Alex-Devera/tpotce
1
0
Fork 0
mirror of https://github.com/telekom-security/tpotce.git synced 2025-07-02 04:52:11 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

fix data fields with regard to the request field, log4pot, nginx

Browse source
This commit is contained in:
t3chn0m4g3 2022-01-17 14:50:50 +00:00
parent 2226780086
commit 68d6aa4180
2 changed files with 33 additions and 21 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

48
docker/elk/logstash/dist/http_output.conf vendored
View file

@ -1,12 +1,12 @@
# Input section # Input section
input { input {
# Fatt # Fatt
file { file {
path => ["/data/fatt/log/fatt.log"] path => ["/data/fatt/log/fatt.log"]
codec => json codec => json
type => "Fatt" type => "Fatt"
} }
# Suricata # Suricata
file { file {
@ -279,13 +279,13 @@ filter {
# CitrixHoneypot # CitrixHoneypot
if [type] == "CitrixHoneypot" { if [type] == "CitrixHoneypot" {
grok { grok {
match => { match => {
"message" => [ "\A\(%{IPV4:src_ip:string}:%{INT:src_port:integer}\): %{JAVAMETHOD:http.http_method:string}%{SPACE}%{CISCO_REASON:fileinfo.state:string}: %{UNIXPATH:fileinfo.filename:string}", "message" => [ "\A\(%{IPV4:src_ip:string}:%{INT:src_port:integer}\): %{JAVAMETHOD:http.http_method:string}%{SPACE}%{CISCO_REASON:fileinfo.state:string}: %{UNIXPATH:fileinfo.filename:string}",
"\A\(%{IPV4:src_ip:string}:%{INT:src_port:integer}\): %{JAVAMETHOD:http.http_method:string}%{SPACE}%{CISCO_REASON:fileinfo.state:string}: %{GREEDYDATA:payload:string}", "\A\(%{IPV4:src_ip:string}:%{INT:src_port:integer}\): %{JAVAMETHOD:http.http_method:string}%{SPACE}%{CISCO_REASON:fileinfo.state:string}: %{GREEDYDATA:payload:string}",
"\A\(%{IPV4:src_ip:string}:%{INT:src_port:integer}\): %{S3_REQUEST_LINE:msg:string} %{CISCO_REASON:fileinfo.state:string}: %{GREEDYDATA:payload:string:string}", "\A\(%{IPV4:src_ip:string}:%{INT:src_port:integer}\): %{S3_REQUEST_LINE:msg:string} %{CISCO_REASON:fileinfo.state:string}: %{GREEDYDATA:payload:string:string}",
"\A\(%{IPV4:src_ip:string}:%{INT:src_port:integer}\): %{GREEDYDATA:msg:string}" ] "\A\(%{IPV4:src_ip:string}:%{INT:src_port:integer}\): %{GREEDYDATA:msg:string}" ]
} }
} }
date { date {
match => [ "asctime", "ISO8601" ] match => [ "asctime", "ISO8601" ]
@ -301,18 +301,18 @@ filter {
} }
} }
} }
# Conpot # Conpot
if [type] == "ConPot" { if [type] == "ConPot" {
date { date {
match => [ "timestamp", "ISO8601" ] match => [ "timestamp", "ISO8601" ]
} }
mutate { mutate {
rename => { rename => {
"dst_port" => "dest_port" "dst_port" => "dest_port"
"dst_ip" => "dest_ip" "dst_ip" => "dest_ip"
} }
} }
} }
# Cowrie # Cowrie
@ -439,7 +439,7 @@ filter {
# Example: 2021-10-29T21:08:31.026Z CLOSE host=1.2.3.4 port=12345 fd=4 time=20.015 bytes=24 # Example: 2021-10-29T21:08:31.026Z CLOSE host=1.2.3.4 port=12345 fd=4 time=20.015 bytes=24
# Example: 2021-10-29T21:08:11.011Z ACCEPT host=1.2.3.4 port=12346 fd=4 n=1/4096 # Example: 2021-10-29T21:08:11.011Z ACCEPT host=1.2.3.4 port=12346 fd=4 n=1/4096
if [type] == "Endlessh" { if [type] == "Endlessh" {
grok { match => { "message" => [ "\A%{TIMESTAMP_ISO8601:timestamp}%{SPACE}%{WORD:reason}%{SPACE}host=%{IPV4:src_ip}%{SPACE}port=%{INT:src_port}%{SPACE}fd=%{INT}%{SPACE}time=%{SECOND:duration}%{SPACE}bytes=%{NUMBER:bytes}", "\A%{TIMESTAMP_ISO8601:timestamp}%{SPACE}%{WORD:reason}%{SPACE}host=%{IPV4:src_ip}%{SPACE}port=%{INT:src_port}%{SPACE}fd=%{INT}%{SPACE}n=%{INT}/%{INT}" ] } } grok { match => { "message" => [ "\A%{TIMESTAMP_ISO8601:timestamp}%{SPACE}%{WORD:reason}%{SPACE}host=%{IPV4:src_ip}%{SPACE}port=%{INT:src_port}%{SPACE}fd=%{INT}%{SPACE}time=%{SECOND:duration}%{SPACE}bytes=%{NUMBER:bytes}", "\A%{TIMESTAMP_ISO8601:timestamp}%{SPACE}%{WORD:reason}%{SPACE}host=%{IPV4:src_ip}%{SPACE}port=%{INT:src_port}%{SPACE}fd=%{INT}%{SPACE}n=%{INT}/%{INT}" ] } }
date { date {
match => [ "timestamp", "ISO8601" ] match => [ "timestamp", "ISO8601" ]
remove_field => ["timestamp"] remove_field => ["timestamp"]
@ -534,7 +534,7 @@ filter {
mutate { mutate {
remove_field => "[data]" remove_field => "[data]"
} }
} }
} }
# Honeytrap # Honeytrap
@ -578,6 +578,7 @@ filter {
} }
mutate { mutate {
rename => { rename => {
"request" => "request_uri"
"server_port" => "dest_port" "server_port" => "dest_port"
"port" => "src_port" "port" => "src_port"
"client" => "src_ip" "client" => "src_ip"
@ -629,8 +630,8 @@ filter {
} }
mutate { mutate {
split => { "addr" => ":" } split => { "addr" => ":" }
add_field => { add_field => {
"src_ip" => "%{[addr][0]}" "src_ip" => "%{[addr][0]}"
"src_port" => "%{[addr][1]}" "src_port" => "%{[addr][1]}"
"dest_port" => "6379" "dest_port" => "6379"
"dest_ip" => "${MY_EXTIP}" "dest_ip" => "${MY_EXTIP}"
@ -644,6 +645,11 @@ filter {
date { date {
match => [ "timestamp", "ISO8601" ] match => [ "timestamp", "ISO8601" ]
} }
mutate {
rename => {
"request" => "request_data"
}
}
} }
# Tanner # Tanner

6
docker/elk/logstash/dist/logstash.conf vendored
View file

@ -578,6 +578,7 @@ filter {
} }
mutate { mutate {
rename => { rename => {
"request" => "request_uri"
"server_port" => "dest_port" "server_port" => "dest_port"
"port" => "src_port" "port" => "src_port"
"client" => "src_ip" "client" => "src_ip"
@ -644,6 +645,11 @@ filter {
date { date {
match => [ "timestamp", "ISO8601" ] match => [ "timestamp", "ISO8601" ]
} }
mutate {
rename => {
"request" => "request_data"
}
}
} }
# Tanner # Tanner