mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2025-12-06 17:22:49 +01:00
21 lines
2.0 KiB
Plaintext
21 lines
2.0 KiB
Plaintext
{
|
|
"description" : "osquery",
|
|
"processors" : [
|
|
{ "json": { "field": "message", "target_field": "result", "ignore_failure": true } },
|
|
{ "gsub": { "field": "result.columns.data", "pattern": "\\\\xC2\\\\xAE", "replacement": "", "ignore_missing": true } },
|
|
{ "rename": { "if": "ctx.result.columns?.eventid != null", "field": "result.columns", "target_field": "winlog", "ignore_missing": true } },
|
|
{ "json": { "field": "winlog.data", "target_field": "unparsed", "ignore_failure": true} },
|
|
{ "set": { "if": "!(ctx.unparsed?.EventData instanceof Map)", "field": "error.eventdata_parsing", "value": true, "ignore_failure": true } },
|
|
{ "rename": { "if": "!(ctx.error?.eventdata_parsing == true)", "field": "unparsed.EventData", "target_field": "winlog.event_data", "ignore_missing": true, "ignore_failure": true } },
|
|
{ "rename": { "field": "winlog.source", "target_field": "winlog.channel", "ignore_missing": true } },
|
|
{ "rename": { "field": "winlog.eventid", "target_field": "winlog.event_id", "ignore_missing": true } },
|
|
{ "rename": { "field": "winlog.datetime", "target_field": "winlog.systemTime", "ignore_missing": true } },
|
|
{ "pipeline": { "if": "ctx.winlog?.channel == 'Microsoft-Windows-Sysmon/Operational'", "name": "sysmon" } },
|
|
{ "pipeline": { "if": "ctx.winlog?.channel != 'Microsoft-Windows-Sysmon/Operational' && ctx.containsKey('winlog')", "name":"win.eventlogs" } },
|
|
{ "set": { "field": "event.module", "value": "osquery", "override": false } },
|
|
{ "set": { "field": "event.dataset", "value": "{{result.name}}", "override": false} },
|
|
{ "pipeline": { "if": "!(ctx.containsKey('winlog'))", "name": "osquery.normalize" } },
|
|
{ "pipeline": { "name": "common" } }
|
|
]
|
|
}
|