diff options
| author | jerome <jerome@xlinfo.fr> | 2023-09-30 22:41:07 +0200 |
|---|---|---|
| committer | jerome <jerome@xlinfo.fr> | 2023-09-30 22:41:07 +0200 |
| commit | 788e4af10b9da09ec0ae981f0f8a3e163a76bdc3 (patch) | |
| tree | 8bc86b2ef2090de85316670f19b1a486c27c041b /psad.yml | |
| download | filebeat-master.tar.gz filebeat-master.zip | |
Diffstat (limited to 'psad.yml')
| -rw-r--r-- | psad.yml | 39 |
1 files changed, 39 insertions, 0 deletions
diff --git a/psad.yml b/psad.yml new file mode 100644 index 0000000..cd5af7e --- /dev/null +++ b/psad.yml @@ -0,0 +1,39 @@ +- type: filestream + id: psad + enabled: true + paths: + - /var/log/syslog + include_lines: ['psad'] + exclude_lines: ['dropping event','auto-block'] + processors: + - add_tags: + tags: ['psad'] + target: "service.type" + - add_tags: + tags: ['psad'] + target: "event.module" + - add_tags: + tags: ['intrusion_detection'] + target: "event.category" + - dissect: + when: + contains: + message: "udp pkts" + tokenizer: "%{+timestamp->} %{+timestamp} %{+timestamp} %{host} %{}: %{info}: %{ip|ip} -> %{host_ip|ip} %{protocol}: [%{port}]%{} %{*pkts}: %{&pkts|integer} %{*D}: %{&D|integer}" + field: "message" + target_prefix: "psad" + - dissect: + when: + contains: + message: "tcp pkts" + tokenizer: "%{+timestamp->} %{+timestamp} %{+timestamp} %{host} %{}: %{info}: %{ip|ip} -> %{host_ip|ip} %{protocol}: [%{port}] %{}: %{+flags} %{+flags} %{*pkts}: %{&pkts|integer} %{*D}: %{&D|integer}" + field: "message" + target_prefix: "psad" + - dissect: + when: + contains: + message: "signature" + tokenizer: '%{+timestamp->} %{+timestamp} %{+timestamp} %{host} %{}: %{}: %{ip|ip} %{*sig} "%{&sig}" (%{*i}: %{&i}) %{protocol} %{}: %{port}' + field: "message" + target_prefix: "psad" + |