mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2026-02-21 14:35:27 +01:00
37 lines
1.2 KiB
Plaintext
37 lines
1.2 KiB
Plaintext
# Author: Justin Henderson
|
|
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
|
|
# Email: justin@hasecuritysolution.com
|
|
# Updated by Wes Lambert
|
|
# Last Update: 12/14/2017
|
|
#
|
|
# This conf file is based on accepting logs for dns.log from Bro systems
|
|
filter {
|
|
if [type] == "bro_dns" {
|
|
# This is the initial parsing of the log
|
|
mutate {
|
|
gsub => [ "message", "[\"']", "" ]
|
|
}
|
|
csv {
|
|
columns => ["timestamp","uid","source_ip","source_port","destination_ip","destination_port","protocol","transaction_id","rtt","query","query_class","query_class_name","query_type","query_type_name","rcode","rcode_name","aa","tc","rd","ra","z","answers","ttls","rejected"]
|
|
|
|
#If you use a custom delimiter, change the following value in between the quotes to your delimiter. Otherwise, insert a literal <tab> in between the two quotes on your logstash system, use a text editor like nano that doesn't convert tabs to spaces.
|
|
separator => " "
|
|
}
|
|
mutate {
|
|
add_tag => [ "dns" ]
|
|
}
|
|
if [ttls] == "-" {
|
|
mutate {
|
|
remove_field => [ "ttls" ]
|
|
}
|
|
} else {
|
|
mutate {
|
|
convert => [ "ttls", "float" ]
|
|
}
|
|
}
|
|
mutate {
|
|
#add_tag => [ "conf_file_1102"]
|
|
}
|
|
}
|
|
}
|