mirror of
https://github.com/marcredhat/SIEM-toolkit-patched
synced 2026-06-10 13:21:17 +00:00
Mick
c182d837ee
Dockerized SecOps toolkit with: - Coverage Map: STAR rule vs SDL parser field coverage analysis - Ingest Dashboard: PowerQuery-powered event volume and source breakdown - Onboarding Assistant: AI-guided log source onboarding with Claude - Parser management via SDL MCP integration Stack: FastAPI + PostgreSQL backend, nginx-served HTML frontend, Docker Compose. PowerQuery runs via Scalyr XDR API (SDL_XDR_URL + SDL_LOG_READ_KEY). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
42 lines
1.9 KiB
Plaintext
42 lines
1.9 KiB
Plaintext
{
|
|
"attributes": {
|
|
"dataSource.vendor": "Cisco",
|
|
"dataSource.name": "Cisco Duo Security",
|
|
"dataSource.category": "security"
|
|
},
|
|
"formats": [
|
|
{
|
|
"format": "$unmapped.{parse=json}$",
|
|
"rewrites": [
|
|
{ "input": "unmapped.timestamp", "output": "timestamp", "match": ".*", "replace": "$0" },
|
|
{ "input": "unmapped.time", "output": "time", "match": ".*", "replace": "$0" }
|
|
]
|
|
}
|
|
],
|
|
"mappings": {
|
|
"version": 1,
|
|
"mappings": [
|
|
{
|
|
"predicate": "unmapped.class_uid = '3002'",
|
|
"transformations": [
|
|
{ "copy": { "from": "unmapped.activity_id", "to": "activity_id" } },
|
|
{ "copy": { "from": "unmapped.activity_name", "to": "activity_name" } },
|
|
{ "copy": { "from": "unmapped.type_uid", "to": "type_uid" } },
|
|
{ "copy": { "from": "unmapped.severity_id", "to": "severity_id" } },
|
|
{ "copy": { "from": "unmapped.status_id", "to": "status_id" } },
|
|
{ "copy": { "from": "unmapped.status", "to": "status" } },
|
|
{ "copy": { "from": "unmapped.message", "to": "message" } },
|
|
{ "copy": { "from": "unmapped.user.name", "to": "user.name" } },
|
|
{ "copy": { "from": "unmapped.user.account_uid", "to": "user.account_uid" } },
|
|
{ "copy": { "from": "unmapped.user.account_type", "to": "user.account_type" } },
|
|
{ "copy": { "from": "unmapped.src_endpoint.ip", "to": "src_endpoint.ip" } },
|
|
{ "copy": { "from": "unmapped.src_endpoint.location.desc", "to": "src_endpoint.location.desc" } },
|
|
{ "copy": { "from": "unmapped.src_endpoint.location.city", "to": "src_endpoint.location.city" } },
|
|
{ "copy": { "from": "unmapped.src_endpoint.location.country", "to": "src_endpoint.location.country" } },
|
|
{ "copy": { "from": "unmapped.auth_protocol", "to": "auth_protocol" } },
|
|
{ "copy": { "from": "unmapped.mfa_factors", "to": "mfa_factors" } }
|
|
]
|
|
}
|
|
]
|
|
}
|
|
} |