mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2026-04-24 21:47:48 +02:00
Mike Reeves
282 lines
11 KiB
Plaintext
282 lines
11 KiB
Plaintext
# Author: Justin Henderson
|
|
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
|
|
# Email: justin@hasecuritysolution.com
|
|
# Last Update: 12/9/2016
|
|
|
|
filter {
|
|
if [type] == "fortinet" {
|
|
mutate {
|
|
gsub => [ "message", "= ", "=NA " ]
|
|
}
|
|
|
|
grok {
|
|
match => ["message", "type=%{DATA:event_type}\s+"]
|
|
tag_on_failure => []
|
|
}
|
|
grok {
|
|
match => ["message", "<%{DATA}>%{GREEDYDATA:kv}"]
|
|
tag_on_failure => []
|
|
}
|
|
kv {
|
|
source => "kv"
|
|
exclude_keys => [ "type" ]
|
|
}
|
|
mutate {
|
|
gsub => [ "log", "= ", "=NA " ]
|
|
}
|
|
kv {
|
|
source => "log"
|
|
target => "SubLog"
|
|
}
|
|
grok {
|
|
match => ["message", "custom: DOM-ALL, dns_query=%{DATA:dns_query};"]
|
|
tag_on_failure => [ "" ]
|
|
}
|
|
mutate {
|
|
rename => { "action" => "action" }
|
|
rename => { "addr" => "addr_ip" }
|
|
rename => { "age" => "age" }
|
|
rename => { "assigned" => "assigned_ip" }
|
|
rename => { "assignip" => "assign_ip" }
|
|
rename => { "ap" => "access_point" }
|
|
rename => { "app" => "application" }
|
|
rename => { "appcat" => "application_category" }
|
|
rename => { "applist" => "application_list" }
|
|
rename => { "apprisk" => "application_risk" }
|
|
rename => { "approfile" => "accessPoint_profile" }
|
|
rename => { "apscan" => "access_point_scan" }
|
|
rename => { "apstatus" => "acces_point_status" }
|
|
rename => { "aptype" => "access_point_type" }
|
|
rename => { "authproto" => "authentication_protocol" }
|
|
rename => { "bandwidth" => "bandwidth" }
|
|
rename => { "banned_src" => "banned_source" }
|
|
rename => { "cat" => "category" }
|
|
rename => { "catdesc" => "category_description" }
|
|
rename => { "cfgattr" => "configuration_attribute" }
|
|
rename => { "cfgobj" => "configuration_object" }
|
|
rename => { "cfgpath" => "configuration_path" }
|
|
rename => { "cfgtid" => "configuration_transaction_id" }
|
|
rename => { "channel" => "channel" }
|
|
rename => { "community" => "community" }
|
|
rename => { "cookies" => "cookies" }
|
|
rename => { "craction" => "cr_action" }
|
|
rename => { "crlevel" => "cr_level" }
|
|
rename => { "crscore" => "cr_score" }
|
|
rename => { "datarange" => "data_range" }
|
|
rename => { "desc" => "description" }
|
|
rename => { "detectionmethod" => "detection_method" }
|
|
rename => { "devid" => "device_id" }
|
|
rename => { "devname" => "device_name" }
|
|
rename => { "devtype" => "device_type" }
|
|
rename => { "dhcp_msg" => "dhcp_message" }
|
|
rename => { "disklograte" => "disk_lograte" }
|
|
rename => { "dstcountry" => "destination_country" }
|
|
rename => { "dstintf" => "destination_interface" }
|
|
rename => { "dstip" => "destination_ip" }
|
|
rename => { "dstport" => "destination_port" }
|
|
rename => { "duration" => "elapsed_time" }
|
|
rename => { "error_num" => "error_number" }
|
|
rename => { "espauth" => "esp_authentication" }
|
|
rename => { "esptransform" => "esp_transform" }
|
|
rename => { "eventid" => "event_id" }
|
|
rename => { "eventtype" => "event_type" }
|
|
rename => { "fazlograte" => "faz_lograte" }
|
|
rename => { "filename" => "file_name" }
|
|
rename => { "filesize" => "file_size" }
|
|
rename => { "filetype" => "file_type" }
|
|
rename => { "hostname" => "hostname" }
|
|
rename => { "ip" => "source_ip" }
|
|
rename => { "localip" => "source_ip" }
|
|
rename => { "locip" => "local_ip" }
|
|
rename => { "locport" => "source_port" }
|
|
rename => { "logid" => "log_id" }
|
|
rename => { "logver" => "log_version" }
|
|
rename => { "manuf" => "manufacturer" }
|
|
rename => { "mem" => "memory" }
|
|
rename => { "meshmode" => "mesh_mode" }
|
|
rename => { "msg" => "message" }
|
|
rename => { "nextstat" => "next_stat" }
|
|
rename => { "onwire" => "on_wire" }
|
|
rename => { "osname" => "os_name" }
|
|
rename => { "osversion" => "unauthenticated_user" }
|
|
rename => { "outintf" => "outbound_interface" }
|
|
rename => { "peer_notif" => "peer_notification" }
|
|
rename => { "phase2_name" => "phase2_name" }
|
|
rename => { "policyid" => "policy_id" }
|
|
rename => { "policytype" => "policy_type" }
|
|
rename => { "port" => "port" }
|
|
rename => { "probeproto" => "probe_protocol" }
|
|
rename => { "proto" => "protocol_number" }
|
|
rename => { "radioband" => "radio_band" }
|
|
rename => { "radioidclosest" => "radio_id_closest" }
|
|
rename => { "radioiddetected" => "radio_id_detected" }
|
|
rename => { "rcvd" => "bytes_received" }
|
|
rename => { "rcvdbyte" => "bytes_received" }
|
|
rename => { "rcvdpkt" => "packets_received" }
|
|
rename => { "remip" => "destination_ip" }
|
|
rename => { "remport" => "remote_port" }
|
|
rename => { "reqtype" => "request_type" }
|
|
rename => { "scantime" => "scan_time" }
|
|
rename => { "securitymode" => "security_mode" }
|
|
rename => { "sent" => "bytes_sent" }
|
|
rename => { "sentbyte" => "bytes_sent" }
|
|
rename => { "sentpkt" => "packets_sent" }
|
|
rename => { "session_id" => "session_id" }
|
|
rename => { "setuprate" => "setup_rate" }
|
|
rename => { "sn" => "serial" }
|
|
rename => { "snclosest" => "serial_closest_access_point" }
|
|
rename => { "sndetected" => "serial_access_point_that_detected_rogue_ap" }
|
|
rename => { "snmeshparent" => "serial_mesh_parent" }
|
|
rename => { "srccountry" => "source_country" }
|
|
rename => { "srcip" => "source_ip" }
|
|
rename => { "srcmac" => "source_mac" }
|
|
rename => { "srcname" => "source_name" }
|
|
rename => { "srcintf" => "source_interface" }
|
|
rename => { "srcport" => "source_port" }
|
|
rename => { "stacount" => "station_count" }
|
|
rename => { "stamac" => "static_mac" }
|
|
rename => { "srccountry" => "source_country" }
|
|
rename => { "srcip" => "source_ip" }
|
|
rename => { "srcmac" => "source_mac" }
|
|
rename => { "srcname" => "source_name" }
|
|
rename => { "sn" => "serial" }
|
|
rename => { "srcintf" => "source_interface" }
|
|
rename => { "srcport" => "source_port" }
|
|
rename => { "total" => "total_bytes" }
|
|
rename => { "totalsession" => "total_sessions" }
|
|
rename => { "trandisp" => "nat_translation_type" }
|
|
rename => { "tranip" => "nat_destination_ip" }
|
|
rename => { "tranport" => "nat_destination_port" }
|
|
rename => { "transip" => "nat_source_ip" }
|
|
rename => { "transport" => "nat_source_port" }
|
|
rename => { "tunnelid" => "tunnel_id" }
|
|
rename => { "tunnelip" => "tunnel_ip" }
|
|
rename => { "tunneltype" => "tunnel_type" }
|
|
rename => { "unauthuser" => "unauthenticated_user_source" }
|
|
rename => { "unauthusersource" => "os_version" }
|
|
rename => { "vendorurl" => "vendor_url" }
|
|
rename => { "vpntunnel" => "vpn_tunnel" }
|
|
rename => { "vulncat" => "vulnerability_category" }
|
|
rename => { "vulncmt" => "vulnerability_count" }
|
|
rename => { "vulnid" => "vulnerability_id" }
|
|
rename => { "vulnname" => "vulnerability_name" }
|
|
rename => { "vulnref" => "vulnerability_reference" }
|
|
rename => { "vulnscore" => "vulnerability_score" }
|
|
rename => { "xauthgroup" => "x_authentication_group" }
|
|
rename => { "xauthuser" => "x_authentication_user" }
|
|
rename => { "[SubLog][appid]" => "sub_application_id" }
|
|
rename => { "[SubLog][devid]" => "sub_device_id" }
|
|
rename => { "[SubLog][dstip]" => "sub_destination_ip" }
|
|
rename => { "[SubLog][srcip]" => "sub_source_ip" }
|
|
rename => { "[SubLog][dstport]" => "sub_destination_port" }
|
|
rename => { "[SubLog][eventtype]" => "sub_event_type" }
|
|
rename => { "[SubLog][proto]" => "sub_protocol_number" }
|
|
rename => { "[SubLog][date]" => "sub_date" }
|
|
rename => { "[SubLog][time]" => "sub_time" }
|
|
rename => { "[SubLog][srcport]" => "sub_source_port" }
|
|
rename => { "[SubLog][subtype]" => "sub_subtype" }
|
|
rename => { "[SubLog][devname]" => "sub_device_name" }
|
|
rename => { "[SubLog][itime]" => "sub_itime" }
|
|
rename => { "[SubLog][level]" => "sub_level" }
|
|
rename => { "[SubLog][logid]" => "sub_log_id" }
|
|
rename => { "[SubLog][logver]" => "sub_log_version" }
|
|
rename => { "[SubLog][type]" => "sub_event_type" }
|
|
rename => { "[SubLog][vd]" => "sub_vd" }
|
|
rename => { "[SubLog][action]" => "sub_action" }
|
|
rename => { "[SubLog][logdesc]" => "sub_destination_ip" }
|
|
rename => { "[SubLog][policyid]" => "sub_olicy_id" }
|
|
rename => { "[SubLog][reason]" => "sub_reason" }
|
|
rename => { "[SubLog][service]" => "sub_service" }
|
|
rename => { "[SubLog][sessionid]" => "sub_session_id" }
|
|
rename => { "[SubLog][src]" => "sub_source_ip" }
|
|
rename => { "[SubLog][status]" => "sub_status" }
|
|
rename => { "[SubLog][ui]" => "sub_ui" }
|
|
rename => { "[SubLog][urlfilteridx]" => "sub_url_filter_idx" }
|
|
strip => [ "bytes_sent", "bytes_received" ]
|
|
convert => [ "bytes_sent", "integer" ]
|
|
convert => [ "bytes_received", "integer" ]
|
|
convert => [ "cr_score", "integer" ]
|
|
convert => [ "cr_action", "integer" ]
|
|
convert => [ "elapsed_time", "integer" ]
|
|
convert => [ "destination_port", "integer" ]
|
|
convert => [ "source_port", "integer" ]
|
|
convert => [ "local_port", "integer" ]
|
|
convert => [ "remote_port", "integer" ]
|
|
convert => [ "packets_sent", "integer" ]
|
|
convert => [ "packets_received", "integer" ]
|
|
convert => [ "port", "integer" ]
|
|
convert => [ "ProtocolNumber", "integer" ]
|
|
convert => [ "XAuthUser", "string" ]
|
|
remove_field => [ "kv", "log" ]
|
|
}
|
|
if [tunnel_ip] == "N/A" {
|
|
mutate {
|
|
remove_field => [ "tunnel_ip" ]
|
|
}
|
|
}
|
|
if [nat_destination_ip] {
|
|
mutate {
|
|
add_field => { "ips" => [ "%{nat_destination_ip}" ] }
|
|
add_field => { "destination_ips" => [ "%{nat_destination_ip}" ] }
|
|
}
|
|
}
|
|
if [sub_destination_ip] {
|
|
mutate {
|
|
add_field => { "ips" => [ "%{sub_destination_ip}" ] }
|
|
add_field => { "destination_ips" => [ "%{sub_destination_ip}" ] }
|
|
}
|
|
}
|
|
if [nat_source_ip] {
|
|
mutate {
|
|
add_field => { "ips" => [ "%{nat_source_ip}" ] }
|
|
add_field => { "source_ips" => [ "%{nat_source_ip}" ] }
|
|
}
|
|
}
|
|
if [sub_source_ip] {
|
|
mutate {
|
|
add_field => { "ips" => [ "%{sub_source_ip}" ] }
|
|
add_field => { "source_ips" => [ "%{sub_source_ip}" ] }
|
|
}
|
|
}
|
|
if [addr_ip] {
|
|
mutate {
|
|
add_field => { "ips" => [ "%{addr_ip}" ] }
|
|
}
|
|
}
|
|
if [assign_ip] {
|
|
mutate {
|
|
add_field => { "ips" => [ "%{assign_ip}" ] }
|
|
}
|
|
}
|
|
if [assigned_ip] {
|
|
mutate {
|
|
add_field => { "ips" => [ "%{assigned_ip}" ] }
|
|
}
|
|
}
|
|
grok {
|
|
match => ["message", "type=%{DATA:event_type}\s+"]
|
|
}
|
|
if [date] and [time] {
|
|
mutate {
|
|
add_field => { "receive_time" => "%{date} %{time}" }
|
|
remove_field => [ "date", "time" ]
|
|
}
|
|
date {
|
|
timezone => "America/Chicago"
|
|
match => [ "receive_time", "YYYY-MM-dd HH:mm:ss" ]
|
|
target => "receive_time"
|
|
}
|
|
mutate {
|
|
rename => { "receive_time" => "@timestamp" }
|
|
}
|
|
} else {
|
|
mutate {
|
|
add_tag => [ "missing_date" ]
|
|
}
|
|
}
|
|
mutate {
|
|
#add_tag => [ "conf_file_6200"]
|
|
}
|
|
}
|
|
}
|