weslambert e6599cd10e Update with changes from Abe's PR and other fixes

2022-03-25 13:57:44 -04:00

..

beats.common

Support non-WEL Beats

2021-11-02 08:23:29 -04:00

common.nids

…

dns.tld

…

ecs

Add ECS testing pipeline

2021-11-08 20:08:56 +00:00

filterlog

Switch to the ES-included community_id plugin

2021-04-29 12:08:07 -04:00

http.status

…

import.wel

so-import-evtx - fix ingest formatting

2021-09-15 14:13:16 -04:00

logscan.alert

Only append source.ip to logscan.source.ips if it's been created

2021-08-02 09:50:49 -04:00

osquery.live_query

…

osquery.normalize

…

osquery.query_result

Differentiate between event & ingest timestamp

2021-04-13 12:55:40 -04:00

ossec

Fix Wazuh WEL Parsing

2022-01-10 13:55:38 -05:00

rita.beacon

Add RITA Elasticsearch ingest pipeline config

2022-03-22 17:38:22 +00:00

rita.connection

Add RITA Elasticsearch ingest pipeline config

2022-03-22 17:38:22 +00:00

rita.dns

Add RITA Elasticsearch ingest pipeline config

2022-03-22 17:38:22 +00:00

strelka.file

Replace staging path with processed path for analyzed files

2021-07-14 15:04:46 +00:00

suricata.alert

…

suricata.common

Rename ingest.timestamp to event.ingested

2022-03-01 15:05:08 +00:00

suricata.dhcp

…

suricata.dnp3

…

suricata.dns

FIX: Suricata dns.response.code needs to be renamed to dns.response.code_name #4770

2021-07-12 13:24:21 -04:00

suricata.fileinfo

Several Suricata things

2021-07-21 09:10:33 -04:00

suricata.flow

…

suricata.ftp

…

suricata.ftp_data

…

suricata.http

…

suricata.ikev2

…

suricata.krb5

…

suricata.nfs

…

suricata.rdp

…

suricata.sip

…

suricata.smb

…

suricata.smtp

…

suricata.snmp

…

suricata.ssh

…

suricata.tftp

…

suricata.tls

…

syslog

Update with changes from Abe's PR and other fixes

2022-03-25 13:57:44 -04:00

sysmon

Switch to the ES-included community_id plugin

2021-04-29 12:08:07 -04:00

win.eventlogs

Differentiate between event & ingest timestamp

2021-04-13 12:55:40 -04:00

zeek.common

Rename ingest.timestamp to event.ingested

2022-03-01 15:05:08 +00:00

zeek.common_ssl

…

zeek.conn

…

zeek.dce_rpc

…

zeek.dhcp

…

zeek.dnp3

…

zeek.dns

Avoid changing _index for imported logs

2022-02-26 10:36:09 -05:00

zeek.dpd

…

zeek.files

…

zeek.ftp

…

zeek.http

…

zeek.intel

…

zeek.irc

…

zeek.kerberos

…

zeek.modbus

…

zeek.mysql

…

zeek.notice

…

zeek.ntlm

…

zeek.pe

…

zeek.radius

…

zeek.rdp

…

zeek.rfb

…

zeek.signatures

…

zeek.sip

…

zeek.smb_files

…

zeek.smb_mapping

…

zeek.smtp

…

zeek.snmp

…

zeek.socks

…

zeek.software

…

zeek.ssh

…

zeek.ssl

…

zeek.syslog

Change to label fields to comply with what's defined in Filebeat template

2022-03-04 16:29:01 -05:00

zeek.tunnel

…

zeek.tunnels

…

zeek.weird

…

zeek.x509

…