diff options
Diffstat (limited to 'psad.yml')
| -rw-r--r-- | psad.yml | 39 |
1 files changed, 39 insertions, 0 deletions
diff --git a/psad.yml b/psad.yml new file mode 100644 index 0000000..cd5af7e --- /dev/null +++ b/psad.yml @@ -0,0 +1,39 @@ +- type: filestream + id: psad + enabled: true + paths: + - /var/log/syslog + include_lines: ['psad'] + exclude_lines: ['dropping event','auto-block'] + processors: + - add_tags: + tags: ['psad'] + target: "service.type" + - add_tags: + tags: ['psad'] + target: "event.module" + - add_tags: + tags: ['intrusion_detection'] + target: "event.category" + - dissect: + when: + contains: + message: "udp pkts" + tokenizer: "%{+timestamp->} %{+timestamp} %{+timestamp} %{host} %{}: %{info}: %{ip|ip} -> %{host_ip|ip} %{protocol}: [%{port}]%{} %{*pkts}: %{&pkts|integer} %{*D}: %{&D|integer}" + field: "message" + target_prefix: "psad" + - dissect: + when: + contains: + message: "tcp pkts" + tokenizer: "%{+timestamp->} %{+timestamp} %{+timestamp} %{host} %{}: %{info}: %{ip|ip} -> %{host_ip|ip} %{protocol}: [%{port}] %{}: %{+flags} %{+flags} %{*pkts}: %{&pkts|integer} %{*D}: %{&D|integer}" + field: "message" + target_prefix: "psad" + - dissect: + when: + contains: + message: "signature" + tokenizer: '%{+timestamp->} %{+timestamp} %{+timestamp} %{host} %{}: %{}: %{ip|ip} %{*sig} "%{&sig}" (%{*i}: %{&i}) %{protocol} %{}: %{port}' + field: "message" + target_prefix: "psad" + |