mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2025-12-06 17:22:49 +01:00
17 lines
1.4 KiB
HTTP
17 lines
1.4 KiB
HTTP
{
|
|
"description" : "suricata.http",
|
|
"processors" : [
|
|
{ "rename": { "field": "message2.proto", "target_field": "network.transport", "ignore_missing": true } },
|
|
{ "rename": { "field": "message2.app_proto", "target_field": "network.protocol", "ignore_missing": true } },
|
|
{ "rename": { "field": "message2.http.hostname", "target_field": "http.virtual_host", "ignore_missing": true } },
|
|
{ "rename": { "field": "message2.http.http_user_agent", "target_field": "http.useragent", "ignore_missing": true } },
|
|
{ "rename": { "field": "message2.http.url", "target_field": "http.uri", "ignore_missing": true } },
|
|
{ "rename": { "field": "message2.http.http_content_type", "target_field": "file.resp_mime_types", "ignore_missing": true } },
|
|
{ "rename": { "field": "message2.http.http_refer", "target_field": "http.referrer", "ignore_missing": true } },
|
|
{ "rename": { "field": "message2.http.http_method", "target_field": "http.method", "ignore_missing": true } },
|
|
{ "rename": { "field": "message2.http.protocol", "target_field": "http.version", "ignore_missing": true } },
|
|
{ "rename": { "field": "message2.http.status", "target_field": "http.status_code", "ignore_missing": true } },
|
|
{ "rename": { "field": "message2.http.length", "target_field": "http.request.body.length", "ignore_missing": true } },
|
|
{ "pipeline": { "name": "common" } }
|
|
]
|
|
} |