mirror of
https://github.com/marcredhat/SIEM-toolkit-patched
synced 2026-06-08 12:33:51 +00:00
marc
7c1687efce
Brought in 35 upstream commits (MITRE heatmap, health score, dependency map,
PowerQuery playground, onboarding tracker, product grouping, modern UI redesign).
Preserved fork additions:
backend/routers/quality.py KV scanner, pattern refs, JS keys, JSON mode,
/parsers + /sync-from-sdl endpoints
parsers/ 96 OCSF + tenant parsers
tools/stormshield-verify/ end-to-end ingest regression test
.gitignore un-ignored parsers/*
CHANGES.md, PATCHES.md
20 lines
476 B
Plaintext
20 lines
476 B
Plaintext
{
|
|
// specify a time zone if the timestamps in your log are not in GMT
|
|
// timezone: "GMT-0800"
|
|
|
|
formats: [
|
|
|
|
{
|
|
id: "format1",
|
|
format: ".*$=json{parse=dottedJson}$"
|
|
rewrites: [
|
|
{input: "TimestampConnectionEnd", output: "timestamp", match: ".*", replace: "$0"}
|
|
// moved upstread wher it is more efficient
|
|
{input: "message", output: "message", match: "(.*\")(\\{\"\\w+\".*)", replace: "$2"}
|
|
|
|
]
|
|
}
|
|
|
|
]
|
|
}
|