mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2025-12-06 09:12:45 +01:00
33 lines
2.9 KiB
Plaintext
33 lines
2.9 KiB
Plaintext
{
|
|
"description" : "bro_files",
|
|
"processors" : [
|
|
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
|
{ "rename": { "field": "message2.fuid", "target_field": "fuid", "ignore_missing": true } },
|
|
{ "rename": { "field": "message2.tx_hosts", "target_field": "file_ip", "ignore_missing": true } },
|
|
{ "rename": { "field": "message2.rx_hosts.0", "target_field": "destination_ip", "ignore_missing": true } },
|
|
{ "remove": { "field": "message2.rx_hosts", "ignore_missing": true } },
|
|
{ "rename": { "field": "message2.conn_uids", "target_field": "uid", "ignore_missing": true } },
|
|
{ "remove": { "field": "source", "ignore_missing": true } },
|
|
{ "rename": { "field": "message2.source", "target_field": "source", "ignore_missing": true } },
|
|
{ "rename": { "field": "message2.depth", "target_field": "depth", "ignore_missing": true } },
|
|
{ "rename": { "field": "message2.analyzers", "target_field": "analyzer", "ignore_missing": true } },
|
|
{ "rename": { "field": "message2.mime_type", "target_field": "mimetype", "ignore_missing": true } },
|
|
{ "rename": { "field": "message2.filename", "target_field": "file_name", "ignore_missing": true } },
|
|
{ "rename": { "field": "message2.duration", "target_field": "duration", "ignore_missing": true } },
|
|
{ "rename": { "field": "message2.local_orig", "target_field": "local_orig", "ignore_missing": true } },
|
|
{ "rename": { "field": "message2.is_orig", "target_field": "is_orig", "ignore_missing": true } },
|
|
{ "rename": { "field": "message2.seen_bytes", "target_field": "seen_bytes", "ignore_missing": true } },
|
|
{ "rename": { "field": "message2.total_bytes", "target_field": "total_bytes", "ignore_missing": true } },
|
|
{ "rename": { "field": "message2.missing_bytes", "target_field": "missing_bytes", "ignore_missing": true } },
|
|
{ "rename": { "field": "message2.overflow_bytes", "target_field": "overflow_bytes", "ignore_missing": true } },
|
|
{ "rename": { "field": "message2.timedout", "target_field": "timed_out", "ignore_missing": true } },
|
|
{ "rename": { "field": "message2.parent_fuid", "target_field": "parent_fuid", "ignore_missing": true } },
|
|
{ "rename": { "field": "message2.md5", "target_field": "md5", "ignore_missing": true } },
|
|
{ "rename": { "field": "message2.sha1", "target_field": "sha1", "ignore_missing": true } },
|
|
{ "rename": { "field": "message2.extracted", "target_field": "extracted", "ignore_missing": true } },
|
|
{ "rename": { "field": "message2.extracted_cutoff", "target_field": "extracted_cutoff", "ignore_missing": true } },
|
|
{ "rename": { "field": "message2.extracted_size", "target_field": "extracted_size", "ignore_missing": true } },
|
|
{ "pipeline": { "name": "bro_common" } }
|
|
]
|
|
}
|