Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
[HOT FIX] v0.1.7-alpha02262019 - Logstash Pipeline
helk-logstash + Added offline plugins file + Updated win security conversion + cleaned process-name filter & process-name-split configs + cleaned process-id filter & proces-id conversion configs + set kafka max poll records to 500 + updated SOURCE_ & TARGET_ field names from process entity to be renamed process_source_ and process_target. Following the basic `entity_context_property` from OSSEM CIM
- Loading branch information
1 parent
65131b2
commit cfb9b98
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,44 @@ | ||
| # HELK process-name-filter filter conf | ||
| # HELK build Stage: Alpha | ||
| # Author: Roberto Rodriguez (@Cyb3rWard0g) | ||
| # License: GPL-3.0 | ||
|
|
||
| filter { | ||
This comment has been minimized.
Sorry, something went wrong. |
||
| if [event_id] { | ||
| if [Image] { | ||
| mutate { add_field => { "z_logstash_pipeline" => "1523_1" } } | ||
| mutate { rename => { "Image" => "process_path" } } | ||
| } | ||
| if [Application] { | ||
| mutate { add_field => { "z_logstash_pipeline" => "1523_2" } } | ||
| mutate { rename => { "Application" => "process_path" } } | ||
| } | ||
| if [NewProcessName] { | ||
| mutate { add_field => { "z_logstash_pipeline" => "1523_3" } } | ||
| mutate { rename => { "NewProcessName" => "process_path" } } | ||
| } | ||
| if [ProcessName] { | ||
| mutate { add_field => { "z_logstash_pipeline" => "1523_4" } } | ||
| mutate { rename => { "ProcessName" => "process_path" }} | ||
| } | ||
| if [ParentProcessName] { | ||
| mutate { add_field => { "z_logstash_pipeline" => "1523_5" } } | ||
| mutate { rename => { "ParentProcessName" => "process_parent_path" } } | ||
| } | ||
| if [ParentImage] { | ||
| mutate { add_field => { "z_logstash_pipeline" => "1523_6" } } | ||
| mutate { rename => { "ParentImage" => "process_parent_path" } } | ||
| } | ||
| if [TargetImage] { | ||
| mutate { add_field => { "z_logstash_pipeline" => "1523_7" } } | ||
| mutate { rename => { "TargetImage" => "process_target_path" } } | ||
| } | ||
| if [SourceImage] { | ||
| mutate { add_field => { "z_logstash_pipeline" => "1523_8" } } | ||
| mutate { rename => { "SourceImage" => "process_path" } } | ||
| } | ||
| if [ProdessName] { | ||
| mutate { rename => { "ProdessName" => "process_path" } } | ||
| } | ||
| } | ||
| } | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,53 @@ | ||
| # HELK process-ids filter conf | ||
| # HELK build Stage: Alpha | ||
| # Author: Roberto Rodriguez (@Cyb3rWard0g) | ||
| # License: GPL-3.0 | ||
|
|
||
| filter { | ||
This comment has been minimized.
Sorry, something went wrong. 
neu5ron
Collaborator
|
||
| if [event_id] { | ||
| if [ProcessId] { | ||
| mutate { add_field => { "z_logstash_pipeline" => "1524_2" } } | ||
| mutate { rename => { "ProcessId" => "process_id" } } | ||
| } | ||
| if [NewProcessId] { | ||
| mutate { add_field => { "z_logstash_pipeline" => "1524_3" } } | ||
| mutate { rename => { "NewProcessId" => "process_id" } } | ||
| } | ||
| if [ParentProcessId] { | ||
| mutate { add_field => { "z_logstash_pipeline" => "1524_5" } } | ||
| mutate { rename => { "ParentProcessId" => "process_parent_id" } } | ||
| } | ||
| if [ProcessGuid] { | ||
| mutate { add_field => { "z_logstash_pipeline" => "1524_6" } } | ||
| mutate { rename => { "ProcessGuid" => "process_guid" } } | ||
| } | ||
| if [ParentProcessGuid] { | ||
| mutate { add_field => { "z_logstash_pipeline" => "1524_7" } } | ||
| mutate { rename => { "ParentProcessGuid" => "process_parent_guid" } } | ||
| } | ||
| if [SourceProcessGuid] { | ||
| mutate { add_field => { "z_logstash_pipeline" => "1524_8" } } | ||
| mutate { rename => { "SourceProcessGuid" => "process_guid" } } | ||
| } | ||
| if [SourceProcessGUID] { | ||
| mutate { add_field => { "z_logstash_pipeline" => "1524_9" } } | ||
| mutate { rename => { "SourceProcessGUID" => "process_guid" } } | ||
| } | ||
| if [SourceProcessId] { | ||
| mutate { add_field => { "z_logstash_pipeline" => "1524_11" } } | ||
| mutate { rename => { "SourceProcessId" => "process_id" } } | ||
| } | ||
| if [TargetProcessGuid] { | ||
| mutate { add_field => { "z_logstash_pipeline" => "1524_12" } } | ||
| mutate { rename => { "TargetProcessGuid" => "process_target_guid" } } | ||
| } | ||
| if [TargetProcessGUID] { | ||
| mutate { add_field => { "z_logstash_pipeline" => "1524_13" } } | ||
| mutate { rename => { "TargetProcessGUID" => "process_target_guid" } } | ||
| } | ||
| if [TargetProcessId] { | ||
| mutate { add_field => { "z_logstash_pipeline" => "1524_15" } } | ||
| mutate { rename => { "TargetProcessId" => "process_target_id" } } | ||
| } | ||
| } | ||
| } | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
recommend moving all the "add_field" into the mutate rename.