rules.js

rules.js

exports.transform = function (event) {
  if (event.categoryDeviceGroup === '/IDS/Host/Antivirus' && (event.categoryObject === '/Host/Resource/File' || event.categoryObject === '/Host/Application/Malware')) {
    if (event.categoryObject === '/Host/Resource/File')
      event.echo_malwareName = event.deviceCustomString1;
    else if (event.categoryObject === '/Host/Application/Malware')
      event.echo_malwareName = event.name;
    event.echo_actionTaken = event.deviceAction;
    if (event.destinationUserName && !event.sourceUserName)
      event.echo_antivirusUsername = event.destinationUserName;
    else if (!event.destinationUserName && event.sourceUserName)
      event.echo_antivirusUsername = event.sourceUserName;
  }
  if (event.destinationUserName) {
    event.echo_isDestinationComputerAccount = event.destinationUserName.indexOf('$') > -1;
  }
  if (event.sourceUserName) {
    event.echo_isSourceComputerAccount = event.sourceUserName.indexOf('$') > -1;
  }
  if (event.name)
    event.echo_isAlert = event.name.indexOf('(') === 0 && event.deviceEventCategory === '/Rule/Fire';
  if (event.destinationHostName && event.destinationAddress)
    event.echo_destinationHostIP = event.destinationHostName + ' (' + event.destinationAddress + ')';
  if (event.sourceHostName && event.sourceAddress)
    event.echo_sourceHostIP = event.sourceHostName + ' (' + event.sourceAddress + ')';
  
  var eventTypesDictionary = ['Base', 'Aggregated', 'Correlation', 'Action'];
  event._eventType = event.eventType; //storing the original value
  try {
    event.eventType = eventTypesDictionary[parseInt(event.eventType, 10)];
  }
  catch (ex) {
    console.log('FAIL, event type translation, eventType: ', event.eventType);
    event.eventType = event.eventType.toString(); //use the current value as string
  }
  
  var localityDictionary = ['Local', 'Forwarded', 'Remote', 'ESMPassThrough', 'DirectPassToLoggger'];
  event._locality = event.locality; //storing the original value
  try {
    event.locality = localityDictionary[parseInt(event.locality, 10)];
  }
  catch (ex) {
    console.log('FAIL, locality translation, locality: ', event.locality);
    event.locality = event.locality.toString(); //use the current value as string
  }
  return event;
};