Sync upstream features; preserve fork KV scanner, parsers, verifier

Brought in 35 upstream commits (MITRE heatmap, health score, dependency map, PowerQuery playground, onboarding tracker, product grouping, modern UI redesign). Preserved fork additions: backend/routers/quality.py KV scanner, pattern refs, JS keys, JSON mode, /parsers + /sync-from-sdl endpoints parsers/ 96 OCSF + tenant parsers tools/stormshield-verify/ end-to-end ingest regression test .gitignore un-ignored parsers/* CHANGES.md, PATCHES.md
2026-06-10 21:31:19 +00:00 · 2026-05-22 18:19:52 +02:00
parent a7ebcac9a6
commit 7c1687efce
102 changed files with 13912 additions and 178 deletions
@@ -0,0 +1,84 @@
+{
+  // specify a time zone if the timestamps in your log are not in GMT
+  // timezone: "GMT-0800"
+  attributes: {
+    "dataSource.name": "Imperva WAF",
+    "dataSource.vendor": "Imperva",
+    "dataSource.category": "security"
+    "metadata.product.name": "Imperva WAF",
+    "metadata.product.vendor_name": "Imperva"
+  },
+    
+  patterns: {
+    tsPattern: "\\d+",
+    value: "[^\\s]+",
+    toDrop: "^(?!CEF).*$"   
+  },
+    
+  formats: [
+    //drop logs
+    {
+      id: "drop",
+      format: "$unwanted=toDrop$",
+      discard: true
+    },
+    
+    {
+      format: "$unmapped.cef.version$\\|$metadata.vendor_name$\\|$metadata.product$\\|$metadata.product.version$\\|$unmapped.signature$\\|$event.type$\\|$severity$\\|",
+    },
+    {
+      format: ".*\\sstart=$timestamp=tsPattern$",
+    }, 
+    {
+      format: ".*requestClientApplication=$unmapped.requestClientApplication$\\sdeviceFacility",
+    },
+ 	{
+      format: ".*\\scs2=$unmapped.cs2$\\scs2Label=$unmapped.cs2Label$\\scs3=$unmapped.cs3$\\scs3Label=$unmapped.cs3Label$\\scs1=$unmapped.cs1$\\scs1Label=$unmapped.cs1Label$\\scs4=$unmapped.cs4$\\scs4Label=$unmapped.cs4Label$\\scs5=$unmapped.cs5$\\scs5Label=$unmapped.cs5Label$\\scs6=$unmapped.cs6$\\scs6Label=$unmapped.cs6Label$\\scs7=$unmapped.cs7$\\scs7Label=$unmapped.cs7Label$\\scs8=$unmapped.cs8$\\scs8Label=$unmapped.cs8Label$\\sCustomer",
+    },
+    {
+      format: ".*\\scs10=$unmapped.cs10$\\scs10Label=$unmapped.cs10Label$\\scpt",
+    },
+    {
+      format: ".*\\sver=$unmapped.ver$\\s$unmapped.cipher$\\s",
+    },
+    {
+      format: ".*$_=identifier$=$unmapped._=value$",
+      repeat: true
+    }
+  ], 
+  mappings: {
+    version: 0,
+    mappings: [
+      {
+        predicate: "",
+        renames: [
+          {
+            inputs : ["unmapped.dst"],
+            output : "dst_endpoint.ip",
+            type: "string"
+          }, 
+          {
+            inputs: ["unmapped.dpt"],
+            output: "dst_endpoint.port",
+            type: "string"
+          },
+          {
+            inputs: ["unmapped.src"],
+            output: "src_endpoint.ip",
+            type: "string"
+          },            
+          {
+            inputs: ["unmapped.spt"],
+            output: "src_endpoint.port",
+            type: "string"
+          },
+          {
+            inputs: ["unmapped.Customer"],
+            output: "Account Name",
+            type: "string"
+          }
+        ]
+      }
+    ]
+  }
+}