mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2025-12-12 20:22:59 +01:00
34 lines
938 B
Plaintext
34 lines
938 B
Plaintext
# Updated by: Doug Burks and Wes Lambert
|
|
# Last Update: 10/30/2018
|
|
|
|
filter {
|
|
if "syslogng" in [tags] {
|
|
mutate {
|
|
rename => { "MESSAGE" => "message" }
|
|
rename => { "PROGRAM" => "type" }
|
|
rename => { "FACILITY" => "syslog-facility" }
|
|
rename => { "FILE_NAME" => "syslog-file_name" }
|
|
rename => { "HOST" => "syslog-host" }
|
|
rename => { "HOST_FROM" => "syslog-host_from" }
|
|
rename => { "LEGACY_MSGHDR" => "syslog-legacy_msghdr" }
|
|
rename => { "PID" => "syslog-pid" }
|
|
rename => { "PRIORITY" => "syslog-priority" }
|
|
rename => { "SOURCEIP" => "syslog-sourceip" }
|
|
rename => { "TAGS" => "syslog-tags" }
|
|
lowercase => [ "syslog-host_from" ]
|
|
remove_field => [ "ISODATE" ]
|
|
remove_field => [ "SEQNUM" ]
|
|
#add_tag => [ "conf_file_1001"]
|
|
}
|
|
if "bro_" in [type] {
|
|
mutate {
|
|
add_tag => [ "bro" ]
|
|
}
|
|
} else if [type] !~ /ossec.*|snort/ and "firewall" not in [tags] {
|
|
mutate {
|
|
add_tag => [ "syslog" ]
|
|
}
|
|
}
|
|
}
|
|
}
|