mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2026-04-18 18:51:51 +02:00
52 lines
3.7 KiB
JSON
52 lines
3.7 KiB
JSON
{
|
|
"package": {
|
|
"name": "filestream",
|
|
"version": ""
|
|
},
|
|
"name": "import-evtx-logs",
|
|
"namespace": "so",
|
|
"description": "Import Windows EVTX logs",
|
|
"policy_id": "so-grid-nodes_general",
|
|
"policy_ids": [
|
|
"so-grid-nodes_general"
|
|
],
|
|
"vars": {},
|
|
"inputs": {
|
|
"filestream-filestream": {
|
|
"enabled": true,
|
|
"streams": {
|
|
"filestream.filestream": {
|
|
"enabled": true,
|
|
"vars": {
|
|
"paths": [
|
|
"/nsm/import/*/evtx/*.json"
|
|
],
|
|
"compression_gzip": false,
|
|
"use_logs_stream": false,
|
|
"data_stream.dataset": "import",
|
|
"parsers": "#- ndjson:\n# target: \"\"\n# message_key: msg\n#- multiline:\n# type: count\n# count_lines: 3\n",
|
|
"exclude_files": [
|
|
"\\.gz$"
|
|
],
|
|
"include_files": [],
|
|
"processors": "- dissect:\n tokenizer: \"/nsm/import/%{import.id}/evtx/%{import.file}\"\n field: \"log.file.path\"\n target_prefix: \"\"\n- decode_json_fields:\n fields: [\"message\"]\n target: \"\"\n- drop_fields:\n fields: [\"host\"]\n ignore_missing: true\n- add_fields:\n target: data_stream\n fields:\n type: logs\n dataset: system.security\n- add_fields:\n target: event\n fields:\n dataset: system.security\n module: system\n imported: true\n- add_fields:\n target: \"@metadata\"\n fields:\n pipeline: logs-system.security-2.13.0\n- if:\n equals:\n winlog.channel: 'Microsoft-Windows-Sysmon/Operational'\n then: \n - add_fields:\n target: data_stream\n fields:\n dataset: windows.sysmon_operational\n - add_fields:\n target: event\n fields:\n dataset: windows.sysmon_operational\n module: windows\n imported: true\n - add_fields:\n target: \"@metadata\"\n fields:\n pipeline: logs-windows.sysmon_operational-3.6.0\n- if:\n equals:\n winlog.channel: 'Application'\n then: \n - add_fields:\n target: data_stream\n fields:\n dataset: system.application\n - add_fields:\n target: event\n fields:\n dataset: system.application\n - add_fields:\n target: \"@metadata\"\n fields:\n pipeline: logs-system.application-2.13.0\n- if:\n equals:\n winlog.channel: 'System'\n then: \n - add_fields:\n target: data_stream\n fields:\n dataset: system.system\n - add_fields:\n target: event\n fields:\n dataset: system.system\n - add_fields:\n target: \"@metadata\"\n fields:\n pipeline: logs-system.system-2.13.0\n \n- if:\n equals:\n winlog.channel: 'Microsoft-Windows-PowerShell/Operational'\n then: \n - add_fields:\n target: data_stream\n fields:\n dataset: windows.powershell_operational\n - add_fields:\n target: event\n fields:\n dataset: windows.powershell_operational\n module: windows\n - add_fields:\n target: \"@metadata\"\n fields:\n pipeline: logs-windows.powershell_operational-3.6.0\n- add_fields:\n target: data_stream\n fields:\n dataset: import",
|
|
"tags": [
|
|
"import"
|
|
],
|
|
"recursive_glob": true,
|
|
"ignore_older": "72h",
|
|
"clean_inactive": -1,
|
|
"harvester_limit": 0,
|
|
"fingerprint": false,
|
|
"fingerprint_offset": 0,
|
|
"file_identity_native": true,
|
|
"exclude_lines": [],
|
|
"include_lines": [],
|
|
"delete_enabled": false
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"force": true
|
|
} |