mirror of
https://github.com/marcredhat/SIEM-toolkit-patched
synced 2026-06-09 21:07:15 +00:00
marc
a9dcf48e65
The original upstream gitignores parsers/* on the assumption that each tenant has its own set. This fork commits a working snapshot so the Parser Test Runner and Parser Coverage features are usable out of the box. Stormshield parser exercises the new SDL key=value scanner, pattern references, and JS-style unquoted format keys added to backend/routers/quality.py.
58 lines
1.6 KiB
Plaintext
58 lines
1.6 KiB
Plaintext
{
|
|
// specify a time zone if the timestamps in your log are not in GMT
|
|
timezone: "Europe/Paris",
|
|
attributes: {
|
|
"dataSource.category": "security",
|
|
"dataSource.name": "Stormshield",
|
|
"dataSource.vendor": "Stormshield",
|
|
"class_name": "Network Activity",
|
|
"class_id": 4001
|
|
},
|
|
patterns: {
|
|
tsPattern: "\\d{4}-\\d{2}-\\d{2} \\d{2}:\\d{2}:\\d{2}"
|
|
},
|
|
formats: [
|
|
{
|
|
format: ".*time=\"$timestamp=tsPattern$\""
|
|
},
|
|
{
|
|
format: ".*$_$=$unmapped._$ ",
|
|
repeat: true
|
|
},
|
|
{
|
|
format: "^.*",
|
|
rewrites: [
|
|
{
|
|
"input": "unmapped.src",
|
|
"output": "src_endpoint.ip",
|
|
"match": ".*",
|
|
"replace": "$0"
|
|
},
|
|
{
|
|
"input": "unmapped.srcport",
|
|
"output": "src_endpoint.port",
|
|
"match": ".*",
|
|
"replace": "$0"
|
|
},
|
|
{
|
|
"input": "unmapped.dst",
|
|
"output": "dst_endpoint.ip",
|
|
"match": ".*",
|
|
"replace": "$0"
|
|
},
|
|
{
|
|
"input": "unmapped.dstport",
|
|
"output": "dst_endpoint.port",
|
|
"match": ".*",
|
|
"replace": "$0"
|
|
},
|
|
{
|
|
"input": "unmapped.user",
|
|
"output": "actor.user.name",
|
|
"match": ".*",
|
|
"replace": "$0"
|
|
},
|
|
]
|
|
}
|
|
]
|
|
} |