mirror of
https://github.com/marcredhat/SIEM-toolkit-patched
synced 2026-06-08 12:33:51 +00:00
marc
7c1687efce
Brought in 35 upstream commits (MITRE heatmap, health score, dependency map,
PowerQuery playground, onboarding tracker, product grouping, modern UI redesign).
Preserved fork additions:
backend/routers/quality.py KV scanner, pattern refs, JS keys, JSON mode,
/parsers + /sync-from-sdl endpoints
parsers/ 96 OCSF + tenant parsers
tools/stormshield-verify/ end-to-end ingest regression test
.gitignore un-ignored parsers/*
CHANGES.md, PATCHES.md
25 lines
1.6 KiB
Plaintext
25 lines
1.6 KiB
Plaintext
{
|
|
// specify a time zone if the timestamps in your log are not in GMT
|
|
// timezone: "GMT-0800"
|
|
|
|
patterns: {
|
|
tsPattern: "\\d{4}-\\d{2}-\\d{2} \\d{2}:\\d{2}:\\d{2}"
|
|
},
|
|
formats: [
|
|
{
|
|
format: "\"$timestamp=tsPattern$\",\"$PolicyIdentityLabel$\",\"$InternalClientIP$\",\"$ExternalClientIP$\",\"$DestinationIP$\",\"$ContentType$\",\"$Action$\",\"$url$\",\"$Referer$\",\"$UserAgent$\",\"$StatusCode$\",\"$RequestSize$\",\"$ResponseSize$\",\"$ResponseBodySize$\",\"$SHA-SHA256$\",\"$Categories$\",\"$AVDetections$\",\"$PUAs$\",\"$AMPDisposition$\",\"$AMPMalwareName$\",\"$AMPScore$\",\"$PolicyIdentityType$\",\"$BlockedCategories$\",\"$Identities$\",\"$IdentityTypes$\",\"$RequestMethod$\",\"$DLPStatus$\",\"$CertificateErrors$\",\"$Filename$\",\"$RulesetID$\",\"$RuleID$\",\"$DestinationsListIDs$\"",
|
|
attributes: {"dataSource.vendor": "Cisco", "dataSource.name": "Cisco Umbrella", "LogType": "proxylogs"},
|
|
halt: true
|
|
},
|
|
{
|
|
format: "\"$timestamp=tsPattern$\",\"$MostGranularIdentity$\",\"$Identities$\",\"$InternalIP$\",\"$ExternalIP$\",\"$Action$\",\"$QueryType$\",\"$ResponseCode$\",\"$Domain$\",\"$Categories$\",\"$MostGranularIdentityType$\",\"$IdentityTypes$\",\"$BlockedCategories$\"",
|
|
attributes: {"dataSource.vendor": "Cisco", "dataSource.name": "Cisco Umbrella", "LogType": "dnslogs"},
|
|
halt: true
|
|
},
|
|
{
|
|
format: "\"$ID$\",\"$timestamp=tsPattern$\",\"$Email$\",\"$User$\",\"$Type$\",\"$Action$\",\"$LoggedInFrom$\",\"$Before$\",\"$After$\"",
|
|
attributes: {"dataSource.vendor": "Cisco", "dataSource.name": "Cisco Umbrella", "LogType": "auditlogs"},
|
|
halt: true
|
|
}
|
|
]
|
|
} |