Last active
May 19, 2020 16:18
-
-
Save cjcenizal/8e07e71d8b46b49d36b0a6a554bd2d9f to your computer and use it in GitHub Desktop.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| PUT _ingest/pipeline/test | |
| { | |
| "description": "Pipeline for Cisco ASA logs", | |
| "processors": [ | |
| { | |
| "grok": { | |
| "field": "message", | |
| "patterns": [ | |
| "(?:%{SYSLOG_HEADER})?\\s*%{GREEDYDATA:log.original}" | |
| ], | |
| "pattern_definitions": { | |
| "SYSLOG_HEADER": "(?:%{SYSLOGFACILITY}\\s*)?(?:%{FTD_DATE:_temp_.raw_date}:?\\s+)?(?:%{PROCESS_HOST}|%{HOST_PROCESS})(?:{DATA})?%{SYSLOG_END}?", | |
| "SYSLOGFACILITY": "<%{NONNEGINT:syslog.facility:int}(?:.%{NONNEGINT:syslog.priority:int})?>", | |
| "FTD_DATE": "(?:%{TIMESTAMP_ISO8601}|%{ASA_DATE})", | |
| "ASA_DATE": "(?:%{DAY} )?%{MONTH} *%{MONTHDAY}(?: %{YEAR})? %{TIME}(?: %{TZ})?", | |
| "PROCESS": "(?:[^%\\s:\\[]+)", | |
| "SYSLOG_END": "(?:(:|\\s)\\s+)", | |
| "PROCESS_HOST": "(?:%{PROCESS:process.name}:\\s%{SYSLOGHOST:host.name})", | |
| "HOST_PROCESS": "(?:%{SYSLOGHOST:host.hostname}:?\\s+)?(?:%{PROCESS:process.name}?(?:\\[%{POSINT:process.pid:long}\\])?)?" | |
| } | |
| } | |
| }, | |
| { | |
| "grok": { | |
| "field": "log.original", | |
| "patterns": [ | |
| "%{FTD_PREFIX}-(?:%{FTD_SUFFIX:_temp_.cisco.suffix}-)?%{NONNEGINT:event.severity:int}-%{POSINT:_temp_.cisco.message_id}?:?\\s*%{GREEDYDATA:message}", | |
| "%{GREEDYDATA:message}" | |
| ], | |
| "pattern_definitions": { | |
| "FTD_SUFFIX": "[^0-9-]+", | |
| "FTD_PREFIX": "%{DATA}%(?:[A-Z]+)" | |
| } | |
| } | |
| }, | |
| { | |
| "set": { | |
| "field": "_temp_.cisco.message_id", | |
| "value": "", | |
| "if": "ctx?._temp_?.cisco?.message_id == null" | |
| } | |
| }, | |
| { | |
| "set": { | |
| "field": "event.severity", | |
| "value": 7, | |
| "if": "ctx?.event?.severity == null" | |
| } | |
| }, | |
| { | |
| "rename": { | |
| "field": "@timestamp", | |
| "target_field": "event.created" | |
| }, | |
| }, | |
| { | |
| "date": { | |
| "if": "ctx.event.timezone == null", | |
| "field": "_temp_.raw_date", | |
| "target_field": "@timestamp", | |
| "formats": [ | |
| "ISO8601", | |
| "MMM d HH:mm:ss", | |
| "MMM dd HH:mm:ss", | |
| "EEE MMM d HH:mm:ss", | |
| "EEE MMM dd HH:mm:ss", | |
| "MMM d HH:mm:ss z", | |
| "MMM dd HH:mm:ss z", | |
| "EEE MMM d HH:mm:ss z", | |
| "EEE MMM dd HH:mm:ss z", | |
| "MMM d yyyy HH:mm:ss", | |
| "MMM dd yyyy HH:mm:ss", | |
| "EEE MMM d yyyy HH:mm:ss", | |
| "EEE MMM dd yyyy HH:mm:ss", | |
| "MMM d yyyy HH:mm:ss z", | |
| "MMM dd yyyy HH:mm:ss z", | |
| "EEE MMM d yyyy HH:mm:ss z", | |
| "EEE MMM dd yyyy HH:mm:ss z" | |
| ], | |
| "on_failure": [ | |
| { | |
| "append": { | |
| "field": "error.message", | |
| "value": "{{ _ingest.on_failure_message }}" | |
| } | |
| } | |
| ] | |
| } | |
| }, | |
| { | |
| "date": { | |
| "if": "ctx.event.timezone != null", | |
| "timezone": "{{ event.timezone }}", | |
| "field": "_temp_.raw_date", | |
| "target_field": "@timestamp", | |
| "formats": [ | |
| "ISO8601", | |
| "MMM d HH:mm:ss", | |
| "MMM dd HH:mm:ss", | |
| "EEE MMM d HH:mm:ss", | |
| "EEE MMM dd HH:mm:ss", | |
| "MMM d HH:mm:ss z", | |
| "MMM dd HH:mm:ss z", | |
| "EEE MMM d HH:mm:ss z", | |
| "EEE MMM dd HH:mm:ss z", | |
| "MMM d yyyy HH:mm:ss", | |
| "MMM dd yyyy HH:mm:ss", | |
| "EEE MMM d yyyy HH:mm:ss", | |
| "EEE MMM dd yyyy HH:mm:ss", | |
| "MMM d yyyy HH:mm:ss z", | |
| "MMM dd yyyy HH:mm:ss z", | |
| "EEE MMM d yyyy HH:mm:ss z", | |
| "EEE MMM dd yyyy HH:mm:ss z" | |
| ], | |
| "on_failure": [ | |
| { | |
| "append": { | |
| "field": "error.message", | |
| "value": "{{ _ingest.on_failure_message }}" | |
| } | |
| } | |
| ] | |
| } | |
| }, | |
| { | |
| "set": { | |
| "field": "log.level", | |
| "if": "ctx.event.severity == 0", | |
| "value": "unknown" | |
| } | |
| }, | |
| { | |
| "set": { | |
| "field": "log.level", | |
| "if": "ctx.event.severity == 1", | |
| "value": "alert" | |
| } | |
| }, | |
| { | |
| "set": { | |
| "field": "log.level", | |
| "if": "ctx.event.severity == 2", | |
| "value": "critical" | |
| } | |
| }, | |
| { | |
| "set": { | |
| "field": "log.level", | |
| "if": "ctx.event.severity == 3", | |
| "value": "error" | |
| } | |
| }, | |
| { | |
| "set": { | |
| "field": "log.level", | |
| "if": "ctx.event.severity == 4", | |
| "value": "warning" | |
| } | |
| }, | |
| { | |
| "set": { | |
| "field": "log.level", | |
| "if": "ctx.event.severity == 5", | |
| "value": "notification" | |
| } | |
| }, | |
| { | |
| "set": { | |
| "field": "log.level", | |
| "if": "ctx.event.severity == 6", | |
| "value": "informational" | |
| } | |
| }, | |
| { | |
| "set": { | |
| "field": "log.level", | |
| "if": "ctx.event.severity == 7", | |
| "value": "debug" | |
| } | |
| }, | |
| { | |
| "set": { | |
| "if": "ctx._temp_.cisco.message_id != \"\"", | |
| "field": "event.action", | |
| "value": "firewall-rule" | |
| } | |
| }, | |
| { | |
| "dissect": { | |
| "if": "ctx._temp_.cisco.message_id == '106001'", | |
| "field": "message", | |
| "pattern": "%{network.direction} %{network.transport} connection %{event.outcome} from %{source.address}/%{source.port} to %{destination.address}/%{destination.port} flags %{} on interface %{_temp_.cisco.source_interface}" | |
| } | |
| }, | |
| { | |
| "dissect": { | |
| "if": "ctx._temp_.cisco.message_id == '106002'", | |
| "field": "message", | |
| "pattern": "%{network.transport} Connection %{event.outcome} by %{network.direction} list %{_temp_.cisco.list_id} src %{source.address} dest %{destination.address}" | |
| } | |
| }, | |
| { | |
| "dissect": { | |
| "if": "ctx._temp_.cisco.message_id == '106006'", | |
| "field": "message", | |
| "pattern": "%{event.outcome} %{network.direction} %{network.transport} from %{source.address}/%{source.port} to %{destination.address}/%{destination.port} on interface %{_temp_.cisco.source_interface}" | |
| } | |
| }, | |
| { | |
| "dissect": { | |
| "if": "ctx._temp_.cisco.message_id == '106007'", | |
| "field": "message", | |
| "pattern": "%{event.outcome} %{network.direction} %{network.transport} from %{source.address}/%{source.port} to %{destination.address}/%{destination.port} due to %{network.protocol} %{}" | |
| } | |
| }, | |
| { | |
| "dissect": { | |
| "if": "ctx._temp_.cisco.message_id == '106010'", | |
| "field": "message", | |
| "pattern": "%{event.outcome} %{network.direction} %{network.transport} src %{_temp_.cisco.source_interface}:%{source.address}/%{source.port} %{} dst %{_temp_.cisco.destination_interface}:%{destination.address}/%{destination.port} %{}" | |
| } | |
| }, | |
| { | |
| "dissect": { | |
| "if": "ctx._temp_.cisco.message_id == '106013'", | |
| "field": "message", | |
| "pattern": "Dropping echo request from %{source.address} to PAT address %{destination.address}" | |
| } | |
| }, | |
| { | |
| "set": { | |
| "if": "ctx._temp_.cisco.message_id == '106013'", | |
| "field": "network.transport", | |
| "value": "icmp" | |
| } | |
| }, | |
| { | |
| "set": { | |
| "if": "ctx._temp_.cisco.message_id == '106013'", | |
| "field": "network.direction", | |
| "value": "inbound" | |
| } | |
| }, | |
| { | |
| "dissect": { | |
| "if": "ctx._temp_.cisco.message_id == '106014'", | |
| "field": "message", | |
| "pattern": "%{event.outcome} %{network.direction} %{network.transport} src %{_temp_.cisco.source_interface}:%{source.address} %{}dst %{_temp_.cisco.destination_interface}:%{destination.address} %{}" | |
| } | |
| }, | |
| { | |
| "dissect": { | |
| "if": "ctx._temp_.cisco.message_id == '106015'", | |
| "field": "message", | |
| "pattern": "%{event.outcome} %{network.transport} (no connection) from %{source.address}/%{source.port} to %{destination.address}/%{destination.port} flags %{} on interface %{_temp_.cisco.source_interface}" | |
| } | |
| }, | |
| { | |
| "dissect": { | |
| "if": "ctx._temp_.cisco.message_id == '106016'", | |
| "field": "message", | |
| "pattern": "%{event.outcome} IP spoof from (%{source.address}) to %{destination.address} on interface %{_temp_.cisco.source_interface}" | |
| } | |
| }, | |
| { | |
| "dissect": { | |
| "if": "ctx._temp_.cisco.message_id == '106017'", | |
| "field": "message", | |
| "pattern": "%{event.outcome} IP due to Land Attack from %{source.address} to %{destination.address}" | |
| } | |
| }, | |
| { | |
| "dissect": { | |
| "if": "ctx._temp_.cisco.message_id == '106018'", | |
| "field": "message", | |
| "pattern": "%{network.transport} packet type %{_temp_.cisco.icmp_type} %{event.outcome} by %{network.direction} list %{_temp_.cisco.list_id} src %{source.address} dest %{destination.address}" | |
| } | |
| }, | |
| { | |
| "dissect": { | |
| "if": "ctx._temp_.cisco.message_id == '106020'", | |
| "field": "message", | |
| "pattern": "%{event.outcome} IP teardrop fragment (size = %{}, offset = %{}) from %{source.address} to %{destination.address}" | |
| } | |
| }, | |
| { | |
| "dissect": { | |
| "if": "ctx._temp_.cisco.message_id == '106021'", | |
| "field": "message", | |
| "pattern": "%{event.outcome} %{network.transport} reverse path check from %{source.address} to %{destination.address} on interface %{_temp_.cisco.source_interface}" | |
| } | |
| }, | |
| { | |
| "dissect": { | |
| "if": "ctx._temp_.cisco.message_id == '106022'", | |
| "field": "message", | |
| "pattern": "%{event.outcome} %{network.transport} connection spoof from %{source.address} to %{destination.address} on interface %{_temp_.cisco.source_interface}" | |
| } | |
| }, | |
| { | |
| "grok": { | |
| "if": "ctx._temp_.cisco.message_id == '106023'", | |
| "field": "message", | |
| "patterns": [ | |
| "^%{NOTSPACE:event.outcome} %{NOTSPACE:network.transport} src %{NOTSPACE:_temp_.cisco.source_interface}:%{IPORHOST:source.address}(/%{POSINT:source.port})?\\s*(%{GREEDYDATA:_temp_.cisco.source_username} )?dst %{NOTSPACE:_temp_.cisco.destination_interface}:%{IPORHOST:destination.address}(/%{POSINT:destination.port})?%{DATA}by access.group \"%{NOTSPACE:_temp_.cisco.list_id}\"" | |
| ] | |
| } | |
| }, | |
| { | |
| "dissect": { | |
| "if": "ctx._temp_.cisco.message_id == '106027'", | |
| "field": "message", | |
| "pattern": "%{} %{event.outcome} src %{source.address} dst %{destination.address} by access-group \"%{_temp_.cisco.list_id}\"" | |
| } | |
| }, | |
| { | |
| "dissect": { | |
| "if": "ctx._temp_.cisco.message_id == '106100'", | |
| "field": "message", | |
| "pattern": "access-list %{_temp_.cisco.list_id} %{event.outcome} %{network.transport} %{_temp_.cisco.source_interface}/%{source.address}(%{source.port}) -> %{_temp_.cisco.destination_interface}/%{destination.address}(%{destination.port}) %{}" | |
| } | |
| }, | |
| { | |
| "dissect": { | |
| "if": "ctx._temp_.cisco.message_id == '106102'", | |
| "field": "message", | |
| "pattern": "access-list %{_temp_.cisco.list_id} %{event.outcome} %{network.transport} for user %{_temp_.cisco.username} %{_temp_.cisco.source_interface}/%{source.address} %{source.port} %{_temp_.cisco.destination_interface}/%{destination.address} %{destination.port} %{}" | |
| } | |
| }, | |
| { | |
| "dissect": { | |
| "if": "ctx._temp_.cisco.message_id == '106103'", | |
| "field": "message", | |
| "pattern": "access-list %{_temp_.cisco.list_id} %{event.outcome} %{network.transport} for user %{_temp_.cisco.username} %{_temp_.cisco.source_interface}/%{source.address} %{source.port} %{_temp_.cisco.destination_interface}/%{destination.address} %{destination.port} %{}" | |
| } | |
| }, | |
| { | |
| "dissect": { | |
| "if": "ctx._temp_.cisco.message_id == '304001'", | |
| "field": "message", | |
| "pattern": "%{source.address} %{}ccessed URL %{destination.address}:%{url.original}" | |
| } | |
| }, | |
| { | |
| "set": { | |
| "if": "ctx._temp_.cisco.message_id == '304001'", | |
| "field": "event.outcome", | |
| "value": "allow" | |
| } | |
| }, | |
| { | |
| "dissect": { | |
| "if": "ctx._temp_.cisco.message_id == '304002'", | |
| "field": "message", | |
| "pattern": "Access %{event.outcome} URL %{url.original} SRC %{source.address} %{}EST %{destination.address} on interface %{_temp_.cisco.source_interface}" | |
| } | |
| }, | |
| { | |
| "dissect": { | |
| "if": "ctx._temp_.cisco.message_id == '313001'", | |
| "field": "message", | |
| "pattern": "%{event.outcome} %{network.transport} type=%{_temp_.cisco.icmp_type}, code=%{_temp_.cisco.icmp_code} from %{source.address} on interface %{_temp_.cisco.source_interface}" | |
| } | |
| }, | |
| { | |
| "dissect": { | |
| "if": "ctx._temp_.cisco.message_id == '313004'", | |
| "field": "message", | |
| "pattern": "%{event.outcome} %{network.transport} type=%{_temp_.cisco.icmp_type}, from%{}addr %{source.address} on interface %{_temp_.cisco.source_interface} to %{destination.address}: no matching session" | |
| } | |
| }, | |
| { | |
| "dissect": { | |
| "if": "ctx._temp_.cisco.message_id == '313005'", | |
| "field": "message", | |
| "pattern": "No matching connection for %{network.transport} error message: %{} on %{_temp_.cisco.source_interface} interface.%{}riginal IP payload: %{}" | |
| } | |
| }, | |
| { | |
| "dissect": { | |
| "if": "ctx._temp_.cisco.message_id == '313008'", | |
| "field": "message", | |
| "pattern": "%{event.outcome} %{network.transport} type=%{_temp_.cisco.icmp_type} , code=%{_temp_.cisco.icmp_code} from %{source.address} on interface %{_temp_.cisco.source_interface}" | |
| } | |
| }, | |
| { | |
| "dissect": { | |
| "if": "ctx._temp_.cisco.message_id == '313009'", | |
| "field": "message", | |
| "pattern": "%{event.outcome} invalid %{network.transport} code %{_temp_.cisco.icmp_code} , for %{_temp_.cisco.source_interface}:%{source.address}/%{source.port} (%{_temp_.cisco.mapped_source_ip}/%{_temp_.cisco.mapped_source_port}) to %{_temp_.cisco.destination_interface}:%{destination.address}/%{destination.port} (%{_temp_.cisco.mapped_destination_ip}/%{_temp_.cisco.mapped_destination_port})%{}" | |
| } | |
| }, | |
| { | |
| "dissect": { | |
| "if": "ctx._temp_.cisco.message_id == '322001'", | |
| "field": "message", | |
| "pattern": "%{event.outcome} MAC address %{source.mac}, possible spoof attempt on interface %{_temp_.cisco.source_interface}" | |
| } | |
| }, | |
| { | |
| "dissect": { | |
| "if": "ctx._temp_.cisco.message_id == '338001'", | |
| "field": "message", | |
| "pattern": "Dynamic filter %{event.outcome} black%{}d %{network.transport} traffic from %{_temp_.cisco.source_interface}:%{source.address}/%{source.port} (%{_temp_.cisco.mapped_source_ip}/%{_temp_.cisco.mapped_source_port}) to %{_temp_.cisco.destination_interface}:%{destination.address}/%{destination.port} (%{_temp_.cisco.mapped_destination_ip}/%{_temp_.cisco.mapped_destination_port})%{}source %{} resolved from %{_temp_.cisco.list_id} list: %{source.domain}, threat-level: %{_temp_.cisco.threat_level}, category: %{_temp_.cisco.threat_category}" | |
| } | |
| }, | |
| { | |
| "set": { | |
| "if": "ctx._temp_.cisco.message_id == '338001'", | |
| "field": "server.domain", | |
| "value": "{{source.domain}}" | |
| } | |
| }, | |
| { | |
| "dissect": { | |
| "if": "ctx._temp_.cisco.message_id == '338002'", | |
| "field": "message", | |
| "pattern": "Dynamic %{}ilter %{event.outcome} black%{}d %{network.transport} traffic from %{_temp_.cisco.source_interface}:%{source.address}/%{source.port} (%{_temp_.cisco.mapped_source_ip}/%{_temp_.cisco.mapped_source_port}) to %{_temp_.cisco.destination_interface}:%{destination.address}/%{destination.port} (%{_temp_.cisco.mapped_destination_ip}/%{_temp_.cisco.mapped_destination_port})%{}destination %{} resolved from %{_temp_.cisco.list_id} list: %{destination.domain}" | |
| } | |
| }, | |
| { | |
| "set": { | |
| "if": "ctx._temp_.cisco.message_id == '338002'", | |
| "field": "server.domain", | |
| "value": "{{destination.domain}}" | |
| } | |
| }, | |
| { | |
| "dissect": { | |
| "if": "ctx._temp_.cisco.message_id == '338003'", | |
| "field": "message", | |
| "pattern": "Dynamic %{}ilter %{event.outcome} black%{}d %{network.transport} traffic from %{_temp_.cisco.source_interface}:%{source.address}/%{source.port} (%{_temp_.cisco.mapped_source_ip}/%{_temp_.cisco.mapped_source_port}) to %{_temp_.cisco.destination_interface}:%{destination.address}/%{destination.port} (%{_temp_.cisco.mapped_destination_ip}/%{_temp_.cisco.mapped_destination_port})%{}source %{} resolved from %{_temp_.cisco.list_id} list: %{}, threat-level: %{_temp_.cisco.threat_level}, category: %{_temp_.cisco.threat_category}" | |
| } | |
| }, | |
| { | |
| "dissect": { | |
| "if": "ctx._temp_.cisco.message_id == '338004'", | |
| "field": "message", | |
| "pattern": "Dynamic %{}ilter %{event.outcome} black%{}d %{network.transport} traffic from %{_temp_.cisco.source_interface}:%{source.address}/%{source.port} (%{_temp_.cisco.mapped_source_ip}/%{_temp_.cisco.mapped_source_port}) to %{_temp_.cisco.destination_interface}:%{destination.address}/%{destination.port} (%{_temp_.cisco.mapped_destination_ip}/%{_temp_.cisco.mapped_destination_port})%{}destination %{} resolved from %{_temp_.cisco.list_id} list: %{}, threat-level: %{_temp_.cisco.threat_level}, category: %{_temp_.cisco.threat_category}" | |
| } | |
| }, | |
| { | |
| "dissect": { | |
| "if": "ctx._temp_.cisco.message_id == '338005'", | |
| "field": "message", | |
| "pattern": "Dynamic %{}ilter %{event.outcome} black%{}d %{network.transport} traffic from %{_temp_.cisco.source_interface}:%{source.address}/%{source.port} (%{_temp_.cisco.mapped_source_ip}/%{_temp_.cisco.mapped_source_port}) to %{_temp_.cisco.destination_interface}:%{destination.address}/%{destination.port} (%{_temp_.cisco.mapped_destination_ip}/%{_temp_.cisco.mapped_destination_port})%{}source %{} resolved from %{_temp_.cisco.list_id} list: %{source.domain}, threat-level: %{_temp_.cisco.threat_level}, category: %{_temp_.cisco.threat_category}" | |
| } | |
| }, | |
| { | |
| "set": { | |
| "if": "ctx._temp_.cisco.message_id == '338005'", | |
| "field": "server.domain", | |
| "value": "{{source.domain}}" | |
| } | |
| }, | |
| { | |
| "dissect": { | |
| "if": "ctx._temp_.cisco.message_id == '338006'", | |
| "field": "message", | |
| "pattern": "Dynamic %{}ilter %{event.outcome} black%{}d %{network.transport} traffic from %{_temp_.cisco.source_interface}:%{source.address}/%{source.port} (%{_temp_.cisco.mapped_source_ip}/%{_temp_.cisco.mapped_source_port}) to %{_temp_.cisco.destination_interface}:%{destination.address}/%{destination.port} (%{_temp_.cisco.mapped_destination_ip}/%{_temp_.cisco.mapped_destination_port})%{}destination %{} resolved from %{_temp_.cisco.list_id} list: %{destination.domain}, threat-level: %{_temp_.cisco.threat_level}, category: %{_temp_.cisco.threat_category}" | |
| } | |
| }, | |
| { | |
| "set": { | |
| "if": "ctx._temp_.cisco.message_id == '338006'", | |
| "field": "server.domain", | |
| "value": "{{destination.domain}}" | |
| } | |
| }, | |
| { | |
| "dissect": { | |
| "if": "ctx._temp_.cisco.message_id == '338007'", | |
| "field": "message", | |
| "pattern": "Dynamic %{}ilter %{event.outcome} black%{}d %{network.transport} traffic from %{_temp_.cisco.source_interface}:%{source.address}/%{source.port} (%{_temp_.cisco.mapped_source_ip}/%{_temp_.cisco.mapped_source_port}) to %{_temp_.cisco.destination_interface}:%{destination.address}/%{destination.port} (%{_temp_.cisco.mapped_destination_ip}/%{_temp_.cisco.mapped_destination_port})%{}source %{} resolved from %{_temp_.cisco.list_id} list: %{}, threat-level: %{_temp_.cisco.threat_level}, category: %{_temp_.cisco.threat_category}" | |
| } | |
| }, | |
| { | |
| "dissect": { | |
| "if": "ctx._temp_.cisco.message_id == '338008'", | |
| "field": "message", | |
| "pattern": "Dynamic %{}ilter %{event.outcome} black%{}d %{network.transport} traffic from %{_temp_.cisco.source_interface}:%{source.address}/%{source.port} (%{_temp_.cisco.mapped_source_ip}/%{_temp_.cisco.mapped_source_port}) to %{_temp_.cisco.destination_interface}:%{destination.address}/%{destination.port} (%{_temp_.cisco.mapped_destination_ip}/%{_temp_.cisco.mapped_destination_port})%{}destination %{} resolved from %{_temp_.cisco.list_id} list: %{}, threat-level: %{_temp_.cisco.threat_level}, category: %{_temp_.cisco.threat_category}" | |
| } | |
| }, | |
| { | |
| "dissect": { | |
| "if": "ctx._temp_.cisco.message_id == '338101'", | |
| "field": "message", | |
| "pattern": "Dynamic %{}ilter %{event.outcome} white%{}d %{network.transport} traffic from %{_temp_.cisco.source_interface}:%{source.address}/%{source.port} (%{_temp_.cisco.mapped_source_ip}/%{_temp_.cisco.mapped_source_port}) to %{_temp_.cisco.destination_interface}:%{destination.address}/%{destination.port} (%{_temp_.cisco.mapped_destination_ip}/%{_temp_.cisco.mapped_destination_port})%{}source %{} resolved from %{_temp_.cisco.list_id} list: %{source.domain}" | |
| } | |
| }, | |
| { | |
| "set": { | |
| "if": "ctx._temp_.cisco.message_id == '338101'", | |
| "field": "server.domain", | |
| "value": "{{source.domain}}" | |
| } | |
| }, | |
| { | |
| "dissect": { | |
| "if": "ctx._temp_.cisco.message_id == '338102'", | |
| "field": "message", | |
| "pattern": "Dynamic %{}ilter %{event.outcome} white%{}d %{network.transport} traffic from %{_temp_.cisco.source_interface}:%{source.address}/%{source.port} (%{_temp_.cisco.mapped_source_ip}/%{_temp_.cisco.mapped_source_port}) to %{_temp_.cisco.destination_interface}:%{destination.address}/%{destination.port} (%{_temp_.cisco.mapped_destination_ip}/%{_temp_.cisco.mapped_destination_port})%{}destination %{} resolved from %{_temp_.cisco.list_id} list: %{destination.domain}" | |
| } | |
| }, | |
| { | |
| "set": { | |
| "if": "ctx._temp_.cisco.message_id == '338102'", | |
| "field": "server.domain", | |
| "value": "{{destination.domain}}" | |
| } | |
| }, | |
| { | |
| "dissect": { | |
| "if": "ctx._temp_.cisco.message_id == '338103'", | |
| "field": "message", | |
| "pattern": "Dynamic %{}ilter %{event.outcome} white%{}d %{network.transport} traffic from %{_temp_.cisco.source_interface}:%{source.address}/%{source.port} (%{_temp_.cisco.mapped_source_ip}/%{_temp_.cisco.mapped_source_port}) to %{_temp_.cisco.destination_interface}:%{destination.address}/%{destination.port} (%{_temp_.cisco.mapped_destination_ip}/%{_temp_.cisco.mapped_destination_port})%{}source %{} resolved from %{_temp_.cisco.list_id} list: %{}" | |
| } | |
| }, | |
| { | |
| "dissect": { | |
| "if": "ctx._temp_.cisco.message_id == '338104'", | |
| "field": "message", | |
| "pattern": "Dynamic %{}ilter %{event.outcome} white%{}d %{network.transport} traffic from %{_temp_.cisco.source_interface}:%{source.address}/%{source.port} (%{_temp_.cisco.mapped_source_ip}/%{_temp_.cisco.mapped_source_port}) to %{_temp_.cisco.destination_interface}:%{destination.address}/%{destination.port} (%{_temp_.cisco.mapped_destination_ip}/%{_temp_.cisco.mapped_destination_port})%{}destination %{} resolved from %{_temp_.cisco.list_id} list: %{}" | |
| } | |
| }, | |
| { | |
| "dissect": { | |
| "if": "ctx._temp_.cisco.message_id == '338201'", | |
| "field": "message", | |
| "pattern": "Dynamic %{}ilter %{event.outcome} grey%{}d %{network.transport} traffic from %{_temp_.cisco.source_interface}:%{source.address}/%{source.port} (%{_temp_.cisco.mapped_source_ip}/%{_temp_.cisco.mapped_source_port}) to %{_temp_.cisco.destination_interface}:%{destination.address}/%{destination.port} (%{_temp_.cisco.mapped_destination_ip}/%{_temp_.cisco.mapped_destination_port})%{}source %{} resolved from %{_temp_.cisco.list_id} list: %{source.domain}, threat-level: %{_temp_.cisco.threat_level}, category: %{_temp_.cisco.threat_category}" | |
| } | |
| }, | |
| { | |
| "set": { | |
| "if": "ctx._temp_.cisco.message_id == '338201'", | |
| "field": "server.domain", | |
| "value": "{{source.domain}}" | |
| } | |
| }, | |
| { | |
| "dissect": { | |
| "if": "ctx._temp_.cisco.message_id == '338202'", | |
| "field": "message", | |
| "pattern": "Dynamic %{}ilter %{event.outcome} grey%{}d %{network.transport} traffic from %{_temp_.cisco.source_interface}:%{source.address}/%{source.port} (%{_temp_.cisco.mapped_source_ip}/%{_temp_.cisco.mapped_source_port}) to %{_temp_.cisco.destination_interface}:%{destination.address}/%{destination.port} (%{_temp_.cisco.mapped_destination_ip}/%{_temp_.cisco.mapped_destination_port})%{}destination %{} resolved from %{_temp_.cisco.list_id} list: %{destination.domain}, threat-level: %{_temp_.cisco.threat_level}, category: %{_temp_.cisco.threat_category}" | |
| } | |
| }, | |
| { | |
| "set": { | |
| "if": "ctx._temp_.cisco.message_id == '338202'", | |
| "field": "server.domain", | |
| "value": "{{destination.domain}}" | |
| } | |
| }, | |
| { | |
| "dissect": { | |
| "if": "ctx._temp_.cisco.message_id == '338203'", | |
| "field": "message", | |
| "pattern": "Dynamic %{}ilter %{event.outcome} grey%{}d %{network.transport} traffic from %{_temp_.cisco.source_interface}:%{source.address}/%{source.port} (%{_temp_.cisco.mapped_source_ip}/%{_temp_.cisco.mapped_source_port}) to %{_temp_.cisco.destination_interface}:%{destination.address}/%{destination.port} (%{_temp_.cisco.mapped_destination_ip}/%{_temp_.cisco.mapped_destination_port})%{}source %{} resolved from %{_temp_.cisco.list_id} list: %{source.domain}, threat-level: %{_temp_.cisco.threat_level}, category: %{_temp_.cisco.threat_category}" | |
| } | |
| }, | |
| { | |
| "set": { | |
| "if": "ctx._temp_.cisco.message_id == '338203'", | |
| "field": "server.domain", | |
| "value": "{{source.domain}}" | |
| } | |
| }, | |
| { | |
| "dissect": { | |
| "if": "ctx._temp_.cisco.message_id == '338204'", | |
| "field": "message", | |
| "pattern": "Dynamic %{}ilter %{event.outcome} grey%{}d %{network.transport} traffic from %{_temp_.cisco.source_interface}:%{source.address}/%{source.port} (%{_temp_.cisco.mapped_source_ip}/%{_temp_.cisco.mapped_source_port}) to %{_temp_.cisco.destination_interface}:%{destination.address}/%{destination.port} (%{_temp_.cisco.mapped_destination_ip}/%{_temp_.cisco.mapped_destination_port})%{}destination %{} resolved from %{_temp_.cisco.list_id} list: %{destination.domain}, threat-level: %{_temp_.cisco.threat_level}, category: %{_temp_.cisco.threat_category}" | |
| } | |
| }, | |
| { | |
| "set": { | |
| "if": "ctx._temp_.cisco.message_id == '338204'", | |
| "field": "server.domain", | |
| "value": "{{destination.domain}}" | |
| } | |
| }, | |
| { | |
| "dissect": { | |
| "if": "ctx._temp_.cisco.message_id == '338301'", | |
| "field": "message", | |
| "pattern": "Intercepted DNS reply for domain %{source.domain} from %{_temp_.cisco.source_interface}:%{source.address}/%{source.port} to %{_temp_.cisco.destination_interface}:%{destination.address}/%{destination.port}, matched %{_temp_.cisco.list_id}" | |
| } | |
| }, | |
| { | |
| "set": { | |
| "if": "ctx._temp_.cisco.message_id == '338301'", | |
| "field": "client.address", | |
| "value": "{{destination.address}}" | |
| } | |
| }, | |
| { | |
| "set": { | |
| "if": "ctx._temp_.cisco.message_id == '338301'", | |
| "field": "client.port", | |
| "value": "{{destination.port}}" | |
| } | |
| }, | |
| { | |
| "set": { | |
| "if": "ctx._temp_.cisco.message_id == '338301'", | |
| "field": "server.address", | |
| "value": "{{source.address}}" | |
| } | |
| }, | |
| { | |
| "set": { | |
| "if": "ctx._temp_.cisco.message_id == '338301'", | |
| "field": "server.port", | |
| "value": "{{source.port}}" | |
| } | |
| }, | |
| { | |
| "dissect": { | |
| "if": "ctx._temp_.cisco.message_id == '734001'", | |
| "field": "message", | |
| "pattern": "DAP: User %{user.email}, Addr %{source.address}, Connection %{_temp_.cisco.connection_type}: The following DAP records were selected for this connection: %{_temp_.cisco.dap_records->}" | |
| } | |
| }, | |
| { | |
| "split": { | |
| "field": "_temp_.cisco.dap_records", | |
| "separator": ",\\s+", | |
| "ignore_missing": true | |
| } | |
| }, | |
| { | |
| "set": { | |
| "if": "[\"302014\", \"302016\", \"302018\", \"302021\", \"302036\", \"302304\", \"302306\"].contains(ctx._temp_.cisco.message_id)", | |
| "field": "event.action", | |
| "value": "flow-expiration" | |
| } | |
| }, | |
| { | |
| "grok": { | |
| "field": "message", | |
| "if": "[\"302014\", \"302016\", \"302018\", \"302021\", \"302036\", \"302304\", \"302306\"].contains(ctx._temp_.cisco.message_id)", | |
| "patterns": [ | |
| "Teardown %{NOTSPACE:network.transport} (?:state-bypass )?connection %{NOTSPACE:_temp_.cisco.connection_id} (?:for|from) %{NOTCOLON:_temp_.cisco.source_interface}:%{DATA:source.address}/%{NUMBER:source.port:int}\\s*(?:%{NOTSPACE:_temp_.cisco.source_username} )?to %{NOTCOLON:_temp_.cisco.destination_interface}:%{DATA:destination.address}/%{NUMBER:destination.port:int}\\s*(?:%{NOTSPACE:_temp_.cisco.destination_username} )?(?:duration %{TIME:_temp_.duration_hms} bytes %{NUMBER:network.bytes:int})%{GREEDYDATA}", | |
| "Teardown %{NOTSPACE:network.transport} connection for faddr (?:%{NOTCOLON:_temp_.cisco.source_interface}:)?%{ECSDESTIPORHOST}/%{NUMBER}\\s*(?:%{NOTSPACE:_temp_.cisco.destination_username} )?gaddr (?:%{NOTCOLON}:)?%{MAPPEDSRC}/%{NUMBER} laddr (?:%{NOTCOLON:_temp_.cisco.source_interface}:)?%{ECSSOURCEIPORHOST}/%{NUMBER}\\s*(?:%{NOTSPACE:_temp_.cisco.source_username})?%{GREEDYDATA}" | |
| ], | |
| "pattern_definitions": { | |
| "NOTCOLON": "[^:]*", | |
| "ECSSOURCEIPORHOST": "(?:%{IP:source.address}|%{HOSTNAME:source.domain})", | |
| "ECSDESTIPORHOST": "(?:%{IP:destination.address}|%{HOSTNAME:destination.domain})", | |
| "MAPPEDSRC": "(?:%{DATA:_temp_.cisco.mapped_source_ip}|%{HOSTNAME})" | |
| } | |
| } | |
| }, | |
| { | |
| "kv": { | |
| "if": "[\"430001\", \"430002\", \"430003\", \"430004\", \"430005\", \"\"].contains(ctx._temp_.cisco.message_id)", | |
| "field": "message", | |
| "field_split": ",(?=[A-za-z1-9\\s]+:)", | |
| "value_split": ":", | |
| "target_field": "_temp_.orig_security", | |
| "trim_key": " ", | |
| "trim_value": " ", | |
| "ignore_failure": true | |
| } | |
| }, | |
| { | |
| "remove": { | |
| "field": [ | |
| "message" | |
| ], | |
| "ignore_missing": true | |
| } | |
| }, | |
| { | |
| "script": { | |
| "if": "ctx._temp_?.orig_security != null", | |
| "params": { | |
| "ACPolicy": { | |
| "target": "ac_policy", | |
| "id": [ | |
| "430001", | |
| "430002", | |
| "430003" | |
| ], | |
| "ecs": [ | |
| "_temp_.cisco.rule_name" | |
| ] | |
| }, | |
| "AccessControlRuleAction": { | |
| "target": "access_control_rule_action", | |
| "id": [ | |
| "430002", | |
| "430003" | |
| ], | |
| "ecs": [ | |
| "event.outcome" | |
| ] | |
| }, | |
| "AccessControlRuleName": { | |
| "target": "access_control_rule_name", | |
| "id": [ | |
| "430002", | |
| "430003" | |
| ], | |
| "ecs": [ | |
| "_temp_.cisco.rule_name" | |
| ] | |
| }, | |
| "AccessControlRuleReason": { | |
| "target": "access_control_rule_reason", | |
| "id": [ | |
| "430002", | |
| "430003" | |
| ] | |
| }, | |
| "ApplicationProtocol": { | |
| "target": "application_protocol", | |
| "ecs": [ | |
| "network.protocol" | |
| ] | |
| }, | |
| "ArchiveDepth": { | |
| "target": "archive_depth", | |
| "id": [ | |
| "430004", | |
| "430005" | |
| ] | |
| }, | |
| "ArchiveFileName": { | |
| "target": "archive_file_name", | |
| "id": [ | |
| "430004", | |
| "430005" | |
| ], | |
| "ecs": [ | |
| "file.name" | |
| ] | |
| }, | |
| "ArchiveFileStatus": { | |
| "target": "archive_file_status", | |
| "id": [ | |
| "430004", | |
| "430005" | |
| ] | |
| }, | |
| "ArchiveSHA256": { | |
| "target": "archive_sha256", | |
| "id": [ | |
| "430004", | |
| "430005" | |
| ], | |
| "ecs": [ | |
| "file.hash.sha256" | |
| ] | |
| }, | |
| "Classification": { | |
| "target": "classification", | |
| "id": [ | |
| "430001" | |
| ] | |
| }, | |
| "Client": { | |
| "target": "client", | |
| "ecs": [ | |
| "network.application" | |
| ] | |
| }, | |
| "ClientVersion": { | |
| "target": "client_version", | |
| "id": [ | |
| "430002", | |
| "430003" | |
| ] | |
| }, | |
| "ConnectionDuration": { | |
| "target": "connection_duration", | |
| "id": [ | |
| "430003" | |
| ], | |
| "ecs": [ | |
| "event.duration" | |
| ] | |
| }, | |
| "DNS_Sinkhole": { | |
| "target": "dns_sinkhole", | |
| "id": [ | |
| "430002", | |
| "430003" | |
| ] | |
| }, | |
| "DNS_TTL": { | |
| "target": "dns_ttl", | |
| "id": [ | |
| "430002", | |
| "430003" | |
| ] | |
| }, | |
| "DNSQuery": { | |
| "target": "dns_query", | |
| "id": [ | |
| "430002", | |
| "430003" | |
| ], | |
| "ecs": [ | |
| "dns.question.name" | |
| ] | |
| }, | |
| "DNSRecordType": { | |
| "target": "dns_record_type", | |
| "id": [ | |
| "430002", | |
| "430003" | |
| ], | |
| "ecs": [ | |
| "dns.question.type" | |
| ] | |
| }, | |
| "DNSResponseType": { | |
| "target": "dns_response_type", | |
| "id": [ | |
| "430002", | |
| "430003" | |
| ], | |
| "ecs": [ | |
| "dns.response_code" | |
| ] | |
| }, | |
| "DNSSICategory": { | |
| "target": "dnssi_category", | |
| "id": [ | |
| "430002", | |
| "430003" | |
| ] | |
| }, | |
| "DstIP": { | |
| "target": "dst_ip", | |
| "ecs": [ | |
| "destination.address" | |
| ] | |
| }, | |
| "DstPort": { | |
| "target": "dst_port", | |
| "ecs": [ | |
| "destination.port" | |
| ] | |
| }, | |
| "EgressInterface": { | |
| "target": "egress_interface", | |
| "id": [ | |
| "430001", | |
| "430002", | |
| "430003" | |
| ], | |
| "ecs": [ | |
| "_temp_.cisco.destination_interface" | |
| ] | |
| }, | |
| "EgressZone": { | |
| "target": "egress_zone", | |
| "id": [ | |
| "430001", | |
| "430002", | |
| "430003" | |
| ] | |
| }, | |
| "Endpoint Profile": { | |
| "target": "endpoint_profile", | |
| "id": [ | |
| "430002", | |
| "430003" | |
| ] | |
| }, | |
| "FileAction": { | |
| "target": "file_action", | |
| "id": [ | |
| "430004", | |
| "430005" | |
| ] | |
| }, | |
| "FileCount": { | |
| "target": "file_count", | |
| "id": [ | |
| "430002", | |
| "430003" | |
| ] | |
| }, | |
| "FileDirection": { | |
| "target": "file_direction", | |
| "id": [ | |
| "430004", | |
| "430005" | |
| ] | |
| }, | |
| "FileName": { | |
| "target": "file_name", | |
| "id": [ | |
| "430004", | |
| "430005" | |
| ], | |
| "ecs": [ | |
| "file.name" | |
| ] | |
| }, | |
| "FilePolicy": { | |
| "target": "file_policy", | |
| "id": [ | |
| "430004", | |
| "430005" | |
| ], | |
| "ecs": [ | |
| "_temp_.cisco.rule_name" | |
| ] | |
| }, | |
| "FileSHA256": { | |
| "target": "file_sha256", | |
| "id": [ | |
| "430004", | |
| "430005" | |
| ], | |
| "ecs": [ | |
| "file.hash.sha256" | |
| ] | |
| }, | |
| "FileSandboxStatus": { | |
| "target": "file_sandbox_status", | |
| "id": [ | |
| "430004", | |
| "430005" | |
| ] | |
| }, | |
| "FileSize": { | |
| "target": "file_size", | |
| "id": [ | |
| "430004", | |
| "430005" | |
| ], | |
| "ecs": [ | |
| "file.size" | |
| ] | |
| }, | |
| "FileStorageStatus": { | |
| "target": "file_storage_status", | |
| "id": [ | |
| "430004", | |
| "430005" | |
| ] | |
| }, | |
| "FileType": { | |
| "target": "file_type", | |
| "id": [ | |
| "430004", | |
| "430005" | |
| ] | |
| }, | |
| "FirstPacketSecond": { | |
| "target": "first_packet_second", | |
| "id": [ | |
| "430004", | |
| "430005" | |
| ], | |
| "ecs": [ | |
| "event.start" | |
| ] | |
| }, | |
| "GID": { | |
| "target": "gid", | |
| "id": [ | |
| "430001" | |
| ], | |
| "ecs": [ | |
| "service.id" | |
| ] | |
| }, | |
| "HTTPReferer": { | |
| "target": "http_referer", | |
| "id": [ | |
| "430002", | |
| "430003" | |
| ], | |
| "ecs": [ | |
| "http.request.referrer" | |
| ] | |
| }, | |
| "HTTPResponse": { | |
| "target": "http_response", | |
| "id": [ | |
| "430001", | |
| "430002", | |
| "430003" | |
| ], | |
| "ecs": [ | |
| "http.response.status_code" | |
| ] | |
| }, | |
| "ICMPCode": { | |
| "target": "icmp_code", | |
| "id": [ | |
| "430001", | |
| "430002", | |
| "430003" | |
| ] | |
| }, | |
| "ICMPType": { | |
| "target": "icmp_type", | |
| "id": [ | |
| "430001", | |
| "430002", | |
| "430003" | |
| ] | |
| }, | |
| "IPReputationSICategory": { | |
| "target": "ip_reputation_si_category", | |
| "id": [ | |
| "430002", | |
| "430003" | |
| ] | |
| }, | |
| "IPSCount": { | |
| "target": "ips_count", | |
| "id": [ | |
| "430002", | |
| "430003" | |
| ] | |
| }, | |
| "IngressInterface": { | |
| "target": "ingress_interface", | |
| "id": [ | |
| "430001", | |
| "430002", | |
| "430003" | |
| ], | |
| "ecs": [ | |
| "_temp_.cisco.source_interface" | |
| ] | |
| }, | |
| "IngressZone": { | |
| "target": "ingress_zone", | |
| "id": [ | |
| "430001", | |
| "430002", | |
| "430003" | |
| ] | |
| }, | |
| "InitiatorBytes": { | |
| "target": "initiator_bytes", | |
| "id": [ | |
| "430003" | |
| ], | |
| "ecs": [ | |
| "source.bytes" | |
| ] | |
| }, | |
| "InitiatorPackets": { | |
| "target": "initiator_packets", | |
| "id": [ | |
| "430003" | |
| ], | |
| "ecs": [ | |
| "source.packets" | |
| ] | |
| }, | |
| "InlineResult": { | |
| "target": "inline_result", | |
| "id": [ | |
| "430001" | |
| ], | |
| "ecs": [ | |
| "event.outcome" | |
| ] | |
| }, | |
| "IntrusionPolicy": { | |
| "target": "intrusion_policy", | |
| "id": [ | |
| "430001" | |
| ], | |
| "ecs": [ | |
| "_temp_.cisco.rule_name" | |
| ] | |
| }, | |
| "MPLS_Label": { | |
| "target": "mpls_label", | |
| "id": [ | |
| "430001" | |
| ] | |
| }, | |
| "Message": { | |
| "target": "message", | |
| "id": [ | |
| "430001" | |
| ], | |
| "ecs": [ | |
| "message" | |
| ] | |
| }, | |
| "NAPPolicy": { | |
| "target": "nap_policy", | |
| "id": [ | |
| "430001", | |
| "430002", | |
| "430003" | |
| ] | |
| }, | |
| "NetBIOSDomain": { | |
| "target": "net_bios_domain", | |
| "id": [ | |
| "430002", | |
| "430003" | |
| ], | |
| "ecs": [ | |
| "host.hostname" | |
| ] | |
| }, | |
| "NumIOC": { | |
| "target": "num_ioc", | |
| "id": [ | |
| "430001" | |
| ] | |
| }, | |
| "Prefilter Policy": { | |
| "target": "prefilter_policy", | |
| "id": [ | |
| "430002", | |
| "430003" | |
| ] | |
| }, | |
| "Priority": { | |
| "target": "priority", | |
| "id": [ | |
| "430001" | |
| ] | |
| }, | |
| "Protocol": { | |
| "target": "protocol", | |
| "ecs": [ | |
| "network.transport" | |
| ] | |
| }, | |
| "ReferencedHost": { | |
| "target": "referenced_host", | |
| "id": [ | |
| "430002", | |
| "430003" | |
| ], | |
| "ecs": [ | |
| "url.domain" | |
| ] | |
| }, | |
| "ResponderBytes": { | |
| "target": "responder_bytes", | |
| "id": [ | |
| "430003" | |
| ], | |
| "ecs": [ | |
| "destination.bytes" | |
| ] | |
| }, | |
| "ResponderPackets": { | |
| "target": "responder_packets", | |
| "id": [ | |
| "430003" | |
| ], | |
| "ecs": [ | |
| "destination.packets" | |
| ] | |
| }, | |
| "Revision": { | |
| "target": "revision", | |
| "id": [ | |
| "430001" | |
| ] | |
| }, | |
| "SHA_Disposition": { | |
| "target": "sha_disposition", | |
| "id": [ | |
| "430004", | |
| "430005" | |
| ] | |
| }, | |
| "SID": { | |
| "target": "sid", | |
| "id": [ | |
| "430001" | |
| ] | |
| }, | |
| "SSLActualAction": { | |
| "target": "ssl_actual_action", | |
| "ecs": [ | |
| "event.outcome" | |
| ] | |
| }, | |
| "SSLCertificate": { | |
| "target": "ssl_certificate", | |
| "id": [ | |
| "430002", | |
| "430003", | |
| "430004", | |
| "430005" | |
| ] | |
| }, | |
| "SSLExpectedAction": { | |
| "target": "ssl_expected_action", | |
| "id": [ | |
| "430002", | |
| "430003" | |
| ] | |
| }, | |
| "SSLFlowStatus": { | |
| "target": "ssl_flow_status", | |
| "id": [ | |
| "430002", | |
| "430003", | |
| "430004", | |
| "430005" | |
| ] | |
| }, | |
| "SSLPolicy": { | |
| "target": "ssl_policy", | |
| "id": [ | |
| "430002", | |
| "430003" | |
| ] | |
| }, | |
| "SSLRuleName": { | |
| "target": "ssl_rule_name", | |
| "id": [ | |
| "430002", | |
| "430003" | |
| ] | |
| }, | |
| "SSLServerCertStatus": { | |
| "target": "ssl_server_cert_status", | |
| "id": [ | |
| "430002", | |
| "430003" | |
| ] | |
| }, | |
| "SSLServerName": { | |
| "target": "ssl_server_name", | |
| "id": [ | |
| "430002", | |
| "430003" | |
| ], | |
| "ecs": [ | |
| "server.domain" | |
| ] | |
| }, | |
| "SSLSessionID": { | |
| "target": "ssl_session_id", | |
| "id": [ | |
| "430002", | |
| "430003" | |
| ] | |
| }, | |
| "SSLTicketID": { | |
| "target": "ssl_ticket_id", | |
| "id": [ | |
| "430002", | |
| "430003" | |
| ] | |
| }, | |
| "SSLURLCategory": { | |
| "target": "sslurl_category", | |
| "id": [ | |
| "430002", | |
| "430003" | |
| ] | |
| }, | |
| "SSLVersion": { | |
| "target": "ssl_version", | |
| "id": [ | |
| "430002", | |
| "430003" | |
| ] | |
| }, | |
| "SSSLCipherSuite": { | |
| "target": "sssl_cipher_suite", | |
| "id": [ | |
| "430002", | |
| "430003" | |
| ] | |
| }, | |
| "SecIntMatchingIP": { | |
| "target": "sec_int_matching_ip", | |
| "id": [ | |
| "430002", | |
| "430003" | |
| ] | |
| }, | |
| "Security Group": { | |
| "target": "security_group", | |
| "id": [ | |
| "430002", | |
| "430003" | |
| ] | |
| }, | |
| "SperoDisposition": { | |
| "target": "spero_disposition", | |
| "id": [ | |
| "430004", | |
| "430005" | |
| ] | |
| }, | |
| "SrcIP": { | |
| "target": "src_ip", | |
| "ecs": [ | |
| "source.address" | |
| ] | |
| }, | |
| "SrcPort": { | |
| "target": "src_port", | |
| "ecs": [ | |
| "source.port" | |
| ] | |
| }, | |
| "TCPFlags": { | |
| "target": "tcp_flags", | |
| "id": [ | |
| "430002", | |
| "430003" | |
| ] | |
| }, | |
| "ThreatName": { | |
| "target": "threat_name", | |
| "id": [ | |
| "430005" | |
| ], | |
| "ecs": [ | |
| "_temp_.cisco.threat_category" | |
| ] | |
| }, | |
| "ThreatScore": { | |
| "target": "threat_score", | |
| "id": [ | |
| "430005" | |
| ], | |
| "ecs": [ | |
| "_temp_.cisco.threat_level" | |
| ] | |
| }, | |
| "Tunnel or Prefilter Rule": { | |
| "target": "tunnel_or_prefilter_rule", | |
| "id": [ | |
| "430002", | |
| "430003" | |
| ] | |
| }, | |
| "URI": { | |
| "target": "uri", | |
| "id": [ | |
| "430004", | |
| "430005" | |
| ], | |
| "ecs": [ | |
| "url.original" | |
| ] | |
| }, | |
| "URL": { | |
| "target": "url", | |
| "id": [ | |
| "430002", | |
| "430003" | |
| ], | |
| "ecs": [ | |
| "url.original" | |
| ] | |
| }, | |
| "URLCategory": { | |
| "target": "url_category", | |
| "id": [ | |
| "430002", | |
| "430003" | |
| ] | |
| }, | |
| "URLReputation": { | |
| "target": "url_reputation", | |
| "id": [ | |
| "430002", | |
| "430003" | |
| ] | |
| }, | |
| "URLSICategory": { | |
| "target": "urlsi_category", | |
| "id": [ | |
| "430002", | |
| "430003" | |
| ] | |
| }, | |
| "User": { | |
| "target": "user", | |
| "ecs": [ | |
| "user.id", | |
| "user.name" | |
| ] | |
| }, | |
| "UserAgent": { | |
| "target": "user_agent", | |
| "id": [ | |
| "430002", | |
| "430003" | |
| ], | |
| "ecs": [ | |
| "user_agent.original" | |
| ] | |
| }, | |
| "VLAN_ID": { | |
| "target": "vlan_id", | |
| "id": [ | |
| "430001", | |
| "430002", | |
| "430003" | |
| ] | |
| }, | |
| "WebApplication": { | |
| "target": "web_application", | |
| "ecs": [ | |
| "network.application" | |
| ] | |
| }, | |
| "originalClientSrcIP": { | |
| "target": "original_client_src_ip", | |
| "id": [ | |
| "430002", | |
| "430003" | |
| ], | |
| "ecs": [ | |
| "client.address" | |
| ] | |
| } | |
| }, | |
| "lang": "painless", | |
| "source": "boolean isEmpty(def value) {\n return (value instanceof AbstractList? value.size() : value.length()) == 0;\n}\ndef appendOrCreate(Map dest, String[] path, def value) {\n for (int i=0; i<path.length-1; i++) {\n dest = dest.computeIfAbsent(path[i], _ -> new HashMap());\n }\n String key = path[path.length - 1];\n def existing = dest.get(key);\n return existing == null?\n dest.put(key, value)\n : existing instanceof AbstractList?\n existing.add(value)\n : dest.put(key, new ArrayList([existing, value]));\n}\ndef msg = ctx._temp_.orig_security;\ndef counters = new HashMap();\ndef dest = new HashMap();\nctx._temp_.cisco['security'] = dest;\nfor (entry in msg.entrySet()) {\n def param = params.get(entry.getKey());\n if (param == null) {\n continue;\n }\n param.getOrDefault('id', []).forEach( id -> counters[id] = 1 + counters.getOrDefault(id, 0) );\n if (!isEmpty(entry.getValue())) {\n param.getOrDefault('ecs', []).forEach( field -> appendOrCreate(ctx, field.splitOnToken('.'), entry.getValue()) );\n dest[param.target] = entry.getValue();\n }\n}\nif (ctx._temp_.cisco.message_id != \"\") return;\ndef best;\nfor (entry in counters.entrySet()) {\n if (best == null || best.getValue() < entry.getValue()) best = entry;\n}\nif (best != null) ctx._temp_.cisco.message_id = best.getKey();\n" | |
| } | |
| }, | |
| { | |
| "script": { | |
| "lang": "painless", | |
| "params": { | |
| "ctx._temp_.cisco.message_id": { | |
| "target": "event.action", | |
| "map": { | |
| "430001": "intrusion-detected", | |
| "430002": "connection-started", | |
| "430003": "connection-finished", | |
| "430004": "file-detected", | |
| "430005": "malware-detected" | |
| } | |
| }, | |
| "dns.question.type": { | |
| "map": { | |
| "a host address": "A", | |
| "ip6 address": "AAAA", | |
| "text strings": "TXT", | |
| "a domain name pointer": "PTR", | |
| "an authoritative name server": "NS", | |
| "the canonical name for an alias": "CNAME", | |
| "marks the start of a zone of authority": "SOA", | |
| "mail exchange": "MX", | |
| "server selection": "SRV" | |
| } | |
| }, | |
| "dns.response_code": { | |
| "map": { | |
| "non-existent domain": "NXDOMAIN", | |
| "server failure": "SERVFAIL", | |
| "query refused": "REFUSED", | |
| "no error": "NOERROR" | |
| } | |
| } | |
| }, | |
| "source": "def getField(Map src, String[] path) {\n for (int i=0; i<path.length-1; i++) {\n src = src.getOrDefault(path[i], null);\n if (src == null || !(src instanceof Map)) {\n return null;\n }\n }\n return src[path[path.length-1]];\n}\ndef setField(Map dest, String[] path, def value) {\n for (int i=0; i<path.length-1; i++) {\n dest = dest.computeIfAbsent(path[i], _ -> new HashMap());\n }\n dest[path[path.length-1]] = value;\n}\nfor (entry in params.entrySet()) {\n def srcField = entry.getKey();\n def param = entry.getValue();\n String oldVal = getField(ctx, srcField.splitOnToken('.'));\n if (oldVal == null) continue;\n def newVal = param.map?.getOrDefault(oldVal.toLowerCase(), null);\n if (newVal != null) {\n def dstField = param.getOrDefault('target', srcField);\n setField(ctx, dstField.splitOnToken('.'), newVal);\n }\n}\n" | |
| } | |
| }, | |
| { | |
| "set": { | |
| "if": "ctx.dns?.question?.type != null && ctx.dns?.response_code == null", | |
| "field": "dns.response_code", | |
| "value": "NOERROR" | |
| } | |
| }, | |
| { | |
| "set": { | |
| "if": "ctx._temp_.cisco.message_id == \"430001\"", | |
| "field": "event.action", | |
| "value": "intrusion-detected" | |
| } | |
| }, | |
| { | |
| "set": { | |
| "if": "ctx._temp_.cisco.message_id == \"430002\"", | |
| "field": "event.action", | |
| "value": "connection-started" | |
| } | |
| }, | |
| { | |
| "set": { | |
| "if": "ctx._temp_.cisco.message_id == \"430003\"", | |
| "field": "event.action", | |
| "value": "connection-finished" | |
| } | |
| }, | |
| { | |
| "set": { | |
| "if": "ctx._temp_.cisco.message_id == \"430004\"", | |
| "field": "event.action", | |
| "value": "file-detected" | |
| } | |
| }, | |
| { | |
| "set": { | |
| "if": "ctx._temp_.cisco.message_id == \"430005\"", | |
| "field": "event.action", | |
| "value": "malware-detected" | |
| } | |
| }, | |
| { | |
| "set": { | |
| "field": "_temp_.duration_hms", | |
| "value": "{{event.duration}}", | |
| "if": "ctx.event?.duration != null" | |
| } | |
| }, | |
| { | |
| "script": { | |
| "lang": "painless", | |
| "if": "ctx?._temp_?.duration_hms != null", | |
| "source": "long parse_hms(String s) {\n long cur = 0, total = 0;\n for (char c: s.toCharArray()) {\n if (c >= (char)'0' && c <= (char)'9') {\n cur = (cur*10) + (long)c - (char)'0';\n } else if (c == (char)':') {\n total = (total + cur) * 60;\n cur = 0;\n } else {\n return 0;\n }\n }\n return total + cur;\n} if (ctx?.event == null) {\n ctx['event'] = new HashMap();\n} String end = ctx['@timestamp']; ctx.event['end'] = end; long nanos = parse_hms(ctx._temp_.duration_hms) * 1000000000L; ctx.event['duration'] = nanos; ctx.event['start'] = ZonedDateTime.ofInstant(\n Instant.parse(end).minusNanos(nanos),\n ZoneOffset.UTC);\n" | |
| } | |
| }, | |
| { | |
| "lowercase": { | |
| "field": "network.transport", | |
| "ignore_failure": true | |
| } | |
| }, | |
| { | |
| "lowercase": { | |
| "field": "network.protocol", | |
| "ignore_failure": true | |
| } | |
| }, | |
| { | |
| "lowercase": { | |
| "field": "network.application", | |
| "ignore_failure": true | |
| } | |
| }, | |
| { | |
| "lowercase": { | |
| "field": "file.type", | |
| "ignore_failure": true | |
| } | |
| }, | |
| { | |
| "lowercase": { | |
| "field": "network.direction", | |
| "ignore_failure": true | |
| } | |
| }, | |
| { | |
| "script": { | |
| "if": "ctx?.network?.transport != null", | |
| "lang": "painless", | |
| "params": { | |
| "icmp": 1, | |
| "igmp": 2, | |
| "ipv4": 4, | |
| "tcp": 6, | |
| "egp": 8, | |
| "igp": 9, | |
| "pup": 12, | |
| "udp": 17, | |
| "rdp": 27, | |
| "irtp": 28, | |
| "dccp": 33, | |
| "idpr": 35, | |
| "ipv6": 41, | |
| "ipv6-route": 43, | |
| "ipv6-frag": 44, | |
| "rsvp": 46, | |
| "gre": 47, | |
| "esp": 50, | |
| "ipv6-icmp": 58, | |
| "ipv6-nonxt": 59, | |
| "ipv6-opts": 60 | |
| }, | |
| "source": "def net = ctx.network; def iana = params[net.transport]; if (iana != null) {\n net['iana_number'] = iana;\n return;\n} def reverse = new HashMap(); def[] arr = new def[] { null }; for (entry in params.entrySet()) {\n arr[0] = entry.getValue();\n reverse.put(String.format(\"%d\", arr), entry.getKey());\n} def trans = reverse[net.transport]; if (trans != null) {\n net['iana_number'] = net.transport;\n net['transport'] = trans;\n}\n" | |
| } | |
| }, | |
| { | |
| "lowercase": { | |
| "field": "event.outcome", | |
| "ignore_missing": true | |
| } | |
| }, | |
| { | |
| "set": { | |
| "field": "event.outcome", | |
| "if": "ctx.event?.outcome == \"est-allowed\"", | |
| "value": "allow" | |
| } | |
| }, | |
| { | |
| "set": { | |
| "field": "event.outcome", | |
| "if": "ctx.event?.outcome == \"permitted\"", | |
| "value": "allow" | |
| } | |
| }, | |
| { | |
| "set": { | |
| "field": "event.outcome", | |
| "if": "ctx.event?.outcome == \"denied\"", | |
| "value": "deny" | |
| } | |
| }, | |
| { | |
| "set": { | |
| "field": "event.outcome", | |
| "if": "ctx.event?.outcome == \"dropped\"", | |
| "value": "deny" | |
| } | |
| }, | |
| { | |
| "set": { | |
| "field": "network.transport", | |
| "if": "ctx.network?.transport == \"icmpv6\"", | |
| "value": "ipv6-icmp" | |
| } | |
| }, | |
| { | |
| "convert": { | |
| "field": "source.port", | |
| "type": "integer", | |
| "ignore_failure": true | |
| } | |
| }, | |
| { | |
| "convert": { | |
| "field": "destination.port", | |
| "type": "integer", | |
| "ignore_failure": true | |
| } | |
| }, | |
| { | |
| "convert": { | |
| "field": "source.bytes", | |
| "type": "integer", | |
| "ignore_failure": true | |
| } | |
| }, | |
| { | |
| "convert": { | |
| "field": "destination.bytes", | |
| "type": "integer", | |
| "ignore_failure": true | |
| } | |
| }, | |
| { | |
| "convert": { | |
| "field": "source.packets", | |
| "type": "integer", | |
| "ignore_failure": true | |
| } | |
| }, | |
| { | |
| "convert": { | |
| "field": "destination.packets", | |
| "type": "integer", | |
| "ignore_failure": true | |
| } | |
| }, | |
| { | |
| "convert": { | |
| "field": "_temp_.cisco.mapped_source_port", | |
| "type": "integer", | |
| "ignore_failure": true | |
| } | |
| }, | |
| { | |
| "convert": { | |
| "field": "_temp_.cisco.mapped_destination_port", | |
| "type": "integer", | |
| "ignore_failure": true | |
| } | |
| }, | |
| { | |
| "convert": { | |
| "field": "_temp_.cisco.icmp_code", | |
| "type": "integer", | |
| "ignore_failure": true | |
| } | |
| }, | |
| { | |
| "convert": { | |
| "field": "_temp_.cisco.icmp_type", | |
| "type": "integer", | |
| "ignore_failure": true | |
| } | |
| }, | |
| { | |
| "convert": { | |
| "field": "network.iana_number", | |
| "type": "integer", | |
| "ignore_failure": true | |
| } | |
| }, | |
| { | |
| "grok": { | |
| "field": "source.address", | |
| "patterns": [ | |
| "(?:%{IP:source.ip}|%{GREEDYDATA:source.domain})" | |
| ], | |
| "ignore_failure": true | |
| } | |
| }, | |
| { | |
| "grok": { | |
| "field": "destination.address", | |
| "patterns": [ | |
| "(?:%{IP:destination.ip}|%{GREEDYDATA:destination.domain})" | |
| ], | |
| "ignore_failure": true | |
| } | |
| }, | |
| { | |
| "grok": { | |
| "field": "client.address", | |
| "patterns": [ | |
| "(?:%{IP:client.ip}|%{GREEDYDATA:client.domain})" | |
| ], | |
| "ignore_failure": true | |
| } | |
| }, | |
| { | |
| "grok": { | |
| "field": "server.address", | |
| "patterns": [ | |
| "(?:%{IP:server.ip}|%{GREEDYDATA:server.domain})" | |
| ], | |
| "ignore_failure": true | |
| } | |
| }, | |
| { | |
| "geoip": { | |
| "field": "source.ip", | |
| "target_field": "source.geo", | |
| "ignore_missing": true | |
| } | |
| }, | |
| { | |
| "geoip": { | |
| "field": "destination.ip", | |
| "target_field": "destination.geo", | |
| "ignore_missing": true | |
| } | |
| }, | |
| { | |
| "geoip": { | |
| "database_file": "GeoLite2-ASN.mmdb", | |
| "field": "source.ip", | |
| "target_field": "source.as", | |
| "properties": [ | |
| "asn", | |
| "organization_name" | |
| ], | |
| "ignore_missing": true | |
| } | |
| }, | |
| { | |
| "geoip": { | |
| "database_file": "GeoLite2-ASN.mmdb", | |
| "field": "destination.ip", | |
| "target_field": "destination.as", | |
| "properties": [ | |
| "asn", | |
| "organization_name" | |
| ], | |
| "ignore_missing": true | |
| } | |
| }, | |
| { | |
| "rename": { | |
| "field": "source.as.asn", | |
| "target_field": "source.as.number", | |
| "ignore_missing": true | |
| } | |
| }, | |
| { | |
| "rename": { | |
| "field": "source.as.organization_name", | |
| "target_field": "source.as.organization.name", | |
| "ignore_missing": true | |
| } | |
| }, | |
| { | |
| "rename": { | |
| "field": "destination.as.asn", | |
| "target_field": "destination.as.number", | |
| "ignore_missing": true | |
| } | |
| }, | |
| { | |
| "rename": { | |
| "field": "destination.as.organization_name", | |
| "target_field": "destination.as.organization.name", | |
| "ignore_missing": true | |
| } | |
| }, | |
| { | |
| "set": { | |
| "field": "source.nat.ip", | |
| "value": "{{_temp_.cisco.mapped_source_ip}}", | |
| "if": "ctx._temp_.cisco.mapped_source_ip != null && (ctx._temp_.cisco.mapped_source_ip != ctx.source.ip || ctx._temp_.cisco.mapped_source_port != ctx.source.port)" | |
| } | |
| }, | |
| { | |
| "set": { | |
| "field": "source.nat.port", | |
| "value": "{{_temp_.cisco.mapped_source_port}}", | |
| "if": "ctx._temp_.cisco.mapped_source_port != null && (ctx._temp_.cisco.mapped_source_ip != ctx.source.ip || ctx._temp_.cisco.mapped_source_port != ctx.source.port)" | |
| } | |
| }, | |
| { | |
| "set": { | |
| "field": "destination.nat.ip", | |
| "value": "{{_temp_.cisco.mapped_destination_ip}}", | |
| "if": "ctx._temp_.cisco.mapped_destination_ip != null && (ctx._temp_.cisco.mapped_destination_ip != ctx.destination.ip || ctx._temp_.cisco.mapped_destination_port != ctx.destination.port)" | |
| } | |
| }, | |
| { | |
| "set": { | |
| "field": "destination.nat.port", | |
| "value": "{{_temp_.cisco.mapped_destination_port}}", | |
| "if": "ctx._temp_.cisco.mapped_destination_port != null && (ctx._temp_.cisco.mapped_destination_ip != ctx.destination.ip || ctx._temp_.cisco.mapped_destination_port != ctx.destination.port)" | |
| } | |
| }, | |
| { | |
| "convert": { | |
| "field": "_temp_.cisco.message_id", | |
| "target_field": "event.code", | |
| "type": "integer", | |
| "ignore_failure": true | |
| } | |
| }, | |
| { | |
| "remove": { | |
| "field": [ | |
| "_temp_.cisco.message_id", | |
| "event.code" | |
| ], | |
| "if": "ctx._temp_.cisco.message_id == \"\"", | |
| "ignore_failure": true | |
| } | |
| }, | |
| { | |
| "rename": { | |
| "field": "_temp_.cisco", | |
| "target_field": "cisco.asa", | |
| "ignore_failure": true | |
| } | |
| }, | |
| { | |
| "remove": { | |
| "field": "_temp_", | |
| "ignore_missing": true | |
| } | |
| }, | |
| { | |
| "rename": { | |
| "field": "log.original", | |
| "target_field": "event.original", | |
| "ignore_missing": true | |
| } | |
| }, | |
| { | |
| "rename": { | |
| "field": "cisco.asa.list_id", | |
| "target_field": "cisco.asa.rule_name", | |
| "ignore_missing": true | |
| } | |
| } | |
| ], | |
| "on_failure": [ | |
| { | |
| "rename": { | |
| "field": "_temp_.cisco", | |
| "target_field": "cisco.asa", | |
| "ignore_failure": true | |
| } | |
| }, | |
| { | |
| "remove": { | |
| "field": "_temp_", | |
| "ignore_missing": true | |
| } | |
| }, | |
| { | |
| "append": { | |
| "field": "error.message", | |
| "value": "{{ _ingest.on_failure_message }}" | |
| } | |
| } | |
| ] | |
| } |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment