-
Notifications
You must be signed in to change notification settings - Fork 1
/
Copy pathlogstash-bro22-parse.conf
198 lines (178 loc) · 7.61 KB
/
logstash-bro22-parse.conf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
#Parser generated by Jason Smith
#Currently parses the following logs;
#communication.log
#conn.log
#conn-summary.log
#dhcp.log
#dns.log
#dpd.log
#files.log
#http.log
#packet_filter.log
#reporter.log
#software.log
#ssl.log
#weird.log
#notice.log
input {
#Production Logs#############################
file {
type => "BRO_httplog"
path => "/opt/bro2/logs/current/http.log"
}
file {
type => "BRO_dpdlog"
path => "/opt/bro2/logs/current/dpd.log"
}
file {
type => "BRO_connlog"
path => "/opt/bro2/logs/current/conn.log"
}
file {
type => "BRO_weirdlog"
path => "/opt/bro2/logs/current/weird.log"
}
file {
type => "BRO_appstatslog"
path => "/opt/bro2/logs/current/appstats.log"
}
file {
type => "BRO_communicationlog"
path => "/opt/bro2/logs/current/communication.log"
}
file {
type => "BRO_dhcplog"
path => "/opt/bro2/logs/current/dhcp.log"
}
file {
type => "BRO_fileslog"
path => "/opt/bro2/logs/current/files.log"
}
file {
type => "BRO_SSLlog"
path => "/opt/bro2/logs/current/ssl.log"
}
file {
type => "BRO_noticelog"
path => "/opt/bro2/logs/current/notice.log"
}
file {
type => "BRO_softwarelog"
path => "/opt/bro2/logs/current/software.log"
}
file {
type => "BRO_reporterlog"
path => "/opt/bro2/logs/current/reporter.log"
}
file {
type => "BRO_packetfilterlog"
path => "/opt/bro2/logs/current/packet_filter.log"
}
file {
type => "BRO_dnslog"
path => "/opt/bro2/logs/current/dns.log"
}
#Test Logs#############################################
# file {
# type => "BRO_httplogTEST"
# path => "/home/idsusr/brotest/http.log"
# }
# file {
# type => "BRO_noticelogTEST"
# path => "/home/idsusr/brotest/notice.log"
# }
#######################################################
}
filter {
if [message] =~ /^#/ {
drop { }
} else {
# BRO_httplog ######################
if [type] == "BRO_httplog" {
grok {
match => [ "message", "(?<ts>(.*?))\t(?<uid>(.*?))\t(?<id.orig_h>(.*?))\t(?<id.orig_p>(.*?))\t(?<id.resp_h>(.*?))\t(?<id.resp_p>(.*?))\t(?<trans_depth>(.*?))\t(?<method>(.*?))\t(?<host>(.*?))\t(?<uri>(.*?))\t(?<referrer>(.*?))\t(?<user_agent>(.*?))\t(?<request_body_len>(.*?))\t(?<response_body_len>(.*?))\t(?<status_code>(.*?))\t(?<status_msg>(.*?))\t(?<info_code>(.*?))\t(?<info_msg>(.*?))\t(?<filename>(.*?))\t(?<tags>(.*?))\t(?<username>(.*?))\t(?<password>(.*?))\t(?<proxied>(.*?))\t(?<orig_fuids>(.*?))\t(?<orig_mime_types>(.*?))\t(?<resp_fuids>(.*?))\t(?<resp_mime_types>(.*))" ]
}
}
# BRO_dpdlog ######################
if [type] == "BRO_dpdlog" {
grok {
match => [ "message", "(?<ts>(.*?))\t(?<uid>(.*?))\t(?<id.orig_h>(.*?))\t(?<id.orig_p>(.*?))\t(?<id.resp_h>(.*?))\t(?<id.resp_p>(.*?))\t(?<proto>(.*?))\t(?<analyzer>(.*?))\t(?<failure_reason>(.*))" ]
}
}
# BRO_connlog ######################
if [type] == "BRO_connlog" {
grok {
match => [ "message", "(?<ts>(.*?))\t(?<uid>(.*?))\t(?<id.orig_h>(.*?))\t(?<id.orig_p>(.*?))\t(?<id.resp_h>(.*?))\t(?<id.resp_p>(.*?))\t(?<proto>(.*?))\t(?<service>(.*?))\t(?<duration>(.*?))\t(?<orig_bytes>(.*?))\t(?<resp_bytes>(.*?))\t(?<conn_state>(.*?))\t(?<local_orig>(.*?))\t(?<missed_bytes>(.*?))\t(?<history>(.*?))\t(?<orig_pkts>(.*?))\t(?<orig_ip_bytes>(.*?))\t(?<resp_pkts>(.*?))\t(?<resp_ip_bytes>(.*?))\t(?<tunnel_parents>(.*))" ]
}
}
# BRO_weirdlog ######################
if [type] == "BRO_weirdlog" {
grok {
match => [ "message", "(?<ts>(.*?))\t(?<uid>(.*?))\t(?<id.orig_h>(.*?))\t(?<id.orig_p>(.*?))\t(?<id.resp_h>(.*?))\t(?<id.resp_p>(.*?))\t(?<name>(.*?))\t(?<addl>(.*?))\t(?<notice>(.*?))\t(?<peer>(.*))" ]
}
}
# BRO_appstatslog ######################
if [type] == "BRO_appstatslog" {
grok {
match => [ "message", "(?<ts>(.*?))\t(?<ts_delta>(.*?))\t(?<app>(.*?))\t(?<uniq_hosts>(.*?))\t(?<hits>(.*?))\t(?<bytes>(.*))" ]
}
}
# BRO_communicationlog ######################
if [type] == "BRO_communicationlog" {
grok {
match => [ "message", "(?<ts>(.*?))\t(?<peer>(.*?))\t(?<src_name>(.*?))\t(?<connected_peer_desc>(.*?))\t(?<connected_peer_addr>(.*?))\t(?<connected_peer_port>(.*?))\t(?<level>(.*?))\t(?<message>(.*))" ]
}
}
# BRO_dhcplog ######################
if [type] == "BRO_dhcplog" {
grok {
match => [ "message", "(?<ts>(.*?))\t(?<uid>(.*?))\t(?<id.orig_h>(.*?))\t(?<id.orig_p>(.*?))\t(?<id.resp_h>(.*?))\t(?<id.resp_p>(.*?))\t(?<mac>(.*?))\t(?<assigned_ip>(.*?))\t(?<lease_time>(.*?))\t(?<trans_id>(.*))" ]
}
}
# BRO_fileslog ######################
if [type] == "BRO_fileslog" {
grok {
match => [ "message", "(?<ts>(.*?))\t(?<fuid>(.*?))\t(?<tx_hosts>(.*?))\t(?<rx_hosts>(.*?))\t(?<conn_uids>(.*?))\t(?<source>(.*?))\t(?<depth>(.*?))\t(?<analyzers>(.*?))\t(?<mime_type>(.*?))\t(?<filename>(.*?))\t(?<duration>(.*?))\t(?<local_orig>(.*?))\t(?<is_orig>(.*?))\t(?<seen_bytes>(.*?))\t(?<total_bytes>(.*?))\t(?<missing_bytes>(.*?))\t(?<overflow_bytes>(.*?))\t(?<timedout>(.*?))\t(?<parent_fuid>(.*?))\t(?<md5>(.*?))\t(?<sha1>(.*?))\t(?<sha256>(.*?))\t(?<extracted>(.*))" ]
}
}
# BRO_SSLlog ######################
if [type] == "BRO_SSLlog" {
grok {
match => [ "message", "(?<ts>(.*?))\t(?<uid>(.*?))\t(?<id.orig_h>(.*?))\t(?<id.orig_p>(.*?))\t(?<id.resp_h>(.*?))\t(?<id.resp_p>(.*?))\t(?<version>(.*?))\t(?<cipher>(.*?))\t(?<server_name>(.*?))\t(?<session_id>(.*?))\t(?<subject>(.*?))\t(?<issuer_subject>(.*?))\t(?<not_valid_before>(.*?))\t(?<not_valid_after>(.*?))\t(?<last_alert>(.*?))\t(?<client_subject>(.*?))\t(?<client_issuer_subject>(.*?))\t(?<cert_hash>(.*?))\t(?<validation_status>(.*))" ]
}
}
# BRO_noticelog ######################
if [type] == "BRO_noticelog" {
grok {
match => [ "message", "(?<ts>(.*?))\t(?<uid>(.*?))\t(?<id.orig_h>(.*?))\t(?<id.orig_p>(.*?))\t(?<id.resp_h>(.*?))\t(?<id.resp_p>(.*?))\t(?<fuid>(.*?))\t(?<file_mime_type>(.*?))\t(?<file_desc>(.*?))\t(?<proto>(.*?))\t(?<note>(.*?))\t(?<msg>(.*?))\t(?<sub>(.*?))\t(?<src>(.*?))\t(?<dst>(.*?))\t(?<p>(.*?))\t(?<n>(.*?))\t(?<peer_descr>(.*?))\t(?<actions>(.*?))\t(?<suppress_for>(.*?))\t(?<dropped>(.*?))\t(?<remote_location.country_code>(.*?))\t(?<remote_location.region>(.*?))\t(?<remote_location.city>(.*?))\t(?<remote_location.latitude>(.*?))\t(?<remote_location.longitude>(.*))" ]
}
}
# BRO_softwarelog ######################
if [type] == "BRO_softwarelog" {
grok {
match => [ "message", "(?<ts>(.*?))\t(?<host>(.*?))\t(?<host_p>(.*?))\t(?<software_type>(.*?))\t(?<name>(.*?))\t(?<version.major>(.*?))\t(?<version.minor>(.*?))\t(?<version.minor2>(.*?))\t(?<version.minor3>(.*?))\t(?<version.addl>(.*?))\t(?<unparsed_version>(.*))" ]
}
}
# BRO_reporterlog ######################
if [type] == "BRO_noticelog" {
grok {
match => [ "message", "(?<ts>(.*?))\t(?<level>(.*?))\t(?<message>(.*?))\t(?<location>(.*))" ]
}
}
# BRO_packetfilterlog ######################
if [type] == "BRO_packetfilterlog" {
grok {
match => [ "message", "(?<ts>(.*?))\t(?<node>(.*?))\t(?<filter>(.*?))\t(?<init>(.*?))\t(?<success>(.*))" ]
}
}
# BRO_dnslog ######################
if [type] == "BRO_dnslog" {
grok {
match => [ "message", "(?<ts>(.*?))\t(?<uid>(.*?))\t(?<id.orig_h>(.*?))\t(?<id.orig_p>(.*?))\t(?<id.resp_h>(.*?))\t(?<id.resp_p>(.*?))\t(?<proto>(.*?))\t(?<trans_id>(.*?))\t(?<query>(.*?))\t(?<qclass>(.*?))\t(?<qclass_name>(.*?))\t(?<qtype>(.*?))\t(?<qtype_name>(.*?))\t(?<rcode>(.*?))\t(?<rcode_name>(.*?))\t(?<AA>(.*?))\t(?<TC>(.*?))\t(?<RD>(.*?))\t(?<RA>(.*?))\t(?<Z>(.*?))\t(?<answers>(.*?))\t(?<TTLs>(.*?))\t(?<rejected>(.*))" ]
}
}
}
}
output {
elasticsearch { embedded => true }
}