diff --git a/docker/elk/logstash/dist/logstash.conf b/docker/elk/logstash/dist/logstash.conf index 603684e3..f57aa7f4 100644 --- a/docker/elk/logstash/dist/logstash.conf +++ b/docker/elk/logstash/dist/logstash.conf @@ -64,6 +64,13 @@ input { type => "Dionaea" } +# Dicompot + file { + path => ["/data/dicompot/log/dicompot.log"] + codec => json + type => "Dicompot" + } + # ElasticPot file { path => ["/data/elasticpot/log/elasticpot.json"] @@ -298,6 +305,34 @@ filter { } } +# Dicompot + if [type] == "Dicompot" { + date { + match => [ "time", "yyyy-MM-dd HH:mm:ss" ] + remove_field => ["time"] + remove_field => ["timestamp"] + } + mutate { + rename => { + "[Address][IP]" => "src_ip" + "[Address][Port]" => "src_port" + "[Address][Zone]" => "zone" + "AETitle" => "aetitle" + "Command" => "input" + "Files" => "files" + "Identifier" => "identifier" + "Matches" => "matches" + "Status" => "session" + "Version" => "version" + } + } + if [Address] { + mutate { + remove_field => "[Address]" + } + } + } + # ElasticPot if [type] == "ElasticPot" { date { diff --git a/etc/objects/elkbase.tgz b/etc/objects/elkbase.tgz index 5232b520..aea78c71 100644 Binary files a/etc/objects/elkbase.tgz and b/etc/objects/elkbase.tgz differ diff --git a/etc/objects/kibana-objects.tgz b/etc/objects/kibana-objects.tgz index 0a844859..6dc1cb1d 100644 Binary files a/etc/objects/kibana-objects.tgz and b/etc/objects/kibana-objects.tgz differ