mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2025-12-06 09:12:45 +01:00
36 lines
3.5 KiB
Plaintext
36 lines
3.5 KiB
Plaintext
{
|
|
"description" : "zeek.files",
|
|
"processors" : [
|
|
{ "remove": { "field": ["host"], "ignore_failure": true } },
|
|
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
|
|
{ "rename": { "field": "message2.fuid", "target_field": "log.id.fuid", "ignore_missing": true } },
|
|
{ "rename": { "field": "message2.conn_uids", "target_field": "log.id.uids", "ignore_missing": true } },
|
|
{ "remove": { "field": "source", "ignore_missing": true } },
|
|
{ "rename": { "field": "message2.rx_hosts.0", "target_field": "destination.ip", "ignore_missing": true } },
|
|
{ "rename": { "field": "message2.tx_hosts.0", "target_field": "source.ip", "ignore_missing": true } },
|
|
{ "remove": { "field": "message2.rx_hosts", "ignore_missing": true } },
|
|
{ "remove": { "field": "message2.tx_hosts", "ignore_missing": true } },
|
|
{ "rename": { "field": "message2.conn_uids", "target_field": "log.id.uids", "ignore_missing": true } },
|
|
{ "rename": { "field": "message2.source", "target_field": "file.source", "ignore_missing": true } },
|
|
{ "rename": { "field": "message2.depth", "target_field": "file.depth", "ignore_missing": true } },
|
|
{ "rename": { "field": "message2.analyzers", "target_field": "file.analyzer", "ignore_missing": true } },
|
|
{ "rename": { "field": "message2.mime_type", "target_field": "file.mime_type", "ignore_missing": true } },
|
|
{ "rename": { "field": "message2.filename", "target_field": "file.name", "ignore_missing": true } },
|
|
{ "rename": { "field": "message2.duration", "target_field": "event.duration", "ignore_missing": true } },
|
|
{ "rename": { "field": "message2.local_orig", "target_field": "file.local_orig", "ignore_missing": true } },
|
|
{ "rename": { "field": "message2.is_orig", "target_field": "file.is_orig", "ignore_missing": true } },
|
|
{ "rename": { "field": "message2.seen_bytes", "target_field": "file.bytes.seen", "ignore_missing": true } },
|
|
{ "rename": { "field": "message2.total_bytes", "target_field": "file.bytes.total", "ignore_missing": true } },
|
|
{ "rename": { "field": "message2.missing_bytes", "target_field": "file.bytes.missing", "ignore_missing": true } },
|
|
{ "rename": { "field": "message2.overflow_bytes", "target_field": "file.bytes.overflow", "ignore_missing": true } },
|
|
{ "rename": { "field": "message2.timedout", "target_field": "file.timed_out", "ignore_missing": true } },
|
|
{ "rename": { "field": "message2.parent_fuid", "target_field": "log.id.parent_fuid", "ignore_missing": true } },
|
|
{ "rename": { "field": "message2.md5", "target_field": "hash.md5", "ignore_missing": true } },
|
|
{ "rename": { "field": "message2.sha1", "target_field": "hash.sha1", "ignore_missing": true } },
|
|
{ "rename": { "field": "message2.extracted", "target_field": "file.extracted.filename", "ignore_missing": true } },
|
|
{ "rename": { "field": "message2.extracted_cutoff", "target_field": "file.extracted.cutoff", "ignore_missing": true } },
|
|
{ "rename": { "field": "message2.extracted_size", "target_field": "file.extracted.size", "ignore_missing": true } },
|
|
{ "pipeline": { "name": "zeek.common" } }
|
|
]
|
|
}
|