securityonion Documentation

File: README.md Copy Chapter

Security Onion

Security Onion is a free and open Linux distribution for threat hunting, enterprise security monitoring, and log management. It includes a comprehensive suite of tools designed to work together to provide visibility into your network and host activity.

✨ Features Copy Chapter

Security Onion includes everything you need to monitor your network and host systems:

• Security Onion Console (SOC): A unified web interface for analyzing security events and managing your grid.
• Elastic Stack: Powerful search backed by Elasticsearch.
• Intrusion Detection: Network-based IDS with Suricata and host-based monitoring with Elastic Fleet.
• Network Metadata: Detailed network metadata generated by Zeek or Suricata.
• Full Packet Capture: Retain and analyze raw network traffic with Suricata PCAP.

⭐ Security Onion Pro Copy Chapter

For organizations and enterprises requiring advanced capabilities, Security Onion Pro offers additional features designed for scale and efficiency:

• Onion AI: Leverage powerful AI-driven insights to accelerate your analysis and investigations.
• Enterprise Features: Enhanced tools and integrations tailored for enterprise-grade security operations.

For more information, visit the Security Onion Pro page.

☁️ Cloud Deployment Copy Chapter

Security Onion is available and ready to deploy in the AWS, Azure, and Google Cloud (GCP) marketplaces.

🚀 Getting Started Copy Chapter

📖 Documentation & Support Copy Chapter

For more detailed information, please visit our Documentation.

• FAQ: Frequently Asked Questions
• Community: Discussions & Support
• Training: Official Training

🤝 Contributing Copy Chapter

We welcome contributions! Please see our CONTRIBUTING.md for guidelines on how to get involved.

🛡️ License Copy Chapter

Security Onion is licensed under the terms of the license found in the LICENSE file.

Built with 🧅 by Security Onion Solutions.

File: CONTRIBUTING.md Copy Chapter

Contributing to Security Onion

Questions, suggestions, and general comments Copy Section

• Security Onion uses GitHub's Discussions to provide a forum where the community and developers can interact as well as ask and answer questions.

Reporting a bug Copy Section

• The primary place to report unexpected behavior or possible bugs is the repo's Discussions forum.

• If you are familiar with the current version of Security Onion and are confident you've discovered a bug, first ensure there is not already an issue present by searching the open issues. If there is, a thumbs up :+1: is a great way to show this bug is affecting you too.

• If an issue doesn't exist, open a new one, following the directions in the issue template. This means including:

  • System information and how Security Onion was installed
  • Log files relevant to the bug report
  • Reproduction steps

Contributing code Copy Section

• All commits must be signed with a valid key that has been added to your GitHub account. Each commit should have the "Verified" tag when viewed on GitHub as shown below:

• If an issue does not already exist for the bug or feature for which you are submitting a pull request, create one with the relevant prefix. (FIX: for bug fixes, FEATURE: for new features.)

• Link the PR to the related issue, either using keywords in the PR description, or manually.

• Pull requests should be opened against the current ?/dev branch of this repo, and should clearly describe the problem and solution.

• Be sure you have tested your changes and are confident they will not break other parts of the product.

• See this document's code styling and conventions section below to be sure your PR fits our code requirements prior to submitting.

• Change behavior (fix a bug, add a new feature) separately from refactoring code. Refactor pull requests are welcome, but ensure your new code behaves exactly the same as the old.

• Do not refactor code for non-functional reasons. If you are submitting a pull request that refactors code, ensure the refactor is improving the functionality of the code you're refactoring (e.g. decreasing complexity, removing reliance on 3rd party tools, improving performance).

• Before submitting a PR with significant changes to the project, start a discussion explaining what you hope to acheive. The project maintainers will provide feedback and determine whether your goal aligns with the project.

Code style and conventions Copy Section

• Keep code DRY. For example, Bash code used by multiple scripts will likely best be added to so-common.

• All new Bash code should pass ShellCheck analysis. Where errors can be safely ignored, the relevant disable directive should be accompanied by a brief explanation as to why the error is being ignored.

• Ensure all YAML (this includes Salt states and pillars) is properly formatted. The spec for YAML v1.2 can be found here, however there are numerous online resources with simpler descriptions of its formatting rules.

• All code of any language should match the style of other code of that same language within the project. Be sure that any changes you make do not break from the pre-existing style of Security Onion code.

File: DOWNLOAD_AND_VERIFY_ISO.md Copy Chapter

3.3.0-20260911 ISO image released on 2026/09/11 Copy Section

Download and Verify Copy Section

3.3.0-20260911 ISO image:
https://download.securityonion.net/file/securityonion/securityonion-3.3.0-20260911.iso

MD5: 12B18433D3A2198A185892FF79CF638F
SHA1: 2B3C2E1FA7A78ED1F956E7EDCC12E32593C14EEE
SHA256: 0938C73B76CE30EC9E4394D312C79EA7CAC721B6818541697279A6221F7D870D

Signature for ISO image:
https://github.com/Security-Onion-Solutions/securityonion/raw/3/main/sigs/securityonion-3.3.0-20260911.iso.sig

Signing key:
https://raw.githubusercontent.com/Security-Onion-Solutions/securityonion/3/main/KEYS

For example, here are the steps you can use on most Linux distributions to download and verify our Security Onion ISO image.

Download and import the signing key:

wget https://raw.githubusercontent.com/Security-Onion-Solutions/securityonion/3/main/KEYS -O - | gpg --import -

Download the signature file for the ISO:

wget https://github.com/Security-Onion-Solutions/securityonion/raw/3/main/sigs/securityonion-3.3.0-20260911.iso.sig

Download the ISO image:

wget https://download.securityonion.net/file/securityonion/securityonion-3.3.0-20260911.iso

Verify the downloaded ISO image using the signature file:

gpg --verify securityonion-3.3.0-20260911.iso.sig securityonion-3.3.0-20260911.iso

The output should show "Good signature" and the Primary key fingerprint should match what's shown below:

gpg: Signature made Fri 11 Sep 2026 11:23:56 AM EDT using RSA key ID FE507013
gpg: Good signature from "Security Onion Solutions, LLC <[email protected]>"
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: C804 A93D 36BE 0C73 3EA1  9644 7C10 60B7 FE50 7013

If it fails to verify, try downloading again. If it still fails to verify, try downloading from another computer or another network.

Once you've verified the ISO image, you're ready to proceed to our Installation guide:
https://securityonion.net/docs/installation

File: SECURITY.md Copy Chapter

Security Policy

Supported Versions Copy Chapter

Security Onion 2.3 has reached End Of Life and is no longer supported.

Security Onion 16.04 has reached End Of Life and is no longer supported.

Reporting a Vulnerability Copy Chapter

If you have any security concerns regarding Security Onion or believe you have uncovered a vulnerability, please follow these steps:

• send an email to [email protected]
• include a description of the issue and steps to reproduce
• please use plain text format (no Word documents or PDF files)
• please do not disclose publicly until we have had sufficient time to resolve the issue

This security address should be used only for undisclosed vulnerabilities. Dealing with fixed issues or general questions on how to use Security Onion should be handled via the normal support channels.

File: files/firewall/assigned_hostgroups.local.map.yaml Copy Chapter

{% import_yaml 'firewall/ports/ports.yaml' as default_portgroups %}
{% set default_portgroups = default_portgroups.firewall.ports %}
{% import_yaml 'firewall/ports/ports.local.yaml' as local_portgroups %}
{% if local_portgroups.firewall.ports %}
{% set local_portgroups = local_portgroups.firewall.ports %}
{% else %}
{% set local_portgroups = {} %}
{% endif %}
{% set portgroups = salt['defaults.merge'](default_portgroups, local_portgroups, in_place=False) %}

role:
eval:
fleet:
heavynode:
idh:
import:
manager:
managersearch:
receiver:
standalone:
searchnode:
sensor:

File: files/firewall/ports/ports.local.yaml Copy Chapter

firewall:
ports:

File: salt/backup/defaults.yaml Copy Chapter

backup:
locations:
- /opt/so/saltstack/local
- /etc/pki
- /etc/salt
- /nsm/kratos
- /nsm/hydra
destination: "/nsm/backup"

File: salt/backup/soc_backup.yaml Copy Chapter

backup:
locations:
helpLink: backup
global: True
destination:
helpLink: backup
global: True

File: salt/bpf/defaults.yaml Copy Chapter

bpf:
pcap: []
suricata: []
zeek: []

File: salt/bpf/soc_bpf.yaml Copy Chapter

bpf:
pcap:
multiline: True
forcedType: "[]string"
helpLink: bpf
suricata:
multiline: True
forcedType: "[]string"
helpLink: bpf
zeek:
multiline: True
forcedType: "[]string"
helpLink: bpf

File: salt/docker/defaults.yaml Copy Chapter

docker:
range: '172.17.1.0/24'
gateway: '172.17.1.1'
ulimits:
- name: nofile
soft: 1048576
hard: 1048576
containers:
'so-dockerregistry':
final_octet: 20
port_bindings:
- 0.0.0.0:5000:5000
custom_bind_mounts: []
extra_hosts: []
extra_env: []
ulimits: []
'so-elastic-fleet':
final_octet: 21
port_bindings:
- 0.0.0.0:8220:8220/tcp
custom_bind_mounts: []
extra_hosts: []
extra_env: []
ulimits: []
'so-elasticsearch':
final_octet: 22
port_bindings:
- 0.0.0.0:9200:9200/tcp
- 0.0.0.0:9300:9300/tcp
custom_bind_mounts: []
extra_hosts: []
extra_env: []
ulimits:
- name: memlock
soft: -1
hard: -1
- name: nofile
soft: 65536
hard: 65536
- name: nproc
soft: 4096
hard: 4096
'so-influxdb':
final_octet: 26
port_bindings:
- 0.0.0.0:8086:8086
custom_bind_mounts: []
extra_hosts: []
extra_env: []
ulimits: []
'so-kibana':
final_octet: 27
port_bindings:
- 0.0.0.0:5601:5601
custom_bind_mounts: []
extra_hosts: []
extra_env: []
ulimits: []
'so-kratos':
final_octet: 28
port_bindings:
- 0.0.0.0:4433:4433
- 0.0.0.0:4434:4434
custom_bind_mounts: []
extra_hosts: []
extra_env: []
ulimits: []
'so-hydra':
final_octet: 30
port_bindings:
- 0.0.0.0:4444:4444
- 0.0.0.0:4445:4445
custom_bind_mounts: []
extra_hosts: []
extra_env: []
ulimits: []
'so-logstash':
final_octet: 29
port_bindings:
- 0.0.0.0:3765:3765
- 0.0.0.0:5044:5044
- 0.0.0.0:5055:5055
- 0.0.0.0:5056:5056
- 0.0.0.0:5644:5644
- 0.0.0.0:6050:6050
- 0.0.0.0:6051:6051
- 0.0.0.0:6052:6052
- 0.0.0.0:6053:6053
- 0.0.0.0:9600:9600
custom_bind_mounts: []
extra_hosts: []
extra_env: []
ulimits: []
'so-nginx':
final_octet: 31
port_bindings:
- 80:80
- 443:443
- 8443:8443
- 7788:7788
- 7789:7789
custom_bind_mounts: []
extra_hosts: []
extra_env: []
ulimits: []
'so-nginx-fleet-node':
final_octet: 31
port_bindings:
- 8443:8443
custom_bind_mounts: []
extra_hosts: []
extra_env: []
ulimits: []
'so-redis':
final_octet: 33
port_bindings:
- 0.0.0.0:6379:6379
- 0.0.0.0:9696:9696
custom_bind_mounts: []
extra_hosts: []
extra_env: []
ulimits: []
'so-sensoroni':
final_octet: 99
custom_bind_mounts: []
extra_hosts: []
extra_env: []
ulimits: []
'so-soc':
final_octet: 34
port_bindings:
- 0.0.0.0:9822:9822
custom_bind_mounts: []
extra_hosts: []
extra_env: []
ulimits: []
'so-strelka-backend':
final_octet: 36
custom_bind_mounts: []
extra_hosts: []
extra_env: []
ulimits: []
'so-strelka-filestream':
final_octet: 37
custom_bind_mounts: []
extra_hosts: []
extra_env: []
ulimits: []
'so-strelka-frontend':
final_octet: 38
port_bindings:
- 0.0.0.0:57314:57314
custom_bind_mounts: []
extra_hosts: []
extra_env: []
ulimits: []
'so-strelka-manager':
final_octet: 39
custom_bind_mounts: []
extra_hosts: []
extra_env: []
ulimits: []
'so-strelka-gatekeeper':
final_octet: 40
port_bindings:
- 0.0.0.0:6381:6379
custom_bind_mounts: []
extra_hosts: []
extra_env: []
ulimits: []
'so-strelka-coordinator':
final_octet: 41
port_bindings:
- 0.0.0.0:6380:6379
custom_bind_mounts: []
extra_hosts: []
extra_env: []
ulimits: []
'so-elastalert':
final_octet: 42
custom_bind_mounts: []
extra_hosts: []
extra_env: []
ulimits: []
'so-elastic-fleet-package-registry':
final_octet: 44
port_bindings:
- 0.0.0.0:8080:8080/tcp
custom_bind_mounts: []
extra_hosts: []
extra_env: []
ulimits: []
'so-idh':
final_octet: 45
custom_bind_mounts: []
extra_hosts: []
extra_env: []
ulimits: []
'so-elastic-agent':
final_octet: 46
port_bindings:
- 0.0.0.0:514:514/tcp
- 0.0.0.0:514:514/udp
custom_bind_mounts: []
extra_hosts: []
extra_env: []
ulimits: []
'so-telegraf':
final_octet: 99
custom_bind_mounts: []
extra_hosts: []
extra_env: []
ulimits: []
'so-suricata':
final_octet: 99
custom_bind_mounts: []
extra_hosts: []
extra_env: []
ulimits: []
'so-zeek':
final_octet: 99
custom_bind_mounts: []
extra_hosts: []
extra_env: []
ulimits:
- name: core
soft: 0
hard: 0
'so-kafka':
final_octet: 88
port_bindings:
- 0.0.0.0:9092:9092
- 0.0.0.0:29092:29092
- 0.0.0.0:9093:9093
- 0.0.0.0:8778:8778
custom_bind_mounts: []
extra_hosts: []
extra_env: []
ulimits: []
'so-postgres':
final_octet: 47
port_bindings:
- 0.0.0.0:5432:5432
custom_bind_mounts: []
extra_hosts: []
extra_env: []
ulimits: []

File: salt/docker/soc_docker.yaml Copy Chapter

docker:
gateway:
helpLink: docker
advanced: True
range:
helpLink: docker
advanced: True
ulimits:
Default ulimit settings applied to all containers via the Docker daemon. Each entry specifies a resource name (e.g. nofile, memlock, core, nproc) with soft and hard limits. Individual container ulimits override these defaults. Valid resource names include: cpu, fsize, data, stack, core, rss, nproc, nofile, memlock, as, locks, sigpending, msgqueue, nice, rtprio, rttime.
forcedType: "[]{}"
syntax: json
advanced: True
helpLink: docker.html
uiElements:
- field: name
label: Resource Name
required: True
regex: ^(cpu|fsize|data|stack|core|rss|nproc|nofile|memlock|as|locks|sigpending|msgqueue|nice|rtprio|rttime)$
regexFailureMessage: You must enter a valid ulimit name (cpu, fsize, data, stack, core, rss, nproc, nofile, memlock, as, locks, sigpending, msgqueue, nice, rtprio, rttime).
- field: soft
label: Soft Limit
forcedType: int
- field: hard
label: Hard Limit
forcedType: int
containers:
so-dockerregistry: &dockerOptions
final_octet:
helpLink: docker
readonly: True
advanced: True
global: True
port_bindings:
helpLink: docker
advanced: True
multiline: True
forcedType: "[]string"
custom_bind_mounts:
advanced: True
helpLink: docker
multiline: True
forcedType: "[]string"
extra_hosts:
advanced: True
helpLink: docker
multiline: True
forcedType: "[]string"
extra_env:
advanced: True
helpLink: docker
multiline: True
forcedType: "[]string"
ulimits:
Ulimit settings for the container. Each entry specifies a resource name (e.g. nofile, memlock, core, nproc) with optional soft and hard limits. Valid resource names include: cpu, fsize, data, stack, core, rss, nproc, nofile, memlock, as, locks, sigpending, msgqueue, nice, rtprio, rttime.
advanced: True
helpLink: docker.html
forcedType: "[]{}"
syntax: json
uiElements:
- field: name
label: Resource Name
required: True
regex: ^(cpu|fsize|data|stack|core|rss|nproc|nofile|memlock|as|locks|sigpending|msgqueue|nice|rtprio|rttime)$
regexFailureMessage: You must enter a valid ulimit name (cpu, fsize, data, stack, core, rss, nproc, nofile, memlock, as, locks, sigpending, msgqueue, nice, rtprio, rttime).
- field: soft
label: Soft Limit
forcedType: int
- field: hard
label: Hard Limit
forcedType: int
so-elastic-fleet: *dockerOptions
so-elasticsearch: *dockerOptions
so-influxdb: *dockerOptions
so-kibana: *dockerOptions
so-kratos: *dockerOptions
so-hydra: *dockerOptions
so-logstash: *dockerOptions
so-nginx: *dockerOptions
so-nginx-fleet-node: *dockerOptions
so-redis: *dockerOptions
so-sensoroni: *dockerOptions
so-soc: *dockerOptions
so-strelka-backend: *dockerOptions
so-strelka-filestream: *dockerOptions
so-strelka-frontend: *dockerOptions
so-strelka-manager: *dockerOptions
so-strelka-gatekeeper: *dockerOptions
so-strelka-coordinator: *dockerOptions
so-elastalert: *dockerOptions
so-elastic-fleet-package-registry: *dockerOptions
so-idh: *dockerOptions
so-elastic-agent: *dockerOptions
so-telegraf: *dockerOptions
so-suricata: *dockerOptions
so-zeek: *dockerOptions
so-kafka: *dockerOptions

File: salt/elastalert/defaults.yaml Copy Chapter

elastalert:
enabled: False
alerter_parameters: ""
config:
rules_folder: /opt/elastalert/rules/
scan_subdirectories: true
disable_rules_on_error: false
run_every:
minutes: 3
buffer_time:
minutes: 10
old_query_limit:
minutes: 5
es_port: 9200
es_conn_timeout: 55
max_query_size: 5000
use_ssl: true
verify_certs: false
writeback_index: elastalert
alert_time_limit:
days: 2
index_settings:
shards: 1
replicas: 0
logging:
version: 1
incremental: false
disable_existing_loggers: false
formatters:
logline:
format: '%(asctime)s %(levelname)+8s %(name)+20s %(message)s'
handlers:
file:
class: logging.FileHandler
formatter: logline
level: INFO
filename: /var/log/elastalert/elastalert.log
loggers:
'':
level: INFO
handlers:
- file
propagate: false

File: salt/elastalert/soc_elastalert.yaml Copy Chapter

elastalert:
enabled:
forcedType: bool
helpLink: elastalert
alerter_parameters:
title: Custom Configuration Parameters
global: True
multiline: True
syntax: yaml
helpLink: elastalert
forcedType: string
jira_api_key:
title: Jira API Key
global: True
sensitive: True
helpLink: elastalert
forcedType: string
jira_pass:
title: Jira Password
global: True
sensitive: True
helpLink: elastalert
forcedType: string
jira_user:
title: Jira Username
global: True
helpLink: elastalert
forcedType: string
smtp_pass:
title: SMTP Password
global: True
sensitive: True
helpLink: elastalert
forcedType: string
smtp_user:
title: SMTP Username
global: True
helpLink: elastalert
forcedType: string
files:
custom:
alertmanager_ca__crt:
global: True
file: True
helpLink: elastalert
gelf_ca__crt:
global: True
file: True
helpLink: elastalert
http_post_ca__crt:
global: True
file: True
helpLink: elastalert
http_post2_ca__crt:
global: True
file: True
helpLink: elastalert
ms_teams_ca__crt:
global: True
file: True
helpLink: elastalert
pagerduty_ca__crt:
global: True
file: True
helpLink: elastalert
rocket_chat_ca__crt:
global: True
file: True
helpLink: elastalert
smtp__crt:
global: True
file: True
helpLink: elastalert
smtp__key:
global: True
file: True
helpLink: elastalert
slack_ca__crt:
global: True
file: True
helpLink: elastalert
config:
scan_subdirectories:
forcedType: bool
advanced: True
global: True
helpLink: elastalert
disable_rules_on_error:
forcedType: bool
global: True
helpLink: elastalert
run_every:
minutes:
global: True
helpLink: elastalert
buffer_time:
minutes:
global: True
helpLink: elastalert
old_query_limit:
minutes:
global: True
helpLink: elastalert
es_conn_timeout:
global: True
helpLink: elastalert
max_query_size:
global: True
helpLink: elastalert
use_ssl:
forcedType: bool
advanced: True
global: True
helpLink: elastalert
verify_certs:
forcedType: bool
advanced: True
global: True
helpLink: elastalert
alert_time_limit:
days:
global: True
helpLink: elastalert
index_settings:
shards:
global: True
helpLink: elastalert
replicas:
global: True
helpLink: elastalert
logging:
incremental:
forcedType: bool
advanced: True
global: True
helpLink: elastalert
disable_existing_loggers:
forcedType: bool
advanced: True
global: True
helpLink: elastalert
loggers:
'':
propagate:
forcedType: bool
advanced: True
global: True
helpLink: elastalert

File: salt/elastalert/files/predefined/jira_auth.yaml Copy Chapter

{% if elastalert.get('jira_user', '') | length > 0 and elastalert.get('jira_pass', '') | length > 0 %}
user: {{ elastalert.jira_user }}
password: {{ elastalert.jira_pass }}
{% else %}
apikey: {{ elastalert.get('jira_api_key', '') }}
{% endif %}

File: salt/elastalert/files/predefined/smtp_auth.yaml Copy Chapter

user: {{ elastalert.get('smtp_user', '') }}
password: {{ elastalert.get('smtp_pass', '') }}

File: salt/elastic-fleet-package-registry/defaults.yaml Copy Chapter

elastic_fleet_package_registry:
enabled: False

File: salt/elastic-fleet-package-registry/soc_elastic-fleet-package-registry.yaml Copy Chapter

elastic_fleet_package_registry:
enabled:
forcedType: bool
advanced: True

File: salt/elasticagent/defaults.yaml Copy Chapter

elasticagent:
enabled: False

File: salt/elasticagent/soc_elasticagent.yaml Copy Chapter

elasticagent:
enabled:
forcedType: bool
advanced: True

File: salt/elasticfleet/defaults.yaml Copy Chapter

elasticfleet:
enabled: False
enable_manager_output: True
config:
server:
custom_fqdn: []
enable_auto_configuration: True
endpoints_enrollment: ''
es_token: ''
grid_enrollment: ''
defend_filters:
enable_auto_configuration: False
outputs:
logstash:
bulk_max_size: ''
worker: ''
queue_mem_events: ''
timeout: ''
loadbalance: False
compression_level: ''
subscription_integrations: False
auto_upgrade_integrations: False
logging:
zeek:
excluded:
- broker
- capture_loss
- cluster
- conn-summary
- console
- ecat_arp_info
- known_certs
- known_hosts
- known_services
- loaded_scripts
- ntp
- ocsp
- packet_filter
- reporter
- stats
- stderr
- stdout
packages:
- elastic_agent
- elasticsearch
- endpoint
- fleet_server
- filestream
- http_endpoint
- httpjson
- log
- osquery_manager
- redis
- system
- tcp
- udp
- windows
- winlog
optional_integrations:
sublime_platform:
enabled_nodes: []
api_key:
base_url: https://api.platform.sublimesecurity.com
poll_interval: 5m
limit: 100
kismet:
base_url: http://localhost:2501
poll_interval: 1m
api_key:
enabled_nodes: []

File: salt/elasticfleet/soc_elasticfleet.yaml Copy Chapter

elasticfleet:
enabled:
forcedType: bool
advanced: True
helpLink: elastic-fleet
enable_manager_output:
advanced: True
global: True
forcedType: bool
helpLink: elastic-fleet
files:
soc:
elastic-defend-disabled-filters__yaml:
title: Disabled Elastic Defend filters
syntax: yaml
file: True
global: True
helpLink: elastic-fleet
advanced: True
elastic-defend-custom-filters__yaml:
title: Custom Elastic Defend filters
syntax: yaml
file: True
global: True
helpLink: elastic-fleet
advanced: True
logging:
zeek:
excluded:
forcedType: "[]string"
helpLink: zeek
config:
defend_filters:
enable_auto_configuration:
forcedType: bool
global: True
helpLink: elastic-fleet
advanced: True
subscription_integrations:
global: True
forcedType: bool
helpLink: elastic-fleet
auto_upgrade_integrations:
global: True
forcedType: bool
helpLink: elastic-fleet
outputs:
logstash:
bulk_max_size:
global: True
forcedType: int
advanced: True
helpLink: elastic-fleet
worker:
global: True
forcedType: int
advanced: true
helpLink: elastic-fleet
queue_mem_events:
title: queued events
global: True
forcedType: int
advanced: True
helpLink: elastic-fleet
timeout:
regex: ^[0-9]+s$
advanced: True
global: True
helpLink: elastic-fleet
loadbalance:
forcedType: bool
advanced: True
global: True
helpLink: elastic-fleet
compression_level:
regex: ^[1-9]$
forcedType: int
advanced: True
global: True
helpLink: elastic-fleet
server:
custom_fqdn:
global: True
helpLink: elastic-fleet
advanced: True
forcedType: "[]string"
enable_auto_configuration:
forcedType: bool
global: True
helpLink: elastic-fleet
advanced: True
endpoints_enrollment:
global: True
helpLink: elastic-fleet
sensitive: True
advanced: True
es_token:
global: True
helpLink: elastic-fleet
sensitive: True
advanced: True
grid_enrollment:
global: True
helpLink: elastic-fleet
sensitive: True
advanced: True
optional_integrations:
sublime_platform:
enabled_nodes:
global: True
helpLink: elastic-fleet
advanced: True
forcedType: "[]string"
api_key:
global: True
helpLink: elastic-fleet
advanced: True
forcedType: string
sensitive: True
base_url:
global: True
helpLink: elastic-fleet
advanced: True
forcedType: string
poll_interval:
global: True
helpLink: elastic-fleet
advanced: True
forcedType: string
limit:
global: True
helpLink: elastic-fleet
advanced: True
forcedType: int
kismet:
base_url:
global: True
helpLink: elastic-fleet
advanced: True
forcedType: string
poll_interval:
global: True
helpLink: elastic-fleet
advanced: True
forcedType: string
api_key:
global: True
helpLink: elastic-fleet
advanced: True
forcedType: string
sensitive: True
enabled_nodes:
global: True
helpLink: elastic-fleet
advanced: True
forcedType: "[]string"

File: salt/elasticfleet/files/integrations/elastic-defend/elastic-defend-endpoints.json Copy Chapter

{
"name": "elastic-defend-endpoints",
"namespace": "default",
"description": "",
"package": {
"name": "endpoint",
"title": "Elastic Defend",
"version": "9.4.1",
"requires_root": true
},
"enabled": true,
"policy_ids": [
"endpoints-initial"
],
"vars": {},
"inputs": [
{
"type": "ENDPOINT_INTEGRATION_CONFIG",
"enabled": true,
"config": {
"_config": {
"value": {
"type": "endpoint",
"endpointConfig": {
"preset": "DataCollection"
}
}
}
},
"streams": []
}
]
}

File: salt/elasticfleet/files/integrations/endpoints-initial/osquery.json Copy Chapter

{
"package": {
"name": "osquery_manager",
"version": ""
},
"name": "osquery-endpoints",
"namespace": "default",
"policy_id": "endpoints-initial",
"inputs": {
"osquery_manager-osquery": {
"enabled": true,
"streams": {
"osquery_manager.result": {
"enabled": true,
"vars": {}
}
}
}
},
"force": true
}

File: salt/elasticfleet/files/integrations/endpoints-initial/system-endpoints.json Copy Chapter

{
"policy_id": "endpoints-initial",
"package": {
"name": "system",
"version": ""
},
"name": "system-endpoints",
"namespace": "default",
"inputs": {
"system-logfile": {
"enabled": true,
"streams": {
"system.auth": {
"enabled": true,
"vars": {
"ignore_older": "72h",
"paths": [
"/var/log/auth.log*",
"/var/log/secure*"
],
"preserve_original_event": false,
"tags": [
"system-auth"
]
}
},
"system.syslog": {
"enabled": true,
"vars": {
"paths": [
"/var/log/messages*",
"/var/log/syslog*",
"/var/log/system*"
],
"tags": [],
"ignore_older": "72h"
}
}
}
},
"system-winlog": {
"enabled": true,
"streams": {
"system.application": {
"enabled": true,
"vars": {
"preserve_original_event": false,
"ignore_older": "72h",
"language": 0,
"tags": []
}
},
"system.security": {
"enabled": true,
"vars": {
"preserve_original_event": false,
"ignore_older": "72h",
"language": 0,
"tags": []
}
},
"system.system": {
"enabled": true,
"vars": {
"preserve_original_event": false,
"ignore_older": "72h",
"language": 0,
"tags": []
}
}
}
},
"system-system/metrics": {
"enabled": false
}
},
"force": true
}

File: salt/elasticfleet/files/integrations/endpoints-initial/windows-defender.json Copy Chapter

{
"package": {
"name": "winlog",
"version": ""
},
"name": "windows-defender",
"namespace": "default",
"description": "Windows Defender - Operational logs",
"policy_id": "endpoints-initial",
"inputs": {
"winlogs-winlog": {
"enabled": true,
"streams": {
"winlog.winlogs": {
"enabled": true,
"vars": {
"channel": "Microsoft-Windows-Windows Defender/Operational",
"data_stream.dataset": "winlog.winlog",
"preserve_original_event": false,
"providers": [],
"ignore_older": "72h",
"language": 0,
"tags": [] }
}
}
}
},
"force": true
}

File: salt/elasticfleet/files/integrations/endpoints-initial/windows-endpoints.json Copy Chapter

{
"policy_id": "endpoints-initial",
"package": {
"name": "windows",
"version": ""
},
"name": "windows-endpoints",
"description": "",
"namespace": "default",
"inputs": {
"windows-winlog": {
"enabled": true,
"streams": {
"windows.forwarded": {
"enabled": true,
"vars": {
"tags": [
"forwarded"
],
"preserve_original_event": false
}
},
"windows.powershell": {
"enabled": true,
"vars": {
"tags": [],
"preserve_original_event": false
}
},
"windows.powershell_operational": {
"enabled": true,
"vars": {
"tags": [],
"preserve_original_event": false
}
},
"windows.sysmon_operational": {
"enabled": true,
"vars": {
"tags": [],
"preserve_original_event": false
}
}
}
},
"windows-windows/metrics": {
"enabled": false,
"streams": {
"windows.perfmon": {
"enabled": false,
"vars": {
"perfmon.group_measurements_by_instance": false,
"perfmon.ignore_non_existent_counters": false,
"perfmon.queries": "- object: 'Process'\n instance: ["*"]\n counters:\n - name: '% Processor Time'\n field: cpu_perc\n format: "float"\n - name: "Working Set"\n",
"period": "10s"
}
},
"windows.service": {
"enabled": false,
"vars": {
"period": "60s"
}
}
}
}
},
"force": true
}

File: salt/elasticfleet/files/integrations/grid-nodes_general/elastic-agent-monitor.json Copy Chapter

{
"package": {
"name": "filestream",
"version": ""
},
"name": "agent-monitor",
"namespace": "",
"description": "",
"policy_id": "so-grid-nodes_general",
"policy_ids": [
"so-grid-nodes_general"
],
"vars": {},
"inputs": {
"filestream-filestream": {
"enabled": true,
"streams": {
"filestream.filestream": {
"enabled": true,
"vars": {
"paths": [
"/opt/so/log/agents/agent-monitor.log"
],
"compression_gzip": false,
"use_logs_stream": false,
"data_stream.dataset": "agentmonitor",
"pipeline": "elasticagent.monitor",
"parsers": "",
"exclude_files": [
"\.gz$"
],
"include_files": [],
"processors": "- decode_json_fields:\n fields: ["message"]\n target: ""\n- add_fields:\n target: event\n fields:\n module: gridmetrics",
"tags": [],
"recursive_glob": true,
"ignore_older": "72h",
"clean_inactive": -1,
"harvester_limit": 0,
"fingerprint": false,
"fingerprint_offset": 0,
"file_identity_native": true,
"exclude_lines": [],
"include_lines": [],
"delete_enabled": false
}
}
}
}
},
"force": true
}

File: salt/elasticfleet/files/integrations/grid-nodes_general/elasticsearch-logs.json Copy Chapter

{
"package": {
"name": "elasticsearch",
"version": ""
},
"name": "elasticsearch-logs",
"namespace": "default",
"description": "Elasticsearch Logs",
"policy_id": "so-grid-nodes_general",
"inputs": {
"elasticsearch-logfile": {
"enabled": true,
"streams": {
"elasticsearch.audit": {
"enabled": false,
"vars": {
"paths": [
"/var/log/elasticsearch/_audit.json"
]
}
},
"elasticsearch.deprecation": {
"enabled": false,
"vars": {
"paths": [
"/var/log/elasticsearch/_deprecation.json"
]
}
},
"elasticsearch.gc": {
"enabled": false,
"vars": {
"paths": [
"/var/log/elasticsearch/gc.log.[0-9]",
"/var/log/elasticsearch/gc.log"
]
}
},
"elasticsearch.server": {
"enabled": true,
"vars": {
"paths": [
"/opt/so/log/elasticsearch/.json"
]
}
},
"elasticsearch.slowlog": {
"enabled": false,
"vars": {
"paths": [
"/var/log/elasticsearch/_index_search_slowlog.json",
"/var/log/elasticsearch/_index_indexing_slowlog.json"
]
}
}
}
},
"elasticsearch-elasticsearch/metrics": {
"enabled": false,
"vars": {
"hosts": [
"http://localhost:9200"
],
"scope": "node"
},
"streams": {
"elasticsearch.stack_monitoring.ccr": {
"enabled": false
},
"elasticsearch.stack_monitoring.cluster_stats": {
"enabled": false
},
"elasticsearch.stack_monitoring.enrich": {
"enabled": false
},
"elasticsearch.stack_monitoring.index": {
"enabled": false
},
"elasticsearch.stack_monitoring.index_recovery": {
"enabled": false,
"vars": {
"active.only": true
}
},
"elasticsearch.stack_monitoring.index_summary": {
"enabled": false
},
"elasticsearch.stack_monitoring.ml_job": {
"enabled": false
},
"elasticsearch.stack_monitoring.node": {
"enabled": false
},
"elasticsearch.stack_monitoring.node_stats": {
"enabled": false
},
"elasticsearch.stack_monitoring.pending_tasks": {
"enabled": false
},
"elasticsearch.stack_monitoring.shard": {
"enabled": false
}
}
}
},
"force": true
}

File: salt/elasticfleet/files/integrations/grid-nodes_general/hydra-logs.json Copy Chapter

{
"package": {
"name": "filestream",
"version": ""
},
"name": "hydra-logs",
"namespace": "so",
"description": "Hydra logs",
"policy_id": "so-grid-nodes_general",
"policy_ids": [
"so-grid-nodes_general"
],
"vars": {},
"inputs": {
"filestream-filestream": {
"enabled": true,
"streams": {
"filestream.filestream": {
"enabled": true,
"vars": {
"paths": [
"/opt/so/log/hydra/hydra.log"
],
"compression_gzip": false,
"use_logs_stream": false,
"data_stream.dataset": "hydra",
"pipeline": "hydra",
"parsers": "#- ndjson:\n# target: ""\n# message_key: msg\n#- multiline:\n# type: count\n# count_lines: 3\n",
"exclude_files": [
"\.gz$"
],
"include_files": [],
"processors": "- decode_json_fields:\n fields: ["message"]\n target: ""\n add_error_key: true\n- add_fields:\n target: event\n fields:\n category: iam\n module: hydra",
"tags": [
"so-hydra"
],
"recursive_glob": true,
"ignore_older": "72h",
"clean_inactive": -1,
"harvester_limit": 0,
"fingerprint": false,
"fingerprint_offset": 0,
"file_identity_native": true,
"exclude_lines": [],
"include_lines": [],
"delete_enabled": false
}
}
}
}
},
"force": true
}

File: salt/elasticfleet/files/integrations/grid-nodes_general/idh-logs.json Copy Chapter

{
"package": {
"name": "filestream",
"version": ""
},
"name": "idh-logs",
"namespace": "so",
"description": "IDH integration",
"policy_id": "so-grid-nodes_general",
"policy_ids": [
"so-grid-nodes_general"
],
"vars": {},
"inputs": {
"filestream-filestream": {
"enabled": true,
"streams": {
"filestream.filestream": {
"enabled": true,
"vars": {
"paths": [
"/nsm/idh/opencanary.log"
],
"compression_gzip": false,
"use_logs_stream": false,
"data_stream.dataset": "idh",
"pipeline": "common",
"parsers": "#- ndjson:\n# target: ""\n# message_key: msg\n#- multiline:\n# type: count\n# count_lines: 3\n",
"exclude_files": [
"\.gz$"
],
"include_files": [],
"processors": "\n- decode_json_fields:\n fields: ["message"]\n target: ""\n add_error_key: true\n- convert:\n fields:\n - {from: "logtype", to: "event.code", type: "string"}\n- drop_fields:\n when:\n equals:\n event.code: "1001"\n fields: ["src_host", "src_port", "dst_host", "dst_port" ]\n ignore_missing: true\n- rename:\n fields:\n - from: "src_host"\n to: "source.ip"\n - from: "src_port"\n to: "source.port"\n - from: "dst_host"\n to: "destination.host"\n - from: "dst_port"\n to: "destination.port"\n ignore_missing: true\n- drop_fields:\n fields: '["prospector", "input", "offset", "beat"]'\n- add_fields:\n target: event\n fields:\n category: host\n module: opencanary",
"tags": [],
"recursive_glob": true,
"clean_inactive": -1,
"harvester_limit": 0,
"fingerprint": false,
"fingerprint_offset": 0,
"file_identity_native": true,
"exclude_lines": [],
"include_lines": [],
"delete_enabled": false
}
}
}
}
},
"force": true
}

File: salt/elasticfleet/files/integrations/grid-nodes_general/import-evtx-logs.json Copy Chapter

{
"package": {
"name": "filestream",
"version": ""
},
"name": "import-evtx-logs",
"namespace": "so",
"description": "Import Windows EVTX logs",
"policy_id": "so-grid-nodes_general",
"policy_ids": [
"so-grid-nodes_general"
],
"vars": {},
"inputs": {
"filestream-filestream": {
"enabled": true,
"streams": {
"filestream.filestream": {
"enabled": true,
"vars": {
"paths": [
"/nsm/import//evtx/.json"
],
"compression_gzip": false,
"use_logs_stream": false,
"data_stream.dataset": "import",
"parsers": "#- ndjson:\n# target: ""\n# message_key: msg\n#- multiline:\n# type: count\n# count_lines: 3\n",
"exclude_files": [
"\.gz$"
],
"include_files": [],
"processors": "- dissect:\n tokenizer: "/nsm/import/%{import.id}/evtx/%{import.file}"\n field: "log.file.path"\n target_prefix: ""\n- decode_json_fields:\n fields: ["message"]\n target: ""\n- drop_fields:\n fields: ["host"]\n ignore_missing: true\n- add_fields:\n target: data_stream\n fields:\n type: logs\n dataset: system.security\n- add_fields:\n target: event\n fields:\n dataset: system.security\n module: system\n imported: true\n- add_fields:\n target: "@metadata"\n fields:\n pipeline: logs-system.security-2.22.3\n- if:\n equals:\n winlog.channel: 'Microsoft-Windows-Sysmon/Operational'\n then: \n - add_fields:\n target: data_stream\n fields:\n dataset: windows.sysmon_operational\n - add_fields:\n target: event\n fields:\n dataset: windows.sysmon_operational\n module: windows\n imported: true\n - add_fields:\n target: "@metadata"\n fields:\n pipeline: logs-windows.sysmon_operational-3.9.0\n- if:\n equals:\n winlog.channel: 'Application'\n then: \n - add_fields:\n target: data_stream\n fields:\n dataset: system.application\n - add_fields:\n target: event\n fields:\n dataset: system.application\n - add_fields:\n target: "@metadata"\n fields:\n pipeline: logs-system.application-2.22.3\n- if:\n equals:\n winlog.channel: 'System'\n then: \n - add_fields:\n target: data_stream\n fields:\n dataset: system.system\n - add_fields:\n target: event\n fields:\n dataset: system.system\n - add_fields:\n target: "@metadata"\n fields:\n pipeline: logs-system.system-2.22.3\n \n- if:\n equals:\n winlog.channel: 'Microsoft-Windows-PowerShell/Operational'\n then: \n - add_fields:\n target: data_stream\n fields:\n dataset: windows.powershell_operational\n - add_fields:\n target: event\n fields:\n dataset: windows.powershell_operational\n module: windows\n - add_fields:\n target: "@metadata"\n fields:\n pipeline: logs-windows.powershell_operational-3.9.0\n- add_fields:\n target: data_stream\n fields:\n dataset: import",
"tags": [
"import"
],
"recursive_glob": true,
"ignore_older": "72h",
"clean_inactive": -1,
"harvester_limit": 0,
"fingerprint": false,
"fingerprint_offset": 0,
"file_identity_native": true,
"exclude_lines": [],
"include_lines": [],
"delete_enabled": false
}
}
}
}
},
"force": true
}

File: salt/elasticfleet/files/integrations/grid-nodes_general/import-suricata-logs.json Copy Chapter

{
"package": {
"name": "filestream",
"version": ""
},
"name": "import-suricata-logs",
"namespace": "so",
"description": "Import Suricata logs",
"policy_id": "so-grid-nodes_general",
"policy_ids": [
"so-grid-nodes_general"
],
"vars": {},
"inputs": {
"filestream-filestream": {
"enabled": true,
"streams": {
"filestream.filestream": {
"enabled": true,
"vars": {
"paths": [
"/nsm/import//suricata/eve.json"
],
"compression_gzip": false,
"use_logs_stream": false,
"data_stream.dataset": "import",
"pipeline": "suricata.common",
"parsers": "#- ndjson:\n# target: ""\n# message_key: msg\n#- multiline:\n# type: count\n# count_lines: 3\n",
"exclude_files": [
"\.gz$"
],
"include_files": [],
"processors": "- add_fields:\n target: event\n fields:\n category: network\n module: suricata\n imported: true\n- dissect:\n tokenizer: "/nsm/import/%{import.id}/suricata/%{import.file}"\n field: "log.file.path"\n target_prefix: ""\n",
"tags": [],
"recursive_glob": true,
"ignore_older": "72h",
"clean_inactive": -1,
"harvester_limit": 0,
"fingerprint": false,
"fingerprint_offset": 0,
"file_identity_native": true,
"exclude_lines": [],
"include_lines": [],
"delete_enabled": false
}
}
}
}
},
"force": true
}

File: salt/elasticfleet/files/integrations/grid-nodes_general/osquery-grid-nodes.json Copy Chapter

{
"package": {
"name": "osquery_manager",
"version": ""
},
"name": "osquery-grid-nodes",
"namespace": "default",
"policy_id": "so-grid-nodes_general",
"inputs": {
"osquery_manager-osquery": {
"enabled": true,
"streams": {
"osquery_manager.result": {
"enabled": true,
"vars": {}
}
}
}
},
"force": true
}

File: salt/elasticfleet/files/integrations/grid-nodes_general/redis-logs.json Copy Chapter

{
"package": {
"name": "redis",
"version": ""
},
"name": "redis-logs",
"namespace": "default",
"description": "Redis logs",
"policy_id": "so-grid-nodes_general",
"inputs": {
"redis-logfile": {
"enabled": true,
"streams": {
"redis.log": {
"enabled": true,
"vars": {
"paths": [
"/opt/so/log/redis/redis-server.log"
],
"tags": [
"redis-log"
],
"preserve_original_event": false
}
}
}
},
"redis-redis": {
"enabled": false,
"streams": {
"redis.slowlog": {
"enabled": false,
"vars": {
"hosts": [
"127.0.0.1:6379"
],
"password": ""
}
}
}
},
"redis-redis/metrics": {
"enabled": false,
"vars": {
"hosts": [
"127.0.0.1:6379"
],
"idle_timeout": "20s",
"maxconn": 10,
"network": "tcp",
"password": ""
},
"streams": {
"redis.info": {
"enabled": false,
"vars": {
"period": "10s"
}
},
"redis.key": {
"enabled": false,
"vars": {
"key.patterns": "- limit: 20\n pattern: *\n",
"period": "10s"
}
},
"redis.keyspace": {
"enabled": false,
"vars": {
"period": "10s"
}
}
}
}
},
"force": true
}

File: salt/elasticfleet/files/integrations/grid-nodes_general/rita-logs.json Copy Chapter

{
"package": {
"name": "filestream",
"version": ""
},
"name": "rita-logs",
"namespace": "so",
"description": "RITA Logs",
"policy_id": "so-grid-nodes_general",
"policy_ids": [
"so-grid-nodes_general"
],
"vars": {},
"inputs": {
"filestream-filestream": {
"enabled": true,
"streams": {
"filestream.filestream": {
"enabled": true,
"vars": {
"paths": [
"/nsm/rita/beacons.csv",
"/nsm/rita/exploded-dns.csv",
"/nsm/rita/long-connections.csv"
],
"compression_gzip": false,
"use_logs_stream": false,
"data_stream.dataset": "rita",
"parsers": "#- ndjson:\n# target: ""\n# message_key: msg\n#- multiline:\n# type: count\n# count_lines: 3\n",
"exclude_files": [
"\.gz$"
],
"include_files": [],
"processors": "- dissect:\n tokenizer: "/nsm/rita/%{pipeline}.csv"\n field: "log.file.path"\n trim_chars: ".csv"\n target_prefix: ""\n- script:\n lang: javascript\n source: >\n function process(event) {\n var pl = event.Get("pipeline").split("-");\n if (pl.length > 1) {\n pl = pl[1];\n }\n else {\n pl = pl[0];\n }\n event.Put("@metadata.pipeline", "rita." + pl);\n }\n- add_fields:\n target: event\n fields:\n category: network\n module: rita",
"tags": [],
"recursive_glob": true,
"ignore_older": "72h",
"clean_inactive": -1,
"harvester_limit": 0,
"fingerprint": false,
"fingerprint_offset": 0,
"file_identity_native": true,
"exclude_lines": [],
"include_lines": [],
"delete_enabled": false
}
}
}
}
},
"force": true
}

File: salt/elasticfleet/files/integrations/grid-nodes_general/so-ip-mappings.json Copy Chapter

{
"package": {
"name": "filestream",
"version": ""
},
"name": "so-ip-mappings",
"namespace": "so",
"description": "IP Description mappings",
"policy_id": "so-grid-nodes_general",
"policy_ids": [
"so-grid-nodes_general"
],
"vars": {},
"inputs": {
"filestream-filestream": {
"enabled": true,
"streams": {
"filestream.filestream": {
"enabled": true,
"vars": {
"paths": [
"/nsm/custom-mappings/ip-descriptions.csv"
],
"compression_gzip": false,
"use_logs_stream": false,
"data_stream.dataset": "hostnamemappings",
"parsers": "#- ndjson:\n# target: ""\n# message_key: msg\n#- multiline:\n# type: count\n# count_lines: 3\n",
"exclude_files": [
"\.gz$"
],
"include_files": [],
"processors": "- decode_csv_fields:\n fields:\n message: decoded.csv\n separator: ","\n ignore_missing: false\n overwrite_keys: true\n trim_leading_space: true\n fail_on_error: true\n\n- extract_array:\n field: decoded.csv\n mappings:\n so.ip_address: '0'\n so.description: '1'\n\n- script:\n lang: javascript\n source: >\n function process(event) {\n var ip = event.Get('so.ip_address');\n var validIpRegex = /^((25[0-5]|2[0-4]\d|1\d{2}|[1-9]?\d)\.){3}(25[0-5]|2[0-4]\d|1\d{2}|[1-9]?\d)$/\n if (!validIpRegex.test(ip)) {\n event.Cancel();\n }\n }\n- fingerprint:\n fields: ["so.ip_address"]\n target_field: "@metadata._id"\n",
"tags": [
"so-ip-mappings"
],
"recursive_glob": true,
"clean_inactive": -1,
"harvester_limit": 0,
"fingerprint": false,
"fingerprint_offset": 0,
"file_identity_native": true,
"exclude_lines": [],
"include_lines": [],
"delete_enabled": false
}
}
}
}
},
"force": true
}

File: salt/elasticfleet/files/integrations/grid-nodes_general/soc-auth-sync-logs.json Copy Chapter

{
"package": {
"name": "filestream",
"version": ""
},
"name": "soc-auth-sync-logs",
"namespace": "so",
"description": "Security Onion - Elastic Auth Sync - Logs",
"policy_id": "so-grid-nodes_general",
"policy_ids": [
"so-grid-nodes_general"
],
"vars": {},
"inputs": {
"filestream-filestream": {
"enabled": true,
"streams": {
"filestream.filestream": {
"enabled": true,
"vars": {
"paths": [
"/opt/so/log/soc/sync.log"
],
"compression_gzip": false,
"use_logs_stream": false,
"data_stream.dataset": "soc",
"pipeline": "common",
"parsers": "#- ndjson:\n# target: ""\n# message_key: msg\n#- multiline:\n# type: count\n# count_lines: 3\n",
"exclude_files": [
"\.gz$"
],
"include_files": [],
"processors": "- dissect:\n tokenizer: "%{event.action}"\n field: "message"\n target_prefix: ""\n- add_fields:\n target: event\n fields:\n category: host\n module: soc\n dataset_temp: auth_sync",
"tags": [],
"recursive_glob": true,
"clean_inactive": -1,
"harvester_limit": 0,
"fingerprint": false,
"fingerprint_offset": 0,
"file_identity_native": true,
"exclude_lines": [],
"include_lines": [],
"delete_enabled": false
}
}
}
}
},
"force": true
}

File: salt/elasticfleet/files/integrations/grid-nodes_general/soc-detections-logs.json Copy Chapter

{
"package": {
"name": "filestream",
"version": ""
},
"name": "soc-detections-logs",
"namespace": "so",
"description": "Security Onion Console - Detections Logs",
"policy_id": "so-grid-nodes_general",
"policy_ids": [
"so-grid-nodes_general"
],
"vars": {},
"inputs": {
"filestream-filestream": {
"enabled": true,
"streams": {
"filestream.filestream": {
"enabled": true,
"vars": {
"paths": [
"/opt/so/log/soc/detections_runtime-status_sigma.log",
"/opt/so/log/soc/detections_runtime-status_yara.log"
],
"compression_gzip": false,
"use_logs_stream": false,
"data_stream.dataset": "soc",
"pipeline": "common",
"parsers": "#- ndjson:\n# target: ""\n# message_key: msg\n#- multiline:\n# type: count\n# count_lines: 3\n",
"exclude_files": [
"\.gz$"
],
"include_files": [],
"processors": "- decode_json_fields:\n fields: ["message"]\n target: "soc"\n process_array: true\n max_depth: 2\n add_error_key: true \n- add_fields:\n target: event\n fields:\n category: host\n module: soc\n dataset_temp: detections\n- rename:\n fields:\n - from: "soc.fields.sourceIp"\n to: "source.ip"\n - from: "soc.fields.status"\n to: "http.response.status_code"\n - from: "soc.fields.method"\n to: "http.request.method"\n - from: "soc.fields.path"\n to: "url.path"\n - from: "soc.message"\n to: "event.action"\n - from: "soc.level"\n to: "log.level"\n ignore_missing: true",
"tags": [
"so-soc"
],
"recursive_glob": true,
"ignore_older": "72h",
"clean_inactive": -1,
"harvester_limit": 0,
"fingerprint": false,
"fingerprint_offset": 0,
"file_identity_native": true,
"exclude_lines": [],
"include_lines": [],
"delete_enabled": false
}
}
}
}
},
"force": true
}

File: salt/elasticfleet/files/integrations/grid-nodes_general/soc-salt-relay-logs.json Copy Chapter

{
"package": {
"name": "filestream",
"version": ""
},
"name": "soc-salt-relay-logs",
"namespace": "so",
"description": "Security Onion - Salt Relay - Logs",
"policy_id": "so-grid-nodes_general",
"policy_ids": [
"so-grid-nodes_general"
],
"vars": {},
"inputs": {
"filestream-filestream": {
"enabled": true,
"streams": {
"filestream.filestream": {
"enabled": true,
"vars": {
"paths": [
"/opt/so/log/soc/salt-relay.log"
],
"compression_gzip": false,
"use_logs_stream": false,
"data_stream.dataset": "soc",
"pipeline": "common",
"parsers": "#- ndjson:\n# target: ""\n# message_key: msg\n#- multiline:\n# type: count\n# count_lines: 3\n",
"exclude_files": [
"\.gz$"
],
"include_files": [],
"processors": "- dissect:\n tokenizer: "%{soc.ts} | %{event.action}"\n field: "message"\n target_prefix: ""\n- add_fields:\n target: event\n fields:\n category: host\n module: soc\n dataset_temp: salt_relay",
"tags": [
"so-soc"
],
"recursive_glob": true,
"clean_inactive": -1,
"harvester_limit": 0,
"fingerprint": false,
"fingerprint_offset": 0,
"file_identity_native": true,
"exclude_lines": [],
"include_lines": [],
"delete_enabled": false
}
}
}
}
},
"force": true
}

File: salt/elasticfleet/files/integrations/grid-nodes_general/soc-sensoroni-logs.json Copy Chapter

{
"package": {
"name": "filestream",
"version": ""
},
"name": "soc-sensoroni-logs",
"namespace": "so",
"description": "Security Onion - Sensoroni - Logs",
"policy_id": "so-grid-nodes_general",
"policy_ids": [
"so-grid-nodes_general"
],
"vars": {},
"inputs": {
"filestream-filestream": {
"enabled": true,
"streams": {
"filestream.filestream": {
"enabled": true,
"vars": {
"paths": [
"/opt/so/log/sensoroni/sensoroni.log"
],
"compression_gzip": false,
"use_logs_stream": false,
"data_stream.dataset": "soc",
"pipeline": "common",
"parsers": "#- ndjson:\n# target: ""\n# message_key: msg\n#- multiline:\n# type: count\n# count_lines: 3\n",
"exclude_files": [
"\.gz$"
],
"include_files": [],
"processors": "- decode_json_fields:\n fields: ["message"]\n target: "sensoroni"\n process_array: true\n max_depth: 2\n add_error_key: true \n- add_fields:\n target: event\n fields:\n category: host\n module: soc\n dataset_temp: sensoroni\n- rename:\n fields:\n - from: "sensoroni.fields.sourceIp"\n to: "source.ip"\n - from: "sensoroni.fields.status"\n to: "http.response.status_code"\n - from: "sensoroni.fields.method"\n to: "http.request.method"\n - from: "sensoroni.fields.path"\n to: "url.path"\n - from: "sensoroni.message"\n to: "event.action"\n - from: "sensoroni.level"\n to: "log.level"\n ignore_missing: true",
"tags": [],
"recursive_glob": true,
"clean_inactive": -1,
"harvester_limit": 0,
"fingerprint": false,
"fingerprint_offset": 0,
"file_identity_native": true,
"exclude_lines": [],
"include_lines": [],
"delete_enabled": false
}
}
}
}
},
"force": true
}

File: salt/elasticfleet/files/integrations/grid-nodes_general/soc-server-logs.json Copy Chapter

{
"package": {
"name": "filestream",
"version": ""
},
"name": "soc-server-logs",
"namespace": "so",
"description": "Security Onion Console Logs",
"policy_id": "so-grid-nodes_general",
"policy_ids": [
"so-grid-nodes_general"
],
"vars": {},
"inputs": {
"filestream-filestream": {
"enabled": true,
"streams": {
"filestream.filestream": {
"enabled": true,
"vars": {
"paths": [
"/opt/so/log/soc/sensoroni-server.log"
],
"compression_gzip": false,
"use_logs_stream": false,
"data_stream.dataset": "soc",
"pipeline": "common",
"parsers": "#- ndjson:\n# target: ""\n# message_key: msg\n#- multiline:\n# type: count\n# count_lines: 3\n",
"exclude_files": [
"\.gz$"
],
"include_files": [],
"processors": "- decode_json_fields:\n fields: ["message"]\n target: "soc"\n process_array: true\n max_depth: 2\n add_error_key: true \n- add_fields:\n target: event\n fields:\n category: host\n module: soc\n dataset_temp: server\n- rename:\n fields:\n - from: "soc.fields.sourceIp"\n to: "source.ip"\n - from: "soc.fields.status"\n to: "http.response.status_code"\n - from: "soc.fields.method"\n to: "http.request.method"\n - from: "soc.fields.path"\n to: "url.path"\n - from: "soc.message"\n to: "event.action"\n - from: "soc.level"\n to: "log.level"\n ignore_missing: true",
"tags": [
"so-soc"
],
"recursive_glob": true,
"clean_inactive": -1,
"harvester_limit": 0,
"fingerprint": false,
"fingerprint_offset": 0,
"file_identity_native": true,
"exclude_lines": [],
"include_lines": [],
"delete_enabled": false
}
}
}
}
},
"force": true
}

File: salt/elasticfleet/files/integrations/grid-nodes_general/strelka-logs.json Copy Chapter

{
"package": {
"name": "filestream",
"version": ""
},
"name": "strelka-logs",
"namespace": "so",
"description": "Strelka Logs",
"policy_id": "so-grid-nodes_general",
"policy_ids": [
"so-grid-nodes_general"
],
"vars": {},
"inputs": {
"filestream-filestream": {
"enabled": true,
"streams": {
"filestream.filestream": {
"enabled": true,
"vars": {
"paths": [
"/nsm/strelka/log/strelka.log"
],
"compression_gzip": false,
"use_logs_stream": false,
"data_stream.dataset": "strelka",
"pipeline": "strelka.file",
"parsers": "#- ndjson:\n# target: ""\n# message_key: msg\n#- multiline:\n# type: count\n# count_lines: 3\n",
"exclude_files": [
"\.gz$"
],
"include_files": [],
"processors": "- add_fields:\n target: event\n fields:\n category: file\n module: strelka",
"tags": [],
"recursive_glob": true,
"clean_inactive": -1,
"harvester_limit": 0,
"fingerprint": false,
"fingerprint_offset": 0,
"file_identity_native": true,
"exclude_lines": [],
"include_lines": [],
"delete_enabled": false
}
}
}
}
},
"force": true
}

File: salt/elasticfleet/files/integrations/grid-nodes_general/suricata-logs.json Copy Chapter

{
"package": {
"name": "filestream",
"version": ""
},
"name": "suricata-logs",
"namespace": "so",
"description": "Suricata integration",
"policy_id": "so-grid-nodes_general",
"policy_ids": [
"so-grid-nodes_general"
],
"vars": {},
"inputs": {
"filestream-filestream": {
"enabled": true,
"streams": {
"filestream.filestream": {
"enabled": true,
"vars": {
"paths": [
"/nsm/suricata/eve*.json"
],
"compression_gzip": false,
"use_logs_stream": false,
"data_stream.dataset": "suricata",
"pipeline": "suricata.common",
"parsers": "#- ndjson:\n# target: ""\n# message_key: msg\n#- multiline:\n# type: count\n# count_lines: 3\n",
"exclude_files": [
"\.gz$"
],
"include_files": [],
"processors": "- add_fields:\n target: event\n fields:\n category: network\n module: suricata",
"tags": [],
"recursive_glob": true,
"clean_inactive": -1,
"harvester_limit": 0,
"fingerprint": false,
"fingerprint_offset": 0,
"file_identity_native": true,
"exclude_lines": [],
"include_lines": [],
"delete_enabled": false
}
}
}
}
},
"force": true
}

File: salt/elasticfleet/files/integrations/grid-nodes_general/syslog-tcp-514.json Copy Chapter

{
"package": {
"name": "tcp",
"version": ""
},
"name": "syslog-tcp-514",
"namespace": "so",
"description": "Syslog Over TCP Port 514",
"policy_id": "so-grid-nodes_general",
"inputs": {
"tcp-tcp": {
"enabled": true,
"streams": {
"tcp.tcp": {
"enabled": true,
"vars": {
"listen_address": "0.0.0.0",
"listen_port": "514",
"data_stream.dataset": "syslog",
"pipeline": "syslog",
"processors": "- add_fields:\n target: event\n fields:\n module: syslog",
"tags": [
"syslog"
],
"syslog_options": "field: message\n#format: auto\n#timezone: Local",
"ssl": "",
"custom": ""
}
}
}
}
},
"force": true
}

File: salt/elasticfleet/files/integrations/grid-nodes_general/syslog-udp-514.json Copy Chapter

{
"package": {
"name": "udp",
"version": ""
},
"name": "syslog-udp-514",
"namespace": "so",
"description": "Syslog over UDP Port 514",
"policy_id": "so-grid-nodes_general",
"inputs": {
"udp-udp": {
"enabled": true,
"streams": {
"udp.udp": {
"enabled": true,
"vars": {
"listen_address": "0.0.0.0",
"listen_port": "514",
"data_stream.dataset": "syslog",
"pipeline": "syslog",
"max_message_size": "10KiB",
"keep_null": false,
"processors": "- add_fields:\n target: event\n fields: \n module: syslog",
"tags": [
"syslog"
],
"syslog_options": "field: message\n#format: auto\n#timezone: Local\n",
"preserve_original_event": false,
"custom": ""
}
}
}
}
},
"force": true
}

File: salt/elasticfleet/files/integrations/grid-nodes_general/system-grid-nodes.json Copy Chapter

{
"policy_id": "so-grid-nodes_general",
"package": {
"name": "system",
"version": ""
},
"name": "system-grid-nodes",
"namespace": "default",
"inputs": {
"system-logfile": {
"enabled": true,
"streams": {
"system.auth": {
"enabled": true,
"vars": {
"paths": [
"/var/log/auth.log*",
"/var/log/secure*"
],
"tags": [
"so-grid-node"
]
}
},
"system.syslog": {
"enabled": true,
"vars": {
"paths": [
"/var/log/messages*",
"/var/log/syslog*"
],
"tags": [
"so-grid-node"
],
"processors": "- if:\n contains:\n message: "salt-minion"\n then: \n - dissect:\n tokenizer: "%{} %{} %{} %{} %{} %{}: [%{log.level}] %{*}"\n field: "message"\n trim_values: "all"\n target_prefix: ""\n - drop_event:\n when:\n equals:\n log.level: "INFO""
}
}
}
},
"system-winlog": {
"enabled": false
},
"system-system/metrics": {
"enabled": false
}
},
"force": true
}

File: salt/elasticfleet/files/integrations/grid-nodes_heavy/elasticsearch-grid-nodes.json Copy Chapter

{
"package": {
"name": "elasticsearch",
"version": ""
},
"name": "elasticsearch-grid-nodes_heavy",
"namespace": "default",
"description": "Elasticsearch Logs",
"policy_id": "so-grid-nodes_heavy",
"inputs": {
"elasticsearch-logfile": {
"enabled": true,
"streams": {
"elasticsearch.audit": {
"enabled": false,
"vars": {
"paths": [
"/var/log/elasticsearch/_audit.json"
]
}
},
"elasticsearch.deprecation": {
"enabled": false,
"vars": {
"paths": [
"/var/log/elasticsearch/_deprecation.json"
]
}
},
"elasticsearch.gc": {
"enabled": false,
"vars": {
"paths": [
"/var/log/elasticsearch/gc.log.[0-9]",
"/var/log/elasticsearch/gc.log"
]
}
},
"elasticsearch.server": {
"enabled": true,
"vars": {
"paths": [
"/opt/so/log/elasticsearch/.json"
]
}
},
"elasticsearch.slowlog": {
"enabled": false,
"vars": {
"paths": [
"/var/log/elasticsearch/_index_search_slowlog.json",
"/var/log/elasticsearch/_index_indexing_slowlog.json"
]
}
}
}
},
"elasticsearch-elasticsearch/metrics": {
"enabled": false,
"vars": {
"hosts": [
"http://localhost:9200"
],
"scope": "node"
},
"streams": {
"elasticsearch.stack_monitoring.ccr": {
"enabled": false
},
"elasticsearch.stack_monitoring.cluster_stats": {
"enabled": false
},
"elasticsearch.stack_monitoring.enrich": {
"enabled": false
},
"elasticsearch.stack_monitoring.index": {
"enabled": false
},
"elasticsearch.stack_monitoring.index_recovery": {
"enabled": false,
"vars": {
"active.only": true
}
},
"elasticsearch.stack_monitoring.index_summary": {
"enabled": false
},
"elasticsearch.stack_monitoring.ml_job": {
"enabled": false
},
"elasticsearch.stack_monitoring.node": {
"enabled": false
},
"elasticsearch.stack_monitoring.node_stats": {
"enabled": false
},
"elasticsearch.stack_monitoring.pending_tasks": {
"enabled": false
},
"elasticsearch.stack_monitoring.shard": {
"enabled": false
}
}
}
},
"force": true
}

File: salt/elasticfleet/files/integrations/grid-nodes_heavy/osquery-grid-nodes.json Copy Chapter

{
"package": {
"name": "osquery_manager",
"version": ""
},
"name": "osquery-grid-nodes_heavy",
"namespace": "default",
"policy_id": "so-grid-nodes_heavy",
"inputs": {
"osquery_manager-osquery": {
"enabled": true,
"streams": {
"osquery_manager.result": {
"enabled": true,
"vars": {}
}
}
}
},
"force": true
}

File: salt/elasticfleet/files/integrations/grid-nodes_heavy/system-grid-nodes.json Copy Chapter

{
"policy_id": "so-grid-nodes_heavy",
"package": {
"name": "system",
"version": ""
},
"name": "system-grid-nodes_heavy",
"namespace": "default",
"inputs": {
"system-logfile": {
"enabled": true,
"streams": {
"system.auth": {
"enabled": true,
"vars": {
"paths": [
"/var/log/auth.log*",
"/var/log/secure*"
],
"tags": [
"so-grid-node"
]
}
},
"system.syslog": {
"enabled": true,
"vars": {
"paths": [
"/var/log/messages*",
"/var/log/syslog*"
],
"tags": [
"so-grid-node"
]
}
}
}
},
"system-winlog": {
"enabled": false
},
"system-system/metrics": {
"enabled": false
}
},
"force": true
}

File: salt/elasticfleet/files/integrations-dynamic/fleet-server/fleet-server.json Copy Chapter

{
"package": {
"name": "fleet_server",
"version": ""
},
"name": "fleet_server-1",
"namespace": "default",
"policy_id": "FleetServer_hostname",
"vars": {},
"inputs": {
"fleet_server-fleet-server": {
"enabled": true,
"vars": {
"custom": "server.ssl.supported_protocols: ["TLSv1.2", "TLSv1.3"]\nserver.ssl.cipher_suites: [ "ECDHE-RSA-AES-128-GCM-SHA256", "ECDHE-RSA-AES-256-GCM-SHA384", "ECDHE-RSA-AES-128-CBC-SHA", "ECDHE-RSA-AES-256-CBC-SHA", "RSA-AES-128-GCM-SHA256", "RSA-AES-256-GCM-SHA384"]"
},
"streams": {}
}
}
}

File: salt/elasticfleet/files/integrations-dynamic/grid-nodes_general/import-zeek-logs.json Copy Chapter

{% from 'elasticfleet/map.jinja' import ELASTICFLEETMERGED %}
{%- raw -%}
{
"package": {
"name": "filestream",
"version": ""
},
"name": "import-zeek-logs",
"namespace": "so",
"description": "Zeek Import logs",
"policy_id": "so-grid-nodes_general",
"policy_ids": [
"so-grid-nodes_general"
],
"vars": {},
"inputs": {
"filestream-filestream": {
"enabled": true,
"streams": {
"filestream.filestream": {
"enabled": true,
"vars": {
"paths": [
"/nsm/import//zeek/logs/.log"
],
"compression_gzip": false,
"use_logs_stream": false,
"data_stream.dataset": "import",
"pipeline": "",
"parsers": "#- ndjson:\n# target: ""\n# message_key: msg\n#- multiline:\n# type: count\n# count_lines: 3\n",
"exclude_files": ["({%- endraw -%}{{ ELASTICFLEETMERGED.logging.zeek.excluded | join('|') }}{%- raw -%})(\..+)?\.log$"],
"include_files": [],
"processors": "- dissect:\n tokenizer: "/nsm/import/%{import.id}/zeek/logs/%{import.file}"\n field: "log.file.path"\n target_prefix: ""\n- script:\n lang: javascript\n source: >\n function process(event) {\n var pl = event.Get("import.file").slice(0,-4);\n event.Put("@metadata.pipeline", "zeek." + pl);\n }\n- add_fields:\n target: event\n fields:\n category: network\n module: zeek\n imported: true\n- add_tags:\n tags: "ics"\n when:\n regexp:\n import.file: "^bacnet*|^bsap*|^cip*|^cotp*|^dnp3*|^ecat*|^enip*|^modbus*|^opcua*|^profinet*|^s7comm*"",
"tags": [],
"recursive_glob": true,
"clean_inactive": -1,
"harvester_limit": 0,
"fingerprint": false,
"fingerprint_offset": 0,
"fingerprint_length": "64",
"file_identity_native": true,
"exclude_lines": [],
"include_lines": [],
"delete_enabled": false
}
}
}
}
},
"force": true
}
{%- endraw -%}

File: salt/elasticfleet/files/integrations-dynamic/grid-nodes_general/kratos-logs.json Copy Chapter

{%- set identities = salt'sqlite3.fetch' -%}
{%- set valid_identities = false -%}
{%- if identities -%}
{%- set valid_identities = true -%}
{%- for id, email in identities -%}
{%- if not id or not email -%}
{%- set valid_identities = false -%}
{%- break -%}
{%- endif -%}
{%- endfor -%}
{%- endif -%}
{
"package": {
"name": "filestream",
"version": ""
},
"name": "kratos-logs",
"namespace": "so",
"description": "Kratos logs",
"policy_id": "so-grid-nodes_general",
"policy_ids": [
"so-grid-nodes_general"
],
"vars": {},
"inputs": {
"filestream-filestream": {
"enabled": true,
"streams": {
"filestream.filestream": {
"enabled": true,
"vars": {
"paths": [
"/opt/so/log/kratos/kratos.log"
],
"compression_gzip": false,
"use_logs_stream": false,
"data_stream.dataset": "kratos",
"pipeline": "kratos",
"parsers": "#- ndjson:\n# target: ""\n# message_key: msg\n#- multiline:\n# type: count\n# count_lines: 3\n",
"exclude_files": [
"\.gz$"
],
"include_files": [],
{%- if valid_identities -%}
"processors": "- decode_json_fields:\n fields: ["message"]\n target: ""\n add_error_key: true\n- add_fields:\n target: event\n fields:\n category: iam\n module: kratos\n- if:\n has_fields:\n - identity_id\n then:{% for id, email in identities %}\n - if:\n equals:\n identity_id: "{{ id }}"\n then:\n - add_fields:\n target: ''\n fields:\n user.name: "{{ email }}"{% endfor %}",
{%- else -%}
"processors": "- decode_json_fields:\n fields: ["message"]\n target: ""\n add_error_key: true\n- add_fields:\n target: event\n fields:\n category: iam\n module: kratos",
{%- endif -%}
"tags": [
"so-kratos"
],
"recursive_glob": true,
"clean_inactive": -1,
"harvester_limit": 0,
"fingerprint": false,
"fingerprint_offset": 0,
"file_identity_native": true,
"exclude_lines": [],
"include_lines": [],
"delete_enabled": false
}
}
}
}
},
"force": true
}

File: salt/elasticfleet/files/integrations-dynamic/grid-nodes_general/zeek-logs.json Copy Chapter

{% from 'elasticfleet/map.jinja' import ELASTICFLEETMERGED %}
{%- raw -%}
{
"package": {
"name": "filestream",
"version": ""
},
"name": "zeek-logs",
"namespace": "so",
"description": "Zeek logs",
"policy_id": "so-grid-nodes_general",
"policy_ids": [
"so-grid-nodes_general"
],
"vars": {},
"inputs": {
"filestream-filestream": {
"enabled": true,
"streams": {
"filestream.filestream": {
"enabled": true,
"vars": {
"paths": [
"/nsm/zeek/logs/current/.log"
],
"compression_gzip": false,
"use_logs_stream": false,
"data_stream.dataset": "zeek",
"parsers": "#- ndjson:\n# target: ""\n# message_key: msg\n#- multiline:\n# type: count\n# count_lines: 3\n",
"exclude_files": ["({%- endraw -%}{{ ELASTICFLEETMERGED.logging.zeek.excluded | join('|') }}{%- raw -%})(\..+)?\.log$"],
"include_files": [],
"processors": "- dissect:\n tokenizer: "/nsm/zeek/logs/current/%{pipeline}.log"\n field: "log.file.path"\n trim_chars: ".log"\n target_prefix: ""\n- script:\n lang: javascript\n source: >\n function process(event) {\n var pl = event.Get("pipeline");\n event.Put("@metadata.pipeline", "zeek." + pl);\n }\n- add_fields:\n target: event\n fields:\n category: network\n module: zeek\n- add_tags:\n tags: "ics"\n when:\n regexp:\n pipeline: "^bacnet|^bsap*|^cip*|^cotp*|^dnp3*|^ecat*|^enip*|^modbus*|^opcua*|^profinet*|^s7comm*"",
"tags": [],
"recursive_glob": true,
"clean_inactive": -1,
"harvester_limit": 0,
"fingerprint": false,
"fingerprint_offset": 0,
"file_identity_native": true,
"exclude_lines": [],
"include_lines": [],
"delete_enabled": false
}
}
}
}
},
"force": true
}
{%- endraw -%}

File: salt/elasticfleet/files/integrations-optional/kismet.json Copy Chapter

{% from 'elasticfleet/map.jinja' import ELASTICFLEETMERGED %}
{% raw %}
{
"package": {
"name": "httpjson",
"version": ""
},
"name": "kismet-logs",
"namespace": "so",
"description": "Kismet Logs",
"policy_id": "FleetServer_{% endraw %}{{ NAME }}{% raw %}",
"inputs": {
"generic-httpjson": {
"enabled": true,
"streams": {
"httpjson.generic": {
"enabled": true,
"vars": {
"data_stream.dataset": "kismet",
"request_url": "{% endraw %}{{ ELASTICFLEETMERGED.optional_integrations.kismet.base_url }}{% raw %}/devices/last-time/-600/devices.tjson",
"request_interval": "{% endraw %}{{ ELASTICFLEETMERGED.optional_integrations.kismet.poll_interval }}{% raw %}",
"request_method": "GET",
"request_transforms": "- set:\r\n target: header.Cookie\r\n value: 'KISMET={% endraw %}{{ ELASTICFLEETMERGED.optional_integrations.kismet.api_key }}{% raw %}'",
"request_redirect_headers_ban_list": [],
"oauth_scopes": [],
"processors": "",
"tags": [],
"pipeline": "kismet.common"
}
}
}
}
},
"force": true
}
{% endraw %}

File: salt/elasticfleet/files/integrations-optional/sublime_platform.json Copy Chapter

{%- from 'elasticfleet/map.jinja' import ELASTICFLEETMERGED -%}
{%- from 'sensoroni/map.jinja' import SENSORONIMERGED -%}
{%- from 'vars/globals.map.jinja' import GLOBALS -%}
{%- raw -%}
{
"package": {
"name": "httpjson",
"version": ""
},
"name": "sublime-platform",
"namespace": "default",
"description": "",
"policy_id": "FleetServer_{%- endraw -%}{{ NAME }}{%- raw -%}",
"vars": {},
"inputs": {
"generic-httpjson": {
"enabled": true,
"streams": {
"httpjson.generic": {
"enabled": true,
"vars": {
"request_method": "GET",
"processors": "- drop_event:\n when:\n not:\n contains: \n message: "flagged_rules"\n- decode_json_fields:\n fields: ["message"]\n document_id: id\n target: """,
"enable_request_tracer": false,
"oauth_scopes": [],
"request_transforms": "- set:\n target: header.Authorization\n value: 'Bearer {% endraw -%}{{ ELASTICFLEETMERGED.optional_integrations.sublime_platform.api_key }}{%- raw -%}'\n- set:\n target: header.accept\n value: application/json\n- set:\n target: url.params.last_message_created_at[gte]\n value: '[[formatDate (now (parseDuration "-{%- endraw -%}{{ ELASTICFLEETMERGED.optional_integrations.sublime_platform.poll_interval }}{%- raw -%}")) "2006-01-02T15:04:05Z"]]'\n- set:\n target: url.params.reviewed\n value: false\n- set:\n target: url.params.flagged\n value: true\n- set:\n target: url.params.limit\n value: {% endraw %}{{ ELASTICFLEETMERGED.optional_integrations.sublime_platform.limit }}{%- raw -%}",
"response_transforms": "",
"request_redirect_headers_ban_list": [],
"request_encode_as": "application/x-www-form-urlencoded",
"request_url": "{%- endraw -%}{{ ELASTICFLEETMERGED.optional_integrations.sublime_platform.base_url }}{%- raw -%}/v0/message-groups",
"response_split": "target: body.message_groups\ntype: array\nkeep_parent: false\ntransforms:\n - set:\n target: body.sublime.request_url\n value : '[[ .last_response.url.value ]]'",
"tags": [
"forwarded"
],
"pipeline": "sublime",
"data_stream.dataset": "sublime",
"request_interval": "1m"
}
}
}
}
},
"force": true
}
{%- endraw -%}

File: salt/elasticfleet/files/soc/elastic-defend-custom-filters.yaml Copy Chapter

title: 'Template 1'
id: 'This needs to be a UUIDv4 id - https://www.uuidgenerator.net/version4'
references: 'Relevant urls, etc'
author: '@SecurityOnion'
date: 'MM/DD/YY'
event_type: 'dns_query'
filter_type: 'exclude'
filter:
selection_1:
TargetField: 'QueryName'
Condition: 'end with'
Pattern: '.thawte.com'

title: 'Template 2'
id: 'This needs to be a UUIDv4 id - https://www.uuidgenerator.net/version4'
references: 'Relevant urls, etc'
author: '@SecurityOnion'
date: 'MM/DD/YY'
event_type: 'process_creation'
filter_type: 'exclude'
filter:
selection_1:
TargetField: 'ParentImage'
Condition: 'is'
Pattern: 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe'

File: salt/elasticfleet/files/soc/elastic-defend-disabled-filters.yaml Copy Chapter

'9EDAA51C-BB12-49D9-8748-2B61371F2E7D':
Date: '10/10/2024'
Notes: 'Example Disabled Filter - Leave this entry here, just copy and paste as needed.'

File: salt/elasticsearch/roles/analyst.json Copy Chapter

{
"cluster": [
"cancel_task",
"create_snapshot",
"monitor",
"monitor_data_frame_transforms",
"monitor_ml",
"monitor_rollup",
"monitor_snapshot",
"monitor_text_structure",
"monitor_transform",
"monitor_watcher",
"read_ccr",
"read_ilm",
"read_pipeline",
"read_slm"
],
"indices": [
{
"names": [
"logs-",
"so-"
],
"privileges": [
"index",
"maintenance",
"monitor",
"read",
"read_cross_cluster",
"view_index_metadata",
"write"
]
}
],
"applications": [
{
"application": "kibana-.kibana",
"privileges": [
"feature_discover.all",
"feature_dashboard.all",
"feature_canvas.all",
"feature_maps.all",
"feature_ml.all",
"feature_logs.read",
"feature_visualize.all",
"feature_infrastructure.read",
"feature_apm.read",
"feature_uptime.read",
"feature_siem.read",
"feature_dev_tools.read",
"feature_advancedSettings.read",
"feature_indexPatterns.read",
"feature_savedObjectsManagement.read",
"feature_savedObjectsTagging.read",
"feature_fleet.all",
"feature_actions.read",
"feature_stackAlerts.read"
],
"resources": [
"*"
]
}
],
"run_as": []
}

File: salt/elasticsearch/roles/auditor.json Copy Chapter

{
"cluster": [
"monitor",
"monitor_data_frame_transforms",
"monitor_ml",
"monitor_rollup",
"monitor_snapshot",
"monitor_text_structure",
"monitor_transform",
"monitor_watcher",
"read_ccr",
"read_ilm",
"read_pipeline",
"read_slm"
],
"indices": [
{
"names": [
"logs-",
"so-"
],
"privileges": [
"read",
"read_cross_cluster",
"monitor",
"view_index_metadata"
]
}
],
"applications": [
{
"application": "kibana-.kibana",
"privileges": [
"feature_discover.read",
"feature_dashboard.read",
"feature_canvas.read",
"feature_maps.read",
"feature_ml.read",
"feature_logs.read",
"feature_visualize.read",
"feature_infrastructure.read",
"feature_apm.read",
"feature_uptime.read",
"feature_siem.read",
"feature_dev_tools.read",
"feature_advancedSettings.read",
"feature_indexPatterns.read",
"feature_savedObjectsManagement.read",
"feature_savedObjectsTagging.read",
"feature_fleet.read",
"feature_actions.read",
"feature_stackAlerts.read"
],
"resources": [
"*"
]
}
],
"run_as": []
}

File: salt/elasticsearch/roles/limited-analyst.json Copy Chapter

{
"cluster": [
],
"indices": [
{
"names": [
"logs-",
"so-"
],
"privileges": [
"index",
"maintenance",
"monitor",
"read",
"read_cross_cluster",
"view_index_metadata",
"write"
]
}
],
"applications": [
{
"application": "kibana-.kibana",
"privileges": [
"feature_discover.read",
"feature_dashboard.read",
"feature_canvas.read",
"feature_maps.read",
"feature_ml.read",
"feature_logs.read",
"feature_visualize.read",
"feature_infrastructure.read",
"feature_apm.read",
"feature_uptime.read",
"feature_siem.read",
"feature_dev_tools.read",
"feature_advancedSettings.read",
"feature_indexPatterns.read",
"feature_savedObjectsManagement.read",
"feature_savedObjectsTagging.read",
"feature_fleet.read",
"feature_actions.read",
"feature_stackAlerts.read"
],
"resources": [
"*"
]
}
],
"run_as": []
}

File: salt/elasticsearch/roles/limited-auditor.json Copy Chapter

{
"cluster": [
],
"indices": [
{
"names": [
"logs-",
"so-"
],
"privileges": [
"read",
"read_cross_cluster",
"monitor",
"view_index_metadata"
]
}
],
"applications": [
{
"application": "kibana-.kibana",
"privileges": [
"feature_discover.read",
"feature_dashboard.read",
"feature_canvas.read",
"feature_maps.read",
"feature_ml.read",
"feature_logs.read",
"feature_visualize.read",
"feature_infrastructure.read",
"feature_apm.read",
"feature_uptime.read",
"feature_siem.read",
"feature_dev_tools.read",
"feature_advancedSettings.read",
"feature_indexPatterns.read",
"feature_savedObjectsManagement.read",
"feature_savedObjectsTagging.read",
"feature_fleet.read",
"feature_actions.read",
"feature_stackAlerts.read"
],
"resources": [
"*"
]
}
],
"run_as": []
}

File: salt/elasticsearch/templates/component/ecs/agent.json Copy Chapter

{
"_meta": {
"documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-agent.html",
"ecs_version": "1.12.2"
},
"template": {
"mappings": {
"properties": {
"agent": {
"properties": {
"build": {
"properties": {
"original": {
"ignore_above": 1024,
"type": "keyword"
}
}
},
"ephemeral_id": {
"ignore_above": 1024,
"type": "keyword"
},
"id": {
"ignore_above": 1024,
"type": "keyword"
},
"name": {
"ignore_above": 1024,
"type": "keyword"
},
"type": {
"ignore_above": 1024,
"type": "keyword"
},
"version": {
"ignore_above": 1024,
"type": "keyword"
}
}
}
}
}
}
}

File: salt/elasticsearch/templates/component/ecs/aws.json Copy Chapter

{
"_meta": {
"documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-base.html",
"ecs_version": "1.12.2"
},
"template": {
"mappings": {
"properties": {
"aws": {
"properties": {
"cloudtrail": {
"properties": {
"additional_eventdata": {
"ignore_above": 1024,
"type": "keyword"
},
"api_version": {
"ignore_above": 1024,
"type": "keyword"
},
"console_login": {
"properties": {
"additional_eventdata": {
"properties": {
"login_to": {
"ignore_above": 1024,
"type": "keyword"
},
"mfa_used": {
"type": "boolean"
},
"mobile_version": {
"type": "boolean"
}
}
}
}
},
"digest": {
"properties": {
"end_time": {
"type": "date"
},
"log_files": {
"type": "nested"
},
"newest_event_time": {
"type": "date"
},
"oldest_event_time": {
"type": "date"
},
"previous_hash_algorithm": {
"ignore_above": 1024,
"type": "keyword"
},
"previous_s3_bucket": {
"ignore_above": 1024,
"type": "keyword"
},
"public_key_fingerprint": {
"ignore_above": 1024,
"type": "keyword"
},
"s3_bucket": {
"ignore_above": 1024,
"type": "keyword"
},
"s3_object": {
"ignore_above": 1024,
"type": "keyword"
},
"signature_algorithm": {
"ignore_above": 1024,
"type": "keyword"
},
"start_time": {
"type": "date"
}
}
},
"error_code": {
"ignore_above": 1024,
"type": "keyword"
},
"error_message": {
"ignore_above": 1024,
"type": "keyword"
},
"event_category": {
"ignore_above": 1024,
"type": "keyword"
},
"event_type": {
"ignore_above": 1024,
"type": "keyword"
},
"event_version": {
"ignore_above": 1024,
"type": "keyword"
},
"flattened": {
"properties": {
"additional_eventdata": {
"type": "flattened"
},
"request_parameters": {
"type": "flattened"
},
"response_elements": {
"type": "flattened"
},
"service_event_details": {
"type": "flattened"
}
}
},
"insight_details": {
"type": "flattened"
},
"management_event": {
"ignore_above": 1024,
"type": "keyword"
},
"read_only": {
"ignore_above": 1024,
"type": "keyword"
},
"recipient_account_id": {
"ignore_above": 1024,
"type": "keyword"
},
"request_id": {
"ignore_above": 1024,
"type": "keyword"
},
"request_parameters": {
"ignore_above": 1024,
"type": "keyword"
},
"resources": {
"properties": {
"account_id": {
"ignore_above": 1024,
"type": "keyword"
},
"arn": {
"ignore_above": 1024,
"type": "keyword"
},
"type": {
"ignore_above": 1024,
"type": "keyword"
}
}
},
"response_elements": {
"ignore_above": 1024,
"type": "keyword"
},
"service_event_details": {
"ignore_above": 1024,
"type": "keyword"
},
"shared_event_id": {
"ignore_above": 1024,
"type": "keyword"
},
"user_identity": {
"properties": {
"access_key_id": {
"ignore_above": 1024,
"type": "keyword"
},
"arn": {
"ignore_above": 1024,
"type": "keyword"
},
"invoked_by": {
"ignore_above": 1024,
"type": "keyword"
},
"session_context": {
"properties": {
"creation_date": {
"type": "date"
},
"mfa_authenticated": {
"ignore_above": 1024,
"type": "keyword"
},
"session_issuer": {
"properties": {
"account_id": {
"ignore_above": 1024,
"type": "keyword"
},
"arn": {
"ignore_above": 1024,
"type": "keyword"
},
"principal_id": {
"ignore_above": 1024,
"type": "keyword"
},
"type": {
"ignore_above": 1024,
"type": "keyword"
}
}
}
}
},
"type": {
"ignore_above": 1024,
"type": "keyword"
}
}
},
"vpc_endpoint_id": {
"ignore_above": 1024,
"type": "keyword"
}
}
},
"cloudwatch": {
"properties": {
"message": {
"norms": false,
"type": "text"
}
}
},
"ec2": {
"properties": {
"ip_address": {
"ignore_above": 1024,
"type": "keyword"
}
}
},
"elb": {
"properties": {
"action_executed": {
"ignore_above": 1024,
"type": "keyword"
},
"backend": {
"properties": {
"http": {
"properties": {
"response": {
"properties": {
"status_code": {
"ignore_above": 1024,
"type": "keyword"
}
}
}
}
},
"ip": {
"ignore_above": 1024,
"type": "keyword"
},
"port": {
"ignore_above": 1024,
"type": "keyword"
}
}
},
"backend_processing_time": {
"properties": {
"sec": {
"type": "float"
}
}
},
"chosen_cert": {
"properties": {
"arn": {
"ignore_above": 1024,
"type": "keyword"
},
"serial": {
"ignore_above": 1024,
"type": "keyword"
}
}
},
"classification": {
"ignore_above": 1024,
"type": "keyword"
},
"classification_reason": {
"ignore_above": 1024,
"type": "keyword"
},
"connection_time": {
"properties": {
"ms": {
"type": "long"
}
}
},
"error": {
"properties": {
"reason": {
"ignore_above": 1024,
"type": "keyword"
}
}
},
"incoming_tls_alert": {
"ignore_above": 1024,
"type": "keyword"
},
"listener": {
"ignore_above": 1024,
"type": "keyword"
},
"matched_rule_priority": {
"ignore_above": 1024,
"type": "keyword"
},
"name": {
"ignore_above": 1024,
"type": "keyword"
},
"protocol": {
"ignore_above": 1024,
"type": "keyword"
},
"redirect_url": {
"ignore_above": 1024,
"type": "keyword"
},
"request_processing_time": {
"properties": {
"sec": {
"type": "float"
}
}
},
"response_processing_time": {
"properties": {
"sec": {
"type": "float"
}
}
},
"ssl_cipher": {
"ignore_above": 1024,
"type": "keyword"
},
"ssl_protocol": {
"ignore_above": 1024,
"type": "keyword"
},
"target_group": {
"properties": {
"arn": {
"ignore_above": 1024,
"type": "keyword"
}
}
},
"target_port": {
"ignore_above": 1024,
"type": "keyword"
},
"target_status_code": {
"ignore_above": 1024,
"type": "keyword"
},
"tls_handshake_time": {
"properties": {
"ms": {
"type": "long"
}
}
},
"tls_named_group": {
"ignore_above": 1024,
"type": "keyword"
},
"trace_id": {
"ignore_above": 1024,
"type": "keyword"
},
"type": {
"ignore_above": 1024,
"type": "keyword"
}
}
},
"s3access": {
"properties": {
"authentication_type": {
"ignore_above": 1024,
"type": "keyword"
},
"bucket": {
"ignore_above": 1024,
"type": "keyword"
},
"bucket_owner": {
"ignore_above": 1024,
"type": "keyword"
},
"bytes_sent": {
"type": "long"
},
"cipher_suite": {
"ignore_above": 1024,
"type": "keyword"
},
"error_code": {
"ignore_above": 1024,
"type": "keyword"
},
"host_header": {
"ignore_above": 1024,
"type": "keyword"
},
"host_id": {
"ignore_above": 1024,
"type": "keyword"
},
"http_status": {
"type": "long"
},
"key": {
"ignore_above": 1024,
"type": "keyword"
},
"object_size": {
"type": "long"
},
"operation": {
"ignore_above": 1024,
"type": "keyword"
},
"referrer": {
"ignore_above": 1024,
"type": "keyword"
},
"remote_ip": {
"type": "ip"
},
"request_id": {
"ignore_above": 1024,
"type": "keyword"
},
"request_uri": {
"ignore_above": 1024,
"type": "keyword"
},
"requester": {
"ignore_above": 1024,
"type": "keyword"
},
"signature_version": {
"ignore_above": 1024,
"type": "keyword"
},
"tls_version": {
"ignore_above": 1024,
"type": "keyword"
},
"total_time": {
"type": "long"
},
"turn_around_time": {
"type": "long"
},
"user_agent": {
"ignore_above": 1024,
"type": "keyword"
},
"version_id": {
"ignore_above": 1024,
"type": "keyword"
}
}
},
"vpcflow": {
"properties": {
"account_id": {
"ignore_above": 1024,
"type": "keyword"
},
"action": {
"ignore_above": 1024,
"type": "keyword"
},
"instance_id": {
"ignore_above": 1024,
"type": "keyword"
},
"interface_id": {
"ignore_above": 1024,
"type": "keyword"
},
"log_status": {
"ignore_above": 1024,
"type": "keyword"
},
"pkt_dstaddr": {
"type": "ip"
},
"pkt_srcaddr": {
"type": "ip"
},
"subnet_id": {
"ignore_above": 1024,
"type": "keyword"
},
"tcp_flags": {
"ignore_above": 1024,
"type": "keyword"
},
"tcp_flags_array": {
"ignore_above": 1024,
"type": "keyword"
},
"type": {
"ignore_above": 1024,
"type": "keyword"
},
"version": {
"ignore_above": 1024,
"type": "keyword"
},
"vpc_id": {
"ignore_above": 1024,
"type": "keyword"
}
}
}
}
}
}
}
}
}

File: salt/elasticsearch/templates/component/ecs/azure.json Copy Chapter

{
"_meta": {
"documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-base.html",
"ecs_version": "1.12.2"
},
"template": {
"mappings": {
"properties": {
"azure": {
"properties": {
"activitylogs": {
"properties": {
"category": {
"ignore_above": 1024,
"type": "keyword"
},
"event_category": {
"ignore_above": 1024,
"type": "keyword"
},
"identity": {
"properties": {
"authorization": {
"properties": {
"action": {
"ignore_above": 1024,
"type": "keyword"
},
"evidence": {
"properties": {
"principal_id": {
"ignore_above": 1024,
"type": "keyword"
},
"principal_type": {
"ignore_above": 1024,
"type": "keyword"
},
"role": {
"ignore_above": 1024,
"type": "keyword"
},
"role_assignment_id": {
"ignore_above": 1024,
"type": "keyword"
},
"role_assignment_scope": {
"ignore_above": 1024,
"type": "keyword"
},
"role_definition_id": {
"ignore_above": 1024,
"type": "keyword"
}
}
},
"scope": {
"ignore_above": 1024,
"type": "keyword"
}
}
},
"claims": {
"properties": {
"": {
"type": "object"
}
}
},
"claims_initiated_by_user": {
"properties": {
"fullname": {
"ignore_above": 1024,
"type": "keyword"
},
"givenname": {
"ignore_above": 1024,
"type": "keyword"
},
"name": {
"ignore_above": 1024,
"type": "keyword"
},
"schema": {
"ignore_above": 1024,
"type": "keyword"
},
"surname": {
"ignore_above": 1024,
"type": "keyword"
}
}
}
}
},
"operation_name": {
"ignore_above": 1024,
"type": "keyword"
},
"properties": {
"type": "flattened"
},
"result_signature": {
"ignore_above": 1024,
"type": "keyword"
},
"result_type": {
"ignore_above": 1024,
"type": "keyword"
}
}
},
"auditlogs": {
"properties": {
"category": {
"ignore_above": 1024,
"type": "keyword"
},
"identity": {
"ignore_above": 1024,
"type": "keyword"
},
"operation_name": {
"ignore_above": 1024,
"type": "keyword"
},
"operation_version": {
"ignore_above": 1024,
"type": "keyword"
},
"properties": {
"properties": {
"activity_datetime": {
"type": "date"
},
"activity_display_name": {
"ignore_above": 1024,
"type": "keyword"
},
"category": {
"ignore_above": 1024,
"type": "keyword"
},
"correlation_id": {
"ignore_above": 1024,
"type": "keyword"
},
"id": {
"ignore_above": 1024,
"type": "keyword"
},
"initiated_by": {
"properties": {
"app": {
"properties": {
"appId": {
"ignore_above": 1024,
"type": "keyword"
},
"displayName": {
"ignore_above": 1024,
"type": "keyword"
},
"servicePrincipalId": {
"ignore_above": 1024,
"type": "keyword"
},
"servicePrincipalName": {
"ignore_above": 1024,
"type": "keyword"
}
}
},
"user": {
"properties": {
"displayName": {
"ignore_above": 1024,
"type": "keyword"
},
"id": {
"ignore_above": 1024,
"type": "keyword"
},
"ipAddress": {
"ignore_above": 1024,
"type": "keyword"
},
"userPrincipalName": {
"ignore_above": 1024,
"type": "keyword"
}
}
}
}
},
"logged_by_service": {
"ignore_above": 1024,
"type": "keyword"
},
"operation_type": {
"ignore_above": 1024,
"type": "keyword"
},
"result": {
"ignore_above": 1024,
"type": "keyword"
},
"result_reason": {
"ignore_above": 1024,
"type": "keyword"
},
"target_resources": {
"properties": {
"": {
"properties": {
"display_name": {
"ignore_above": 1024,
"type": "keyword"
},
"id": {
"ignore_above": 1024,
"type": "keyword"
},
"ip_address": {
"ignore_above": 1024,
"type": "keyword"
},
"modified_properties": {
"properties": {
"*": {
"properties": {
"display_name": {
"ignore_above": 1024,
"type": "keyword"
},
"new_value": {
"ignore_above": 1024,
"type": "keyword"
},
"old_value": {
"ignore_above": 1024,
"type": "keyword"
}
}
}
}
},
"type": {
"ignore_above": 1024,
"type": "keyword"
},
"user_principal_name": {
"ignore_above": 1024,
"type": "keyword"
}
}
}
}
}
}
},
"result_signature": {
"ignore_above": 1024,
"type": "keyword"
},
"tenant_id": {
"ignore_above": 1024,
"type": "keyword"
}
}
},
"consumer_group": {
"ignore_above": 1024,
"type": "keyword"
},
"correlation_id": {
"ignore_above": 1024,
"type": "keyword"
},
"enqueued_time": {
"type": "date"
},
"eventhub": {
"ignore_above": 1024,
"type": "keyword"
},
"offset": {
"type": "long"
},
"partition_id": {
"type": "long"
},
"platformlogs": {
"properties": {
"ActivityId": {
"ignore_above": 1024,
"type": "keyword"
},
"Caller": {
"ignore_above": 1024,
"type": "keyword"
},
"Cloud": {
"ignore_above": 1024,
"type": "keyword"
},
"Environment": {
"ignore_above": 1024,
"type": "keyword"
},
"EventTimeString": {
"ignore_above": 1024,
"type": "keyword"
},
"ScaleUnit": {
"ignore_above": 1024,
"type": "keyword"
},
"category": {
"ignore_above": 1024,
"type": "keyword"
},
"ccpNamespace": {
"ignore_above": 1024,
"type": "keyword"
},
"event_category": {
"ignore_above": 1024,
"type": "keyword"
},
"operation_name": {
"ignore_above": 1024,
"type": "keyword"
},
"properties": {
"type": "flattened"
},
"result_signature": {
"ignore_above": 1024,
"type": "keyword"
},
"result_type": {
"ignore_above": 1024,
"type": "keyword"
},
"status": {
"ignore_above": 1024,
"type": "keyword"
}
}
},
"resource": {
"properties": {
"authorization_rule": {
"ignore_above": 1024,
"type": "keyword"
},
"group": {
"ignore_above": 1024,
"type": "keyword"
},
"id": {
"ignore_above": 1024,
"type": "keyword"
},
"name": {
"ignore_above": 1024,
"type": "keyword"
},
"namespace": {
"ignore_above": 1024,
"type": "keyword"
},
"provider": {
"ignore_above": 1024,
"type": "keyword"
}
}
},
"sequence_number": {
"type": "long"
},
"signinlogs": {
"properties": {
"category": {
"ignore_above": 1024,
"type": "keyword"
},
"identity": {
"ignore_above": 1024,
"type": "keyword"
},
"operation_name": {
"ignore_above": 1024,
"type": "keyword"
},
"operation_version": {
"ignore_above": 1024,
"type": "keyword"
},
"properties": {
"properties": {
"app_display_name": {
"ignore_above": 1024,
"type": "keyword"
},
"app_id": {
"ignore_above": 1024,
"type": "keyword"
},
"authentication_processing_details": {
"type": "flattened"
},
"authentication_requirement": {
"ignore_above": 1024,
"type": "keyword"
},
"authentication_requirement_policies": {
"ignore_above": 1024,
"type": "keyword"
},
"autonomous_system_number": {
"type": "long"
},
"client_app_used": {
"ignore_above": 1024,
"type": "keyword"
},
"conditional_access_status": {
"ignore_above": 1024,
"type": "keyword"
},
"correlation_id": {
"ignore_above": 1024,
"type": "keyword"
},
"created_at": {
"type": "date"
},
"cross_tenant_access_type": {
"ignore_above": 1024,
"type": "keyword"
},
"device_detail": {
"properties": {
"browser": {
"ignore_above": 1024,
"type": "keyword"
},
"device_id": {
"ignore_above": 1024,
"type": "keyword"
},
"display_name": {
"ignore_above": 1024,
"type": "keyword"
},
"operating_system": {
"ignore_above": 1024,
"type": "keyword"
},
"trust_type": {
"ignore_above": 1024,
"type": "keyword"
}
}
},
"flagged_for_review": {
"type": "boolean"
},
"home_tenant_id": {
"ignore_above": 1024,
"type": "keyword"
},
"id": {
"ignore_above": 1024,
"type": "keyword"
},
"is_interactive": {
"type": "boolean"
},
"is_tenant_restricted": {
"type": "boolean"
},
"original_request_id": {
"ignore_above": 1024,
"type": "keyword"
},
"processing_time_ms": {
"type": "float"
},
"resource_display_name": {
"ignore_above": 1024,
"type": "keyword"
},
"resource_id": {
"ignore_above": 1024,
"type": "keyword"
},
"resource_tenant_id": {
"ignore_above": 1024,
"type": "keyword"
},
"risk_detail": {
"ignore_above": 1024,
"type": "keyword"
},
"risk_event_types": {
"ignore_above": 1024,
"type": "keyword"
},
"risk_event_types_v2": {
"ignore_above": 1024,
"type": "keyword"
},
"risk_level_aggregated": {
"ignore_above": 1024,
"type": "keyword"
},
"risk_level_during_signin": {
"ignore_above": 1024,
"type": "keyword"
},
"risk_state": {
"ignore_above": 1024,
"type": "keyword"
},
"service_principal_id": {
"ignore_above": 1024,
"type": "keyword"
},
"service_principal_name": {
"ignore_above": 1024,
"type": "keyword"
},
"sso_extension_version": {
"ignore_above": 1024,
"type": "keyword"
},
"status": {
"properties": {
"error_code": {
"type": "long"
}
}
},
"token_issuer_name": {
"ignore_above": 1024,
"type": "keyword"
},
"token_issuer_type": {
"ignore_above": 1024,
"type": "keyword"
},
"user_display_name": {
"ignore_above": 1024,
"type": "keyword"
},
"user_id": {
"ignore_above": 1024,
"type": "keyword"
},
"user_principal_name": {
"ignore_above": 1024,
"type": "keyword"
},
"user_type": {
"ignore_above": 1024,
"type": "keyword"
}
}
},
"result_description": {
"ignore_above": 1024,
"type": "keyword"
},
"result_signature": {
"ignore_above": 1024,
"type": "keyword"
},
"result_type": {
"ignore_above": 1024,
"type": "keyword"
},
"tenant_id": {
"ignore_above": 1024,
"type": "keyword"
}
}
},
"subscription_id": {
"ignore_above": 1024,
"type": "keyword"
},
"tenant_id": {
"ignore_above": 1024,
"type": "keyword"
}
}
}
}
}
}
}

File: salt/elasticsearch/templates/component/ecs/base.json Copy Chapter

{
"_meta": {
"documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-base.html",
"ecs_version": "1.12.2"
},
"template": {
"mappings": {
"properties": {
"@timestamp": {
"type": "date"
},
"labels": {
"type": "object"
},
"message": {
"type": "match_only_text"
},
"tags": {
"ignore_above": 1024,
"type": "keyword"
}
}
}
}
}

File: salt/elasticsearch/templates/component/ecs/cef.json Copy Chapter

{
"_meta": {
"documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-base.html",
"ecs_version": "1.12.2"
},
"template": {
"mappings": {
"properties": {
"cef": {
"properties": {
"device": {
"properties": {
"event_class_id": {
"ignore_above": 1024,
"type": "keyword"
},
"product": {
"ignore_above": 1024,
"type": "keyword"
},
"vendor": {
"ignore_above": 1024,
"type": "keyword"
},
"version": {
"ignore_above": 1024,
"type": "keyword"
}
}
},
"extensions": {
"properties": {
"Reason": {
"ignore_above": 1024,
"type": "keyword"
},
"agentAddress": {
"type": "ip"
},
"agentDnsDomain": {
"ignore_above": 1024,
"type": "keyword"
},
"agentHostName": {
"ignore_above": 1024,
"type": "keyword"
},
"agentId": {
"ignore_above": 1024,
"type": "keyword"
},
"agentMacAddress": {
"ignore_above": 1024,
"type": "keyword"
},
"agentNtDomain": {
"ignore_above": 1024,
"type": "keyword"
},
"agentReceiptTime": {
"type": "date"
},
"agentTimeZone": {
"ignore_above": 1024,
"type": "keyword"
},
"agentTranslatedAddress": {
"type": "ip"
},
"agentTranslatedZoneExternalID": {
"ignore_above": 1024,
"type": "keyword"
},
"agentTranslatedZoneURI": {
"ignore_above": 1024,
"type": "keyword"
},
"agentType": {
"ignore_above": 1024,
"type": "keyword"
},
"agentVersion": {
"ignore_above": 1024,
"type": "keyword"
},
"agentZoneExternalID": {
"ignore_above": 1024,
"type": "keyword"
},
"agentZoneURI": {
"ignore_above": 1024,
"type": "keyword"
},
"applicationProtocol": {
"ignore_above": 1024,
"type": "keyword"
},
"baseEventCount": {
"type": "long"
},
"bytesIn": {
"type": "long"
},
"bytesOut": {
"type": "long"
},
"categoryBehavior": {
"ignore_above": 1024,
"type": "keyword"
},
"categoryDeviceGroup": {
"ignore_above": 1024,
"type": "keyword"
},
"categoryDeviceType": {
"ignore_above": 1024,
"type": "keyword"
},
"categoryObject": {
"ignore_above": 1024,
"type": "keyword"
},
"categoryOutcome": {
"ignore_above": 1024,
"type": "keyword"
},
"categorySignificance": {
"ignore_above": 1024,
"type": "keyword"
},
"categoryTechnique": {
"ignore_above": 1024,
"type": "keyword"
},
"cp_app_risk": {
"ignore_above": 1024,
"type": "keyword"
},
"cp_severity": {
"ignore_above": 1024,
"type": "keyword"
},
"customerExternalID": {
"ignore_above": 1024,
"type": "keyword"
},
"customerURI": {
"ignore_above": 1024,
"type": "keyword"
},
"destinationAddress": {
"type": "ip"
},
"destinationDnsDomain": {
"ignore_above": 1024,
"type": "keyword"
},
"destinationGeoLatitude": {
"type": "double"
},
"destinationGeoLongitude": {
"type": "double"
},
"destinationHostName": {
"ignore_above": 1024,
"type": "keyword"
},
"destinationMacAddress": {
"ignore_above": 1024,
"type": "keyword"
},
"destinationNtDomain": {
"ignore_above": 1024,
"type": "keyword"
},
"destinationPort": {
"type": "long"
},
"destinationProcessId": {
"type": "long"
},
"destinationProcessName": {
"ignore_above": 1024,
"type": "keyword"
},
"destinationServiceName": {
"ignore_above": 1024,
"type": "keyword"
},
"destinationTranslatedAddress": {
"type": "ip"
},
"destinationTranslatedPort": {
"type": "long"
},
"destinationTranslatedZoneExternalID": {
"ignore_above": 1024,
"type": "keyword"
},
"destinationTranslatedZoneURI": {
"ignore_above": 1024,
"type": "keyword"
},
"destinationUserId": {
"ignore_above": 1024,
"type": "keyword"
},
"destinationUserName": {
"ignore_above": 1024,
"type": "keyword"
},
"destinationUserPrivileges": {
"ignore_above": 1024,
"type": "keyword"
},
"destinationZoneExternalID": {
"ignore_above": 1024,
"type": "keyword"
},
"destinationZoneURI": {
"ignore_above": 1024,
"type": "keyword"
},
"deviceAction": {
"ignore_above": 1024,
"type": "keyword"
},
"deviceAddress": {
"type": "ip"
},
"deviceCustomDate1": {
"type": "date"
},
"deviceCustomDate1Label": {
"ignore_above": 1024,
"type": "keyword"
},
"deviceCustomDate2": {
"type": "date"
},
"deviceCustomDate2Label": {
"ignore_above": 1024,
"type": "keyword"
},
"deviceCustomFloatingPoint1": {
"type": "double"
},
"deviceCustomFloatingPoint1Label": {
"ignore_above": 1024,
"type": "keyword"
},
"deviceCustomFloatingPoint2": {
"type": "double"
},
"deviceCustomFloatingPoint2Label": {
"ignore_above": 1024,
"type": "keyword"
},
"deviceCustomFloatingPoint3": {
"type": "double"
},
"deviceCustomFloatingPoint3Label": {
"ignore_above": 1024,
"type": "keyword"
},
"deviceCustomFloatingPoint4": {
"type": "double"
},
"deviceCustomFloatingPoint4Label": {
"ignore_above": 1024,
"type": "keyword"
},
"deviceCustomIPv6Address1": {
"type": "ip"
},
"deviceCustomIPv6Address1Label": {
"ignore_above": 1024,
"type": "keyword"
},
"deviceCustomIPv6Address2": {
"type": "ip"
},
"deviceCustomIPv6Address2Label": {
"ignore_above": 1024,
"type": "keyword"
},
"deviceCustomIPv6Address3": {
"type": "ip"
},
"deviceCustomIPv6Address3Label": {
"ignore_above": 1024,
"type": "keyword"
},
"deviceCustomIPv6Address4": {
"type": "ip"
},
"deviceCustomIPv6Address4Label": {
"ignore_above": 1024,
"type": "keyword"
},
"deviceCustomNumber1": {
"type": "long"
},
"deviceCustomNumber1Label": {
"ignore_above": 1024,
"type": "keyword"
},
"deviceCustomNumber2": {
"type": "long"
},
"deviceCustomNumber2Label": {
"ignore_above": 1024,
"type": "keyword"
},
"deviceCustomNumber3": {
"type": "long"
},
"deviceCustomNumber3Label": {
"ignore_above": 1024,
"type": "keyword"
},
"deviceCustomString1": {
"ignore_above": 1024,
"type": "keyword"
},
"deviceCustomString1Label": {
"ignore_above": 1024,
"type": "keyword"
},
"deviceCustomString2": {
"ignore_above": 1024,
"type": "keyword"
},
"deviceCustomString2Label": {
"ignore_above": 1024,
"type": "keyword"
},
"deviceCustomString3": {
"ignore_above": 1024,
"type": "keyword"
},
"deviceCustomString3Label": {
"ignore_above": 1024,
"type": "keyword"
},
"deviceCustomString4": {
"ignore_above": 1024,
"type": "keyword"
},
"deviceCustomString4Label": {
"ignore_above": 1024,
"type": "keyword"
},
"deviceCustomString5": {
"ignore_above": 1024,
"type": "keyword"
},
"deviceCustomString5Label": {
"ignore_above": 1024,
"type": "keyword"
},
"deviceCustomString6": {
"ignore_above": 1024,
"type": "keyword"
},
"deviceCustomString6Label": {
"ignore_above": 1024,
"type": "keyword"
},
"deviceDirection": {
"type": "long"
},
"deviceDnsDomain": {
"ignore_above": 1024,
"type": "keyword"
},
"deviceEventCategory": {
"ignore_above": 1024,
"type": "keyword"
},
"deviceExternalId": {
"ignore_above": 1024,
"type": "keyword"
},
"deviceFacility": {
"ignore_above": 1024,
"type": "keyword"
},
"deviceFlexNumber1": {
"type": "long"
},
"deviceFlexNumber1Label": {
"ignore_above": 1024,
"type": "keyword"
},
"deviceFlexNumber2": {
"type": "long"
},
"deviceFlexNumber2Label": {
"ignore_above": 1024,
"type": "keyword"
},
"deviceHostName": {
"ignore_above": 1024,
"type": "keyword"
},
"deviceInboundInterface": {
"ignore_above": 1024,
"type": "keyword"
},
"deviceMacAddress": {
"ignore_above": 1024,
"type": "keyword"
},
"deviceNtDomain": {
"ignore_above": 1024,
"type": "keyword"
},
"deviceOutboundInterface": {
"ignore_above": 1024,
"type": "keyword"
},
"devicePayloadId": {
"ignore_above": 1024,
"type": "keyword"
},
"deviceProcessId": {
"type": "long"
},
"deviceProcessName": {
"ignore_above": 1024,
"type": "keyword"
},
"deviceReceiptTime": {
"type": "date"
},
"deviceTimeZone": {
"ignore_above": 1024,
"type": "keyword"
},
"deviceTranslatedAddress": {
"type": "ip"
},
"deviceTranslatedZoneExternalID": {
"ignore_above": 1024,
"type": "keyword"
},
"deviceTranslatedZoneURI": {
"ignore_above": 1024,
"type": "keyword"
},
"deviceZoneExternalID": {
"ignore_above": 1024,
"type": "keyword"
},
"deviceZoneURI": {
"ignore_above": 1024,
"type": "keyword"
},
"endTime": {
"type": "date"
},
"eventId": {
"type": "long"
},
"eventOutcome": {
"ignore_above": 1024,
"type": "keyword"
},
"externalId": {
"ignore_above": 1024,
"type": "keyword"
},
"fileCreateTime": {
"type": "date"
},
"fileHash": {
"ignore_above": 1024,
"type": "keyword"
},
"fileId": {
"ignore_above": 1024,
"type": "keyword"
},
"fileModificationTime": {
"type": "date"
},
"filePath": {
"ignore_above": 1024,
"type": "keyword"
},
"filePermission": {
"ignore_above": 1024,
"type": "keyword"
},
"fileSize": {
"type": "long"
},
"fileType": {
"ignore_above": 1024,
"type": "keyword"
},
"filename": {
"ignore_above": 1024,
"type": "keyword"
},
"flexDate1": {
"type": "date"
},
"flexDate1Label": {
"ignore_above": 1024,
"type": "keyword"
},
"flexString1": {
"ignore_above": 1024,
"type": "keyword"
},
"flexString1Label": {
"ignore_above": 1024,
"type": "keyword"
},
"flexString2": {
"ignore_above": 1024,
"type": "keyword"
},
"flexString2Label": {
"ignore_above": 1024,
"type": "keyword"
},
"ifname": {
"ignore_above": 1024,
"type": "keyword"
},
"inzone": {
"ignore_above": 1024,
"type": "keyword"
},
"layer_name": {
"ignore_above": 1024,
"type": "keyword"
},
"layer_uuid": {
"ignore_above": 1024,
"type": "keyword"
},
"logid": {
"ignore_above": 1024,
"type": "keyword"
},
"loguid": {
"ignore_above": 1024,
"type": "keyword"
},
"managerReceiptTime": {
"type": "date"
},
"match_id": {
"ignore_above": 1024,
"type": "keyword"
},
"message": {
"ignore_above": 1024,
"type": "keyword"
},
"nat_addtnl_rulenum": {
"ignore_above": 1024,
"type": "keyword"
},
"nat_rulenum": {
"ignore_above": 1024,
"type": "keyword"
},
"oldFileCreateTime": {
"type": "date"
},
"oldFileHash": {
"ignore_above": 1024,
"type": "keyword"
},
"oldFileId": {
"ignore_above": 1024,
"type": "keyword"
},
"oldFileModificationTime": {
"type": "date"
},
"oldFileName": {
"ignore_above": 1024,
"type": "keyword"
},
"oldFilePath": {
"ignore_above": 1024,
"type": "keyword"
},
"oldFilePermission": {
"ignore_above": 1024,
"type": "keyword"
},
"oldFileSize": {
"type": "long"
},
"oldFileType": {
"ignore_above": 1024,
"type": "keyword"
},
"origin": {
"ignore_above": 1024,
"type": "keyword"
},
"originsicname": {
"ignore_above": 1024,
"type": "keyword"
},
"outzone": {
"ignore_above": 1024,
"type": "keyword"
},
"parent_rule": {
"ignore_above": 1024,
"type": "keyword"
},
"product": {
"ignore_above": 1024,
"type": "keyword"
},
"rawEvent": {
"ignore_above": 1024,
"type": "keyword"
},
"requestClientApplication": {
"ignore_above": 1024,
"type": "keyword"
},
"requestContext": {
"ignore_above": 1024,
"type": "keyword"
},
"requestCookies": {
"ignore_above": 1024,
"type": "keyword"
},
"requestMethod": {
"ignore_above": 1024,
"type": "keyword"
},
"requestUrl": {
"ignore_above": 1024,
"type": "keyword"
},
"rule_action": {
"ignore_above": 1024,
"type": "keyword"
},
"rule_uid": {
"ignore_above": 1024,
"type": "keyword"
},
"sequencenum": {
"ignore_above": 1024,
"type": "keyword"
},
"service_id": {
"ignore_above": 1024,
"type": "keyword"
},
"sourceAddress": {
"type": "ip"
},
"sourceDnsDomain": {
"ignore_above": 1024,
"type": "keyword"
},
"sourceGeoLatitude": {
"type": "double"
},
"sourceGeoLongitude": {
"type": "double"
},
"sourceHostName": {
"ignore_above": 1024,
"type": "keyword"
},
"sourceMacAddress": {
"ignore_above": 1024,
"type": "keyword"
},
"sourceNtDomain": {
"ignore_above": 1024,
"type": "keyword"
},
"sourcePort": {
"type": "long"
},
"sourceProcessId": {
"type": "long"
},
"sourceProcessName": {
"ignore_above": 1024,
"type": "keyword"
},
"sourceServiceName": {
"ignore_above": 1024,
"type": "keyword"
},
"sourceTranslatedAddress": {
"type": "ip"
},
"sourceTranslatedPort": {
"type": "long"
},
"sourceTranslatedZoneExternalID": {
"ignore_above": 1024,
"type": "keyword"
},
"sourceTranslatedZoneURI": {
"ignore_above": 1024,
"type": "keyword"
},
"sourceUserId": {
"ignore_above": 1024,
"type": "keyword"
},
"sourceUserName": {
"ignore_above": 1024,
"type": "keyword"
},
"sourceUserPrivileges": {
"ignore_above": 1024,
"type": "keyword"
},
"sourceZoneExternalID": {
"ignore_above": 1024,
"type": "keyword"
},
"sourceZoneURI": {
"ignore_above": 1024,
"type": "keyword"
},
"startTime": {
"type": "date"
},
"transportProtocol": {
"ignore_above": 1024,
"type": "keyword"
},
"type": {
"type": "long"
},
"version": {
"ignore_above": 1024,
"type": "keyword"
}
}
},
"name": {
"ignore_above": 1024,
"type": "keyword"
},
"severity": {
"ignore_above": 1024,
"type": "keyword"
},
"version": {
"ignore_above": 1024,
"type": "keyword"
}
}
}
}
}
}
}

File: salt/elasticsearch/templates/component/ecs/checkpoint.json Copy Chapter

{
"_meta": {
"documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-base.html",
"ecs_version": "1.12.2"
},
"template": {
"mappings": {
"properties": {
"checkpoint": {
"properties": {
"action_reason": {
"type": "long"
},
"action_reason_msg": {
"ignore_above": 1024,
"type": "keyword"
},
"additional_info": {
"ignore_above": 1024,
"type": "keyword"
},
"additional_ip": {
"ignore_above": 1024,
"type": "keyword"
},
"additional_rdata": {
"ignore_above": 1024,
"type": "keyword"
},
"alert": {
"ignore_above": 1024,
"type": "keyword"
},
"allocated_ports": {
"type": "long"
},
"analyzed_on": {
"ignore_above": 1024,
"type": "keyword"
},
"answer_rdata": {
"ignore_above": 1024,
"type": "keyword"
},
"anti_virus_type": {
"ignore_above": 1024,
"type": "keyword"
},
"app_desc": {
"ignore_above": 1024,
"type": "keyword"
},
"app_id": {
"type": "long"
},
"app_package": {
"ignore_above": 1024,
"type": "keyword"
},
"app_properties": {
"ignore_above": 1024,
"type": "keyword"
},
"app_repackaged": {
"ignore_above": 1024,
"type": "keyword"
},
"app_risk": {
"ignore_above": 1024,
"type": "keyword"
},
"app_severity": {
"ignore_above": 1024,
"type": "keyword"
},
"app_sid_id": {
"ignore_above": 1024,
"type": "keyword"
},
"app_sig_id": {
"ignore_above": 1024,
"type": "keyword"
},
"app_version": {
"ignore_above": 1024,
"type": "keyword"
},
"appi_name": {
"ignore_above": 1024,
"type": "keyword"
},
"arrival_time": {
"ignore_above": 1024,
"type": "keyword"
},
"attachments_num": {
"type": "long"
},
"attack_status": {
"ignore_above": 1024,
"type": "keyword"
},
"audit_status": {
"ignore_above": 1024,
"type": "keyword"
},
"auth_method": {
"ignore_above": 1024,
"type": "keyword"
},
"authority_rdata": {
"ignore_above": 1024,
"type": "keyword"
},
"authorization": {
"ignore_above": 1024,
"type": "keyword"
},
"bcc": {
"ignore_above": 1024,
"type": "keyword"
},
"blade_name": {
"ignore_above": 1024,
"type": "keyword"
},
"broker_publisher": {
"type": "ip"
},
"browse_time": {
"ignore_above": 1024,
"type": "keyword"
},
"c_bytes": {
"type": "long"
},
"calc_desc": {
"ignore_above": 1024,
"type": "keyword"
},
"capacity": {
"type": "long"
},
"capture_uuid": {
"ignore_above": 1024,
"type": "keyword"
},
"category": {
"ignore_above": 1024,
"type": "keyword"
},
"cc": {
"ignore_above": 1024,
"type": "keyword"
},
"certificate_resource": {
"ignore_above": 1024,
"type": "keyword"
},
"certificate_validation": {
"ignore_above": 1024,
"type": "keyword"
},
"cgnet": {
"ignore_above": 1024,
"type": "keyword"
},
"chunk_type": {
"ignore_above": 1024,
"type": "keyword"
},
"client_name": {
"ignore_above": 1024,
"type": "keyword"
},
"client_type": {
"ignore_above": 1024,
"type": "keyword"
},
"client_type_os": {
"ignore_above": 1024,
"type": "keyword"
},
"client_version": {
"ignore_above": 1024,
"type": "keyword"
},
"cluster_info": {
"ignore_above": 1024,
"type": "keyword"
},
"community": {
"ignore_above": 1024,
"type": "keyword"
},
"confidence_level": {
"type": "long"
},
"connection_uid": {
"ignore_above": 1024,
"type": "keyword"
},
"connectivity_level": {
"ignore_above": 1024,
"type": "keyword"
},
"connectivity_state": {
"ignore_above": 1024,
"type": "keyword"
},
"conns_amount": {
"type": "long"
},
"content_disposition": {
"ignore_above": 1024,
"type": "keyword"
},
"content_length": {
"ignore_above": 1024,
"type": "keyword"
},
"content_risk": {
"type": "long"
},
"content_type": {
"ignore_above": 1024,
"type": "keyword"
},
"context_num": {
"type": "long"
},
"cookie": {
"ignore_above": 1024,
"type": "keyword"
},
"cookieI": {
"ignore_above": 1024,
"type": "keyword"
},
"cookieR": {
"ignore_above": 1024,
"type": "keyword"
},
"cp_message": {
"type": "long"
},
"cvpn_category": {
"ignore_above": 1024,
"type": "keyword"
},
"cvpn_resource": {
"ignore_above": 1024,
"type": "keyword"
},
"data_type_name": {
"ignore_above": 1024,
"type": "keyword"
},
"dce-rpc_interface_uuid": {
"ignore_above": 1024,
"type": "keyword"
},
"delivery_time": {
"ignore_above": 1024,
"type": "keyword"
},
"desc": {
"ignore_above": 1024,
"type": "keyword"
},
"description": {
"ignore_above": 1024,
"type": "keyword"
},
"destination_object": {
"ignore_above": 1024,
"type": "keyword"
},
"detected_on": {
"ignore_above": 1024,
"type": "keyword"
},
"developer_certificate_name": {
"ignore_above": 1024,
"type": "keyword"
},
"diameter_app_ID": {
"type": "long"
},
"diameter_cmd_code": {
"type": "long"
},
"diameter_msg_type": {
"ignore_above": 1024,
"type": "keyword"
},
"dlp_action_reason": {
"ignore_above": 1024,
"type": "keyword"
},
"dlp_additional_action": {
"ignore_above": 1024,
"type": "keyword"
},
"dlp_categories": {
"ignore_above": 1024,
"type": "keyword"
},
"dlp_data_type_name": {
"ignore_above": 1024,
"type": "keyword"
},
"dlp_data_type_uid": {
"ignore_above": 1024,
"type": "keyword"
},
"dlp_fingerprint_files_number": {
"type": "long"
},
"dlp_fingerprint_long_status": {
"ignore_above": 1024,
"type": "keyword"
},
"dlp_fingerprint_short_status": {
"ignore_above": 1024,
"type": "keyword"
},
"dlp_incident_uid": {
"ignore_above": 1024,
"type": "keyword"
},
"dlp_recipients": {
"ignore_above": 1024,
"type": "keyword"
},
"dlp_related_incident_uid": {
"ignore_above": 1024,
"type": "keyword"
},
"dlp_relevant_data_types": {
"ignore_above": 1024,
"type": "keyword"
},
"dlp_repository_directories_number": {
"type": "long"
},
"dlp_repository_files_number": {
"type": "long"
},
"dlp_repository_id": {
"ignore_above": 1024,
"type": "keyword"
},
"dlp_repository_not_scanned_directories_percentage": {
"type": "long"
},
"dlp_repository_reached_directories_number": {
"type": "long"
},
"dlp_repository_root_path": {
"ignore_above": 1024,
"type": "keyword"
},
"dlp_repository_scan_progress": {
"type": "long"
},
"dlp_repository_scanned_directories_number": {
"type": "long"
},
"dlp_repository_scanned_files_number": {
"type": "long"
},
"dlp_repository_scanned_total_size": {
"type": "long"
},
"dlp_repository_skipped_files_number": {
"type": "long"
},
"dlp_repository_total_size": {
"type": "long"
},
"dlp_repository_unreachable_directories_number": {
"type": "long"
},
"dlp_rule_name": {
"ignore_above": 1024,
"type": "keyword"
},
"dlp_subject": {
"ignore_above": 1024,
"type": "keyword"
},
"dlp_template_score": {
"ignore_above": 1024,
"type": "keyword"
},
"dlp_transint": {
"ignore_above": 1024,
"type": "keyword"
},
"dlp_violation_description": {
"ignore_above": 1024,
"type": "keyword"
},
"dlp_watermark_profile": {
"ignore_above": 1024,
"type": "keyword"
},
"dlp_word_list": {
"ignore_above": 1024,
"type": "keyword"
},
"dns_query": {
"ignore_above": 1024,
"type": "keyword"
},
"drop_reason": {
"ignore_above": 1024,
"type": "keyword"
},
"dropped_file_hash": {
"ignore_above": 1024,
"type": "keyword"
},
"dropped_file_name": {
"ignore_above": 1024,
"type": "keyword"
},
"dropped_file_type": {
"ignore_above": 1024,
"type": "keyword"
},
"dropped_file_verdict": {
"ignore_above": 1024,
"type": "keyword"
},
"dropped_incoming": {
"type": "long"
},
"dropped_outgoing": {
"type": "long"
},
"dropped_total": {
"type": "long"
},
"drops_amount": {
"type": "long"
},
"dst_country": {
"ignore_above": 1024,
"type": "keyword"
},
"dst_phone_number": {
"ignore_above": 1024,
"type": "keyword"
},
"dst_user_name": {
"ignore_above": 1024,
"type": "keyword"
},
"dstkeyid": {
"ignore_above": 1024,
"type": "keyword"
},
"duplicate": {
"ignore_above": 1024,
"type": "keyword"
},
"duration": {
"ignore_above": 1024,
"type": "keyword"
},
"elapsed": {
"ignore_above": 1024,
"type": "keyword"
},
"email_content": {
"ignore_above": 1024,
"type": "keyword"
},
"email_control": {
"ignore_above": 1024,
"type": "keyword"
},
"email_control_analysis": {
"ignore_above": 1024,
"type": "keyword"
},
"email_headers": {
"ignore_above": 1024,
"type": "keyword"
},
"email_id": {
"ignore_above": 1024,
"type": "keyword"
},
"email_message_id": {
"ignore_above": 1024,
"type": "keyword"
},
"email_queue_id": {
"ignore_above": 1024,
"type": "keyword"
},
"email_queue_name": {
"ignore_above": 1024,
"type": "keyword"
},
"email_recipients_num": {
"type": "long"
},
"email_session_id": {
"ignore_above": 1024,
"type": "keyword"
},
"email_spam_category": {
"ignore_above": 1024,
"type": "keyword"
},
"email_spool_id": {
"ignore_above": 1024,
"type": "keyword"
},
"email_status": {
"ignore_above": 1024,
"type": "keyword"
},
"email_subject": {
"ignore_above": 1024,
"type": "keyword"
},
"emulated_on": {
"ignore_above": 1024,
"type": "keyword"
},
"encryption_failure": {
"ignore_above": 1024,
"type": "keyword"
},
"end_time": {
"ignore_above": 1024,
"type": "keyword"
},
"end_user_firewall_type": {
"ignore_above": 1024,
"type": "keyword"
},
"esod_access_status": {
"ignore_above": 1024,
"type": "keyword"
},
"esod_associated_policies": {
"ignore_above": 1024,
"type": "keyword"
},
"esod_noncompliance_reason": {
"ignore_above": 1024,
"type": "keyword"
},
"esod_rule_action": {
"ignore_above": 1024,
"type": "keyword"
},
"esod_rule_name": {
"ignore_above": 1024,
"type": "keyword"
},
"esod_rule_type": {
"ignore_above": 1024,
"type": "keyword"
},
"esod_scan_status": {
"ignore_above": 1024,
"type": "keyword"
},
"event_count": {
"type": "long"
},
"expire_time": {
"ignore_above": 1024,
"type": "keyword"
},
"extension_version": {
"ignore_above": 1024,
"type": "keyword"
},
"extracted_file_hash": {
"ignore_above": 1024,
"type": "keyword"
},
"extracted_file_names": {
"ignore_above": 1024,
"type": "keyword"
},
"extracted_file_type": {
"ignore_above": 1024,
"type": "keyword"
},
"extracted_file_uid": {
"ignore_above": 1024,
"type": "keyword"
},
"extracted_file_verdict": {
"ignore_above": 1024,
"type": "keyword"
},
"failure_impact": {
"ignore_above": 1024,
"type": "keyword"
},
"failure_reason": {
"ignore_above": 1024,
"type": "keyword"
},
"file_direction": {
"ignore_above": 1024,
"type": "keyword"
},
"file_name": {
"ignore_above": 1024,
"type": "keyword"
},
"files_names": {
"ignore_above": 1024,
"type": "keyword"
},
"first_hit_time": {
"type": "long"
},
"frequency": {
"ignore_above": 1024,
"type": "keyword"
},
"fs-proto": {
"ignore_above": 1024,
"type": "keyword"
},
"ftp_user": {
"ignore_above": 1024,
"type": "keyword"
},
"fw_message": {
"ignore_above": 1024,
"type": "keyword"
},
"fw_subproduct": {
"ignore_above": 1024,
"type": "keyword"
},
"hide_ip": {
"type": "ip"
},
"hit": {
"type": "long"
},
"host_time": {
"ignore_above": 1024,
"type": "keyword"
},
"http_host": {
"ignore_above": 1024,
"type": "keyword"
},
"http_location": {
"ignore_above": 1024,
"type": "keyword"
},
"http_server": {
"ignore_above": 1024,
"type": "keyword"
},
"https_inspection_action": {
"ignore_above": 1024,
"type": "keyword"
},
"https_inspection_rule_id": {
"ignore_above": 1024,
"type": "keyword"
},
"https_inspection_rule_name": {
"ignore_above": 1024,
"type": "keyword"
},
"https_validation": {
"ignore_above": 1024,
"type": "keyword"
},
"icap_more_info": {
"type": "long"
},
"icap_server_name": {
"ignore_above": 1024,
"type": "keyword"
},
"icap_server_service": {
"ignore_above": 1024,
"type": "keyword"
},
"icap_service_id": {
"type": "long"
},
"icmp": {
"ignore_above": 1024,
"type": "keyword"
},
"icmp_code": {
"type": "long"
},
"icmp_type": {
"type": "long"
},
"id": {
"type": "long"
},
"identity_type": {
"ignore_above": 1024,
"type": "keyword"
},
"ike": {
"ignore_above": 1024,
"type": "keyword"
},
"ike_ids": {
"ignore_above": 1024,
"type": "keyword"
},
"impacted_files": {
"ignore_above": 1024,
"type": "keyword"
},
"incident_extension": {
"ignore_above": 1024,
"type": "keyword"
},
"indicator_description": {
"ignore_above": 1024,
"type": "keyword"
},
"indicator_name": {
"ignore_above": 1024,
"type": "keyword"
},
"indicator_reference": {
"ignore_above": 1024,
"type": "keyword"
},
"indicator_uuid": {
"ignore_above": 1024,
"type": "keyword"
},
"info": {
"ignore_above": 1024,
"type": "keyword"
},
"information": {
"ignore_above": 1024,
"type": "keyword"
},
"inspection_category": {
"ignore_above": 1024,
"type": "keyword"
},
"inspection_item": {
"ignore_above": 1024,
"type": "keyword"
},
"inspection_profile": {
"ignore_above": 1024,
"type": "keyword"
},
"inspection_settings_log": {
"ignore_above": 1024,
"type": "keyword"
},
"installed_products": {
"ignore_above": 1024,
"type": "keyword"
},
"int_end": {
"type": "long"
},
"int_start": {
"type": "long"
},
"integrity_av_invoke_type": {
"ignore_above": 1024,
"type": "keyword"
},
"interface_name": {
"ignore_above": 1024,
"type": "keyword"
},
"internal_error": {
"ignore_above": 1024,
"type": "keyword"
},
"invalid_file_size": {
"type": "long"
},
"ip_option": {
"type": "long"
},
"isp_link": {
"ignore_above": 1024,
"type": "keyword"
},
"last_hit_time": {
"type": "long"
},
"last_rematch_time": {
"ignore_above": 1024,
"type": "keyword"
},
"layer_name": {
"ignore_above": 1024,
"type": "keyword"
},
"layer_uuid": {
"ignore_above": 1024,
"type": "keyword"
},
"limit_applied": {
"type": "long"
},
"limit_requested": {
"type": "long"
},
"link_probing_status_update": {
"ignore_above": 1024,
"type": "keyword"
},
"links_num": {
"type": "long"
},
"log_delay": {
"type": "long"
},
"log_id": {
"type": "long"
},
"logid": {
"ignore_above": 1024,
"type": "keyword"
},
"long_desc": {
"ignore_above": 1024,
"type": "keyword"
},
"machine": {
"ignore_above": 1024,
"type": "keyword"
},
"malware_family": {
"ignore_above": 1024,
"type": "keyword"
},
"match_fk": {
"type": "long"
},
"match_id": {
"type": "long"
},
"matched_file": {
"ignore_above": 1024,
"type": "keyword"
},
"matched_file_percentage": {
"type": "long"
},
"matched_file_text_segments": {
"type": "long"
},
"media_type": {
"ignore_above": 1024,
"type": "keyword"
},
"message": {
"ignore_above": 1024,
"type": "keyword"
},
"message_info": {
"ignore_above": 1024,
"type": "keyword"
},
"message_size": {
"type": "long"
},
"method": {
"ignore_above": 1024,
"type": "keyword"
},
"methods": {
"ignore_above": 1024,
"type": "keyword"
},
"mime_from": {
"ignore_above": 1024,
"type": "keyword"
},
"mime_to": {
"ignore_above": 1024,
"type": "keyword"
},
"mirror_and_decrypt_type": {
"ignore_above": 1024,
"type": "keyword"
},
"mitre_collection": {
"ignore_above": 1024,
"type": "keyword"
},
"mitre_command_and_control": {
"ignore_above": 1024,
"type": "keyword"
},
"mitre_credential_access": {
"ignore_above": 1024,
"type": "keyword"
},
"mitre_defense_evasion": {
"ignore_above": 1024,
"type": "keyword"
},
"mitre_discovery": {
"ignore_above": 1024,
"type": "keyword"
},
"mitre_execution": {
"ignore_above": 1024,
"type": "keyword"
},
"mitre_exfiltration": {
"ignore_above": 1024,
"type": "keyword"
},
"mitre_impact": {
"ignore_above": 1024,
"type": "keyword"
},
"mitre_initial_access": {
"ignore_above": 1024,
"type": "keyword"
},
"mitre_lateral_movement": {
"ignore_above": 1024,
"type": "keyword"
},
"mitre_persistence": {
"ignore_above": 1024,
"type": "keyword"
},
"mitre_privilege_escalation": {
"ignore_above": 1024,
"type": "keyword"
},
"monitor_reason": {
"ignore_above": 1024,
"type": "keyword"
},
"msgid": {
"ignore_above": 1024,
"type": "keyword"
},
"name": {
"ignore_above": 1024,
"type": "keyword"
},
"nat46": {
"ignore_above": 1024,
"type": "keyword"
},
"nat_addtnl_rulenum": {
"type": "long"
},
"nat_exhausted_pool": {
"ignore_above": 1024,
"type": "keyword"
},
"nat_rulenum": {
"type": "long"
},
"needs_browse_time": {
"type": "long"
},
"next_hop_ip": {
"ignore_above": 1024,
"type": "keyword"
},
"next_scheduled_scan_date": {
"ignore_above": 1024,
"type": "keyword"
},
"number_of_errors": {
"type": "long"
},
"objecttable": {
"ignore_above": 1024,
"type": "keyword"
},
"objecttype": {
"ignore_above": 1024,
"type": "keyword"
},
"observable_comment": {
"ignore_above": 1024,
"type": "keyword"
},
"observable_id": {
"ignore_above": 1024,
"type": "keyword"
},
"observable_name": {
"ignore_above": 1024,
"type": "keyword"
},
"operation": {
"ignore_above": 1024,
"type": "keyword"
},
"operation_number": {
"ignore_above": 1024,
"type": "keyword"
},
"origin_sic_name": {
"ignore_above": 1024,
"type": "keyword"
},
"original_queue_id": {
"ignore_above": 1024,
"type": "keyword"
},
"outgoing_url": {
"ignore_above": 1024,
"type": "keyword"
},
"packet_amount": {
"type": "long"
},
"packet_capture_unique_id": {
"ignore_above": 1024,
"type": "keyword"
},
"parent_file_hash": {
"ignore_above": 1024,
"type": "keyword"
},
"parent_file_name": {
"ignore_above": 1024,
"type": "keyword"
},
"parent_file_uid": {
"ignore_above": 1024,
"type": "keyword"
},
"parent_process_username": {
"ignore_above": 1024,
"type": "keyword"
},
"parent_rule": {
"type": "long"
},
"peer_gateway": {
"type": "ip"
},
"peer_ip": {
"ignore_above": 1024,
"type": "keyword"
},
"peer_ip_probing_status_update": {
"ignore_above": 1024,
"type": "keyword"
},
"performance_impact": {
"type": "long"
},
"policy_mgmt": {
"ignore_above": 1024,
"type": "keyword"
},
"policy_name": {
"ignore_above": 1024,
"type": "keyword"
},
"ports_usage": {
"type": "long"
},
"ppp": {
"ignore_above": 1024,
"type": "keyword"
},
"precise_error": {
"ignore_above": 1024,
"type": "keyword"
},
"process_username": {
"ignore_above": 1024,
"type": "keyword"
},
"properties": {
"ignore_above": 1024,
"type": "keyword"
},
"protection_id": {
"ignore_above": 1024,
"type": "keyword"
},
"protection_name": {
"ignore_above": 1024,
"type": "keyword"
},
"protection_type": {
"ignore_above": 1024,
"type": "keyword"
},
"protocol": {
"ignore_above": 1024,
"type": "keyword"
},
"proxy_machine_name": {
"type": "long"
},
"proxy_src_ip": {
"type": "ip"
},
"proxy_user_dn": {
"ignore_above": 1024,
"type": "keyword"
},
"proxy_user_name": {
"ignore_above": 1024,
"type": "keyword"
},
"query": {
"ignore_above": 1024,
"type": "keyword"
},
"question_rdata": {
"ignore_above": 1024,
"type": "keyword"
},
"referrer": {
"ignore_above": 1024,
"type": "keyword"
},
"referrer_parent_uid": {
"ignore_above": 1024,
"type": "keyword"
},
"referrer_self_uid": {
"ignore_above": 1024,
"type": "keyword"
},
"registered_ip-phones": {
"ignore_above": 1024,
"type": "keyword"
},
"reject_category": {
"ignore_above": 1024,
"type": "keyword"
},
"reject_id": {
"ignore_above": 1024,
"type": "keyword"
},
"rematch_info": {
"ignore_above": 1024,
"type": "keyword"
},
"remediated_files": {
"ignore_above": 1024,
"type": "keyword"
},
"reply_status": {
"type": "long"
},
"risk": {
"ignore_above": 1024,
"type": "keyword"
},
"rpc_prog": {
"type": "long"
},
"rule": {
"type": "long"
},
"rule_action": {
"ignore_above": 1024,
"type": "keyword"
},
"rulebase_id": {
"type": "long"
},
"scan_direction": {
"ignore_above": 1024,
"type": "keyword"
},
"scan_hosts_day": {
"type": "long"
},
"scan_hosts_hour": {
"type": "long"
},
"scan_hosts_week": {
"type": "long"
},
"scan_id": {
"ignore_above": 1024,
"type": "keyword"
},
"scan_mail": {
"type": "long"
},
"scan_result": {
"ignore_above": 1024,
"type": "keyword"
},
"scan_results": {
"ignore_above": 1024,
"type": "keyword"
},
"scheme": {
"ignore_above": 1024,
"type": "keyword"
},
"scope": {
"ignore_above": 1024,
"type": "keyword"
},
"scrub_activity": {
"ignore_above": 1024,
"type": "keyword"
},
"scrub_download_time": {
"ignore_above": 1024,
"type": "keyword"
},
"scrub_time": {
"ignore_above": 1024,
"type": "keyword"
},
"scrub_total_time": {
"ignore_above": 1024,
"type": "keyword"
},
"scrubbed_content": {
"ignore_above": 1024,
"type": "keyword"
},
"sctp_association_state": {
"ignore_above": 1024,
"type": "keyword"
},
"sctp_error": {
"ignore_above": 1024,
"type": "keyword"
},
"scv_message_info": {
"ignore_above": 1024,
"type": "keyword"
},
"scv_user": {
"ignore_above": 1024,
"type": "keyword"
},
"securexl_message": {
"ignore_above": 1024,
"type": "keyword"
},
"sensor_mode": {
"ignore_above": 1024,
"type": "keyword"
},
"session_id": {
"ignore_above": 1024,
"type": "keyword"
},
"session_uid": {
"ignore_above": 1024,
"type": "keyword"
},
"severity": {
"ignore_above": 1024,
"type": "keyword"
},
"short_desc": {
"ignore_above": 1024,
"type": "keyword"
},
"sig_id": {
"ignore_above": 1024,
"type": "keyword"
},
"similar_communication": {
"ignore_above": 1024,
"type": "keyword"
},
"similar_hashes": {
"ignore_above": 1024,
"type": "keyword"
},
"similar_strings": {
"ignore_above": 1024,
"type": "keyword"
},
"similiar_iocs": {
"ignore_above": 1024,
"type": "keyword"
},
"sip_reason": {
"ignore_above": 1024,
"type": "keyword"
},
"site_name": {
"ignore_above": 1024,
"type": "keyword"
},
"source_interface": {
"ignore_above": 1024,
"type": "keyword"
},
"source_object": {
"ignore_above": 1024,
"type": "keyword"
},
"source_os": {
"ignore_above": 1024,
"type": "keyword"
},
"special_properties": {
"type": "long"
},
"specific_data_type_name": {
"ignore_above": 1024,
"type": "keyword"
},
"speed": {
"type": "long"
},
"spyware_name": {
"ignore_above": 1024,
"type": "keyword"
},
"spyware_status": {
"ignore_above": 1024,
"type": "keyword"
},
"spyware_type": {
"ignore_above": 1024,
"type": "keyword"
},
"src_country": {
"ignore_above": 1024,
"type": "keyword"
},
"src_phone_number": {
"ignore_above": 1024,
"type": "keyword"
},
"src_user_dn": {
"ignore_above": 1024,
"type": "keyword"
},
"src_user_name": {
"ignore_above": 1024,
"type": "keyword"
},
"srckeyid": {
"ignore_above": 1024,
"type": "keyword"
},
"status": {
"ignore_above": 1024,
"type": "keyword"
},
"status_update": {
"ignore_above": 1024,
"type": "keyword"
},
"sub_policy_name": {
"ignore_above": 1024,
"type": "keyword"
},
"sub_policy_uid": {
"ignore_above": 1024,
"type": "keyword"
},
"subs_exp": {
"type": "date"
},
"subscriber": {
"type": "ip"
},
"summary": {
"ignore_above": 1024,
"type": "keyword"
},
"suppressed_logs": {
"type": "long"
},
"sync": {
"ignore_above": 1024,
"type": "keyword"
},
"sys_message": {
"ignore_above": 1024,
"type": "keyword"
},
"tcp_end_reason": {
"ignore_above": 1024,
"type": "keyword"
},
"tcp_flags": {
"ignore_above": 1024,
"type": "keyword"
},
"tcp_packet_out_of_state": {
"ignore_above": 1024,
"type": "keyword"
},
"tcp_state": {
"ignore_above": 1024,
"type": "keyword"
},
"te_verdict_determined_by": {
"ignore_above": 1024,
"type": "keyword"
},
"termination_reason": {
"ignore_above": 1024,
"type": "keyword"
},
"ticket_id": {
"ignore_above": 1024,
"type": "keyword"
},
"tls_server_host_name": {
"ignore_above": 1024,
"type": "keyword"
},
"top_archive_file_name": {
"ignore_above": 1024,
"type": "keyword"
},
"total_attachments": {
"type": "long"
},
"triggered_by": {
"ignore_above": 1024,
"type": "keyword"
},
"trusted_domain": {
"ignore_above": 1024,
"type": "keyword"
},
"unique_detected_day": {
"type": "long"
},
"unique_detected_hour": {
"type": "long"
},
"unique_detected_week": {
"type": "long"
},
"update_status": {
"ignore_above": 1024,
"type": "keyword"
},
"url": {
"ignore_above": 1024,
"type": "keyword"
},
"user": {
"ignore_above": 1024,
"type": "keyword"
},
"user_agent": {
"ignore_above": 1024,
"type": "keyword"
},
"user_status": {
"ignore_above": 1024,
"type": "keyword"
},
"uuid": {
"ignore_above": 1024,
"type": "keyword"
},
"vendor_list": {
"ignore_above": 1024,
"type": "keyword"
},
"verdict": {
"ignore_above": 1024,
"type": "keyword"
},
"via": {
"ignore_above": 1024,
"type": "keyword"
},
"virus_name": {
"ignore_above": 1024,
"type": "keyword"
},
"voip_attach_action_info": {
"ignore_above": 1024,
"type": "keyword"
},
"voip_attach_sz": {
"type": "long"
},
"voip_call_dir": {
"ignore_above": 1024,
"type": "keyword"
},
"voip_call_id": {
"ignore_above": 1024,
"type": "keyword"
},
"voip_call_state": {
"ignore_above": 1024,
"type": "keyword"
},
"voip_call_term_time": {
"ignore_above": 1024,
"type": "keyword"
},
"voip_config": {
"ignore_above": 1024,
"type": "keyword"
},
"voip_duration": {
"ignore_above": 1024,
"type": "keyword"
},
"voip_est_codec": {
"ignore_above": 1024,
"type": "keyword"
},
"voip_exp": {
"type": "long"
},
"voip_from_user_type": {
"ignore_above": 1024,
"type": "keyword"
},
"voip_log_type": {
"ignore_above": 1024,
"type": "keyword"
},
"voip_media_codec": {
"ignore_above": 1024,
"type": "keyword"
},
"voip_media_ipp": {
"ignore_above": 1024,
"type": "keyword"
},
"voip_media_port": {
"ignore_above": 1024,
"type": "keyword"
},
"voip_method": {
"ignore_above": 1024,
"type": "keyword"
},
"voip_reason_info": {
"ignore_above": 1024,
"type": "keyword"
},
"voip_reg_int": {
"type": "long"
},
"voip_reg_ipp": {
"type": "long"
},
"voip_reg_period": {
"type": "long"
},
"voip_reg_server": {
"type": "ip"
},
"voip_reg_user_type": {
"ignore_above": 1024,
"type": "keyword"
},
"voip_reject_reason": {
"ignore_above": 1024,
"type": "keyword"
},
"voip_to_user_type": {
"ignore_above": 1024,
"type": "keyword"
},
"vpn_feature_name": {
"ignore_above": 1024,
"type": "keyword"
},
"watermark": {
"ignore_above": 1024,
"type": "keyword"
},
"web_server_type": {
"ignore_above": 1024,
"type": "keyword"
},
"word_list": {
"ignore_above": 1024,
"type": "keyword"
}
}
}
}
}
}
}

File: salt/elasticsearch/templates/component/ecs/cisco.json Copy Chapter

{
"_meta": {
"documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-base.html",
"ecs_version": "1.12.2"
},
"template": {
"mappings": {
"properties": {
"cisco": {
"properties": {
"amp": {
"properties": {
"bp_data": {
"type": "flattened"
},
"cloud_ioc": {
"properties": {
"description": {
"ignore_above": 1024,
"type": "keyword"
},
"short_description": {
"ignore_above": 1024,
"type": "keyword"
}
}
},
"command_line": {
"properties": {
"arguments": {
"ignore_above": 1024,
"type": "keyword"
}
}
},
"computer": {
"properties": {
"active": {
"type": "boolean"
},
"connector_guid": {
"ignore_above": 1024,
"type": "keyword"
},
"external_ip": {
"type": "ip"
},
"network_addresses": {
"type": "flattened"
}
}
},
"connector_guid": {
"ignore_above": 1024,
"type": "keyword"
},
"detection": {
"ignore_above": 1024,
"type": "keyword"
},
"detection_id": {
"ignore_above": 1024,
"type": "keyword"
},
"error": {
"properties": {
"description": {
"ignore_above": 1024,
"type": "keyword"
},
"error_code": {
"ignore_above": 1024,
"type": "keyword"
}
}
},
"event_type_id": {
"ignore_above": 1024,
"type": "keyword"
},
"file": {
"properties": {
"archived_file": {
"properties": {
"disposition": {
"ignore_above": 1024,
"type": "keyword"
},
"identity": {
"properties": {
"md5": {
"ignore_above": 1024,
"type": "keyword"
},
"sha1": {
"ignore_above": 1024,
"type": "keyword"
},
"sha256": {
"ignore_above": 1024,
"type": "keyword"
}
}
}
}
},
"attack_details": {
"properties": {
"application": {
"ignore_above": 1024,
"type": "keyword"
},
"attacked_module": {
"ignore_above": 1024,
"type": "keyword"
},
"base_address": {
"ignore_above": 1024,
"type": "keyword"
},
"indicators": {
"type": "flattened"
},
"suspicious_files": {
"ignore_above": 1024,
"type": "keyword"
}
}
},
"disposition": {
"ignore_above": 1024,
"type": "keyword"
},
"parent": {
"properties": {
"disposition": {
"ignore_above": 1024,
"type": "keyword"
}
}
}
}
},
"group_guids": {
"ignore_above": 1024,
"type": "keyword"
},
"mitre_tactics": {
"ignore_above": 1024,
"type": "keyword"
},
"mitre_techniques": {
"ignore_above": 1024,
"type": "keyword"
},
"network_info": {
"properties": {
"disposition": {
"ignore_above": 1024,
"type": "keyword"
},
"nfm": {
"properties": {
"direction": {
"ignore_above": 1024,
"type": "keyword"
}
}
},
"parent": {
"properties": {
"disposition": {
"ignore_above": 1024,
"type": "keyword"
},
"identify": {
"properties": {
"sha256": {
"ignore_above": 1024,
"type": "keyword"
}
}
},
"identity": {
"properties": {
"md5": {
"ignore_above": 1024,
"type": "keyword"
},
"sha1": {
"ignore_above": 1024,
"type": "keyword"
}
}
}
}
}
}
},
"related": {
"properties": {
"cve": {
"ignore_above": 1024,
"type": "keyword"
},
"mac": {
"ignore_above": 1024,
"type": "keyword"
}
}
},
"scan": {
"properties": {
"clean": {
"type": "boolean"
},
"description": {
"ignore_above": 1024,
"type": "keyword"
},
"malicious_detections": {
"type": "long"
},
"scanned_files": {
"type": "long"
},
"scanned_paths": {
"type": "long"
},
"scanned_processes": {
"type": "long"
}
}
},
"tactics": {
"type": "flattened"
},
"techniques": {
"type": "flattened"
},
"threat_hunting": {
"properties": {
"incident_end_time": {
"type": "date"
},
"incident_hunt_guid": {
"ignore_above": 1024,
"type": "keyword"
},
"incident_id": {
"ignore_above": 1024,
"type": "keyword"
},
"incident_remediation": {
"ignore_above": 1024,
"type": "keyword"
},
"incident_report_guid": {
"ignore_above": 1024,
"type": "keyword"
},
"incident_start_time": {
"type": "date"
},
"incident_summary": {
"ignore_above": 1024,
"type": "keyword"
},
"incident_title": {
"ignore_above": 1024,
"type": "keyword"
},
"severity": {
"ignore_above": 1024,
"type": "keyword"
},
"tactics": {
"type": "flattened"
},
"techniques": {
"type": "flattened"
}
}
},
"timestamp_nanoseconds": {
"type": "date"
},
"vulnerabilities": {
"type": "flattened"
}
}
},
"asa": {
"properties": {
"assigned_ip": {
"type": "ip"
},
"burst": {
"properties": {
"avg_rate": {
"ignore_above": 1024,
"type": "keyword"
},
"configured_avg_rate": {
"ignore_above": 1024,
"type": "keyword"
},
"configured_rate": {
"ignore_above": 1024,
"type": "keyword"
},
"cumulative_count": {
"ignore_above": 1024,
"type": "keyword"
},
"current_rate": {
"ignore_above": 1024,
"type": "keyword"
},
"id": {
"ignore_above": 1024,
"type": "keyword"
},
"object": {
"ignore_above": 1024,
"type": "keyword"
}
}
},
"command_line_arguments": {
"ignore_above": 1024,
"type": "keyword"
},
"connection_id": {
"ignore_above": 1024,
"type": "keyword"
},
"connection_type": {
"ignore_above": 1024,
"type": "keyword"
},
"dap_records": {
"ignore_above": 1024,
"type": "keyword"
},
"destination_interface": {
"ignore_above": 1024,
"type": "keyword"
},
"destination_username": {
"ignore_above": 1024,
"type": "keyword"
},
"icmp_code": {
"type": "short"
},
"icmp_type": {
"type": "short"
},
"mapped_destination_host": {
"ignore_above": 1024,
"type": "keyword"
},
"mapped_destination_ip": {
"type": "ip"
},
"mapped_destination_port": {
"type": "long"
},
"mapped_source_host": {
"ignore_above": 1024,
"type": "keyword"
},
"mapped_source_ip": {
"type": "ip"
},
"mapped_source_port": {
"type": "long"
},
"message_id": {
"ignore_above": 1024,
"type": "keyword"
},
"privilege": {
"properties": {
"new": {
"ignore_above": 1024,
"type": "keyword"
},
"old": {
"ignore_above": 1024,
"type": "keyword"
}
}
},
"rule_name": {
"ignore_above": 1024,
"type": "keyword"
},
"session_type": {
"ignore_above": 1024,
"type": "keyword"
},
"source_interface": {
"ignore_above": 1024,
"type": "keyword"
},
"source_username": {
"ignore_above": 1024,
"type": "keyword"
},
"suffix": {
"ignore_above": 1024,
"type": "keyword"
},
"termination_initiator": {
"ignore_above": 1024,
"type": "keyword"
},
"termination_user": {
"ignore_above": 1024,
"type": "keyword"
},
"threat_category": {
"ignore_above": 1024,
"type": "keyword"
},
"threat_level": {
"ignore_above": 1024,
"type": "keyword"
},
"tunnel_type": {
"ignore_above": 1024,
"type": "keyword"
},
"webvpn": {
"properties": {
"group_name": {
"ignore_above": 1024,
"type": "keyword"
}
}
}
}
},
"ftd": {
"properties": {
"connection_id": {
"ignore_above": 1024,
"type": "keyword"
},
"connection_type": {
"ignore_above": 1024,
"type": "keyword"
},
"dap_records": {
"ignore_above": 1024,
"type": "keyword"
},
"destination_interface": {
"ignore_above": 1024,
"type": "keyword"
},
"destination_username": {
"ignore_above": 1024,
"type": "keyword"
},
"icmp_code": {
"type": "short"
},
"icmp_type": {
"type": "short"
},
"mapped_destination_host": {
"ignore_above": 1024,
"type": "keyword"
},
"mapped_destination_ip": {
"type": "ip"
},
"mapped_destination_port": {
"type": "long"
},
"mapped_source_host": {
"ignore_above": 1024,
"type": "keyword"
},
"mapped_source_ip": {
"type": "ip"
},
"mapped_source_port": {
"type": "long"
},
"message_id": {
"ignore_above": 1024,
"type": "keyword"
},
"rule_name": {
"ignore_above": 1024,
"type": "keyword"
},
"security": {
"type": "object"
},
"source_interface": {
"ignore_above": 1024,
"type": "keyword"
},
"source_username": {
"ignore_above": 1024,
"type": "keyword"
},
"suffix": {
"ignore_above": 1024,
"type": "keyword"
},
"termination_initiator": {
"ignore_above": 1024,
"type": "keyword"
},
"termination_user": {
"ignore_above": 1024,
"type": "keyword"
},
"threat_category": {
"ignore_above": 1024,
"type": "keyword"
},
"threat_level": {
"ignore_above": 1024,
"type": "keyword"
},
"webvpn": {
"properties": {
"group_name": {
"ignore_above": 1024,
"type": "keyword"
}
}
}
}
},
"ios": {
"properties": {
"access_list": {
"ignore_above": 1024,
"type": "keyword"
},
"facility": {
"ignore_above": 1024,
"type": "keyword"
}
}
},
"umbrella": {
"properties": {
"amp_disposition": {
"ignore_above": 1024,
"type": "keyword"
},
"amp_malware_name": {
"ignore_above": 1024,
"type": "keyword"
},
"amp_score": {
"ignore_above": 1024,
"type": "keyword"
},
"av_detections": {
"ignore_above": 1024,
"type": "keyword"
},
"blocked_categories": {
"ignore_above": 1024,
"type": "keyword"
},
"categories": {
"ignore_above": 1024,
"type": "keyword"
},
"content_type": {
"ignore_above": 1024,
"type": "keyword"
},
"datacenter": {
"ignore_above": 1024,
"type": "keyword"
},
"identities": {
"ignore_above": 1024,
"type": "keyword"
},
"identity_types": {
"ignore_above": 1024,
"type": "keyword"
},
"origin_id": {
"ignore_above": 1024,
"type": "keyword"
},
"policy_identity_type": {
"ignore_above": 1024,
"type": "keyword"
},
"puas": {
"ignore_above": 1024,
"type": "keyword"
},
"sha_sha256": {
"ignore_above": 1024,
"type": "keyword"
}
}
}
}
}
}
}
}
}

File: salt/elasticsearch/templates/component/ecs/client.json Copy Chapter

{
"_meta": {
"documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-client.html",
"ecs_version": "1.12.2"
},
"template": {
"mappings": {
"properties": {
"client": {
"properties": {
"address": {
"ignore_above": 1024,
"type": "keyword"
},
"as": {
"properties": {
"number": {
"type": "long"
},
"organization": {
"properties": {
"name": {
"ignore_above": 1024,
"type": "keyword"
}
}
}
}
},
"bytes": {
"type": "long"
},
"domain": {
"ignore_above": 1024,
"type": "keyword"
},
"geo": {
"properties": {
"city_name": {
"ignore_above": 1024,
"type": "keyword"
},
"continent_code": {
"ignore_above": 1024,
"type": "keyword"
},
"continent_name": {
"ignore_above": 1024,
"type": "keyword"
},
"country_iso_code": {
"ignore_above": 1024,
"type": "keyword"
},
"country_name": {
"ignore_above": 1024,
"type": "keyword"
},
"location": {
"type": "geo_point"
},
"name": {
"ignore_above": 1024,
"type": "keyword"
},
"postal_code": {
"ignore_above": 1024,
"type": "keyword"
},
"region_iso_code": {
"ignore_above": 1024,
"type": "keyword"
},
"region_name": {
"ignore_above": 1024,
"type": "keyword"
},
"timezone": {
"ignore_above": 1024,
"type": "keyword"
}
}
},
"ip": {
"type": "ip"
},
"mac": {
"ignore_above": 1024,
"type": "keyword"
},
"nat": {
"properties": {
"ip": {
"type": "ip"
},
"port": {
"type": "long"
}
}
},
"packets": {
"type": "long"
},
"port": {
"type": "long"
},
"registered_domain": {
"ignore_above": 1024,
"type": "keyword"
},
"subdomain": {
"ignore_above": 1024,
"type": "keyword"
},
"top_level_domain": {
"ignore_above": 1024,
"type": "keyword"
},
"user": {
"properties": {
"domain": {
"ignore_above": 1024,
"type": "keyword"
},
"email": {
"ignore_above": 1024,
"type": "keyword"
},
"full_name": {
"ignore_above": 1024,
"type": "keyword"
},
"group": {
"properties": {
"domain": {
"ignore_above": 1024,
"type": "keyword"
},
"id": {
"ignore_above": 1024,
"type": "keyword"
},
"name": {
"ignore_above": 1024,
"type": "keyword"
}
}
},
"hash": {
"ignore_above": 1024,
"type": "keyword"
},
"id": {
"ignore_above": 1024,
"type": "keyword"
},
"name": {
"ignore_above": 1024,
"type": "keyword"
},
"roles": {
"ignore_above": 1024,
"type": "keyword"
}
}
}
}
}
}
}
}
}

File: salt/elasticsearch/templates/component/ecs/cloud.json Copy Chapter

{
"_meta": {
"documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-cloud.html",
"ecs_version": "1.12.2"
},
"template": {
"mappings": {
"properties": {
"cloud": {
"properties": {
"account": {
"properties": {
"id": {
"ignore_above": 1024,
"type": "keyword"
},
"name": {
"ignore_above": 1024,
"type": "keyword"
}
}
},
"availability_zone": {
"ignore_above": 1024,
"type": "keyword"
},
"instance": {
"properties": {
"id": {
"ignore_above": 1024,
"type": "keyword"
},
"name": {
"ignore_above": 1024,
"type": "keyword"
}
}
},
"machine": {
"properties": {
"type": {
"ignore_above": 1024,
"type": "keyword"
}
}
},
"project": {
"properties": {
"id": {
"ignore_above": 1024,
"type": "keyword"
},
"name": {
"ignore_above": 1024,
"type": "keyword"
}
}
},
"provider": {
"ignore_above": 1024,
"type": "keyword"
},
"region": {
"ignore_above": 1024,
"type": "keyword"
},
"service": {
"properties": {
"name": {
"ignore_above": 1024,
"type": "keyword"
}
}
}
}
}
}
}
}
}

File: salt/elasticsearch/templates/component/ecs/container.json Copy Chapter

{
"_meta": {
"documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-container.html",
"ecs_version": "1.12.2"
},
"template": {
"mappings": {
"properties": {
"container": {
"properties": {
"id": {
"ignore_above": 1024,
"type": "keyword"
},
"image": {
"properties": {
"name": {
"ignore_above": 1024,
"type": "keyword"
},
"tag": {
"ignore_above": 1024,
"type": "keyword"
}
}
},
"labels": {
"type": "object"
},
"name": {
"ignore_above": 1024,
"type": "keyword"
},
"runtime": {
"ignore_above": 1024,
"type": "keyword"
}
}
}
}
}
}
}