mirror of
https://github.com/marcredhat/SIEM-toolkit-patched
synced 2026-06-08 12:33:51 +00:00
marc
7c1687efce
Brought in 35 upstream commits (MITRE heatmap, health score, dependency map,
PowerQuery playground, onboarding tracker, product grouping, modern UI redesign).
Preserved fork additions:
backend/routers/quality.py KV scanner, pattern refs, JS keys, JSON mode,
/parsers + /sync-from-sdl endpoints
parsers/ 96 OCSF + tenant parsers
tools/stormshield-verify/ end-to-end ingest regression test
.gitignore un-ignored parsers/*
CHANGES.md, PATCHES.md
119 lines
7.3 KiB
Plaintext
119 lines
7.3 KiB
Plaintext
{
|
|
// Developer-Workstation OCSF Parser — OCSF v1.3.0
|
|
// Endpoint EDR-style events for software-supply-chain hunts (H1..H18)
|
|
attributes: {
|
|
"metadata.version": "1.3.0",
|
|
"metadata.product.vendor_name": "Synthetic",
|
|
"metadata.product.name": "Developer Workstation EDR",
|
|
"metadata.log_provider": "hec",
|
|
"Category": "endpoint",
|
|
"dataSource.vendor": "Synthetic",
|
|
"dataSource.name": "Developer Workstation",
|
|
"dataSource.category": "Endpoint"
|
|
},
|
|
|
|
formats: [
|
|
{
|
|
// Auto-extract every JSON top-level + nested field as attributes.
|
|
// Nested objects flatten with dot-notation: process.image_name,
|
|
// endpoint.name, file.path, dns.query, registry.key_path, etc.
|
|
format: "$=json{parse=json}$",
|
|
halt: true,
|
|
rewrites: [
|
|
// ─── OCSF classification by event_type ──────────────────────────
|
|
{ input: "event_type", output: "category_uid", match: "PROCESS_START", replace: "1" },
|
|
{ input: "event_type", output: "category_name", match: "PROCESS_START", replace: "System Activity" },
|
|
{ input: "event_type", output: "class_uid", match: "PROCESS_START", replace: "1007" },
|
|
{ input: "event_type", output: "class_name", match: "PROCESS_START", replace: "Process Activity" },
|
|
|
|
{ input: "event_type", output: "category_uid", match: "FILE_CREATE", replace: "1" },
|
|
{ input: "event_type", output: "category_name", match: "FILE_CREATE", replace: "System Activity" },
|
|
{ input: "event_type", output: "class_uid", match: "FILE_CREATE", replace: "1001" },
|
|
{ input: "event_type", output: "class_name", match: "FILE_CREATE", replace: "File System Activity" },
|
|
|
|
{ input: "event_type", output: "category_uid", match: "FILE_WRITE", replace: "1" },
|
|
{ input: "event_type", output: "category_name", match: "FILE_WRITE", replace: "System Activity" },
|
|
{ input: "event_type", output: "class_uid", match: "FILE_WRITE", replace: "1001" },
|
|
{ input: "event_type", output: "class_name", match: "FILE_WRITE", replace: "File System Activity" },
|
|
|
|
{ input: "event_type", output: "category_uid", match: "FILE_READ", replace: "1" },
|
|
{ input: "event_type", output: "category_name", match: "FILE_READ", replace: "System Activity" },
|
|
{ input: "event_type", output: "class_uid", match: "FILE_READ", replace: "1001" },
|
|
{ input: "event_type", output: "class_name", match: "FILE_READ", replace: "File System Activity" },
|
|
|
|
{ input: "event_type", output: "category_uid", match: "DNS_QUERY", replace: "4" },
|
|
{ input: "event_type", output: "category_name", match: "DNS_QUERY", replace: "Network Activity" },
|
|
{ input: "event_type", output: "class_uid", match: "DNS_QUERY", replace: "4003" },
|
|
{ input: "event_type", output: "class_name", match: "DNS_QUERY", replace: "DNS Activity" },
|
|
|
|
{ input: "event_type", output: "category_uid", match: "REGISTRY_SET", replace: "1" },
|
|
{ input: "event_type", output: "category_name", match: "REGISTRY_SET", replace: "System Activity" },
|
|
{ input: "event_type", output: "class_uid", match: "REGISTRY_SET", replace: "201101" },
|
|
{ input: "event_type", output: "class_name", match: "REGISTRY_SET", replace: "Registry Key Activity" },
|
|
|
|
// ─── Severity mapping (string + OCSF int 0-6) ───────────────────
|
|
{ input: "severity", output: "severity_id", match: "(?i)critical", replace: "6" },
|
|
{ input: "severity", output: "severity_id", match: "(?i)high", replace: "5" },
|
|
{ input: "severity", output: "severity_id", match: "(?i)medium", replace: "4" },
|
|
{ input: "severity", output: "severity_id", match: "(?i)low", replace: "2" },
|
|
{ input: "severity", output: "severity_id", match: "(?i)info", replace: "1" },
|
|
{ input: "severity", output: "severity_str", match: ".*", replace: "$0" },
|
|
|
|
// ─── Activity / finding ─────────────────────────────────────────
|
|
{ input: "event_type", output: "activity_name", match: ".*", replace: "$0" },
|
|
{ input: "event_id", output: "finding_info.uid", match: ".*", replace: "$0" },
|
|
{ input: "timestamp", output: "finding_info.created_time_dt", match: ".*", replace: "$0" },
|
|
|
|
// ─── Compliance tags ─────────────────────────────────────────
|
|
{ input: "event_type", output: "compliance.standard", match: ".*", replace: "NIS2,SLSA,SSDF" },
|
|
|
|
// ─── Explicit extraction of nested fields from the raw message blob
|
|
// (the auto-flatten only handles top-level keys; nested objects like
|
|
// process.image_name remain inside `message`).
|
|
{ input: "message", output: "endpoint.name",
|
|
match: "^.*?\"endpoint\":\\s*\\{\"name\":\\s*\"([^\"]+)\".*$",
|
|
replace: "$1" },
|
|
{ input: "message", output: "endpoint.os",
|
|
match: "^.*?\"endpoint\":\\s*\\{\"name\":\\s*\"[^\"]+\",\\s*\"os\":\\s*\"([^\"]+)\".*$",
|
|
replace: "$1" },
|
|
{ input: "message", output: "actor.user.name",
|
|
match: "^.*?\"actor\":\\s*\\{\"user\":\\s*\\{\"name\":\\s*\"([^\"]+)\".*$",
|
|
replace: "$1" },
|
|
{ input: "message", output: "process.image_name",
|
|
match: "^.*?\"process\":\\s*\\{\"image_name\":\\s*\"([^\"]+)\".*$",
|
|
replace: "$1" },
|
|
{ input: "message", output: "process.image_path",
|
|
match: "^.*?\"process\":\\s*\\{\"image_name\":\\s*\"[^\"]+\",\\s*\"image_path\":\\s*\"([^\"]+)\".*$",
|
|
replace: "$1" },
|
|
{ input: "message", output: "process.command_line",
|
|
match: "^.*?\"image_path\":\\s*\"[^\"]+\",\\s*\"command_line\":\\s*\"((?:[^\"\\\\]|\\\\.)*)\".*$",
|
|
replace: "$1" },
|
|
{ input: "message", output: "process.parent.image_name",
|
|
match: "^.*?\"parent\":\\s*\\{\"image_name\":\\s*\"([^\"]+)\".*$",
|
|
replace: "$1" },
|
|
{ input: "message", output: "process.parent.command_line",
|
|
match: "^.*?\"parent\":\\s*\\{\"image_name\":\\s*\"[^\"]+\",\\s*\"command_line\":\\s*\"((?:[^\"\\\\]|\\\\.)*)\".*$",
|
|
replace: "$1" },
|
|
{ input: "message", output: "file.path",
|
|
match: "^.*?\"file\":\\s*\\{\"path\":\\s*\"([^\"]+)\".*$",
|
|
replace: "$1" },
|
|
{ input: "message", output: "file.action",
|
|
match: "^.*?\"file\":\\s*\\{\"path\":\\s*\"[^\"]+\",\\s*\"action\":\\s*\"([^\"]+)\".*$",
|
|
replace: "$1" },
|
|
{ input: "message", output: "file.content",
|
|
match: "^.*?\"content_sample\":\\s*\"((?:[^\"\\\\]|\\\\.)*)\".*$",
|
|
replace: "$1" },
|
|
{ input: "message", output: "dns.query",
|
|
match: "^.*?\"dns\":\\s*\\{\"query\":\\s*\"([^\"]+)\".*$",
|
|
replace: "$1" },
|
|
{ input: "message", output: "registry.key_path",
|
|
match: "^.*?\"registry\":\\s*\\{\"key_path\":\\s*\"([^\"]+)\".*$",
|
|
replace: "$1" },
|
|
{ input: "message", output: "scenario",
|
|
match: "^.*?\"_scenario\":\\s*\"([^\"]+)\".*$",
|
|
replace: "$1" }
|
|
]
|
|
}
|
|
]
|
|
}
|