mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2026-01-24 17:03:27 +01:00
50 lines
1.4 KiB
JSON
50 lines
1.4 KiB
JSON
{
|
|
"package": {
|
|
"name": "filestream",
|
|
"version": ""
|
|
},
|
|
"name": "hydra-logs",
|
|
"description": "Hydra logs",
|
|
"policy_id": "so-grid-nodes_general",
|
|
"namespace": "so",
|
|
"inputs": {
|
|
"filestream-filestream": {
|
|
"enabled": true,
|
|
"streams": {
|
|
"filestream.generic": {
|
|
"enabled": true,
|
|
"vars": {
|
|
"paths": [
|
|
"/opt/so/log/hydra/hydra.log"
|
|
],
|
|
"data_stream.dataset": "hydra",
|
|
"pipeline": "hydra",
|
|
"parsers": "#- ndjson:\n# target: \"\"\n# message_key: msg\n#- multiline:\n# type: count\n# count_lines: 3\n",
|
|
"exclude_files": [
|
|
"\\.gz$"
|
|
],
|
|
"include_files": [],
|
|
"processors": "- decode_json_fields:\n fields: [\"message\"]\n target: \"\"\n add_error_key: true\n- add_fields:\n target: event\n fields:\n category: iam\n module: hydra",
|
|
"tags": [
|
|
"so-hydra"
|
|
],
|
|
"recursive_glob": true,
|
|
"ignore_older": "72h",
|
|
"clean_inactive": -1,
|
|
"harvester_limit": 0,
|
|
"fingerprint": false,
|
|
"fingerprint_offset": 0,
|
|
"fingerprint_length": "64",
|
|
"file_identity_native": true,
|
|
"exclude_lines": [],
|
|
"include_lines": []
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"force": true
|
|
}
|
|
|
|
|