mirror of
https://github.com/marcredhat/SIEM-toolkit-patched
synced 2026-06-08 12:33:51 +00:00
marc
7c1687efce
Brought in 35 upstream commits (MITRE heatmap, health score, dependency map,
PowerQuery playground, onboarding tracker, product grouping, modern UI redesign).
Preserved fork additions:
backend/routers/quality.py KV scanner, pattern refs, JS keys, JSON mode,
/parsers + /sync-from-sdl endpoints
parsers/ 96 OCSF + tenant parsers
tools/stormshield-verify/ end-to-end ingest regression test
.gitignore un-ignored parsers/*
CHANGES.md, PATCHES.md
84 lines
2.4 KiB
Plaintext
84 lines
2.4 KiB
Plaintext
{
|
|
// specify a time zone if the timestamps in your log are not in GMT
|
|
// timezone: "GMT-0800"
|
|
attributes: {
|
|
"dataSource.name": "Imperva WAF",
|
|
"dataSource.vendor": "Imperva",
|
|
"dataSource.category": "security"
|
|
"metadata.product.name": "Imperva WAF",
|
|
"metadata.product.vendor_name": "Imperva"
|
|
},
|
|
|
|
patterns: {
|
|
tsPattern: "\\d+",
|
|
value: "[^\\s]+",
|
|
toDrop: "^(?!CEF).*$"
|
|
},
|
|
|
|
formats: [
|
|
//drop logs
|
|
{
|
|
id: "drop",
|
|
format: "$unwanted=toDrop$",
|
|
discard: true
|
|
},
|
|
|
|
{
|
|
format: "$unmapped.cef.version$\\|$metadata.vendor_name$\\|$metadata.product$\\|$metadata.product.version$\\|$unmapped.signature$\\|$event.type$\\|$severity$\\|",
|
|
},
|
|
{
|
|
format: ".*\\sstart=$timestamp=tsPattern$",
|
|
},
|
|
{
|
|
format: ".*requestClientApplication=$unmapped.requestClientApplication$\\sdeviceFacility",
|
|
},
|
|
{
|
|
format: ".*\\scs2=$unmapped.cs2$\\scs2Label=$unmapped.cs2Label$\\scs3=$unmapped.cs3$\\scs3Label=$unmapped.cs3Label$\\scs1=$unmapped.cs1$\\scs1Label=$unmapped.cs1Label$\\scs4=$unmapped.cs4$\\scs4Label=$unmapped.cs4Label$\\scs5=$unmapped.cs5$\\scs5Label=$unmapped.cs5Label$\\scs6=$unmapped.cs6$\\scs6Label=$unmapped.cs6Label$\\scs7=$unmapped.cs7$\\scs7Label=$unmapped.cs7Label$\\scs8=$unmapped.cs8$\\scs8Label=$unmapped.cs8Label$\\sCustomer",
|
|
},
|
|
{
|
|
format: ".*\\scs10=$unmapped.cs10$\\scs10Label=$unmapped.cs10Label$\\scpt",
|
|
},
|
|
{
|
|
format: ".*\\sver=$unmapped.ver$\\s$unmapped.cipher$\\s",
|
|
},
|
|
{
|
|
format: ".*$_=identifier$=$unmapped._=value$",
|
|
repeat: true
|
|
}
|
|
],
|
|
mappings: {
|
|
version: 0,
|
|
mappings: [
|
|
{
|
|
predicate: "",
|
|
renames: [
|
|
{
|
|
inputs : ["unmapped.dst"],
|
|
output : "dst_endpoint.ip",
|
|
type: "string"
|
|
},
|
|
{
|
|
inputs: ["unmapped.dpt"],
|
|
output: "dst_endpoint.port",
|
|
type: "string"
|
|
},
|
|
{
|
|
inputs: ["unmapped.src"],
|
|
output: "src_endpoint.ip",
|
|
type: "string"
|
|
},
|
|
{
|
|
inputs: ["unmapped.spt"],
|
|
output: "src_endpoint.port",
|
|
type: "string"
|
|
},
|
|
{
|
|
inputs: ["unmapped.Customer"],
|
|
output: "Account Name",
|
|
type: "string"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
} |