mirror of
https://github.com/marcredhat/SIEM-toolkit-patched
synced 2026-06-08 20:37:12 +00:00
marc
7c1687efce
Brought in 35 upstream commits (MITRE heatmap, health score, dependency map,
PowerQuery playground, onboarding tracker, product grouping, modern UI redesign).
Preserved fork additions:
backend/routers/quality.py KV scanner, pattern refs, JS keys, JSON mode,
/parsers + /sync-from-sdl endpoints
parsers/ 96 OCSF + tenant parsers
tools/stormshield-verify/ end-to-end ingest regression test
.gitignore un-ignored parsers/*
CHANGES.md, PATCHES.md
174 lines
8.6 KiB
Plaintext
174 lines
8.6 KiB
Plaintext
{
|
|
// Darktrace CEF / syslog parser — OCSF v1.3.0
|
|
//
|
|
// Supports the four canonical Darktrace log streams:
|
|
// 1. Model Breach → Detection Finding (severity from score)
|
|
// 2. AI Analyst Incident → Detection Finding (Critical)
|
|
// 3. Antigena (autonomous response) → Detection Finding (action: Blocked)
|
|
// 4. Admin / authentication events → Authentication (3002)
|
|
//
|
|
// Wire format is CEF: pipe-separated header + space-separated key=value extension.
|
|
// CEF:0|Darktrace|<product>|<ver>|<sigID>|<name>|<sev>|<extension>
|
|
attributes: {
|
|
"metadata.version": "1.3.0",
|
|
"metadata.product.vendor_name": "Darktrace",
|
|
"metadata.product.name": "Enterprise Immune System",
|
|
"metadata.log_provider": "syslog",
|
|
"Category": "security",
|
|
"dataSource.vendor": "Darktrace",
|
|
"dataSource.name": "Darktrace",
|
|
"dataSource.category": "ndr",
|
|
"event.type": "Alert",
|
|
"event.category": "security",
|
|
"category_uid": 2,
|
|
"category_name": "Findings",
|
|
"class_uid": 2004,
|
|
"class_name": "Detection Finding",
|
|
"activity_id": 1,
|
|
"type_uid": 200401,
|
|
"severity_id": 3
|
|
},
|
|
|
|
patterns: {
|
|
word: "[^ |]+",
|
|
phrase: "[^|]+",
|
|
rest: ".*",
|
|
num: "\\d+",
|
|
ip: "\\d+\\.\\d+\\.\\d+\\.\\d+",
|
|
ext: ".*"
|
|
},
|
|
|
|
formats: [
|
|
// ============================================================
|
|
// 1. MODEL BREACH — sigID 100, name="Model Breach"
|
|
// Example:
|
|
// CEF:0|Darktrace|DCIP|6.1|100|Model Breach|7|src=10.1.1.5 dst=8.8.8.8
|
|
// spt=54321 dpt=443 cs1=Anomalous Connection / Suspicious Self-Signed SSL
|
|
// cs1Label=Model cn1=85 cn1Label=Score duser=jsmith deviceExternalId=12345
|
|
// cs2=Compliance cs2Label=Category act=alert
|
|
// ============================================================
|
|
{
|
|
id: "dt_model_breach",
|
|
attributes: {
|
|
class_uid: 2004, class_name: "Detection Finding",
|
|
category_uid: 2, category_name: "Findings",
|
|
type_uid: 200401,
|
|
finding_title: "Darktrace Model Breach",
|
|
"event.type": "Alert", "event.category": "security",
|
|
severity_id: 4,
|
|
severity: "High",
|
|
disposition_id: 1, disposition: "Allowed",
|
|
status_id: 1, status: "Detected"
|
|
},
|
|
format: "CEF:0[|]Darktrace[|]$dt_product=word$[|]$dt_version=word$[|]100[|]Model Breach[|]$cef_severity=num$[|]$cef_extension=ext$",
|
|
halt: true,
|
|
rewrites: [
|
|
// Pull common fields out of the CEF extension key=value bag
|
|
{ input: "message", output: "src_ip", match: ".*src=(\\d+\\.\\d+\\.\\d+\\.\\d+).*", replace: "$1" },
|
|
{ input: "message", output: "dst_ip", match: ".*dst=(\\d+\\.\\d+\\.\\d+\\.\\d+).*", replace: "$1" },
|
|
{ input: "message", output: "src_port", match: ".*spt=(\\d+).*", replace: "$1" },
|
|
{ input: "message", output: "dst_port", match: ".*dpt=(\\d+).*", replace: "$1" },
|
|
{ input: "message", output: "user_name", match: ".*duser=([^ \\n]+).*", replace: "$1" },
|
|
{ input: "message", output: "device_id", match: ".*deviceExternalId=([^ \\n]+).*", replace: "$1" },
|
|
{ input: "message", output: "model_name", match: ".*cs1=([^=\\n]+?)\\s+\\w+=.*", replace: "$1" },
|
|
{ input: "message", output: "model_category",match: ".*cs2=([^ \\n]+).*", replace: "$1" },
|
|
{ input: "message", output: "score", match: ".*cn1=(\\d+).*", replace: "$1" },
|
|
{ input: "model_name", output: "finding_title", match: "(?i).*",
|
|
replace: "Darktrace Model Breach: $0" }
|
|
]
|
|
},
|
|
|
|
// ============================================================
|
|
// 2. AI ANALYST INCIDENT — sigID 200, name contains "AI Analyst"
|
|
// ============================================================
|
|
{
|
|
id: "dt_aianalyst",
|
|
attributes: {
|
|
class_uid: 2004, class_name: "Detection Finding",
|
|
category_uid: 2, category_name: "Findings",
|
|
type_uid: 200401,
|
|
finding_title: "Darktrace AI Analyst Incident",
|
|
"event.type": "Alert", "event.category": "security",
|
|
severity_id: 5, severity: "Critical",
|
|
disposition_id: 1, disposition: "Allowed",
|
|
status_id: 1, status: "Detected"
|
|
},
|
|
format: "CEF:0[|]Darktrace[|]$dt_product=word$[|]$dt_version=word$[|]200[|]$incident_name=phrase$[|]$cef_severity=num$[|]$cef_extension=ext$",
|
|
halt: true,
|
|
rewrites: [
|
|
{ input: "message", output: "src_ip", match: ".*src=(\\d+\\.\\d+\\.\\d+\\.\\d+).*", replace: "$1" },
|
|
{ input: "message", output: "dst_ip", match: ".*dst=(\\d+\\.\\d+\\.\\d+\\.\\d+).*", replace: "$1" },
|
|
{ input: "message", output: "user_name", match: ".*duser=([^ \\n]+).*", replace: "$1" },
|
|
{ input: "message", output: "device_id", match: ".*deviceExternalId=([^ \\n]+).*", replace: "$1" },
|
|
{ input: "message", output: "incident_id", match: ".*externalId=([^ \\n]+).*", replace: "$1" },
|
|
{ input: "message", output: "summary", match: ".*msg=([^=\\n]+?)(?:\\s+\\w+=.*|$)", replace: "$1" },
|
|
{ input: "incident_name", output: "finding_title",match: ".*", replace: "Darktrace $0" }
|
|
]
|
|
},
|
|
|
|
// ============================================================
|
|
// 3. ANTIGENA (Autonomous Response) — sigID 300
|
|
// ============================================================
|
|
{
|
|
id: "dt_antigena",
|
|
attributes: {
|
|
class_uid: 2004, class_name: "Detection Finding",
|
|
category_uid: 2, category_name: "Findings",
|
|
type_uid: 200401,
|
|
finding_title: "Darktrace Antigena Autonomous Action",
|
|
"event.type": "Action", "event.category": "security",
|
|
severity_id: 5, severity: "Critical",
|
|
disposition_id: 2, disposition: "Blocked",
|
|
status_id: 1, status: "Detected"
|
|
},
|
|
format: "CEF:0[|]Darktrace[|]$dt_product=word$[|]$dt_version=word$[|]300[|]Antigena Action[|]$cef_severity=num$[|]$cef_extension=ext$",
|
|
halt: true,
|
|
rewrites: [
|
|
{ input: "message", output: "src_ip", match: ".*src=(\\d+\\.\\d+\\.\\d+\\.\\d+).*", replace: "$1" },
|
|
{ input: "message", output: "dst_ip", match: ".*dst=(\\d+\\.\\d+\\.\\d+\\.\\d+).*", replace: "$1" },
|
|
{ input: "message", output: "user_name", match: ".*duser=([^ \\n]+).*", replace: "$1" },
|
|
{ input: "message", output: "device_id", match: ".*deviceExternalId=([^ \\n]+).*", replace: "$1" },
|
|
{ input: "message", output: "action", match: ".*act=([^ \\n]+).*", replace: "$1" }
|
|
]
|
|
},
|
|
|
|
// ============================================================
|
|
// 4. ADMIN / AUTH EVENTS — sigID 400 (login success/failure)
|
|
// ============================================================
|
|
{
|
|
id: "dt_auth_fail",
|
|
attributes: {
|
|
class_uid: 3002, class_name: "Authentication",
|
|
category_uid: 3, category_name: "Identity & Access Management",
|
|
type_uid: 300201, activity_id: 1,
|
|
"event.type": "Login", "event.category": "authentication",
|
|
status_id: 2, status: "Failure",
|
|
finding_title: "Darktrace Admin Login Failure"
|
|
},
|
|
format: "CEF:0[|]Darktrace[|]$dt_product=word$[|]$dt_version=word$[|]400[|]Admin Login Failure[|]$cef_severity=num$[|]$cef_extension=ext$",
|
|
halt: true,
|
|
rewrites: [
|
|
{ input: "message", output: "user_name", match: ".*duser=([^ \\n]+).*", replace: "$1" },
|
|
{ input: "message", output: "src_ip", match: ".*src=(\\d+\\.\\d+\\.\\d+\\.\\d+).*", replace: "$1" }
|
|
]
|
|
},
|
|
|
|
{
|
|
id: "dt_auth_ok",
|
|
attributes: {
|
|
class_uid: 3002, class_name: "Authentication",
|
|
category_uid: 3, category_name: "Identity & Access Management",
|
|
type_uid: 300201, activity_id: 1,
|
|
"event.type": "Login", "event.category": "authentication",
|
|
status_id: 1, status: "Success"
|
|
},
|
|
format: "CEF:0[|]Darktrace[|]$dt_product=word$[|]$dt_version=word$[|]400[|]Admin Login Success[|]$cef_severity=num$[|]$cef_extension=ext$",
|
|
halt: true,
|
|
rewrites: [
|
|
{ input: "message", output: "user_name", match: ".*duser=([^ \\n]+).*", replace: "$1" },
|
|
{ input: "message", output: "src_ip", match: ".*src=(\\d+\\.\\d+\\.\\d+\\.\\d+).*", replace: "$1" }
|
|
]
|
|
}
|
|
]
|
|
}
|