mirror of
https://github.com/marcredhat/SIEM-toolkit-patched
synced 2026-06-11 05:41:19 +00:00
Snapshot 95 demo-tenant parsers (incl. stormshield) + un-ignore parsers/
The original upstream gitignores parsers/* on the assumption that each tenant has its own set. This fork commits a working snapshot so the Parser Test Runner and Parser Coverage features are usable out of the box. Stormshield parser exercises the new SDL key=value scanner, pattern references, and JS-style unquoted format keys added to backend/routers/quality.py.
This commit is contained in:
@@ -0,0 +1,19 @@
|
||||
{
|
||||
// specify a time zone if the timestamps in your log are not in GMT
|
||||
// timezone: "GMT-0800"
|
||||
|
||||
formats: [
|
||||
|
||||
{
|
||||
id: "format1",
|
||||
format: ".*$=json{parse=dottedJson}$"
|
||||
rewrites: [
|
||||
{input: "TimestampConnectionEnd", output: "timestamp", match: ".*", replace: "$0"}
|
||||
// moved upstread wher it is more efficient
|
||||
{input: "message", output: "message", match: "(.*\")(\\{\"\\w+\".*)", replace: "$2"}
|
||||
|
||||
]
|
||||
}
|
||||
|
||||
]
|
||||
}
|
||||
Reference in New Issue
Block a user