mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2025-12-06 17:22:49 +01:00
75 lines
3.8 KiB
Plaintext
75 lines
3.8 KiB
Plaintext
{%- set HIGHLANDER = salt['pillar.get']('global:highlander', False) -%}
|
|
{%- raw -%}
|
|
{
|
|
"description" : "common",
|
|
"processors" : [
|
|
{
|
|
"geoip": {
|
|
"field": "destination.ip",
|
|
"target_field": "destination.geo",
|
|
"database_file": "GeoLite2-City.mmdb",
|
|
"ignore_missing": true,
|
|
"ignore_failure": true,
|
|
"properties": ["ip", "country_iso_code", "country_name", "continent_name", "region_iso_code", "region_name", "city_name", "timezone", "location"]
|
|
}
|
|
},
|
|
{
|
|
"geoip": {
|
|
"field": "source.ip",
|
|
"target_field": "source.geo",
|
|
"database_file": "GeoLite2-City.mmdb",
|
|
"ignore_missing": true,
|
|
"ignore_failure": true,
|
|
"properties": ["ip", "country_iso_code", "country_name", "continent_name", "region_iso_code", "region_name", "city_name", "timezone", "location"]
|
|
}
|
|
},
|
|
{
|
|
"geoip": {
|
|
"field": "destination.ip",
|
|
"target_field": "destination_geo",
|
|
"database_file": "GeoLite2-ASN.mmdb",
|
|
"ignore_missing": true,
|
|
"ignore_failure": true,
|
|
"properties": ["ip", "asn", "organization_name", "network"]
|
|
}
|
|
},
|
|
{
|
|
"geoip": {
|
|
"field": "source.ip",
|
|
"target_field": "source_geo",
|
|
"database_file": "GeoLite2-ASN.mmdb",
|
|
"ignore_missing": true,
|
|
"ignore_failure": true,
|
|
"properties": ["ip", "asn", "organization_name", "network"]
|
|
}
|
|
},
|
|
{ "set": { "if": "ctx.event?.severity == 1", "field": "event.severity_label", "value": "low", "override": true } },
|
|
{ "set": { "if": "ctx.event?.severity == 2", "field": "event.severity_label", "value": "medium", "override": true } },
|
|
{ "set": { "if": "ctx.event?.severity == 3", "field": "event.severity_label", "value": "high", "override": true } },
|
|
{ "set": { "if": "ctx.event?.severity == 4", "field": "event.severity_label", "value": "critical", "override": true } },
|
|
{ "rename": { "field": "fields.category", "target_field": "event.category", "ignore_failure": true, "ignore_missing": true } },
|
|
{ "rename": { "field": "fields.module", "target_field": "event.module", "ignore_failure": true, "ignore_missing": true } },
|
|
{ "rename": { "field": "module", "target_field": "event.module", "ignore_failure": true, "ignore_missing": true } },
|
|
{ "rename": { "field": "dataset", "target_field": "event.dataset", "ignore_failure": true, "ignore_missing": true } },
|
|
{ "rename": { "field": "category", "target_field": "event.category", "ignore_failure": true, "ignore_missing": true } },
|
|
{ "rename": { "field": "message2.community_id", "target_field": "network.community_id", "ignore_failure": true, "ignore_missing": true } },
|
|
{ "lowercase": { "field": "event.dataset", "ignore_failure": true, "ignore_missing": true } },
|
|
{ "convert": { "field": "log.id.uid", "type": "string", "ignore_failure": true, "ignore_missing": true } },
|
|
{ "convert": { "field": "agent.id", "type": "string", "ignore_failure": true, "ignore_missing": true } },
|
|
{ "convert": { "field": "event.severity", "type": "integer", "ignore_failure": true, "ignore_missing": true } },
|
|
{ "set": { "field": "event.dataset", "ignore_empty_value":true, "copy_from":"event.dataset_temp" }},
|
|
{ "remove": { "field": [ "message2", "type", "fields", "category", "module", "dataset", "event.dataset_temp" ], "ignore_missing": true, "ignore_failure": true } }
|
|
{%- endraw %}
|
|
{%- if HIGHLANDER %}
|
|
,
|
|
{
|
|
"pipeline": {
|
|
"name": "ecs"
|
|
}
|
|
}
|
|
{%- endif %}
|
|
{%- raw %}
|
|
]
|
|
}
|
|
{% endraw %}
|