From 788e4af10b9da09ec0ae981f0f8a3e163a76bdc3 Mon Sep 17 00:00:00 2001
From: jerome <jerome@xlinfo.fr>
Date: Sat, 30 Sep 2023 22:41:07 +0200
Subject: commit original

---
 psad.yml | 39 +++++++++++++++++++++++++++++++++++++++
 1 file changed, 39 insertions(+)
 create mode 100644 psad.yml

(limited to 'psad.yml')

diff --git a/psad.yml b/psad.yml
new file mode 100644
index 0000000..cd5af7e
--- /dev/null
+++ b/psad.yml
@@ -0,0 +1,39 @@
+- type: filestream
+  id: psad
+  enabled: true
+  paths:
+    - /var/log/syslog
+  include_lines: ['psad']
+  exclude_lines: ['dropping event','auto-block']
+  processors:
+    - add_tags:
+        tags: ['psad']
+        target: "service.type"
+    - add_tags:
+        tags: ['psad']
+        target: "event.module"
+    - add_tags:
+        tags: ['intrusion_detection']
+        target: "event.category"
+    - dissect:
+        when:
+          contains:
+            message: "udp pkts"
+        tokenizer: "%{+timestamp->} %{+timestamp} %{+timestamp} %{host} %{}: %{info}: %{ip|ip} -> %{host_ip|ip} %{protocol}: [%{port}]%{} %{*pkts}: %{&pkts|integer} %{*D}: %{&D|integer}"
+        field: "message"
+        target_prefix: "psad"
+    - dissect:
+        when:
+          contains:
+            message: "tcp pkts"
+        tokenizer: "%{+timestamp->} %{+timestamp} %{+timestamp} %{host} %{}: %{info}: %{ip|ip} -> %{host_ip|ip} %{protocol}: [%{port}] %{}: %{+flags} %{+flags} %{*pkts}: %{&pkts|integer} %{*D}: %{&D|integer}"
+        field: "message"
+        target_prefix: "psad"
+    - dissect:
+        when:
+          contains:
+            message: "signature"
+        tokenizer: '%{+timestamp->} %{+timestamp} %{+timestamp} %{host} %{}: %{}: %{ip|ip} %{*sig} "%{&sig}" (%{*i}: %{&i}) %{protocol} %{}: %{port}'
+        field: "message"
+        target_prefix: "psad"
+
-- 
cgit v1.2.3