mirror of
https://github.com/marcredhat/SIEM-toolkit-patched
synced 2026-06-10 05:17:18 +00:00
marc
a9dcf48e65
The original upstream gitignores parsers/* on the assumption that each tenant has its own set. This fork commits a working snapshot so the Parser Test Runner and Parser Coverage features are usable out of the box. Stormshield parser exercises the new SDL key=value scanner, pattern references, and JS-style unquoted format keys added to backend/routers/quality.py.
26 lines
628 B
Plaintext
26 lines
628 B
Plaintext
{
|
|
attributes: {
|
|
class_uid: "5002",
|
|
category_uid: "4",
|
|
severity_id: "0",
|
|
class_name: "F5 Web Traffic",
|
|
category_name: "F5 HTTP Access Logs",
|
|
"metadata.product.name": "F5 BIG-IP",
|
|
"metadata.product.vendor_name": "F5 Networks",
|
|
"dataSource.category": "network",
|
|
"dataSource.name": "F5 BIG-IP",
|
|
"dataSource.vendor": "F5"
|
|
},
|
|
patterns: {
|
|
timestamp: "\\d{4}/\\d{2}/\\d{2}\\s+\\d{2}:\\d{2}:\\d{2}",
|
|
ipv4: "(?:\\d{1,3}\\.){3}\\d{1,3}",
|
|
quote: "\"[^\"]*\"",
|
|
number: "\\d+"
|
|
},
|
|
formats: [
|
|
{
|
|
format: ".*$_=identifier$=$_$(?:\\,|\\r)",
|
|
repeat: true
|
|
}
|
|
]
|
|
} |