enrichments/squid2.json

squid2.json

{
	"enrichment": {
		"fieldMap": {
			"geo": [
				"ip_dst_addr"
			],
			"hbaseEnrichment": [
				"full_hostname"
			]
		},
		"fieldToTypeMap": {},
		"config": {}
	},
	"threatIntel": {
		"fieldMap": {
			"hbaseThreatIntel": [
				"full_hostname"
			]
		},
		"fieldToTypeMap": {
			"full_hostname": [
				"zeus"
			]
		},
		"config": {},
		"triageConfig": {
			"riskLevelRules": [
				{
					"name": "TooOftenRule",
					"comment": "",
					"rule": "count_unique_dist_addr > 5",
					"score": 33,
					"reason": "FORMAT('%s is surfed to often', ip_dst_addr)"
				},
				{
					"name": "ZeusHijacked",
					"comment": "",
					"rule": "threatintels.hbaseThreatIntel.full_hostname.zeus == 'alert'",
					"score": 100,
					"reason": "FORMAT('%s has known Zeus infection', full_hostname)"
				}
			],
			"aggregator": "MAX",
			"aggregationConfig": {}
		}
	},
	"configuration": {}
}