mirror of
https://github.com/marcredhat/SIEM-toolkit-patched
synced 2026-06-10 21:31:19 +00:00
Sync upstream features; preserve fork KV scanner, parsers, verifier
Brought in 35 upstream commits (MITRE heatmap, health score, dependency map,
PowerQuery playground, onboarding tracker, product grouping, modern UI redesign).
Preserved fork additions:
backend/routers/quality.py KV scanner, pattern refs, JS keys, JSON mode,
/parsers + /sync-from-sdl endpoints
parsers/ 96 OCSF + tenant parsers
tools/stormshield-verify/ end-to-end ingest regression test
.gitignore un-ignored parsers/*
CHANGES.md, PATCHES.md
This commit is contained in:
@@ -0,0 +1,26 @@
|
||||
{
|
||||
attributes: {
|
||||
class_uid: "5002",
|
||||
category_uid: "4",
|
||||
severity_id: "0",
|
||||
class_name: "F5 Web Traffic",
|
||||
category_name: "F5 HTTP Access Logs",
|
||||
"metadata.product.name": "F5 BIG-IP",
|
||||
"metadata.product.vendor_name": "F5 Networks",
|
||||
"dataSource.category": "network",
|
||||
"dataSource.name": "F5 BIG-IP",
|
||||
"dataSource.vendor": "F5"
|
||||
},
|
||||
patterns: {
|
||||
timestamp: "\\d{4}/\\d{2}/\\d{2}\\s+\\d{2}:\\d{2}:\\d{2}",
|
||||
ipv4: "(?:\\d{1,3}\\.){3}\\d{1,3}",
|
||||
quote: "\"[^\"]*\"",
|
||||
number: "\\d+"
|
||||
},
|
||||
formats: [
|
||||
{
|
||||
format: ".*$_=identifier$=$_$(?:\\,|\\r)",
|
||||
repeat: true
|
||||
}
|
||||
]
|
||||
}
|
||||
Reference in New Issue
Block a user