mirror of
https://github.com/marcredhat/SIEM-toolkit-patched
synced 2026-06-08 20:37:12 +00:00
marc
7c1687efce
Brought in 35 upstream commits (MITRE heatmap, health score, dependency map,
PowerQuery playground, onboarding tracker, product grouping, modern UI redesign).
Preserved fork additions:
backend/routers/quality.py KV scanner, pattern refs, JS keys, JSON mode,
/parsers + /sync-from-sdl endpoints
parsers/ 96 OCSF + tenant parsers
tools/stormshield-verify/ end-to-end ingest regression test
.gitignore un-ignored parsers/*
CHANGES.md, PATCHES.md
85 lines
3.9 KiB
Plaintext
85 lines
3.9 KiB
Plaintext
{
|
|
attributes: {
|
|
"dataSource.vendor": "Proofpoint",
|
|
"dataSource.category": "security"
|
|
},
|
|
formats: [
|
|
{
|
|
id: "format1",
|
|
format: "${parse=dottedjson}$"
|
|
rewrites: [
|
|
{input: "messageTime", output: "timestamp", match: ".*", replace: "$0"},
|
|
{input: "clickTime", output: "unmapped.clickTime", match: ".*", replace: "$0"},
|
|
|
|
{input: "threatsInfoMap", output: "unmapped.threatsInfoMap", match: ".*", replace: "$0"},
|
|
{input: "messageParts", output: "unmapped.messageParts", match: ".*", replace: "$0"},
|
|
{input: "quarantineFolder", output: "unmapped.quarantineFolder", match: ".*", replace: "$0"},
|
|
{input: "impostorScore", output: "unmapped.impostorScore", match: ".*", replace: "$0"},
|
|
{input: "phishScore", output: "unmapped.phishScore", match: ".*", replace: "$0"},
|
|
{input: "policyRoutes", output: "unmapped.policyRoutes", match: ".*", replace: "$0"},
|
|
|
|
{input: "threatStatus", output: "unmapped.threatStatus", match: ".*", replace: "$0"},
|
|
{input: "threatsInfoMap[0].threatStatus", output: "unmapped.threatStatus", match: ".*", replace: "$0"},
|
|
|
|
{input: "classification", output: "unmapped.classification", match: ".*", replace: "$0"},
|
|
{input: "threatsInfoMap[0].classification", output: "unmapped.classification", match: ".*", replace: "$0"},
|
|
|
|
{input: "sender", output: "unmapped.sender", match: ".*", replace: "$0"},
|
|
{input: "recipient", output: "unmapped.recipient", match: ".*", replace: "$0"},
|
|
|
|
{input: "sender", output: "email.from", match: ".*", replace: "$0"},
|
|
{input: "fromAddress[0]", output: "email.from", match: ".*", replace: "$0"},
|
|
{input: "fromAddress", output: "email.from", match: ".*", replace: "$0"},
|
|
|
|
{input: "recipient", output: "email.to", match: ".*", replace: "$0"},
|
|
{input: "toAddresses[0]", output: "email.to", match: ".*", replace: "$0"},
|
|
{input: "toAddresses", output: "email.to", match: ".*", replace: "$0"},
|
|
|
|
{input: "recipient", output: "actor.user.name", match: ".*", replace: "$0"},
|
|
{input: "toAddresses[0]", output: "actor.user.name", match: ".*", replace: "$0"},
|
|
{input: "toAddresses", output: "actor.user.name", match: ".*", replace: "$0"},
|
|
|
|
{input: "messageSize", output: "email.size", match: ".*", replace: "$0"},
|
|
{input: "headerFrom", output: "email.smtp_from", match: ".*", replace: "$0"},
|
|
|
|
{input: "oext", output: "oext", match: ".*", replace: "$0"},
|
|
{input: "mod", output: "mod", match: ".*", replace: "$0"}
|
|
]
|
|
}
|
|
],
|
|
mappings: {
|
|
version: 1,
|
|
mappings: [
|
|
{
|
|
predicate: "clickTime = * OR clickIP = * OR threatURL = *",
|
|
transformations: [
|
|
{ constant: { field: "dataSource.name", value: "Proofpoint" } },
|
|
{ constant: { field: "event.type", value: "Click" } },
|
|
{ copy: { from: "fromAddress[0]", to: "email.from" } },
|
|
{ copy: { from: "toAddresses[0]", to: "email.to" } },
|
|
{ copy: { from: "toAddresses[0]", to: "actor.user.name" } },
|
|
{ copy: { from: "recipient", to: "actor.user.name" } }
|
|
]
|
|
},
|
|
{
|
|
predicate: "messageTime = * OR messageParts = * OR threatsInfoMap = *",
|
|
transformations: [
|
|
{ constant: { field: "dataSource.name", value: "Proofpoint" } },
|
|
{ constant: { field: "event.type", value: "Email" } },
|
|
{ copy: { from: "fromAddress[0]", to: "email.from" } },
|
|
{ copy: { from: "toAddresses[0]", to: "email.to" } },
|
|
{ copy: { from: "toAddresses[0]", to: "actor.user.name" } },
|
|
{ copy: { from: "recipient", to: "actor.user.name" } }
|
|
]
|
|
},
|
|
{
|
|
predicate: "true",
|
|
transformations: [
|
|
{ constant: { field: "dataSource.name", value: "Proofpoint" } },
|
|
{ constant: { field: "event.type", value: "Other" } },
|
|
|
|
]
|
|
}
|
|
]
|
|
}
|
|
} |