mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2025-12-07 17:52:46 +01:00
16 lines
1.7 KiB
Plaintext
16 lines
1.7 KiB
Plaintext
{
|
|
"description" : "common.nids",
|
|
"processors" : [
|
|
{ "convert": { "if": "ctx.rule.uuid != null", "field": "rule.uuid", "type": "integer" } },
|
|
{ "set": { "if": "ctx.rule?.uuid < 1000000", "field": "rule.reference", "value": "https://www.snort.org/search?query={{rule.gid}}-{{rule.uuid}}" } },
|
|
{ "set": { "if": "ctx.rule?.uuid > 1999999", "field": "rule.referemce", "value": "https://doc.emergingthreats.net/{{rule.uuid}}" } },
|
|
{ "convert": { "if": "ctx.rule.uuid != null", "field": "rule.uuid", "type": "string" } },
|
|
{ "set": { "if": "ctx.rule?.name =~ /^GPL/", "field": "rule.ruleset", "value": "Snort GPL" } },
|
|
{ "set": { "if": "ctx.rule?.name =~ /^ET/", "field": "rule.ruleset", "value": "Emerging Threats" } },
|
|
{ "set": { "if": "ctx.rule.severity == 3", "field": "event.severity", "value": 1, "override": true } },
|
|
{ "set": { "if": "ctx.rule.severity == 2", "field": "event.severity", "value": 2, "override": true } },
|
|
{ "set": { "if": "ctx.rule.severity == 1", "field": "event.severity", "value": 3, "override": true } },
|
|
{ "pipeline": { "name": "common" } }
|
|
]
|
|
}
|