mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2026-01-25 09:23:28 +01:00
46 lines
1.9 KiB
JSON
46 lines
1.9 KiB
JSON
{
|
|
"package": {
|
|
"name": "filestream",
|
|
"version": ""
|
|
},
|
|
"name": "so-ip-mappings",
|
|
"description": "IP Description mappings",
|
|
"policy_id": "so-grid-nodes_general",
|
|
"namespace": "so",
|
|
"inputs": {
|
|
"filestream-filestream": {
|
|
"enabled": true,
|
|
"streams": {
|
|
"filestream.generic": {
|
|
"enabled": true,
|
|
"vars": {
|
|
"paths": [
|
|
"/nsm/custom-mappings/ip-descriptions.csv"
|
|
],
|
|
"data_stream.dataset": "hostnamemappings",
|
|
"parsers": "#- ndjson:\n# target: \"\"\n# message_key: msg\n#- multiline:\n# type: count\n# count_lines: 3\n",
|
|
"exclude_files": [
|
|
"\\.gz$"
|
|
],
|
|
"include_files": [],
|
|
"processors": "- decode_csv_fields:\n fields:\n message: decoded.csv\n separator: \",\"\n ignore_missing: false\n overwrite_keys: true\n trim_leading_space: true\n fail_on_error: true\n\n- extract_array:\n field: decoded.csv\n mappings:\n so.ip_address: '0'\n so.description: '1'\n\n- script:\n lang: javascript\n source: >\n function process(event) {\n var ip = event.Get('so.ip_address');\n var validIpRegex = /^((25[0-5]|2[0-4]\\d|1\\d{2}|[1-9]?\\d)\\.){3}(25[0-5]|2[0-4]\\d|1\\d{2}|[1-9]?\\d)$/\n if (!validIpRegex.test(ip)) {\n event.Cancel();\n }\n }\n- fingerprint:\n fields: [\"so.ip_address\"]\n target_field: \"@metadata._id\"\n",
|
|
"tags": [
|
|
"so-ip-mappings"
|
|
],
|
|
"recursive_glob": true,
|
|
"clean_inactive": -1,
|
|
"harvester_limit": 0,
|
|
"fingerprint": false,
|
|
"fingerprint_offset": 0,
|
|
"fingerprint_length": "64",
|
|
"file_identity_native": true,
|
|
"exclude_lines": [],
|
|
"include_lines": []
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"force": true
|
|
}
|