mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2025-12-13 12:42:56 +01:00
22 lines
1.0 KiB
Plaintext
22 lines
1.0 KiB
Plaintext
# Author: Justin Henderson
|
|
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
|
|
# Email: justin@hasecuritysolution.com
|
|
# Last Update: 12/9/2016
|
|
|
|
filter {
|
|
if [type] == "greensql" {
|
|
# This section is parsing out the fields for GreenSQL syslog data
|
|
grok {
|
|
match => { "message" => "<%{INT:Code}>%{DATA:Category}\[%{INT:Transcation}\]:\s*Database=%{DATA:Database}\sUser=%{DATA:UserName}\sApplication Name=%{DATA:Application}\sSource IP=%{IPV4:SrcIp}\sSource Port=%{INT:SrcPort}\sTarget IP=?%{IPV4:DstIp}\sTarget Port=%{DATA:DstPort}\sQuery=%{GREEDYDATA:Query}"}
|
|
match => { "message" => "<%{INT:Code}>%{DATA:Category}\[%{INT:Transcation}\]:\sAdmin_Name=%{DATA:UserName}\sIP_Address=%{IPV4:SrcIp}\sUser_Agent=%{DATA:UserAgent}\sMessage=%{DATA:StatusMessage}\sDescription=%{DATA:Description}\sSeverity=%{GREEDYDATA:Severity}"}
|
|
}
|
|
# Remove the message field as it is unnecessary
|
|
#mutate {
|
|
# remove_field => [ "message"]
|
|
#}
|
|
mutate {
|
|
#add_tag => [ "conf_file_1030"]
|
|
}
|
|
}
|
|
}
|