mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2025-12-15 21:52:47 +01:00
65 lines
1.7 KiB
Plaintext
65 lines
1.7 KiB
Plaintext
# Author: Justin Henderson
|
|
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
|
|
# Updated by: Doug Burks
|
|
# Last Update: 2/7/2018
|
|
#
|
|
# This conf file is based on accepting logs for files.log from Bro systems
|
|
filter {
|
|
if [type] == "bro_files" {
|
|
# If message looks like json, try to parse it as such. Otherwise, fall back to csv or grok.
|
|
if [message] =~ /^{.*}$/ {
|
|
json {
|
|
source => "message"
|
|
}
|
|
|
|
mutate {
|
|
rename => { "ts" => "timestamp" }
|
|
#fuid
|
|
rename => { "tx_hosts" => "file_ip" }
|
|
rename => { "rx_hosts" => "destination_ip" }
|
|
rename => { "conn_uids" => "connection_uids" }
|
|
#source field
|
|
#depth field
|
|
rename => { "analyzers" => "analyzer" }
|
|
rename => { "mime_type" => "mimetype" }
|
|
rename => { "filename" => "file_name" }
|
|
#duration
|
|
#local_orig
|
|
#is_orig
|
|
#seen_bytes
|
|
#total_bytes
|
|
#missing_bytes
|
|
#overflow_bytes
|
|
rename => { "timedout" => "timed_out" }
|
|
#parent_fuid
|
|
#md5
|
|
#sha1
|
|
#sha256
|
|
#extracted
|
|
#extracted_cutoff
|
|
#extracted_size
|
|
}
|
|
} else {
|
|
|
|
csv {
|
|
columns => ["timestamp","fuid","file_ip","destination_ip","connection_uids","source","depth","analyzer","mimetype","file_name","duration","local_orig","is_orig","seen_bytes","total_bytes","missing_bytes","overflow_bytes","timed_out","parent_fuid","md5","sha1","sha256","extracted","extracted_cutoff","extracted_size"]
|
|
separator => " "
|
|
}
|
|
if [destination_ip] =~ /,/ {
|
|
mutate {
|
|
split => { "destination_ip" => "," }
|
|
}
|
|
}
|
|
if [file_ip] =~ /,/ {
|
|
mutate {
|
|
split => { "file_ip" => "," }
|
|
}
|
|
}
|
|
}
|
|
|
|
mutate {
|
|
#add_tag => [ "conf_file_1104"]
|
|
}
|
|
}
|
|
}
|