|
|
order: desc
|
|
refresh_interval: 30s
|
|
number_of_shards: 1
|
|
number_of_replicas: 0
|
|
composed_of:
|
|
- agent-mappings
|
|
- dtc-agent-mappings
|
|
- base-mappings
|
|
- dtc-base-mappings
|
|
- client-mappings
|
|
- cloud-mappings
|
|
- container-mappings
|
|
- data_stream-mappings
|
|
- destination-mappings
|
|
- pb-override-destination-mappings
|
|
- dll-mappings
|
|
- dns-mappings
|
|
- dtc-dns-mappings
|
|
- ecs-mappings
|
|
- dtc-ecs-mappings
|
|
- error-mappings
|
|
- event-mappings
|
|
- dtc-event-mappings
|
|
- file-mappings
|
|
- dtc-file-mappings
|
|
- group-mappings
|
|
- host-mappings
|
|
- dtc-host-mappings
|
|
- http-mappings
|
|
- dtc-http-mappings
|
|
- juniper-mappings
|
|
- log-mappings
|
|
- network-mappings
|
|
- dtc-network-mappings
|
|
- observer-mappings
|
|
- dtc-observer-mappings
|
|
- orchestrator-mappings
|
|
- organization-mappings
|
|
- package-mappings
|
|
- process-mappings
|
|
- dtc-process-mappings
|
|
- registry-mappings
|
|
- related-mappings
|
|
- rule-mappings
|
|
- dtc-rule-mappings
|
|
- server-mappings
|
|
- service-mappings
|
|
- dtc-service-mappings
|
|
- source-mappings
|
|
- pb-override-source-mappings
|
|
- threat-mappings
|
|
- tls-mappings
|
|
- tracing-mappings
|
|
- url-mappings
|
|
- user_agent-mappings
|
|
- dtc-user_agent-mappings
|
|
- vulnerability-mappings
|
|
- common-settings
|
|
- common-dynamic-mappings
|
|
priority: 500
|
|
so-kibana:
|
|
index_sorting: False
|
|
index_template:
|
|
index_patterns:
|
|
- so-kibana*
|
|
template:
|
|
mappings:
|
|
dynamic_templates:
|
|
- strings_as_keyword:
|
|
mapping:
|
|
ignore_above: 1024
|
|
type: keyword
|
|
match_mapping_type: string
|
|
date_detection: false
|
|
settings:
|
|
index:
|
|
mapping:
|
|
total_fields:
|
|
limit: 3000
|
|
sort:
|
|
field: "@timestamp"
|
|
order: desc
|
|
refresh_interval: 30s
|
|
number_of_shards: 1
|
|
number_of_replicas: 0
|
|
composed_of:
|
|
- agent-mappings
|
|
- dtc-agent-mappings
|
|
- base-mappings
|
|
- dtc-base-mappings
|
|
- client-mappings
|
|
- cloud-mappings
|
|
- container-mappings
|
|
- data_stream-mappings
|
|
- destination-mappings
|
|
- pb-override-destination-mappings
|
|
- dll-mappings
|
|
- dns-mappings
|
|
- dtc-dns-mappings
|
|
- ecs-mappings
|
|
- dtc-ecs-mappings
|
|
- error-mappings
|
|
- event-mappings
|
|
- dtc-event-mappings
|
|
- file-mappings
|
|
- dtc-file-mappings
|
|
- group-mappings
|
|
- host-mappings
|
|
- dtc-host-mappings
|
|
- http-mappings
|
|
- dtc-http-mappings
|
|
- kibana-mappings
|
|
- log-mappings
|
|
- network-mappings
|
|
- dtc-network-mappings
|
|
- observer-mappings
|
|
- dtc-observer-mappings
|
|
- orchestrator-mappings
|
|
- organization-mappings
|
|
- package-mappings
|
|
- process-mappings
|
|
- dtc-process-mappings
|
|
- registry-mappings
|
|
- related-mappings
|
|
- rule-mappings
|
|
- dtc-rule-mappings
|
|
- server-mappings
|
|
- service-mappings
|
|
- dtc-service-mappings
|
|
- source-mappings
|
|
- pb-override-source-mappings
|
|
- threat-mappings
|
|
- tls-mappings
|
|
- tracing-mappings
|
|
- url-mappings
|
|
- user_agent-mappings
|
|
- dtc-user_agent-mappings
|
|
- vulnerability-mappings
|
|
- common-settings
|
|
- common-dynamic-mappings
|
|
priority: 500
|
|
so-kratos:
|
|
warm: 7
|
|
close: 30
|
|
delete: 365
|
|
index_sorting: False
|
|
index_template:
|
|
index_patterns:
|
|
- so-kratos-*
|
|
template:
|
|
mappings:
|
|
dynamic_templates:
|
|
- strings_as_keyword:
|
|
mapping:
|
|
ignore_above: 1024
|
|
type: keyword
|
|
match_mapping_type: string
|
|
date_detection: false
|
|
settings:
|
|
index:
|
|
mapping:
|
|
total_fields:
|
|
limit: 3000
|
|
sort:
|
|
field: "@timestamp"
|
|
order: desc
|
|
refresh_interval: 30s
|
|
number_of_shards: 1
|
|
number_of_replicas: 0
|
|
composed_of:
|
|
- agent-mappings
|
|
- dtc-agent-mappings
|
|
- base-mappings
|
|
- dtc-base-mappings
|
|
- client-mappings
|
|
- container-mappings
|
|
- destination-mappings
|
|
- pb-override-destination-mappings
|
|
- dll-mappings
|
|
- dns-mappings
|
|
- dtc-dns-mappings
|
|
- ecs-mappings
|
|
- dtc-ecs-mappings
|
|
- error-mappings
|
|
- event-mappings
|
|
- dtc-event-mappings
|
|
- file-mappings
|
|
- dtc-file-mappings
|
|
- group-mappings
|
|
- host-mappings
|
|
- dtc-host-mappings
|
|
- http-mappings
|
|
- dtc-http-mappings
|
|
- log-mappings
|
|
- network-mappings
|
|
- dtc-network-mappings
|
|
- observer-mappings
|
|
- dtc-observer-mappings
|
|
- organization-mappings
|
|
- package-mappings
|
|
- process-mappings
|
|
- dtc-process-mappings
|
|
- related-mappings
|
|
- rule-mappings
|
|
- dtc-rule-mappings
|
|
- server-mappings
|
|
- service-mappings
|
|
- dtc-service-mappings
|
|
- source-mappings
|
|
- pb-override-source-mappings
|
|
- threat-mappings
|
|
- tls-mappings
|
|
- url-mappings
|
|
- user_agent-mappings
|
|
- dtc-user_agent-mappings
|
|
- common-settings
|
|
- common-dynamic-mappings
|
|
priority: 500
|
|
so-logstash:
|
|
index_sorting: False
|
|
index_template:
|
|
index_patterns:
|
|
- so-logstash*
|
|
template:
|
|
mappings:
|
|
dynamic_templates:
|
|
- strings_as_keyword:
|
|
mapping:
|
|
ignore_above: 1024
|
|
type: keyword
|
|
match_mapping_type: string
|
|
date_detection: false
|
|
settings:
|
|
index:
|
|
mapping:
|
|
total_fields:
|
|
limit: 3000
|
|
sort:
|
|
field: "@timestamp"
|
|
order: desc
|
|
refresh_interval: 30s
|
|
number_of_shards: 1
|
|
number_of_replicas: 0
|
|
composed_of:
|
|
- agent-mappings
|
|
- dtc-agent-mappings
|
|
- base-mappings
|
|
- dtc-base-mappings
|
|
- client-mappings
|
|
- cloud-mappings
|
|
- container-mappings
|
|
- data_stream-mappings
|
|
- destination-mappings
|
|
- pb-override-destination-mappings
|
|
- dll-mappings
|
|
- dns-mappings
|
|
- dtc-dns-mappings
|
|
- ecs-mappings
|
|
- dtc-ecs-mappings
|
|
- error-mappings
|
|
- event-mappings
|
|
- dtc-event-mappings
|
|
- file-mappings
|
|
- dtc-file-mappings
|
|
- group-mappings
|
|
- host-mappings
|
|
- dtc-host-mappings
|
|
- http-mappings
|
|
- dtc-http-mappings
|
|
- log-mappings
|
|
- logstash-mappings
|
|
- network-mappings
|
|
- dtc-network-mappings
|
|
- observer-mappings
|
|
- dtc-observer-mappings
|
|
- orchestrator-mappings
|
|
- organization-mappings
|
|
- package-mappings
|
|
- process-mappings
|
|
- dtc-process-mappings
|
|
- registry-mappings
|
|
- related-mappings
|
|
- rule-mappings
|
|
- dtc-rule-mappings
|
|
- server-mappings
|
|
- service-mappings
|
|
- dtc-service-mappings
|
|
- source-mappings
|
|
- pb-override-source-mappings
|
|
- threat-mappings
|
|
- tls-mappings
|
|
- tracing-mappings
|
|
- url-mappings
|
|
- user_agent-mappings
|
|
- dtc-user_agent-mappings
|
|
- vulnerability-mappings
|
|
- common-settings
|
|
- common-dynamic-mappings
|
|
priority: 500
|
|
so-microsoft:
|
|
index_sorting: False
|
|
index_template:
|
|
index_patterns:
|
|
- so-microsoft*
|
|
template:
|
|
mappings:
|
|
dynamic_templates:
|
|
- strings_as_keyword:
|
|
mapping:
|
|
ignore_above: 1024
|
|
type: keyword
|
|
match_mapping_type: string
|
|
date_detection: false
|
|
settings:
|
|
index:
|
|
mapping:
|
|
total_fields:
|
|
limit: 3000
|
|
sort:
|
|
field: "@timestamp"
|
|
order: desc
|
|
refresh_interval: 30s
|
|
number_of_shards: 1
|
|
number_of_replicas: 0
|
|
composed_of:
|
|
- agent-mappings
|
|
- dtc-agent-mappings
|
|
- base-mappings
|
|
- dtc-base-mappings
|
|
- client-mappings
|
|
- cloud-mappings
|
|
- container-mappings
|
|
- data_stream-mappings
|
|
- destination-mappings
|
|
- pb-override-destination-mappings
|
|
- dll-mappings
|
|
- dns-mappings
|
|
- dtc-dns-mappings
|
|
- ecs-mappings
|
|
- dtc-ecs-mappings
|
|
- error-mappings
|
|
- event-mappings
|
|
- dtc-event-mappings
|
|
- file-mappings
|
|
- dtc-file-mappings
|
|
- group-mappings
|
|
- host-mappings
|
|
- dtc-host-mappings
|
|
- http-mappings
|
|
- dtc-http-mappings
|
|
- log-mappings
|
|
- microsoft-mappings
|
|
- network-mappings
|
|
- dtc-network-mappings
|
|
- observer-mappings
|
|
- dtc-observer-mappings
|
|
- orchestrator-mappings
|
|
- organization-mappings
|
|
- package-mappings
|
|
- process-mappings
|
|
- dtc-process-mappings
|
|
- registry-mappings
|
|
- related-mappings
|
|
- rule-mappings
|
|
- dtc-rule-mappings
|
|
- server-mappings
|
|
- service-mappings
|
|
- dtc-service-mappings
|
|
- source-mappings
|
|
- pb-override-source-mappings
|
|
- threat-mappings
|
|
- tls-mappings
|
|
- tracing-mappings
|
|
- url-mappings
|
|
- user_agent-mappings
|
|
- dtc-user_agent-mappings
|
|
- vulnerability-mappings
|
|
- common-settings
|
|
- common-dynamic-mappings
|
|
priority: 500
|
|
so-misp:
|
|
index_sorting: False
|
|
index_template:
|
|
index_patterns:
|
|
- so-misp*
|
|
template:
|
|
mappings:
|
|
dynamic_templates:
|
|
- strings_as_keyword:
|
|
mapping:
|
|
ignore_above: 1024
|
|
type: keyword
|
|
match_mapping_type: string
|
|
date_detection: false
|
|
settings:
|
|
index:
|
|
mapping:
|
|
total_fields:
|
|
limit: 3000
|
|
sort:
|
|
field: "@timestamp"
|
|
order: desc
|
|
refresh_interval: 30s
|
|
number_of_shards: 1
|
|
number_of_replicas: 0
|
|
composed_of:
|
|
- agent-mappings
|
|
- dtc-agent-mappings
|
|
- base-mappings
|
|
- dtc-base-mappings
|
|
- client-mappings
|
|
- cloud-mappings
|
|
- container-mappings
|
|
- data_stream-mappings
|
|
- destination-mappings
|
|
- pb-override-destination-mappings
|
|
- dll-mappings
|
|
- dns-mappings
|
|
- dtc-dns-mappings
|
|
- ecs-mappings
|
|
- dtc-ecs-mappings
|
|
- error-mappings
|
|
- event-mappings
|
|
- dtc-event-mappings
|
|
- file-mappings
|
|
- dtc-file-mappings
|
|
- group-mappings
|
|
- host-mappings
|
|
- dtc-host-mappings
|
|
- http-mappings
|
|
- dtc-http-mappings
|
|
- log-mappings
|
|
- misp-mappings
|
|
- network-mappings
|
|
- dtc-network-mappings
|
|
- observer-mappings
|
|
- dtc-observer-mappings
|
|
- orchestrator-mappings
|
|
- organization-mappings
|
|
- package-mappings
|
|
- process-mappings
|
|
- dtc-process-mappings
|
|
- registry-mappings
|
|
- related-mappings
|
|
- rule-mappings
|
|
- dtc-rule-mappings
|
|
- server-mappings
|
|
- service-mappings
|
|
- dtc-service-mappings
|
|
- source-mappings
|
|
- pb-override-source-mappings
|
|
- threat-mappings
|
|
- tls-mappings
|
|
- tracing-mappings
|
|
- url-mappings
|
|
- user_agent-mappings
|
|
- dtc-user_agent-mappings
|
|
- vulnerability-mappings
|
|
- common-settings
|
|
- common-dynamic-mappings
|
|
priority: 500
|
|
so-netflow:
|
|
index_sorting: False
|
|
index_template:
|
|
index_patterns:
|
|
- so-netflow*
|
|
template:
|
|
mappings:
|
|
dynamic_templates:
|
|
- strings_as_keyword:
|
|
mapping:
|
|
ignore_above: 1024
|
|
type: keyword
|
|
match_mapping_type: string
|
|
date_detection: false
|
|
settings:
|
|
index:
|
|
mapping:
|
|
total_fields:
|
|
limit: 3000
|
|
sort:
|
|
field: "@timestamp"
|
|
order: desc
|
|
refresh_interval: 30s
|
|
number_of_shards: 1
|
|
number_of_replicas: 0
|
|
composed_of:
|
|
- agent-mappings
|
|
- dtc-agent-mappings
|
|
- base-mappings
|
|
- dtc-base-mappings
|
|
- client-mappings
|
|
- cloud-mappings
|
|
- container-mappings
|
|
- data_stream-mappings
|
|
- destination-mappings
|
|
- pb-override-destination-mappings
|
|
- dll-mappings
|
|
- dns-mappings
|
|
- dtc-dns-mappings
|
|
- ecs-mappings
|
|
- dtc-ecs-mappings
|
|
- error-mappings
|
|
- event-mappings
|
|
- dtc-event-mappings
|
|
- file-mappings
|
|
- dtc-file-mappings
|
|
- group-mappings
|
|
- host-mappings
|
|
- dtc-host-mappings
|
|
- http-mappings
|
|
- dtc-http-mappings
|
|
- log-mappings
|
|
- netflow-mappings
|
|
- network-mappings
|
|
- dtc-network-mappings
|
|
- observer-mappings
|
|
- dtc-observer-mappings
|
|
- orchestrator-mappings
|
|
- organization-mappings
|
|
- package-mappings
|
|
- process-mappings
|
|
- dtc-process-mappings
|
|
- registry-mappings
|
|
- related-mappings
|
|
- rule-mappings
|
|
- dtc-rule-mappings
|
|
- server-mappings
|
|
- service-mappings
|
|
- dtc-service-mappings
|
|
- source-mappings
|
|
- pb-override-source-mappings
|
|
- threat-mappings
|
|
- tls-mappings
|
|
- tracing-mappings
|
|
- url-mappings
|
|
- user_agent-mappings
|
|
- dtc-user_agent-mappings
|
|
- vulnerability-mappings
|
|
- common-settings
|
|
- common-dynamic-mappings
|
|
priority: 500
|
|
so-netscout:
|
|
index_sorting: False
|
|
index_template:
|
|
index_patterns:
|
|
- so-netscout*
|
|
template:
|
|
mappings:
|
|
dynamic_templates:
|
|
- strings_as_keyword:
|
|
mapping:
|
|
ignore_above: 1024
|
|
type: keyword
|
|
match_mapping_type: string
|
|
date_detection: false
|
|
settings:
|
|
index:
|
|
mapping:
|
|
total_fields:
|
|
limit: 3000
|
|
sort:
|
|
field: "@timestamp"
|
|
order: desc
|
|
refresh_interval: 30s
|
|
number_of_shards: 1
|
|
number_of_replicas: 0
|
|
composed_of:
|
|
- agent-mappings
|
|
- dtc-agent-mappings
|
|
- base-mappings
|
|
- dtc-base-mappings
|
|
- client-mappings
|
|
- cloud-mappings
|
|
- container-mappings
|
|
- data_stream-mappings
|
|
- destination-mappings
|
|
- pb-override-destination-mappings
|
|
- dll-mappings
|
|
- dns-mappings
|
|
- dtc-dns-mappings
|
|
- ecs-mappings
|
|
- dtc-ecs-mappings
|
|
- error-mappings
|
|
- event-mappings
|
|
- dtc-event-mappings
|
|
- file-mappings
|
|
- dtc-file-mappings
|
|
- group-mappings
|
|
- host-mappings
|
|
- dtc-host-mappings
|
|
- http-mappings
|
|
- dtc-http-mappings
|
|
- log-mappings
|
|
- network-mappings
|
|
- dtc-network-mappings
|
|
- observer-mappings
|
|
- dtc-observer-mappings
|
|
- orchestrator-mappings
|
|
- organization-mappings
|
|
- package-mappings
|
|
- process-mappings
|
|
- dtc-process-mappings
|
|
- registry-mappings
|
|
- related-mappings
|
|
- rule-mappings
|
|
- dtc-rule-mappings
|
|
- server-mappings
|
|
- service-mappings
|
|
- dtc-service-mappings
|
|
- source-mappings
|
|
- pb-override-source-mappings
|
|
- threat-mappings
|
|
- tls-mappings
|
|
- tracing-mappings
|
|
- url-mappings
|
|
- user_agent-mappings
|
|
- dtc-user_agent-mappings
|
|
- vulnerability-mappings
|
|
- common-settings
|
|
- common-dynamic-mappings
|
|
priority: 500
|
|
so-o365:
|
|
index_sorting: False
|
|
index_template:
|
|
index_patterns:
|
|
- so-o365*
|
|
template:
|
|
mappings:
|
|
dynamic_templates:
|
|
- strings_as_keyword:
|
|
mapping:
|
|
ignore_above: 1024
|
|
type: keyword
|
|
match_mapping_type: string
|
|
date_detection: false
|
|
settings:
|
|
index:
|
|
mapping:
|
|
total_fields:
|
|
limit: 3000
|
|
sort:
|
|
field: "@timestamp"
|
|
order: desc
|
|
refresh_interval: 30s
|
|
number_of_shards: 1
|
|
number_of_replicas: 0
|
|
composed_of:
|
|
- agent-mappings
|
|
- dtc-agent-mappings
|
|
- base-mappings
|
|
- dtc-base-mappings
|
|
- client-mappings
|
|
- cloud-mappings
|
|
- container-mappings
|
|
- data_stream-mappings
|
|
- destination-mappings
|
|
- pb-override-destination-mappings
|
|
- dll-mappings
|
|
- dns-mappings
|
|
- dtc-dns-mappings
|
|
- ecs-mappings
|
|
- dtc-ecs-mappings
|
|
- error-mappings
|
|
- event-mappings
|
|
- dtc-event-mappings
|
|
- file-mappings
|
|
- dtc-file-mappings
|
|
- group-mappings
|
|
- host-mappings
|
|
- dtc-host-mappings
|
|
- http-mappings
|
|
- dtc-http-mappings
|
|
- log-mappings
|
|
- network-mappings
|
|
- dtc-network-mappings
|
|
- observer-mappings
|
|
- dtc-observer-mappings
|
|
- o365-mappings
|
|
- orchestrator-mappings
|
|
- organization-mappings
|
|
- package-mappings
|
|
- process-mappings
|
|
- dtc-process-mappings
|
|
- registry-mappings
|
|
- related-mappings
|
|
- rule-mappings
|
|
- dtc-rule-mappings
|
|
- server-mappings
|
|
- service-mappings
|
|
- dtc-service-mappings
|
|
- source-mappings
|
|
- pb-override-source-mappings
|
|
- threat-mappings
|
|
- tls-mappings
|
|
- tracing-mappings
|
|
- url-mappings
|
|
- user_agent-mappings
|
|
- dtc-user_agent-mappings
|
|
- vulnerability-mappings
|
|
- common-settings
|
|
- common-dynamic-mappings
|
|
priority: 500
|
|
so-okta:
|
|
index_sorting: False
|
|
index_template:
|
|
index_patterns:
|
|
- so-okta*
|
|
template:
|
|
mappings:
|
|
dynamic_templates:
|
|
- strings_as_keyword:
|
|
mapping:
|
|
ignore_above: 1024
|
|
type: keyword
|
|
match_mapping_type: string
|
|
date_detection: false
|
|
settings:
|
|
index:
|
|
mapping:
|
|
total_fields:
|
|
limit: 3000
|
|
sort:
|
|
field: "@timestamp"
|
|
order: desc
|
|
refresh_interval: 30s
|
|
number_of_shards: 1
|
|
number_of_replicas: 0
|
|
composed_of:
|
|
- agent-mappings
|
|
- dtc-agent-mappings
|
|
- base-mappings
|
|
- dtc-base-mappings
|
|
- client-mappings
|
|
- cloud-mappings
|
|
- container-mappings
|
|
- data_stream-mappings
|
|
- destination-mappings
|
|
- pb-override-destination-mappings
|
|
- dll-mappings
|
|
- dns-mappings
|
|
- dtc-dns-mappings
|
|
- ecs-mappings
|
|
- dtc-ecs-mappings
|
|
- error-mappings
|
|
- event-mappings
|
|
- dtc-event-mappings
|
|
- file-mappings
|
|
- dtc-file-mappings
|
|
- group-mappings
|
|
- host-mappings
|
|
- dtc-host-mappings
|
|
- http-mappings
|
|
- dtc-http-mappings
|
|
- log-mappings
|
|
- network-mappings
|
|
- dtc-network-mappings
|
|
- observer-mappings
|
|
- dtc-observer-mappings
|
|
- okta-mappings
|
|
- orchestrator-mappings
|
|
- organization-mappings
|
|
- package-mappings
|
|
- process-mappings
|
|
- dtc-process-mappings
|
|
- registry-mappings
|
|
- related-mappings
|
|
- rule-mappings
|
|
- dtc-rule-mappings
|
|
- server-mappings
|
|
- service-mappings
|
|
- dtc-service-mappings
|
|
- source-mappings
|
|
- pb-override-source-mappings
|
|
- threat-mappings
|
|
- tls-mappings
|
|
- tracing-mappings
|
|
- url-mappings
|
|
- user_agent-mappings
|
|
- dtc-user_agent-mappings
|
|
- vulnerability-mappings
|
|
- common-settings
|
|
- common-dynamic-mappings
|
|
priority: 500
|
|
so-osquery:
|
|
index_sorting: False
|
|
index_template:
|
|
index_patterns:
|
|
- so-osquery*
|
|
template:
|
|
mappings:
|
|
dynamic_templates:
|
|
- strings_as_keyword:
|
|
mapping:
|
|
ignore_above: 1024
|
|
type: keyword
|
|
match_mapping_type: string
|
|
date_detection: false
|
|
settings:
|
|
index:
|
|
mapping:
|
|
total_fields:
|
|
limit: 3000
|
|
sort:
|
|
field: "@timestamp"
|
|
order: desc
|
|
refresh_interval: 30s
|
|
number_of_shards: 1
|
|
number_of_replicas: 0
|
|
composed_of:
|
|
- agent-mappings
|
|
- dtc-agent-mappings
|
|
- base-mappings
|
|
- dtc-base-mappings
|
|
- client-mappings
|
|
- cloud-mappings
|
|
- container-mappings
|
|
- data_stream-mappings
|
|
- destination-mappings
|
|
- pb-override-destination-mappings
|
|
- dll-mappings
|
|
- dns-mappings
|
|
- dtc-dns-mappings
|
|
- ecs-mappings
|
|
- dtc-ecs-mappings
|
|
- error-mappings
|
|
- event-mappings
|
|
- dtc-event-mappings
|
|
- file-mappings
|
|
- dtc-file-mappings
|
|
- group-mappings
|
|
- host-mappings
|
|
- dtc-host-mappings
|
|
- http-mappings
|
|
- dtc-http-mappings
|
|
- log-mappings
|
|
- network-mappings
|
|
- dtc-network-mappings
|
|
- observer-mappings
|
|
- dtc-observer-mappings
|
|
- orchestrator-mappings
|
|
- organization-mappings
|
|
- package-mappings
|
|
- process-mappings
|
|
- dtc-process-mappings
|
|
- registry-mappings
|
|
- related-mappings
|
|
- rule-mappings
|
|
- dtc-rule-mappings
|
|
- server-mappings
|
|
- service-mappings
|
|
- dtc-service-mappings
|
|
- source-mappings
|
|
- pb-override-source-mappings
|
|
- threat-mappings
|
|
- tls-mappings
|
|
- tracing-mappings
|
|
- url-mappings
|
|
- user_agent-mappings
|
|
- dtc-user_agent-mappings
|
|
- vulnerability-mappings
|
|
- common-settings
|
|
- common-dynamic-mappings
|
|
- winlog-mappings
|
|
priority: 500
|
|
so-ossec:
|
|
index_sorting: False
|
|
index_template:
|
|
index_patterns:
|
|
- so-ossec*
|
|
template:
|
|
mappings:
|
|
dynamic_templates:
|
|
- strings_as_keyword:
|
|
mapping:
|
|
ignore_above: 1024
|
|
type: keyword
|
|
match_mapping_type: string
|
|
date_detection: false
|
|
settings:
|
|
index:
|
|
mapping:
|
|
total_fields:
|
|
limit: 3000
|
|
sort:
|
|
field: "@timestamp"
|
|
order: desc
|
|
refresh_interval: 30s
|
|
number_of_shards: 1
|
|
number_of_replicas: 0
|
|
composed_of:
|
|
- agent-mappings
|
|
- dtc-agent-mappings
|
|
- base-mappings
|
|
- dtc-base-mappings
|
|
- client-mappings
|
|
- cloud-mappings
|
|
- container-mappings
|
|
- data_stream-mappings
|
|
- destination-mappings
|
|
- pb-override-destination-mappings
|
|
- dll-mappings
|
|
- dns-mappings
|
|
- dtc-dns-mappings
|
|
- ecs-mappings
|
|
- dtc-ecs-mappings
|
|
- error-mappings
|
|
- event-mappings
|
|
- dtc-event-mappings
|
|
- file-mappings
|
|
- dtc-file-mappings
|
|
- group-mappings
|
|
- host-mappings
|
|
- dtc-host-mappings
|
|
- http-mappings
|
|
- dtc-http-mappings
|
|
- log-mappings
|
|
- network-mappings
|
|
- dtc-network-mappings
|
|
- observer-mappings
|
|
- dtc-observer-mappings
|
|
- orchestrator-mappings
|
|
- organization-mappings
|
|
- package-mappings
|
|
- process-mappings
|
|
- dtc-process-mappings
|
|
- registry-mappings
|
|
- related-mappings
|
|
- rule-mappings
|
|
- dtc-rule-mappings
|
|
- server-mappings
|
|
- service-mappings
|
|
- dtc-service-mappings
|
|
- source-mappings
|
|
- pb-override-source-mappings
|
|
- threat-mappings
|
|
- tls-mappings
|
|
- tracing-mappings
|
|
- url-mappings
|
|
- user_agent-mappings
|
|
- dtc-user_agent-mappings
|
|
- vulnerability-mappings
|
|
- common-settings
|
|
- common-dynamic-mappings
|
|
- winlog-mappings
|
|
priority: 500
|
|
so-proofpoint:
|
|
index_sorting: False
|
|
index_template:
|
|
index_patterns:
|
|
- so-proofpoint*
|
|
template:
|
|
mappings:
|
|
dynamic_templates:
|
|
- strings_as_keyword:
|
|
mapping:
|
|
ignore_above: 1024
|
|
type: keyword
|
|
match_mapping_type: string
|
|
date_detection: false
|
|
settings:
|
|
index:
|
|
mapping:
|
|
total_fields:
|
|
limit: 3000
|
|
sort:
|
|
field: "@timestamp"
|
|
order: desc
|
|
refresh_interval: 30s
|
|
number_of_shards: 1
|
|
number_of_replicas: 0
|
|
composed_of:
|
|
- agent-mappings
|
|
- dtc-agent-mappings
|
|
- base-mappings
|
|
- dtc-base-mappings
|
|
- client-mappings
|
|
- cloud-mappings
|
|
- container-mappings
|
|
- data_stream-mappings
|
|
- destination-mappings
|
|
- pb-override-destination-mappings
|
|
- dll-mappings
|
|
- dns-mappings
|
|
- dtc-dns-mappings
|
|
- ecs-mappings
|
|
- dtc-ecs-mappings
|
|
- error-mappings
|
|
- event-mappings
|
|
- dtc-event-mappings
|
|
- file-mappings
|
|
- dtc-file-mappings
|
|
- group-mappings
|
|
- host-mappings
|
|
- dtc-host-mappings
|
|
- http-mappings
|
|
- dtc-http-mappings
|
|
- log-mappings
|
|
- network-mappings
|
|
- dtc-network-mappings
|
|
- observer-mappings
|
|
- dtc-observer-mappings
|
|
- orchestrator-mappings
|
|
- organization-mappings
|
|
- package-mappings
|
|
- process-mappings
|
|
- dtc-process-mappings
|
|
- registry-mappings
|
|
- related-mappings
|
|
- rule-mappings
|
|
- dtc-rule-mappings
|
|
- server-mappings
|
|
- service-mappings
|
|
- dtc-service-mappings
|
|
- source-mappings
|
|
- pb-override-source-mappings
|
|
- threat-mappings
|
|
- tls-mappings
|
|
- tracing-mappings
|
|
- url-mappings
|
|
- user_agent-mappings
|
|
- dtc-user_agent-mappings
|
|
- vulnerability-mappings
|
|
- common-settings
|
|
- common-dynamic-mappings
|
|
priority: 500
|
|
so-radware:
|
|
index_sorting: False
|
|
index_template:
|
|
index_patterns:
|
|
- so-radware*
|
|
template:
|
|
mappings:
|
|
dynamic_templates:
|
|
- strings_as_keyword:
|
|
mapping:
|
|
ignore_above: 1024
|
|
type: keyword
|
|
match_mapping_type: string
|
|
date_detection: false
|
|
settings:
|
|
index:
|
|
mapping:
|
|
total_fields:
|
|
limit: 3000
|
|
sort:
|
|
field: "@timestamp"
|
|
order: desc
|
|
refresh_interval: 30s
|
|
number_of_shards: 1
|
|
number_of_replicas: 0
|
|
composed_of:
|
|
- agent-mappings
|
|
- dtc-agent-mappings
|
|
- base-mappings
|
|
- dtc-base-mappings
|
|
- client-mappings
|
|
- cloud-mappings
|
|
- container-mappings
|
|
- data_stream-mappings
|
|
- destination-mappings
|
|
- pb-override-destination-mappings
|
|
- dll-mappings
|
|
- dns-mappings
|
|
- dtc-dns-mappings
|
|
- ecs-mappings
|
|
- dtc-ecs-mappings
|
|
- error-mappings
|
|
- event-mappings
|
|
- dtc-event-mappings
|
|
- file-mappings
|
|
- dtc-file-mappings
|
|
- group-mappings
|
|
- host-mappings
|
|
- dtc-host-mappings
|
|
- http-mappings
|
|
- dtc-http-mappings
|
|
- log-mappings
|
|
- network-mappings
|
|
- dtc-network-mappings
|
|
- observer-mappings
|
|
- dtc-observer-mappings
|
|
- orchestrator-mappings
|
|
- organization-mappings
|
|
- package-mappings
|
|
- process-mappings
|
|
- dtc-process-mappings
|
|
- registry-mappings
|
|
- related-mappings
|
|
- rule-mappings
|
|
- dtc-rule-mappings
|
|
- server-mappings
|
|
- service-mappings
|
|
- dtc-service-mappings
|
|
- source-mappings
|
|
- pb-override-source-mappings
|
|
- threat-mappings
|
|
- tls-mappings
|
|
- tracing-mappings
|
|
- url-mappings
|
|
- user_agent-mappings
|
|
- dtc-user_agent-mappings
|
|
- vulnerability-mappings
|
|
- common-settings
|
|
- common-dynamic-mappings
|
|
priority: 500
|
|
so-redis:
|
|
index_sorting: False
|
|
index_template:
|
|
index_patterns:
|
|
- so-redis*
|
|
template:
|
|
mappings:
|
|
dynamic_templates:
|
|
- strings_as_keyword:
|
|
mapping:
|
|
ignore_above: 1024
|
|
type: keyword
|
|
match_mapping_type: string
|
|
date_detection: false
|
|
settings:
|
|
index:
|
|
mapping:
|
|
total_fields:
|
|
limit: 3000
|
|
sort:
|
|
field: "@timestamp"
|
|
order: desc
|
|
refresh_interval: 30s
|
|
number_of_shards: 1
|
|
number_of_replicas: 0
|
|
composed_of:
|
|
- agent-mappings
|
|
- dtc-agent-mappings
|
|
- base-mappings
|
|
- dtc-base-mappings
|
|
- client-mappings
|
|
- cloud-mappings
|
|
- container-mappings
|
|
- data_stream-mappings
|
|
- destination-mappings
|
|
- pb-override-destination-mappings
|
|
- dll-mappings
|
|
- dns-mappings
|
|
- dtc-dns-mappings
|
|
- ecs-mappings
|
|
- dtc-ecs-mappings
|
|
- error-mappings
|
|
- event-mappings
|
|
- dtc-event-mappings
|
|
- file-mappings
|
|
- dtc-file-mappings
|
|
- group-mappings
|
|
- host-mappings
|
|
- dtc-host-mappings
|
|
- http-mappings
|
|
- dtc-http-mappings
|
|
- log-mappings
|
|
- network-mappings
|
|
- dtc-network-mappings
|
|
- observer-mappings
|
|
- dtc-observer-mappings
|
|
- orchestrator-mappings
|
|
- organization-mappings
|
|
- package-mappings
|
|
- process-mappings
|
|
- dtc-process-mappings
|
|
- redis-mappings
|
|
- registry-mappings
|
|
- related-mappings
|
|
- rule-mappings
|
|
- dtc-rule-mappings
|
|
- server-mappings
|
|
- service-mappings
|
|
- dtc-service-mappings
|
|
- source-mappings
|
|
- pb-override-source-mappings
|
|
- threat-mappings
|
|
- tls-mappings
|
|
- tracing-mappings
|
|
- url-mappings
|
|
- user_agent-mappings
|
|
- dtc-user_agent-mappings
|
|
- vulnerability-mappings
|
|
- common-settings
|
|
- common-dynamic-mappings
|
|
priority: 500
|
|
so-snort:
|
|
index_sorting: False
|
|
index_template:
|
|
index_patterns:
|
|
- so-snort*
|
|
template:
|
|
mappings:
|
|
dynamic_templates:
|
|
- strings_as_keyword:
|
|
mapping:
|
|
ignore_above: 1024
|
|
type: keyword
|
|
match_mapping_type: string
|
|
date_detection: false
|
|
settings:
|
|
index:
|
|
mapping:
|
|
total_fields:
|
|
limit: 3000
|
|
sort:
|
|
field: "@timestamp"
|
|
order: desc
|
|
refresh_interval: 30s
|
|
number_of_shards: 1
|
|
number_of_replicas: 0
|
|
composed_of:
|
|
- agent-mappings
|
|
- dtc-agent-mappings
|
|
- base-mappings
|
|
- dtc-base-mappings
|
|
- client-mappings
|
|
- cloud-mappings
|
|
- container-mappings
|
|
- data_stream-mappings
|
|
- destination-mappings
|
|
- pb-override-destination-mappings
|
|
- dll-mappings
|
|
- dns-mappings
|
|
- dtc-dns-mappings
|
|
- ecs-mappings
|
|
- dtc-ecs-mappings
|
|
- error-mappings
|
|
- event-mappings
|
|
- dtc-event-mappings
|
|
- file-mappings
|
|
- dtc-file-mappings
|
|
- group-mappings
|
|
- host-mappings
|
|
- dtc-host-mappings
|
|
- http-mappings
|
|
- dtc-http-mappings
|
|
- log-mappings
|
|
- network-mappings
|
|
- dtc-network-mappings
|
|
- observer-mappings
|
|
- dtc-observer-mappings
|
|
- orchestrator-mappings
|
|
- organization-mappings
|
|
- package-mappings
|
|
- process-mappings
|
|
- dtc-process-mappings
|
|
- registry-mappings
|
|
- related-mappings
|
|
- rule-mappings
|
|
- dtc-rule-mappings
|
|
- server-mappings
|
|
- service-mappings
|
|
- dtc-service-mappings
|
|
- source-mappings
|
|
- pb-override-source-mappings
|
|
- threat-mappings
|
|
- tls-mappings
|
|
- tracing-mappings
|
|
- url-mappings
|
|
- user_agent-mappings
|
|
- dtc-user_agent-mappings
|
|
- vulnerability-mappings
|
|
- common-settings
|
|
- common-dynamic-mappings
|
|
priority: 500
|
|
so-snyk:
|
|
index_sorting: False
|
|
index_template:
|
|
index_patterns:
|
|
- so-snyk*
|
|
template:
|
|
mappings:
|
|
dynamic_templates:
|
|
- strings_as_keyword:
|
|
mapping:
|
|
ignore_above: 1024
|
|
type: keyword
|
|
match_mapping_type: string
|
|
date_detection: false
|
|
settings:
|
|
index:
|
|
mapping:
|
|
total_fields:
|
|
limit: 3000
|
|
sort:
|
|
field: "@timestamp"
|
|
order: desc
|
|
refresh_interval: 30s
|
|
number_of_shards: 1
|
|
number_of_replicas: 0
|
|
composed_of:
|
|
- agent-mappings
|
|
- dtc-agent-mappings
|
|
- base-mappings
|
|
- dtc-base-mappings
|
|
- client-mappings
|
|
- cloud-mappings
|
|
- container-mappings
|
|
- data_stream-mappings
|
|
- destination-mappings
|
|
- pb-override-destination-mappings
|
|
- dll-mappings
|
|
- dns-mappings
|
|
- dtc-dns-mappings
|
|
- ecs-mappings
|
|
- dtc-ecs-mappings
|
|
- error-mappings
|
|
- event-mappings
|
|
- dtc-event-mappings
|
|
- file-mappings
|
|
- dtc-file-mappings
|
|
- group-mappings
|
|
- host-mappings
|
|
- dtc-host-mappings
|
|
- http-mappings
|
|
- dtc-http-mappings
|
|
- log-mappings
|
|
- network-mappings
|
|
- dtc-network-mappings
|
|
- observer-mappings
|
|
- dtc-observer-mappings
|
|
- orchestrator-mappings
|
|
- organization-mappings
|
|
- package-mappings
|
|
- process-mappings
|
|
- dtc-process-mappings
|
|
- registry-mappings
|
|
- related-mappings
|
|
- rule-mappings
|
|
- dtc-rule-mappings
|
|
- server-mappings
|
|
- service-mappings
|
|
- dtc-service-mappings
|
|
- snyk-mappings
|
|
- source-mappings
|
|
- pb-override-source-mappings
|
|
- threat-mappings
|
|
- tls-mappings
|
|
- tracing-mappings
|
|
- url-mappings
|
|
- user_agent-mappings
|
|
- dtc-user_agent-mappings
|
|
- vulnerability-mappings
|
|
- common-settings
|
|
- common-dynamic-mappings
|
|
priority: 500
|
|
so-sonicwall:
|
|
index_sorting: False
|
|
index_template:
|
|
index_patterns:
|
|
- so-sonicwall*
|
|
template:
|
|
mappings:
|
|
dynamic_templates:
|
|
- strings_as_keyword:
|
|
mapping:
|
|
ignore_above: 1024
|
|
type: keyword
|
|
match_mapping_type: string
|
|
date_detection: false
|
|
settings:
|
|
index:
|
|
mapping:
|
|
total_fields:
|
|
limit: 3000
|
|
sort:
|
|
field: "@timestamp"
|
|
order: desc
|
|
refresh_interval: 30s
|
|
number_of_shards: 1
|
|
number_of_replicas: 0
|
|
composed_of:
|
|
- agent-mappings
|
|
- dtc-agent-mappings
|
|
- base-mappings
|
|
- dtc-base-mappings
|
|
- client-mappings
|
|
- cloud-mappings
|
|
- container-mappings
|
|
- data_stream-mappings
|
|
- destination-mappings
|
|
- pb-override-destination-mappings
|
|
- dll-mappings
|
|
- dns-mappings
|
|
- dtc-dns-mappings
|
|
- ecs-mappings
|
|
- dtc-ecs-mappings
|
|
- error-mappings
|
|
- event-mappings
|
|
- dtc-event-mappings
|
|
- file-mappings
|
|
- dtc-file-mappings
|
|
- group-mappings
|
|
- host-mappings
|
|
- dtc-host-mappings
|
|
- http-mappings
|
|
- dtc-http-mappings
|
|
- log-mappings
|
|
- network-mappings
|
|
- dtc-network-mappings
|
|
- observer-mappings
|
|
- dtc-observer-mappings
|
|
- orchestrator-mappings
|
|
- organization-mappings
|
|
- package-mappings
|
|
- process-mappings
|
|
- dtc-process-mappings
|
|
- registry-mappings
|
|
- related-mappings
|
|
- rule-mappings
|
|
- dtc-rule-mappings
|
|
- server-mappings
|
|
- service-mappings
|
|
- dtc-service-mappings
|
|
- source-mappings
|
|
- pb-override-source-mappings
|
|
- threat-mappings
|
|
- tls-mappings
|
|
- tracing-mappings
|
|
- url-mappings
|
|
- user_agent-mappings
|
|
- dtc-user_agent-mappings
|
|
- vulnerability-mappings
|
|
- common-settings
|
|
- common-dynamic-mappings
|
|
priority: 500
|
|
so-sophos:
|
|
index_sorting: False
|
|
index_template:
|
|
index_patterns:
|
|
- so-sophos*
|
|
template:
|
|
mappings:
|
|
dynamic_templates:
|
|
- strings_as_keyword:
|
|
mapping:
|
|
ignore_above: 1024
|
|
type: keyword
|
|
match_mapping_type: string
|
|
date_detection: false
|
|
settings:
|
|
index:
|
|
mapping:
|
|
total_fields:
|
|
limit: 3000
|
|
sort:
|
|
field: "@timestamp"
|
|
order: desc
|
|
refresh_interval: 30s
|
|
number_of_shards: 1
|
|
number_of_replicas: 0
|
|
composed_of:
|
|
- agent-mappings
|
|
- dtc-agent-mappings
|
|
- base-mappings
|
|
- dtc-base-mappings
|
|
- client-mappings
|
|
- cloud-mappings
|
|
- container-mappings
|
|
- data_stream-mappings
|
|
- destination-mappings
|
|
- pb-override-destination-mappings
|
|
- dll-mappings
|
|
- dns-mappings
|
|
- dtc-dns-mappings
|
|
- ecs-mappings
|
|
- dtc-ecs-mappings
|
|
- error-mappings
|
|
- event-mappings
|
|
- dtc-event-mappings
|
|
- file-mappings
|
|
- dtc-file-mappings
|
|
- group-mappings
|
|
- host-mappings
|
|
- dtc-host-mappings
|
|
- http-mappings
|
|
- dtc-http-mappings
|
|
- log-mappings
|
|
- network-mappings
|
|
- dtc-network-mappings
|
|
- observer-mappings
|
|
- dtc-observer-mappings
|
|
- orchestrator-mappings
|
|
- organization-mappings
|
|
- package-mappings
|
|
- process-mappings
|
|
- dtc-process-mappings
|
|
- registry-mappings
|
|
- related-mappings
|
|
- rule-mappings
|
|
- dtc-rule-mappings
|
|
- server-mappings
|
|
- service-mappings
|
|
- dtc-service-mappings
|
|
- sophos-mappings
|
|
- source-mappings
|
|
- pb-override-source-mappings
|
|
- threat-mappings
|
|
- tls-mappings
|
|
- tracing-mappings
|
|
- url-mappings
|
|
- user_agent-mappings
|
|
- dtc-user_agent-mappings
|
|
- vulnerability-mappings
|
|
- common-settings
|
|
- common-dynamic-mappings
|
|
priority: 500
|
|
so-squid:
|
|
index_sorting: False
|
|
index_template:
|
|
index_patterns:
|
|
- so-squid*
|
|
template:
|
|
mappings:
|
|
dynamic_templates:
|
|
- strings_as_keyword:
|
|
mapping:
|
|
ignore_above: 1024
|
|
type: keyword
|
|
match_mapping_type: string
|
|
date_detection: false
|
|
settings:
|
|
index:
|
|
mapping:
|
|
total_fields:
|
|
limit: 3000
|
|
sort:
|
|
field: "@timestamp"
|
|
order: desc
|
|
refresh_interval: 30s
|
|
number_of_shards: 1
|
|
number_of_replicas: 0
|
|
composed_of:
|
|
- agent-mappings
|
|
- dtc-agent-mappings
|
|
- base-mappings
|
|
- dtc-base-mappings
|
|
- client-mappings
|
|
- cloud-mappings
|
|
- container-mappings
|
|
- data_stream-mappings
|
|
- destination-mappings
|
|
- pb-override-destination-mappings
|
|
- dll-mappings
|
|
- dns-mappings
|
|
- dtc-dns-mappings
|
|
- ecs-mappings
|
|
- dtc-ecs-mappings
|
|
- error-mappings
|
|
- event-mappings
|
|
- dtc-event-mappings
|
|
- file-mappings
|
|
- dtc-file-mappings
|
|
- group-mappings
|
|
- host-mappings
|
|
- dtc-host-mappings
|
|
- http-mappings
|
|
- dtc-http-mappings
|
|
- log-mappings
|
|
- network-mappings
|
|
- dtc-network-mappings
|
|
- observer-mappings
|
|
- dtc-observer-mappings
|
|
- orchestrator-mappings
|
|
- organization-mappings
|
|
- package-mappings
|
|
- process-mappings
|
|
- dtc-process-mappings
|
|
- registry-mappings
|
|
- related-mappings
|
|
- rule-mappings
|
|
- dtc-rule-mappings
|
|
- server-mappings
|
|
- service-mappings
|
|
- dtc-service-mappings
|
|
- source-mappings
|
|
- pb-override-source-mappings
|
|
- threat-mappings
|
|
- tls-mappings
|
|
- tracing-mappings
|
|
- url-mappings
|
|
- user_agent-mappings
|
|
- dtc-user_agent-mappings
|
|
- vulnerability-mappings
|
|
- common-settings
|
|
- common-dynamic-mappings
|
|
priority: 500
|
|
so-strelka:
|
|
index_sorting: False
|
|
index_template:
|
|
index_patterns:
|
|
- so-strelka*
|
|
template:
|
|
mappings:
|
|
dynamic_templates:
|
|
- strings_as_keyword:
|
|
mapping:
|
|
ignore_above: 1024
|
|
type: keyword
|
|
match_mapping_type: string
|
|
date_detection: false
|
|
settings:
|
|
index:
|
|
mapping:
|
|
total_fields:
|
|
limit: 3000
|
|
sort:
|
|
field: "@timestamp"
|
|
order: desc
|
|
refresh_interval: 30s
|
|
number_of_shards: 1
|
|
number_of_replicas: 0
|
|
composed_of:
|
|
- agent-mappings
|
|
- dtc-agent-mappings
|
|
- base-mappings
|
|
- dtc-base-mappings
|
|
- client-mappings
|
|
- cloud-mappings
|
|
- container-mappings
|
|
- data_stream-mappings
|
|
- destination-mappings
|
|
- pb-override-destination-mappings
|
|
- dll-mappings
|
|
- dns-mappings
|
|
- dtc-dns-mappings
|
|
- ecs-mappings
|
|
- dtc-ecs-mappings
|
|
- error-mappings
|
|
- event-mappings
|
|
- dtc-event-mappings
|
|
- file-mappings
|
|
- dtc-file-mappings
|
|
- so-file-mappings
|
|
- group-mappings
|
|
- host-mappings
|
|
- dtc-host-mappings
|
|
- http-mappings
|
|
- dtc-http-mappings
|
|
- log-mappings
|
|
- network-mappings
|
|
- dtc-network-mappings
|
|
- observer-mappings
|
|
- dtc-observer-mappings
|
|
- orchestrator-mappings
|
|
- organization-mappings
|
|
- package-mappings
|
|
- process-mappings
|
|
- dtc-process-mappings
|
|
- registry-mappings
|
|
- related-mappings
|
|
- rule-mappings
|
|
- dtc-rule-mappings
|
|
- server-mappings
|
|
- service-mappings
|
|
- dtc-service-mappings
|
|
- so-scan-mappings
|
|
- source-mappings
|
|
- pb-override-source-mappings
|
|
- threat-mappings
|
|
- tls-mappings
|
|
- tracing-mappings
|
|
- url-mappings
|
|
- user_agent-mappings
|
|
- dtc-user_agent-mappings
|
|
- vulnerability-mappings
|
|
- common-settings
|
|
- common-dynamic-mappings
|
|
priority: 500
|
|
so-syslog:
|
|
index_sorting: False
|
|
index_template:
|
|
index_patterns:
|
|
- so-syslog*
|
|
template:
|
|
mappings:
|
|
dynamic_templates:
|
|
- strings_as_keyword:
|
|
mapping:
|
|
ignore_above: 1024
|
|
type: keyword
|
|
match_mapping_type: string
|
|
date_detection: false
|
|
settings:
|
|
index:
|
|
mapping:
|
|
total_fields:
|
|
limit: 3000
|
|
sort:
|
|
field: "@timestamp"
|
|
order: desc
|
|
refresh_interval: 30s
|
|
number_of_shards: 1
|
|
number_of_replicas: 0
|
|
composed_of:
|
|
- agent-mappings
|
|
- dtc-agent-mappings
|
|
- base-mappings
|
|
- dtc-base-mappings
|
|
- client-mappings
|
|
- cloud-mappings
|
|
- container-mappings
|
|
- data_stream-mappings
|
|
- destination-mappings
|
|
- pb-override-destination-mappings
|
|
- dll-mappings
|
|
- dns-mappings
|
|
- dtc-dns-mappings
|
|
- ecs-mappings
|
|
- dtc-ecs-mappings
|
|
- error-mappings
|
|
- event-mappings
|
|
- dtc-event-mappings
|
|
- file-mappings
|
|
- dtc-file-mappings
|
|
- group-mappings
|
|
- host-mappings
|
|
- dtc-host-mappings
|
|
- http-mappings
|
|
- dtc-http-mappings
|
|
- log-mappings
|
|
- network-mappings
|
|
- dtc-network-mappings
|
|
- observer-mappings
|
|
- dtc-observer-mappings
|
|
- orchestrator-mappings
|
|
- organization-mappings
|
|
- package-mappings
|
|
- process-mappings
|
|
- dtc-process-mappings
|
|
- registry-mappings
|
|
- related-mappings
|
|
- rule-mappings
|
|
- dtc-rule-mappings
|
|
- server-mappings
|
|
- service-mappings
|
|
- dtc-service-mappings
|
|
- source-mappings
|
|
- pb-override-source-mappings
|
|
- syslog-mappings
|
|
- threat-mappings
|
|
- tls-mappings
|
|
- tracing-mappings
|
|
- url-mappings
|
|
- user_agent-mappings
|
|
- dtc-user_agent-mappings
|
|
- vulnerability-mappings
|
|
- common-settings
|
|
- common-dynamic-mappings
|
|
priority: 500
|
|
so-tomcat:
|
|
index_sorting: False
|
|
index_template:
|
|
index_patterns:
|
|
- so-tomcat*
|
|
template:
|
|
mappings:
|
|
dynamic_templates:
|
|
- strings_as_keyword:
|
|
mapping:
|
|
ignore_above: 1024
|
|
type: keyword
|
|
match_mapping_type: string
|
|
date_detection: false
|
|
settings:
|
|
index:
|
|
mapping:
|
|
total_fields:
|
|
limit: 3000
|
|
sort:
|
|
field: "@timestamp"
|
|
order: desc
|
|
refresh_interval: 30s
|
|
number_of_shards: 1
|
|
number_of_replicas: 0
|
|
composed_of:
|
|
- agent-mappings
|
|
- dtc-agent-mappings
|
|
- base-mappings
|
|
- dtc-base-mappings
|
|
- client-mappings
|
|
- cloud-mappings
|
|
- container-mappings
|
|
- data_stream-mappings
|
|
- destination-mappings
|
|
- pb-override-destination-mappings
|
|
- dll-mappings
|
|
- dns-mappings
|
|
- dtc-dns-mappings
|
|
- ecs-mappings
|
|
- dtc-ecs-mappings
|
|
- error-mappings
|
|
- event-mappings
|
|
- dtc-event-mappings
|
|
- file-mappings
|
|
- dtc-file-mappings
|
|
- group-mappings
|
|
- host-mappings
|
|
- dtc-host-mappings
|
|
- http-mappings
|
|
- dtc-http-mappings
|
|
- log-mappings
|
|
- network-mappings
|
|
- dtc-network-mappings
|
|
- observer-mappings
|
|
- dtc-observer-mappings
|
|
- orchestrator-mappings
|
|
- organization-mappings
|
|
- package-mappings
|
|
- process-mappings
|
|
- dtc-process-mappings
|
|
- registry-mappings
|
|
- related-mappings
|
|
- rule-mappings
|
|
- dtc-rule-mappings
|
|
- server-mappings
|
|
- service-mappings
|
|
- dtc-service-mappings
|
|
- source-mappings
|
|
- pb-override-source-mappings
|
|
- threat-mappings
|
|
- tls-mappings
|
|
- tracing-mappings
|
|
- url-mappings
|
|
- user_agent-mappings
|
|
- dtc-user_agent-mappings
|
|
- vulnerability-mappings
|
|
- common-settings
|
|
- common-dynamic-mappings
|
|
priority: 500
|
|
so-zeek:
|
|
index_sorting: False
|
|
index_template:
|
|
index_patterns:
|
|
- so-zeek*
|
|
template:
|
|
mappings:
|
|
dynamic_templates:
|
|
- strings_as_keyword:
|
|
mapping:
|
|
ignore_above: 1024
|
|
type: keyword
|
|
match_mapping_type: string
|
|
date_detection: false
|
|
settings:
|
|
index:
|
|
mapping:
|
|
total_fields:
|
|
limit: 3000
|
|
sort:
|
|
field: "@timestamp"
|
|
order: desc
|
|
refresh_interval: 30s
|
|
number_of_shards: 1
|
|
number_of_replicas: 0
|
|
composed_of:
|
|
- agent-mappings
|
|
- dtc-agent-mappings
|
|
- base-mappings
|
|
- dtc-base-mappings
|
|
- client-mappings
|
|
- cloud-mappings
|
|
- container-mappings
|
|
- data_stream-mappings
|
|
- destination-mappings
|
|
- pb-override-destination-mappings
|
|
- dll-mappings
|
|
- dns-mappings
|
|
- dtc-dns-mappings
|
|
- ecs-mappings
|
|
- dtc-ecs-mappings
|
|
- error-mappings
|
|
- event-mappings
|
|
- dtc-event-mappings
|
|
- file-mappings
|
|
- dtc-file-mappings
|
|
- group-mappings
|
|
- host-mappings
|
|
- dtc-host-mappings
|
|
- http-mappings
|
|
- dtc-http-mappings
|
|
- log-mappings
|
|
- network-mappings
|
|
- dtc-network-mappings
|
|
- observer-mappings
|
|
- dtc-observer-mappings
|
|
- orchestrator-mappings
|
|
- organization-mappings
|
|
- package-mappings
|
|
- process-mappings
|
|
- dtc-process-mappings
|
|
- registry-mappings
|
|
- related-mappings
|
|
- rule-mappings
|
|
- dtc-rule-mappings
|
|
- server-mappings
|
|
- service-mappings
|
|
- dtc-service-mappings
|
|
- source-mappings
|
|
- pb-override-source-mappings
|
|
- threat-mappings
|
|
- tls-mappings
|
|
- tracing-mappings
|
|
- url-mappings
|
|
- user_agent-mappings
|
|
- dtc-user_agent-mappings
|
|
- vulnerability-mappings
|
|
- zeek-mappings
|
|
- common-settings
|
|
- common-dynamic-mappings
|
|
priority: 500
|
|
so-zscaler:
|
|
index_sorting: False
|
|
index_template:
|
|
index_patterns:
|
|
- so-zscaler*
|
|
template:
|
|
mappings:
|
|
dynamic_templates:
|
|
- strings_as_keyword:
|
|
mapping:
|
|
ignore_above: 1024
|
|
type: keyword
|
|
match_mapping_type: string
|
|
date_detection: false
|
|
settings:
|
|
index:
|
|
mapping:
|
|
total_fields:
|
|
limit: 3000
|
|
sort:
|
|
field: "@timestamp"
|
|
order: desc
|
|
refresh_interval: 30s
|
|
number_of_shards: 1
|
|
number_of_replicas: 0
|
|
composed_of:
|
|
- agent-mappings
|
|
- dtc-agent-mappings
|
|
- base-mappings
|
|
- dtc-base-mappings
|
|
- client-mappings
|
|
- cloud-mappings
|
|
- container-mappings
|
|
- data_stream-mappings
|
|
- destination-mappings
|
|
- pb-override-destination-mappings
|
|
- dll-mappings
|
|
- dns-mappings
|
|
- dtc-dns-mappings
|
|
- ecs-mappings
|
|
- dtc-ecs-mappings
|
|
- error-mappings
|
|
- event-mappings
|
|
- dtc-event-mappings
|
|
- file-mappings
|
|
- dtc-file-mappings
|
|
- group-mappings
|
|
- host-mappings
|
|
- dtc-host-mappings
|
|
- http-mappings
|
|
- dtc-http-mappings
|
|
- log-mappings
|
|
- network-mappings
|
|
- dtc-network-mappings
|
|
- observer-mappings
|
|
- dtc-observer-mappings
|
|
- orchestrator-mappings
|
|
- organization-mappings
|
|
- package-mappings
|
|
- process-mappings
|
|
- dtc-process-mappings
|
|
- registry-mappings
|
|
- related-mappings
|
|
- rule-mappings
|
|
- dtc-rule-mappings
|
|
- server-mappings
|
|
- service-mappings
|
|
- dtc-service-mappings
|
|
- source-mappings
|
|
- pb-override-source-mappings
|
|
- threat-mappings
|
|
- tls-mappings
|
|
- tracing-mappings
|
|
- url-mappings
|
|
- user_agent-mappings
|
|
- dtc-user_agent-mappings
|
|
- vulnerability-mappings
|
|
- common-settings
|
|
- common-dynamic-mappings
|
|
priority: 500
|