Created
April 9, 2013 13:39
-
-
Save dav3860/5345751 to your computer and use it in GitHub Desktop.
Logstash grok patterns for Juniper Netscreen firewalls.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| NETSCREEN1 policy_id=%{INT:policy_id} service=%{DATA:service} proto=%{INT:protocol} src zone=%{WORD} dst zone=%{WORD} action=%{WORD:action} sent=%{INT} rcvd=%{INT} src=%{IP:src_ip} dst=%{IP:dst_ip} icmp type=%{INT} icmp code=%{INT} src-xlated ip=%{IP:src_xlated_ip} dst-xlated ip=%{IP:dst_xlated_ip} | |
| NETSCREEN2 policy_id=%{INT:policy_id} service=%{DATA:service} proto=%{INT:protocol} src zone=%{WORD} dst zone=%{WORD} action=%{WORD:action} sent=%{INT} rcvd=%{INT} src=%{IP:src_ip} dst=%{IP:dst_ip} src_port=%{DATA:src_port} dst_port=%{DATA:dst_port} src-xlated ip=%{IP:src_xlated_ip} port=%{DATA:src_xlated_port} dst-xlated ip=%{IP:dst_xlated_ip} port=%{DATA:dst_xlated_port} | |
| NETSCREEN3 policy_id=%{INT:policy_id} service=%{DATA:service} proto=%{INT:protocol} src zone=%{WORD} dst zone=%{WORD} action=%{WORD:action} sent=%{INT} rcvd=%{INT} src=%{IP:src_ip} dst=%{IP:dst_ip} src_port=%{DATA:src_port} dst_port=%{DATA:dst_port} | |
| NETSCREEN4 policy_id=%{INT:policy_id} service=%{DATA:service} proto=%{INT:protocol} src zone=%{WORD} dst zone=%{WORD} action=%{WORD:action} sent=%{INT} rcvd=%{INT} src=%{IP:src_ip} dst=%{IP:dst_ip} | |
| NETSCREEN5 : %{DATA:action}! From %{IP:src_ip}(?::%{DATA:src_port})? to %{IP:dst_ip}(?::%{DATA:dst_port})?, proto %{WORD:protocol} |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment