mirror of
https://github.com/marcredhat/SIEM-toolkit-patched
synced 2026-06-08 20:37:12 +00:00
marc
7c1687efce
Brought in 35 upstream commits (MITRE heatmap, health score, dependency map,
PowerQuery playground, onboarding tracker, product grouping, modern UI redesign).
Preserved fork additions:
backend/routers/quality.py KV scanner, pattern refs, JS keys, JSON mode,
/parsers + /sync-from-sdl endpoints
parsers/ 96 OCSF + tenant parsers
tools/stormshield-verify/ end-to-end ingest regression test
.gitignore un-ignored parsers/*
CHANGES.md, PATCHES.md
58 lines
1.6 KiB
Plaintext
58 lines
1.6 KiB
Plaintext
{
|
|
// specify a time zone if the timestamps in your log are not in GMT
|
|
timezone: "Europe/Paris",
|
|
attributes: {
|
|
"dataSource.category": "security",
|
|
"dataSource.name": "Stormshield",
|
|
"dataSource.vendor": "Stormshield",
|
|
"class_name": "Network Activity",
|
|
"class_id": 4001
|
|
},
|
|
patterns: {
|
|
tsPattern: "\\d{4}-\\d{2}-\\d{2} \\d{2}:\\d{2}:\\d{2}"
|
|
},
|
|
formats: [
|
|
{
|
|
format: ".*time=\"$timestamp=tsPattern$\""
|
|
},
|
|
{
|
|
format: ".*$_$=$unmapped._$ ",
|
|
repeat: true
|
|
},
|
|
{
|
|
format: "^.*",
|
|
rewrites: [
|
|
{
|
|
"input": "unmapped.src",
|
|
"output": "src_endpoint.ip",
|
|
"match": ".*",
|
|
"replace": "$0"
|
|
},
|
|
{
|
|
"input": "unmapped.srcport",
|
|
"output": "src_endpoint.port",
|
|
"match": ".*",
|
|
"replace": "$0"
|
|
},
|
|
{
|
|
"input": "unmapped.dst",
|
|
"output": "dst_endpoint.ip",
|
|
"match": ".*",
|
|
"replace": "$0"
|
|
},
|
|
{
|
|
"input": "unmapped.dstport",
|
|
"output": "dst_endpoint.port",
|
|
"match": ".*",
|
|
"replace": "$0"
|
|
},
|
|
{
|
|
"input": "unmapped.user",
|
|
"output": "actor.user.name",
|
|
"match": ".*",
|
|
"replace": "$0"
|
|
},
|
|
]
|
|
}
|
|
]
|
|
} |