Alex-Devera/tpotce
1
0
Fork 0
mirror of https://github.com/telekom-security/tpotce.git synced 2025-07-01 04:22:11 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

continue working on fatt

Browse source
This commit is contained in:
t3chn0m4g3 2019-06-03 10:22:07 +00:00
parent 4e902b6560
commit f870c8e885
2 changed files with 24 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

23
docker/elk/logstash/dist/logstash.conf vendored
View file

@ -1,6 +1,13 @@
# Input section # Input section
input { input {
# Fatt
file {
path => ["/data/fatt/log/fatt.log"]
codec => json
type => "Fatt"
}
# Suricata # Suricata
file { file {
path => ["/data/suricata/log/eve.json"] path => ["/data/suricata/log/eve.json"]
@ -128,6 +135,22 @@ input {
# Filter Section # Filter Section
filter { filter {
# Fatt
if [type] == "Fatt" {
date {
match => [ "timestamp", "ISO8601" ]
}
mutate {
rename => {
"sourceIp" => "src_ip"
"destinationIp" => "dest_ip"
"sourcePort" => "src_port"
"destinationPort" => "dest_port"
}
}
}
# Suricata # Suricata
if [type] == "Suricata" { if [type] == "Suricata" {
date { date {

1
update.sh
View file

@ -218,6 +218,7 @@ mkdir -p /data/adbhoney/downloads /data/adbhoney/log \
/data/dionaea/log /data/dionaea/bistreams /data/dionaea/binaries /data/dionaea/rtp /data/dionaea/roots/ftp /data/dionaea/roots/tftp /data/dionaea/roots/www /data/dionaea/roots/upnp \ /data/dionaea/log /data/dionaea/bistreams /data/dionaea/binaries /data/dionaea/rtp /data/dionaea/roots/ftp /data/dionaea/roots/tftp /data/dionaea/roots/www /data/dionaea/roots/upnp \
/data/elasticpot/log \ /data/elasticpot/log \
/data/elk/data /data/elk/log \ /data/elk/data /data/elk/log \
/data/fatt/log \
/data/glastopf/log /data/glastopf/db \ /data/glastopf/log /data/glastopf/db \
/data/honeytrap/log/ /data/honeytrap/attacks/ /data/honeytrap/downloads/ \ /data/honeytrap/log/ /data/honeytrap/attacks/ /data/honeytrap/downloads/ \
/data/glutton/log \ /data/glutton/log \