Skip to content

Commit 28e08cc

Browse files
legoguy1000legoguy1000
committed
missed one
1 parent 6b8ad36 commit 28e08cc

File tree

2 files changed

+98
-34
lines changed

2 files changed

+98
-34
lines changed

‎x-pack/filebeat/module/snort/log/config/liblogparser.js‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1088,8 +1088,8 @@ var ecs_mappings = {
10881088
"rbytes": {convert: to_long, to:[{field: "destination.bytes", setter: fld_set}]},
10891089
"referer": {to:[{field: "http.request.referrer", setter: fld_prio, prio: 1}]},
10901090
"rulename": {to:[{field: "rule.name", setter: fld_set}]},
1091-
"saddr": {convert: to_ip, to:[{field: "source.ip", setter: fld_set},{field: "related.ip", setter: fld_append}]},
1092-
"saddr_v6": {convert: to_ip, to:[{field: "source.ip", setter: fld_set},{field: "related.ip", setter: fld_append}]},
1091+
"saddr": {convert: to_ip, to:[{field: "source.ip", setter: fld_append},{field: "related.ip", setter: fld_append}]},
1092+
"saddr_v6": {convert: to_ip, to:[{field: "source.ip", setter: fld_append},{field: "related.ip", setter: fld_append}]},
10931093
"sbytes": {convert: to_long, to:[{field: "source.bytes", setter: fld_set}]},
10941094
"sdomain": {to:[{field: "source.domain", setter: fld_prio, prio: 0}]},
10951095
"service": {to:[{field: "service.name", setter: fld_prio, prio: 1}]},

‎x-pack/filebeat/module/snort/log/test/generated.log-expected.json‎

Lines changed: 96 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -84,7 +84,9 @@
8484
"rule.name": "iatisu",
8585
"service.type": "snort",
8686
"source.bytes": 4512,
87-
"source.ip": "10.38.77.13",
87+
"source.ip": [
88+
"10.38.77.13"
89+
],
8890
"source.port": 3971,
8991
"tags": [
9092
"forwarded",
@@ -233,7 +235,9 @@
233235
"rule.name": "doloremi",
234236
"service.type": "snort",
235237
"source.bytes": 651,
236-
"source.ip": "10.182.199.231",
238+
"source.ip": [
239+
"10.182.199.231"
240+
],
237241
"source.port": 4478,
238242
"tags": [
239243
"forwarded",
@@ -353,7 +357,9 @@
353357
"rsa.time.event_time_str": "May 22 14:30:33 2016 UTC",
354358
"rsa.time.month": "May",
355359
"service.type": "snort",
356-
"source.ip": "10.110.31.190",
360+
"source.ip": [
361+
"10.110.31.190"
362+
],
357363
"tags": [
358364
"forwarded",
359365
"snort.log"
@@ -845,7 +851,9 @@
845851
"rsa.time.month": "Dec",
846852
"service.type": "snort",
847853
"source.geo.country_name": "tur",
848-
"source.ip": "10.182.213.195",
854+
"source.ip": [
855+
"10.182.213.195"
856+
],
849857
"source.port": 7119,
850858
"tags": [
851859
"forwarded",
@@ -900,7 +908,9 @@
900908
"rule.name": "eriam",
901909
"service.type": "snort",
902910
"source.bytes": 3465,
903-
"source.ip": "10.210.180.142",
911+
"source.ip": [
912+
"10.210.180.142"
913+
],
904914
"source.port": 3015,
905915
"tags": [
906916
"forwarded",
@@ -969,7 +979,9 @@
969979
"rsa.time.day": "20",
970980
"rsa.time.month": "Jan",
971981
"service.type": "snort",
972-
"source.ip": "10.165.33.19",
982+
"source.ip": [
983+
"10.165.33.19"
984+
],
973985
"tags": [
974986
"forwarded",
975987
"snort.log"
@@ -1018,7 +1030,9 @@
10181030
"rsa.time.event_time_str": "Feb 3 21:16:50 2017 UTC",
10191031
"rsa.time.month": "Feb",
10201032
"service.type": "snort",
1021-
"source.ip": "10.52.190.18",
1033+
"source.ip": [
1034+
"10.52.190.18"
1035+
],
10221036
"source.port": 4411,
10231037
"tags": [
10241038
"forwarded",
@@ -1070,7 +1084,9 @@
10701084
"rsa.time.event_time_str": "Feb 18 04:19:24 2017 UTC",
10711085
"rsa.time.month": "Feb",
10721086
"service.type": "snort",
1073-
"source.ip": "10.68.233.163",
1087+
"source.ip": [
1088+
"10.68.233.163"
1089+
],
10741090
"tags": [
10751091
"forwarded",
10761092
"snort.log"
@@ -1219,7 +1235,9 @@
12191235
"rsa.time.event_time_str": "Apr 16 08:29:41 2017 UTC",
12201236
"rsa.time.month": "Apr",
12211237
"service.type": "snort",
1222-
"source.ip": "10.116.175.84",
1238+
"source.ip": [
1239+
"10.116.175.84"
1240+
],
12231241
"tags": [
12241242
"forwarded",
12251243
"snort.log"
@@ -1504,7 +1522,9 @@
15041522
"rule.name": "emagnam",
15051523
"service.type": "snort",
15061524
"source.bytes": 1580,
1507-
"source.ip": "10.240.144.78",
1525+
"source.ip": [
1526+
"10.240.144.78"
1527+
],
15081528
"source.port": 2998,
15091529
"tags": [
15101530
"forwarded",
@@ -1649,7 +1669,9 @@
16491669
"rule.name": "temse",
16501670
"service.type": "snort",
16511671
"source.bytes": 470,
1652-
"source.ip": "10.140.209.249",
1672+
"source.ip": [
1673+
"10.140.209.249"
1674+
],
16531675
"source.port": 1801,
16541676
"tags": [
16551677
"forwarded",
@@ -1734,7 +1756,9 @@
17341756
"rsa.time.event_time_str": "Nov 2 11:05:41 2017 UTC",
17351757
"rsa.time.month": "Nov",
17361758
"service.type": "snort",
1737-
"source.ip": "10.198.44.231",
1759+
"source.ip": [
1760+
"10.198.44.231"
1761+
],
17381762
"tags": [
17391763
"forwarded",
17401764
"snort.log"
@@ -1788,7 +1812,9 @@
17881812
"rule.name": "ffici",
17891813
"service.type": "snort",
17901814
"source.bytes": 3273,
1791-
"source.ip": "10.77.86.215",
1815+
"source.ip": [
1816+
"10.77.86.215"
1817+
],
17921818
"source.port": 5913,
17931819
"tags": [
17941820
"forwarded",
@@ -2113,7 +2139,9 @@
21132139
"rsa.time.event_time_str": "Mar 25 09:31:24 2018 UTC",
21142140
"rsa.time.month": "Mar",
21152141
"service.type": "snort",
2116-
"source.ip": "10.28.105.106",
2142+
"source.ip": [
2143+
"10.28.105.106"
2144+
],
21172145
"tags": [
21182146
"forwarded",
21192147
"snort.log"
@@ -2223,7 +2251,9 @@
22232251
"rsa.time.day": "7",
22242252
"rsa.time.month": "May",
22252253
"service.type": "snort",
2226-
"source.ip": "10.166.40.137",
2254+
"source.ip": [
2255+
"10.166.40.137"
2256+
],
22272257
"source.nat.ip": "10.65.144.119",
22282258
"source.nat.port": 6233,
22292259
"source.port": 5279,
@@ -2264,7 +2294,9 @@
22642294
"rsa.time.day": "21",
22652295
"rsa.time.month": "May",
22662296
"service.type": "snort",
2267-
"source.ip": "10.104.78.147",
2297+
"source.ip": [
2298+
"10.104.78.147"
2299+
],
22682300
"tags": [
22692301
"forwarded",
22702302
"snort.log"
@@ -2302,7 +2334,9 @@
23022334
"rsa.time.day": "4",
23032335
"rsa.time.month": "Jun",
23042336
"service.type": "snort",
2305-
"source.ip": "10.237.43.87",
2337+
"source.ip": [
2338+
"10.237.43.87"
2339+
],
23062340
"tags": [
23072341
"forwarded",
23082342
"snort.log"
@@ -2355,7 +2389,9 @@
23552389
"rsa.time.month": "Jun",
23562390
"service.type": "snort",
23572391
"source.geo.country_name": "eos",
2358-
"source.ip": "10.234.234.205",
2392+
"source.ip": [
2393+
"10.234.234.205"
2394+
],
23592395
"source.port": 5714,
23602396
"tags": [
23612397
"forwarded",
@@ -2440,7 +2476,9 @@
24402476
"rule.name": "iconseq",
24412477
"service.type": "snort",
24422478
"source.bytes": 1259,
2443-
"source.ip": "10.40.250.209",
2479+
"source.ip": [
2480+
"10.40.250.209"
2481+
],
24442482
"source.port": 3941,
24452483
"tags": [
24462484
"forwarded",
@@ -2512,7 +2550,9 @@
25122550
"rsa.time.day": "15",
25132551
"rsa.time.month": "Aug",
25142552
"service.type": "snort",
2515-
"source.ip": "10.198.202.72",
2553+
"source.ip": [
2554+
"10.198.202.72"
2555+
],
25162556
"tags": [
25172557
"forwarded",
25182558
"snort.log"
@@ -2566,7 +2606,9 @@
25662606
"rsa.time.event_time_str": "Aug 29 14:59:40 2018 UTC",
25672607
"rsa.time.month": "Aug",
25682608
"service.type": "snort",
2569-
"source.ip": "10.147.155.100",
2609+
"source.ip": [
2610+
"10.147.155.100"
2611+
],
25702612
"tags": [
25712613
"forwarded",
25722614
"snort.log"
@@ -2617,7 +2659,9 @@
26172659
"rsa.time.event_time_str": "Sep 12 22:02:15 2018 UTC",
26182660
"rsa.time.month": "Sep",
26192661
"service.type": "snort",
2620-
"source.ip": "10.4.147.70",
2662+
"source.ip": [
2663+
"10.4.147.70"
2664+
],
26212665
"source.port": 3210,
26222666
"tags": [
26232667
"forwarded",
@@ -2759,7 +2803,9 @@
27592803
"rsa.time.day": "9",
27602804
"rsa.time.month": "Nov",
27612805
"service.type": "snort",
2762-
"source.ip": "10.224.250.83",
2806+
"source.ip": [
2807+
"10.224.250.83"
2808+
],
27632809
"tags": [
27642810
"forwarded",
27652811
"snort.log"
@@ -2810,7 +2856,9 @@
28102856
"rsa.time.month": "Nov",
28112857
"service.type": "snort",
28122858
"source.geo.country_name": "ipi",
2813-
"source.ip": "10.38.22.60",
2859+
"source.ip": [
2860+
"10.38.22.60"
2861+
],
28142862
"source.port": 653,
28152863
"tags": [
28162864
"forwarded",
@@ -2865,7 +2913,9 @@
28652913
"rule.name": "tlab",
28662914
"service.type": "snort",
28672915
"source.bytes": 42,
2868-
"source.ip": "10.46.57.181",
2916+
"source.ip": [
2917+
"10.46.57.181"
2918+
],
28692919
"source.port": 3760,
28702920
"tags": [
28712921
"forwarded",
@@ -3020,7 +3070,9 @@
30203070
"rule.name": "Secti",
30213071
"service.type": "snort",
30223072
"source.bytes": 4673,
3023-
"source.ip": "10.107.144.80",
3073+
"source.ip": [
3074+
"10.107.144.80"
3075+
],
30243076
"source.port": 703,
30253077
"tags": [
30263078
"forwarded",
@@ -3126,7 +3178,9 @@
31263178
"rsa.time.day": "17",
31273179
"rsa.time.month": "Mar",
31283180
"service.type": "snort",
3129-
"source.ip": "10.198.207.31",
3181+
"source.ip": [
3182+
"10.198.207.31"
3183+
],
31303184
"source.port": 579,
31313185
"tags": [
31323186
"forwarded",
@@ -3388,7 +3442,9 @@
33883442
"rule.name": "itsed",
33893443
"service.type": "snort",
33903444
"source.bytes": 2005,
3391-
"source.ip": "10.154.87.98",
3445+
"source.ip": [
3446+
"10.154.87.98"
3447+
],
33923448
"source.port": 2632,
33933449
"tags": [
33943450
"forwarded",
@@ -3443,7 +3499,9 @@
34433499
"rule.name": "dantiu",
34443500
"service.type": "snort",
34453501
"source.bytes": 4338,
3446-
"source.ip": "10.35.59.140",
3502+
"source.ip": [
3503+
"10.35.59.140"
3504+
],
34473505
"source.port": 1832,
34483506
"tags": [
34493507
"forwarded",
@@ -3613,7 +3671,9 @@
36133671
"rsa.time.day": "19",
36143672
"rsa.time.month": "Sep",
36153673
"service.type": "snort",
3616-
"source.ip": "10.14.46.141",
3674+
"source.ip": [
3675+
"10.14.46.141"
3676+
],
36173677
"tags": [
36183678
"forwarded",
36193679
"snort.log"
@@ -3798,7 +3858,9 @@
37983858
"rsa.time.day": "30",
37993859
"rsa.time.month": "Nov",
38003860
"service.type": "snort",
3801-
"source.ip": "10.125.130.61",
3861+
"source.ip": [
3862+
"10.125.130.61"
3863+
],
38023864
"source.nat.ip": "10.32.195.34",
38033865
"source.nat.port": 135,
38043866
"source.port": 6154,
@@ -3839,7 +3901,9 @@
38393901
"rsa.time.day": "14",
38403902
"rsa.time.month": "Dec",
38413903
"service.type": "snort",
3842-
"source.ip": "10.188.88.133",
3904+
"source.ip": [
3905+
"10.188.88.133"
3906+
],
38433907
"tags": [
38443908
"forwarded",
38453909
"snort.log"

0 commit comments

Comments
 (0)