mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2026-04-27 15:07:51 +02:00
m0duspwnens
67 lines
2.4 KiB
Plaintext
67 lines
2.4 KiB
Plaintext
# Author: Wes Lambert
|
|
#
|
|
# Adapted from existing filters provided by Justin Henderson
|
|
#
|
|
# Updated by: Doug Burks
|
|
# Last Update: 2/7/2018
|
|
#
|
|
# This conf file is based on accepting logs for sip.log from Bro systems
|
|
#
|
|
filter {
|
|
if [type] == "bro_sip" {
|
|
# If message looks like json, try to parse it as such. Otherwise, fall back to csv or grok.
|
|
if [message] =~ /^{.*}$/ {
|
|
json {
|
|
source => "message"
|
|
}
|
|
|
|
mutate {
|
|
rename => { "ts" => "timestamp" }
|
|
#uid
|
|
rename => { "id.orig_h" => "source_ip" }
|
|
rename => { "id.orig_p" => "source_port" }
|
|
rename => { "id.resp_h" => "destination_ip" }
|
|
rename => { "id.resp_p" => "destination_port" }
|
|
#trans_depth
|
|
#method
|
|
#uri
|
|
#date
|
|
#request_from
|
|
#request_to
|
|
#response_from
|
|
#response_to
|
|
#reply_to
|
|
#call_id
|
|
#seq
|
|
#subject
|
|
#request_path
|
|
#response_path
|
|
#user_agent
|
|
#status_code
|
|
#status_msg
|
|
#warning
|
|
rename => { "request_body_len" => "request_body_length" }
|
|
rename => { "response_body_len" => "response_body_length" }
|
|
#content_type
|
|
}
|
|
} else {
|
|
grok {
|
|
match => [ "message", "(?<timestamp>(.*?))\t(?<uid>(.*?))\t(?<source_ip>(.*?))\t(?<source_port>(.*?))\t(?<destination_ip>(.*?))\t(?<destination_port>(.*?))\t(?<trans_depth>(.*?))\t(?<method>(.*?))\t(?<uri>(.*?))\t(?<date>(.*?))\t(?<request_from>(.*?))\t(?<request_to>(.*?))\t(?<response_from>(.*?))\t(?<response_to>(.*?))\t(?<reply_to>(.*?))\t(?<call_id>(.*?))\t(?<seq>(.*?))\t(?<subject>(.*?))\t(?<request_path>(.*?))\t(?<response_path>(.*?))\t(?<user_agent>(.*?))\t(?<status_code>(.*?))\t(?<status_msg>(.*?))\t(?<warning>(.*?))\t(?<request_body_length>(.*?))\t(?<response_body_length>(.*?))\t(?<content_type>(.*?))$" ]
|
|
}
|
|
}
|
|
|
|
mutate {
|
|
add_tag => [ "conf_file_1126"]
|
|
}
|
|
}
|
|
}
|
|
# Parse using csv filter
|
|
#filter {
|
|
# if [type] == "bro_sip" {
|
|
# csv {
|
|
# columns => ["timestamp","uid","source_ip","source_port","destination_ip","destination_port","trans_depth","method","uri","date","request_from","request_to","response_from","response_to","reply_to","call_id","seq","subject","request_path","response_path","user_agent","status_code","status_msg","warning","request_body_len","response_body_len","content_type"]
|
|
# separator => " "
|
|
# }
|
|
# }
|
|
#}
|