mirror of
https://github.com/marcredhat/SIEM-toolkit-patched
synced 2026-06-08 12:33:51 +00:00
marc
7c1687efce
Brought in 35 upstream commits (MITRE heatmap, health score, dependency map,
PowerQuery playground, onboarding tracker, product grouping, modern UI redesign).
Preserved fork additions:
backend/routers/quality.py KV scanner, pattern refs, JS keys, JSON mode,
/parsers + /sync-from-sdl endpoints
parsers/ 96 OCSF + tenant parsers
tools/stormshield-verify/ end-to-end ingest regression test
.gitignore un-ignored parsers/*
CHANGES.md, PATCHES.md
137 lines
6.7 KiB
Plaintext
137 lines
6.7 KiB
Plaintext
{
|
|
attributes: {
|
|
// Required pipeline defaults
|
|
"metadata.version": "1.1.0",
|
|
"dataSource.vendor": "MikroTik",
|
|
"dataSource.name": "MikroTik RouterOS",
|
|
"dataSource.category": "network",
|
|
// Product metadata
|
|
"metadata.product.vendor_name": "MikroTik",
|
|
"metadata.product.name": "RouterOS",
|
|
"metadata.log_provider": "syslog"
|
|
},
|
|
|
|
patterns: {
|
|
ipv4: "\\d+\\.\\d+\\.\\d+\\.\\d+",
|
|
mac: "[0-9A-Fa-f]{2}:[0-9A-Fa-f]{2}:[0-9A-Fa-f]{2}:[0-9A-Fa-f]{2}:[0-9A-Fa-f]{2}:[0-9A-Fa-f]{2}",
|
|
number: "\\d+",
|
|
word: "\\w+",
|
|
iface: "[\\w.-]+"
|
|
},
|
|
|
|
formats: [
|
|
// ─────────────────────────────────────────────────────────────────────────
|
|
// FIREWALL (Network Activity 4001)
|
|
// ─────────────────────────────────────────────────────────────────────────
|
|
{
|
|
// forward in:ether1 out:ether2, src-mac 00:11:22:33:44:55, proto TCP, 192.168.1.10:54321->8.8.8.8:443, len 64
|
|
id: "firewall_full",
|
|
attributes: {
|
|
class_uid: 4001, class_name: "Network Activity",
|
|
category_uid: 4, category_name: "Network Activity",
|
|
activity_id: 6, activity_name: "Traffic"
|
|
},
|
|
format:
|
|
"$disposition=word$ in:$src_endpoint.interface_name=iface$ out:$dst_endpoint.interface_name=iface$, " +
|
|
"src-mac $src_endpoint.mac=mac$, proto $connection_info.protocol_name=word$, " +
|
|
"$src_endpoint.ip=ipv4$:$src_endpoint.port=number$->$dst_endpoint.ip=ipv4$:$dst_endpoint.port=number$, len $traffic.bytes=number$",
|
|
halt: true
|
|
},
|
|
{
|
|
// forward: in:ether1 out:ether2, src-address 192.168.1.10, dst-address 8.8.8.8
|
|
id: "firewall_simple",
|
|
attributes: {
|
|
class_uid: 4001, class_name: "Network Activity",
|
|
category_uid: 4, category_name: "Network Activity",
|
|
activity_id: 6, activity_name: "Traffic"
|
|
},
|
|
format:
|
|
"$disposition=word$: in:$src_endpoint.interface_name=iface$ out:$dst_endpoint.interface_name=iface$, " +
|
|
"src-address $src_endpoint.ip=ipv4$, dst-address $dst_endpoint.ip=ipv4$",
|
|
halt: true
|
|
},
|
|
|
|
// ─────────────────────────────────────────────────────────────────────────
|
|
// DHCP (DHCP Activity 4004)
|
|
// ─────────────────────────────────────────────────────────────────────────
|
|
{
|
|
// dhcp,info leased 192.168.1.100 for 00:11:22:33:44:55
|
|
id: "dhcp_lease",
|
|
attributes: {
|
|
class_uid: 4004, class_name: "DHCP Activity",
|
|
category_uid: 4, category_name: "Network Activity",
|
|
activity_id: 1, activity_name: "Lease"
|
|
},
|
|
format: "$dhcp.action=word$ $dst_endpoint.ip=ipv4$ for $dst_endpoint.mac=mac$",
|
|
halt: true
|
|
},
|
|
|
|
// ─────────────────────────────────────────────────────────────────────────
|
|
// WIRELESS (Network Activity 4001)
|
|
// ─────────────────────────────────────────────────────────────────────────
|
|
{
|
|
// connected, 00:11:22:33:44:55@wlan1, signal-strength=-65
|
|
id: "wireless",
|
|
attributes: {
|
|
class_uid: 4001, class_name: "Network Activity",
|
|
category_uid: 4, category_name: "Network Activity",
|
|
activity_id: 1, activity_name: "Open"
|
|
},
|
|
format: "$status=word$, $src_endpoint.mac=mac$@$src_endpoint.interface_name=iface$, signal-strength=$unmapped.wireless_signal$",
|
|
halt: true
|
|
},
|
|
|
|
// ─────────────────────────────────────────────────────────────────────────
|
|
// AUTHENTICATION (Authentication 3002)
|
|
// ─────────────────────────────────────────────────────────────────────────
|
|
{
|
|
// user admin logged in from 192.168.1.5 via winbox
|
|
id: "login",
|
|
attributes: {
|
|
class_uid: 3002, class_name: "Authentication",
|
|
category_uid: 3, category_name: "Identity & Access Management",
|
|
activity_id: 1, activity_name: "Logon"
|
|
},
|
|
format: "user $actor.user.name=word$ $status$ from $src_endpoint.ip=ipv4$ via $auth_protocol=word$",
|
|
halt: true
|
|
},
|
|
{
|
|
// <ppp-user1> connected from 203.0.113.50
|
|
id: "vpn_connect",
|
|
attributes: {
|
|
class_uid: 3002, class_name: "Authentication",
|
|
category_uid: 3, category_name: "Identity & Access Management",
|
|
activity_id: 1, activity_name: "Logon",
|
|
auth_protocol: "PPP"
|
|
},
|
|
format: "<$actor.user.name$> $status=word$ from $src_endpoint.ip=ipv4$",
|
|
halt: true
|
|
},
|
|
{
|
|
// <ppp-user1> disconnected, uptime 1h30m, bytes-in=12345, bytes-out=67890
|
|
id: "vpn_disconnect",
|
|
attributes: {
|
|
class_uid: 3002, class_name: "Authentication",
|
|
category_uid: 3, category_name: "Identity & Access Management",
|
|
activity_id: 2, activity_name: "Logoff",
|
|
auth_protocol: "PPP"
|
|
},
|
|
format: "<$actor.user.name$> disconnected, uptime $session.duration$, bytes-in=$traffic.bytes_in=number$, bytes-out=$traffic.bytes_out=number$",
|
|
halt: true
|
|
},
|
|
|
|
// ─────────────────────────────────────────────────────────────────────────
|
|
// GENERIC FALLBACK
|
|
// ─────────────────────────────────────────────────────────────────────────
|
|
{
|
|
id: "generic",
|
|
attributes: {
|
|
class_uid: 4001, class_name: "Network Activity",
|
|
category_uid: 4, category_name: "Network Activity",
|
|
activity_id: 0, activity_name: "Unknown"
|
|
},
|
|
format: "$unmapped.facility=word$,$unmapped.topic=word$: $unmapped.body$"
|
|
}
|
|
]
|
|
}
|