mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2025-12-06 17:22:49 +01:00
25 lines
2.0 KiB
Plaintext
25 lines
2.0 KiB
Plaintext
{
|
|
"description" : "osquery",
|
|
"processors" : [
|
|
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
|
{ "gsub": { "field": "message2.columns.data", "pattern": "\\\\xC2\\\\xAE", "replacement": "", "ignore_missing": true } },
|
|
{ "rename": { "if": "ctx.message2.columns?.eventid != null", "field": "message2.columns", "target_field": "winlog", "ignore_missing": true } },
|
|
{ "json": { "field": "winlog.data", "target_field": "unparsed", "ignore_failure": true} },
|
|
{ "set": { "if": "!(ctx.unparsed?.EventData instanceof Map)", "field": "error.eventdata_parsing", "value": true, "ignore_failure": true } },
|
|
{ "rename": { "if": "!(ctx.error?.eventdata_parsing == true)", "field": "unparsed.EventData", "target_field": "winlog.event_data", "ignore_missing": true, "ignore_failure": true } },
|
|
{ "rename": { "field": "winlog.source", "target_field": "winlog.channel", "ignore_missing": true } },
|
|
{ "rename": { "field": "winlog.eventid", "target_field": "winlog.event_id", "ignore_missing": true } },
|
|
{ "pipeline": { "if": "ctx.winlog?.channel == 'Microsoft-Windows-Sysmon/Operational'", "name": "sysmon" } },
|
|
{ "pipeline": { "if": "ctx.winlog?.channel != 'Microsoft-Windows-Sysmon/Operational'", "name":"win.eventlogs" } },
|
|
{
|
|
"script": {
|
|
"lang": "painless",
|
|
"source": "def dict = ['result': new HashMap()]; for (entry in ctx['message2'].entrySet()) { dict['result'][entry.getKey()] = entry.getValue(); } ctx['osquery'] = dict; "
|
|
}
|
|
},
|
|
{ "set": { "field": "event.module", "value": "osquery", "override": false } },
|
|
{ "set": { "field": "event.dataset", "value": "{{osquery.result.name}}", "override": false} },
|
|
{ "pipeline": { "name": "common" } }
|
|
]
|
|
}
|