mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2025-12-14 05:02:52 +01:00
34 lines
1.1 KiB
Plaintext
34 lines
1.1 KiB
Plaintext
# Author: Justin Henderson
|
|
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
|
|
# Email: justin@hasecuritysolution.com
|
|
# Last Update: 12/9/2016
|
|
|
|
filter {
|
|
if [type] == "brocade" {
|
|
grok {
|
|
match => ["message", "<%{DATA}>%{GREEDYDATA:sys_message}"]
|
|
}
|
|
grok {
|
|
match => { "sys_message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid:int}\])?: %{GREEDYDATA:syslog_message}" }
|
|
add_field => [ "received_at", "%{@timestamp}" ]
|
|
}
|
|
if [syslog_message] =~ "Interface ethernet" or [syslog_program] == "PORT" {
|
|
grok {
|
|
match => { "syslog_message" => "%{DATA}%{INT:unit}\/%{INT:interface_type}\/%{INT:interface:int}" }
|
|
}
|
|
mutate {
|
|
add_field => { "interface_port" => "%{unit}/%{interface_type}/%{interface}" }
|
|
}
|
|
}
|
|
date {
|
|
match => [ "syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss" ]
|
|
timezone => "America/Chicago"
|
|
remove_field => "syslog_timestamp"
|
|
remove_field => "received_at"
|
|
}
|
|
mutate {
|
|
#add_tag => [ "conf_file_6101"]
|
|
}
|
|
}
|
|
}
|