diff --git a/packages/cisco_meraki/_dev/build/docs/README.md b/packages/cisco_meraki/_dev/build/docs/README.md index 643dbd8f4d29..40416801d21a 100644 --- a/packages/cisco_meraki/_dev/build/docs/README.md +++ b/packages/cisco_meraki/_dev/build/docs/README.md @@ -1,16 +1,64 @@ # Cisco Meraki Integration -This integration is for Cisco Meraki device's logs. It includes the following -datasets for receiving logs over syslog or read from a file: +Cisco Meraki offers a centralized cloud management platform for all Meraki devices such as MX Security Appliances, MR Access Points and so on. Its out-of-band cloud architecture creates secure, scalable and easy-to-deploy networks that can be managed from anywhere. This can be done from almost any device using web-based Meraki Dashboard and Meraki Mobile App. Each Meraki network generates its own events. -- `log` dataset: supports Cisco Meraki logs. +Cisco Meraki offers [several methods for device reporting](https://documentation.meraki.com/General_Administration/Monitoring_and_Reporting/Meraki_Device_Reporting_-_Syslog%2C_SNMP%2C_and_API). This integration supports gathering events via the Cisco Meraki syslog and via API reporting webhooks. The integration package allows you to search, observe, and visualize the events through Elasticsearch. + +## Compatibility + +A syslog server can be configured to store messages for reporting purposes from MX Security Appliances, MR Access Points, and MS switches. This package collects events from the configured syslog server. The integration supports collection of events from "MX Security Appliances" and "MR Access Points". The "MS Switch" events are not recognized. + +## Configuration + +### Enabling the integration in Elastic + +1. In Kibana go to **Management > Integrations** +2. In "Search for integrations" search bar type **Meraki** +3. Click on "Cisco Meraki" integration from the search results. +4. Click on **Add Cisco Meraki Integration** button to add the integration. + +### Cisco Meraki Dashboard Configuration + +#### Syslog + +Cisco Meraki dashboard can be used to configure one or more syslog servers and Meraki message types to be sent to the syslog servers. Refer to [Syslog Server Overview and Configuration](https://documentation.meraki.com/General_Administration/Monitoring_and_Reporting/Syslog_Server_Overview_and_Configuration#Configuring_a_Syslog_Server) page for more information on how to configure syslog server on Cisco Meraki. + +#### API Endpoint (Webhooks) + +Cisco Meraki dashboard can be used to configure Meraki webhooks. Refer to the [Webhooks Dashboard Setup](https://documentation.meraki.com/General_Administration/Monitoring_and_Reporting/Meraki_Device_Reporting_-_Syslog%2C_SNMP%2C_and_API#Webhooks_Dashboard_Setup) section. + +### Configure the Cisco Meraki integration + +#### Syslog + +Depending on the syslog server setup in your environment check one/more of the following options "Collect syslog from Cisco Meraki via UDP", "Collect syslog from Cisco Meraki via TCP", "Collect syslog from Cisco Meraki via file". + +Enter the values for syslog host and port OR file path based on the chosen configuration options. + +### API Endpoint (Webhooks) + +Check the option "Collect events from Cisco Meraki via Webhooks" option. + +1. Enter values for "Listen Address", "Listen Port" and "Webhook path" to form the endpoint URL. Make note of the **Endpoint URL** https://{AGENT_ADDRESS}:8686/meraki/events. +2. Enter value for "Secret value". This must match the "Shared Secret" value entered when configuring the webhook from Meraki cloud. +3. Enter values for "TLS". Cisco Meraki requires that the webhook accept requests over HTTPS. So you must either configure the integration with a valid TLS certificate or use a reverse proxy in front of the integration. + +### Log Events + +Enable to collect Cisco Meraki log events for all the applications configured for the chosen log stream. ## Logs -### Meraki +### Syslog + +The `cisco_meraki.log` dataset provides events from the configured syslog server. All Cisco Meraki syslog specific fields are available in the `cisco_meraki.log` field group. -The `log` dataset collects Cisco Meraki logs. +{{fields "log"}} {{event "log"}} -{{fields "log"}} +### API Endpoint (Webhooks) + +{{fields "events"}} + +{{event "events"}} diff --git a/packages/cisco_meraki/_dev/deploy/docker/docker-compose.yml b/packages/cisco_meraki/_dev/deploy/docker/docker-compose.yml index ce2f6353fe99..7714b7408618 100644 --- a/packages/cisco_meraki/_dev/deploy/docker/docker-compose.yml +++ b/packages/cisco_meraki/_dev/deploy/docker/docker-compose.yml @@ -1,18 +1,37 @@ -version: "2.3" +version: '2.3' services: - cisco-logfile: + meraki-webhook-http: + image: docker.elastic.co/observability/stream:v0.6.2 + volumes: + - ./sample_events:/sample_events:ro + environment: + - STREAM_PROTOCOL=webhook + - STREAM_ADDR=http://elastic-agent:8686/meraki/events + - STREAM_WEBHOOK_HEADER=Authorization=abc123 + command: log --start-signal=SIGHUP --delay=5s /sample_events/meraki-mx-ndjson.log + meraki-webhook-https: + image: docker.elastic.co/observability/stream:v0.6.2 + volumes: + - ./sample_events:/sample_events:ro + environment: + - STREAM_PROTOCOL=webhook + - STREAM_ADDR=https://elastic-agent:8686/meraki/events + - STREAM_WEBHOOK_HEADER=Authorization=abc123 + - STREAM_INSECURE=true + command: log --start-signal=SIGHUP --delay=5s /sample_events/meraki-mx-ndjson.log + cisco_meraki-log-logfile: image: alpine volumes: - ./sample_logs:/sample_logs:ro - ${SERVICE_LOGS_DIR}:/var/log command: /bin/sh -c "cp /sample_logs/* /var/log/" - cisco-meraki-udp: - image: docker.elastic.co/observability/stream:v0.5.0 + cisco_meraki-log-udp: + image: docker.elastic.co/observability/stream:v0.6.2 volumes: - ./sample_logs:/sample_logs:ro - command: log --start-signal=SIGHUP --delay=5s --addr elastic-agent:9514 -p=udp /sample_logs/cisco-meraki.log - cisco-meraki-tcp: - image: docker.elastic.co/observability/stream:v0.5.0 + command: log --start-signal=SIGHUP --delay=5s --addr elastic-agent:8685 -p=udp /sample_logs/cisco-meraki.log + cisco_meraki-log-tcp: + image: docker.elastic.co/observability/stream:v0.6.2 volumes: - ./sample_logs:/sample_logs:ro - command: log --start-signal=SIGHUP --delay=5s --addr elastic-agent:9514 -p=tcp /sample_logs/cisco-meraki.log + command: log --start-signal=SIGHUP --delay=5s --addr elastic-agent:8685 -p=tcp /sample_logs/cisco-meraki.log diff --git a/packages/cisco_meraki/_dev/deploy/docker/sample_events/flows.log b/packages/cisco_meraki/_dev/deploy/docker/sample_events/flows.log new file mode 100644 index 000000000000..b28eb162eedf --- /dev/null +++ b/packages/cisco_meraki/_dev/deploy/docker/sample_events/flows.log @@ -0,0 +1,235 @@ +Mar 17, 2022 @ 12:03:08.000 <134>1 1647478988.289402144 Nash_AP_4 flows allow src=10.0.2.170 dst=10.0.0.34 mac=00:7C:2D:BD:76:F2 protocol=udp sport=54841 dport=15600 + +Mar 17, 2022 @ 12:03:08.000 <134>1 1647478988.476061795 ATT_Primary flows src=167.99.207.176 dst=12.108.190.178 protocol=tcp sport=54445 dport=44210 pattern: 1 all + +Mar 17, 2022 @ 12:03:08.000 <134>1 1647478988.596151424 Nash_AP_7 flows allow src=10.0.0.34 dst=10.0.0.234 mac=64:1C:B0:BA:F0:EC protocol=tcp sport=49761 dport=15500 + +Mar 17, 2022 @ 12:03:08.000 <134>1 1647478988.606549891 Nash_AP_4 flows allow src=10.0.0.234 dst=10.0.0.34 mac=64:1C:AE:68:2A:01 protocol=tcp sport=15500 dport=49761 + +Mar 17, 2022 @ 12:03:08.000 <134>1 1647478988.610435104 Nash_AP_7 flows allow src=10.0.0.34 dst=10.0.2.170 mac=64:1C:B0:BA:F0:EC protocol=tcp sport=55395 dport=15500 + +Mar 17, 2022 @ 12:03:08.000 <134>1 1647478988.620515225 Nash_AP_4 flows allow src=10.0.2.170 dst=10.0.0.34 mac=00:7C:2D:BD:76:F2 protocol=tcp sport=15500 dport=55395 + +Mar 17, 2022 @ 12:03:08.000 <134>1 1647478988.809731450 Nash_AP_4 flows allow src=10.0.0.234 dst=8.8.8.8 mac=64:1C:AE:68:2A:01 protocol=udp sport=58778 dport=53 + +Mar 17, 2022 @ 12:03:08.000 <134>1 1647478988.835549254 Nash_AP_4 flows allow src=10.0.0.234 dst=3.222.255.68 mac=64:1C:AE:68:2A:01 protocol=tcp sport=54203 dport=443 + +Mar 17, 2022 @ 12:03:08.000 <134>1 1647478988.083887003 Luella_Bates_Ceiling flows allow src=10.0.1.251 dst=142.251.46.238 mac=00:0E:8E:6D:91:77 protocol=tcp sport=55816 dport=80 + +Mar 17, 2022 @ 12:03:08.000 <134>1 1647478988.179272917 Nash_AP_4 flows allow src=10.0.3.243 dst=173.194.219.102 mac=7C:2A:31:70:C7:18 protocol=udp sport=38752 dport=443 + +Mar 17, 2022 @ 12:03:08.000 <134>1 1647478988.228886497 Nash_AP_4 flows allow src=10.0.3.243 dst=8.8.8.8 mac=7C:2A:31:70:C7:18 protocol=udp sport=50468 dport=53 + +Mar 17, 2022 @ 12:03:08.000 <134>1 1647478988.234624064 Nash_AP_7 flows allow src=10.0.0.34 dst=10.0.3.255 mac=64:1C:B0:BA:F0:EC protocol=udp sport=34321 dport=15600 + +Mar 17, 2022 @ 12:03:08.000 <134>1 1647478988.244864904 Nash_AP_4 flows allow src=10.0.0.234 dst=10.0.0.34 mac=64:1C:AE:68:2A:01 protocol=udp sport=56479 dport=15600 + +Mar 17, 2022 @ 12:03:08.000 <134>1 1647478988.250802574 Nash_AP_4 flows allow src=10.0.3.243 dst=108.177.122.94 mac=7C:2A:31:70:C7:18 protocol=udp sport=42111 dport=443 + +Mar 17, 2022 @ 12:03:07.000 <134>1 1647478987.255861347 KT_Nashville_wireless flows allow src=10.122.208.90 dst=17.248.200.4 mac=98:46:0A:BC:AF:5F protocol=tcp sport=58701 dport=443 + +Mar 17, 2022 @ 12:03:07.000 <134>1 1647478987.363359587 KT_Nashville_wireless flows allow src=10.122.208.90 dst=17.248.200.4 mac=98:46:0A:BC:AF:5F protocol=tcp sport=58702 dport=443 + +Mar 17, 2022 @ 12:03:07.000 <134>1 1647478987.506217293 Nash_AP_4 flows allow src=10.0.2.170 dst=10.0.3.255 mac=00:7C:2D:BD:76:F2 protocol=udp sport=45508 dport=15600 + +Mar 17, 2022 @ 12:03:07.000 <134>1 1647478987.501269824 Nash_AP_7 flows allow src=10.0.0.34 dst=10.0.2.170 mac=64:1C:B0:BA:F0:EC protocol=udp sport=34952 dport=15600 + +Mar 17, 2022 @ 12:03:07.000 <134>1 1647478987.508907307 Nash_AP_4 flows allow src=10.0.0.234 dst=10.0.2.170 mac=64:1C:AE:68:2A:01 protocol=udp sport=57122 dport=15600 + +Mar 17, 2022 @ 12:03:06.000 <134>1 1647478986.469961028 Nash_AP_3 flows allow src=10.0.2.147 dst=173.194.219.138 mac=7C:2A:31:C1:1C:86 protocol=udp sport=35931 dport=443 + +Mar 17, 2022 @ 12:03:06.000 <134>1 1647478986.494040914 Nash_AP_4 flows allow src=10.0.2.170 dst=10.0.0.234 mac=00:7C:2D:BD:76:F2 protocol=tcp sport=54447 dport=15500 + +Mar 17, 2022 @ 12:03:06.000 <134>1 1647478986.495233757 Nash_AP_4 flows allow src=10.0.0.234 dst=239.255.255.250 mac=64:1C:AE:68:2A:01 protocol=udp sport=47758 dport=15600 + +Mar 17, 2022 @ 12:03:06.000 <134>1 1647478986.492670624 Nash_AP_7 flows allow src=10.0.0.34 dst=10.0.0.234 mac=64:1C:B0:BA:F0:EC protocol=udp sport=52377 dport=15600 + +Mar 17, 2022 @ 12:03:06.000 <134>1 1647478986.501673576 Nash_AP_4 flows allow src=10.0.0.234 dst=10.0.2.170 mac=64:1C:AE:68:2A:01 protocol=tcp sport=15500 dport=54447 + +Mar 17, 2022 @ 12:03:06.000 <134>1 1647478986.504251486 Nash_AP_4 flows allow src=10.0.2.170 dst=10.0.0.234 mac=00:7C:2D:BD:76:F2 protocol=udp sport=46688 dport=15600 + +Mar 17, 2022 @ 12:03:06.000 <134>1 1647478986.509609446 Nash_AP_4 flows allow src=10.0.2.170 dst=10.0.0.34 mac=00:7C:2D:BD:76:F2 protocol=tcp sport=53624 dport=15500 + +Mar 17, 2022 @ 12:03:06.000 <134>1 1647478986.503009984 Nash_AP_7 flows allow src=10.0.0.34 dst=10.0.2.170 mac=64:1C:B0:BA:F0:EC protocol=tcp sport=15500 dport=53624 + +Mar 17, 2022 @ 12:03:06.000 <134>1 1647478986.511106787 KT_Nashville_wireless flows allow src=10.122.208.90 dst=10.128.128.128 mac=98:46:0A:BC:AF:5F protocol=udp sport=51354 dport=53 + +Mar 17, 2022 @ 12:03:06.000 <134>1 1647478986.537914947 KT_Nashville_wireless flows allow src=10.122.208.90 dst=17.248.200.4 mac=98:46:0A:BC:AF:5F protocol=tcp sport=58699 dport=443 + +Mar 17, 2022 @ 12:03:06.000 <134>1 1647478986.654004092 Nash_AP_4 flows allow src=10.0.0.234 dst=10.0.2.170 mac=64:1C:AE:68:2A:01 protocol=tcp sport=49249 dport=15500 + +Mar 17, 2022 @ 12:03:06.000 <134>1 1647478986.655925691 Nash_AP_4 flows allow src=10.0.2.170 dst=10.0.0.234 mac=00:7C:2D:BD:76:F2 protocol=tcp sport=15500 dport=49249 + +Mar 17, 2022 @ 12:03:06.000 <134>1 1647478986.675600009 Nash_AP_4 flows allow src=10.0.0.234 dst=10.0.0.34 mac=64:1C:AE:68:2A:01 protocol=tcp sport=53122 dport=15500 + +Mar 17, 2022 @ 12:03:06.000 <134>1 1647478986.668720864 Nash_AP_7 flows allow src=10.0.0.34 dst=10.0.0.234 mac=64:1C:B0:BA:F0:EC protocol=tcp sport=15500 dport=53122 + +Mar 17, 2022 @ 12:03:06.000 <134>1 1647478986.720453827 KT_Nashville_wireless flows allow src=10.122.208.90 dst=17.248.200.4 mac=98:46:0A:BC:AF:5F protocol=tcp sport=58700 dport=443 + +Mar 17, 2022 @ 12:03:06.000 <134>1 1647478986.851949087 Nashville_MX100 flows src=190.171.137.146 dst=65.152.242.66 protocol=tcp sport=51393 dport=445 pattern: 1 all + +Mar 17, 2022 @ 12:03:06.000 <134>1 1647478986.002561027 KT_Nashville_wireless flows allow src=10.122.208.90 dst=173.223.192.54 mac=98:46:0A:BC:AF:5F protocol=tcp sport=58698 dport=443 + +Mar 17, 2022 @ 12:03:05.000 <134>1 1647478985.246678507 Nash_AP_4 flows allow src=10.0.0.234 dst=10.0.0.34 mac=64:1C:AE:68:2A:01 protocol=udp sport=42996 dport=15600 + +Mar 17, 2022 @ 12:03:05.000 <134>1 1647478985.252049900 Nash_AP_4 flows allow src=10.0.2.170 dst=10.0.0.34 mac=00:7C:2D:BD:76:F2 protocol=udp sport=50460 dport=15600 + +Mar 17, 2022 @ 12:03:05.000 <134>1 1647478985.414161611 ATT_Primary flows src=98.45.194.225 dst=12.108.190.178 protocol=udp sport=55833 dport=1701 pattern: 1 all + +Mar 17, 2022 @ 12:03:05.000 <134>1 1647478985.557232063 Nash_AP_7 flows allow src=10.0.0.34 dst=10.0.0.234 mac=64:1C:B0:BA:F0:EC protocol=tcp sport=49759 dport=15500 + +Mar 17, 2022 @ 12:03:05.000 <134>1 1647478985.569429211 Nash_AP_4 flows allow src=10.0.0.234 dst=10.0.0.34 mac=64:1C:AE:68:2A:01 protocol=tcp sport=15500 dport=49759 + +Mar 17, 2022 @ 12:03:05.000 <134>1 1647478985.589881354 Buffalo_appliance flows src=128.199.52.122 dst=38.122.36.131 protocol=tcp sport=56906 dport=32915 pattern: 1 all + +Mar 17, 2022 @ 12:03:05.000 <134>1 1647478985.575527423 Nash_AP_7 flows allow src=10.0.0.34 dst=10.0.2.170 mac=64:1C:B0:BA:F0:EC protocol=tcp sport=55393 dport=15500 + +Mar 17, 2022 @ 12:03:05.000 <134>1 1647478985.586773814 Nash_AP_4 flows allow src=10.0.2.170 dst=10.0.0.34 mac=00:7C:2D:BD:76:F2 protocol=tcp sport=15500 dport=55393 + +Mar 17, 2022 @ 12:03:05.000 <134>1 1647478985.959385507 KT_Nashville_wireless flows allow src=10.122.208.90 dst=10.128.128.128 mac=98:46:0A:BC:AF:5F protocol=udp sport=59964 dport=53 + +Mar 17, 2022 @ 12:03:05.000 <134>1 1647478985.233079103 Nash_AP_7 flows allow src=10.0.0.34 dst=239.255.255.250 mac=64:1C:B0:BA:F0:EC protocol=udp sport=50097 dport=15600 + +Mar 17, 2022 @ 12:03:04.000 <134>1 1647478984.211701343 Nash_AP_7 flows allow src=10.0.3.254 dst=10.0.3.213 mac=3E:74:91:02:DB:E6 protocol=udp sport=5353 dport=5353 + +Mar 17, 2022 @ 12:03:04.000 <134>1 1647478984.241618248 Nash_AP_4 flows allow src=10.0.3.243 dst=8.8.8.8 mac=7C:2A:31:70:C7:18 protocol=udp sport=52012 dport=53 + +Mar 17, 2022 @ 12:03:04.000 <134>1 1647478984.228708547 KT_Nashville_wireless flows allow src=10.122.208.90 dst=10.128.128.128 mac=98:46:0A:BC:AF:5F protocol=udp sport=49797 dport=53 + +Mar 17, 2022 @ 12:03:04.000 <134>1 1647478984.263991216 Nash_AP_4 flows allow src=10.0.3.243 dst=35.213.232.93 mac=7C:2A:31:70:C7:18 protocol=tcp sport=46828 dport=443 + +Mar 17, 2022 @ 12:03:04.000 <134>1 1647478984.261853827 KT_Nashville_wireless flows allow src=10.122.208.90 dst=17.253.6.253 mac=98:46:0A:BC:AF:5F protocol=udp sport=61028 dport=123 + +Mar 17, 2022 @ 12:03:04.000 <134>1 1647478984.282091267 KT_Nashville_wireless flows allow src=10.122.208.90 dst=17.253.6.125 mac=98:46:0A:BC:AF:5F protocol=udp sport=57344 dport=123 + +Mar 17, 2022 @ 12:03:04.000 <134>1 1647478984.429578307 KT_Nashville_wireless flows allow src=10.122.208.90 dst=17.253.20.125 mac=98:46:0A:BC:AF:5F protocol=udp sport=53459 dport=123 + +Mar 17, 2022 @ 12:03:04.000 <134>1 1647478984.492805232 Nash_AP_4 flows allow src=10.0.3.243 dst=35.213.232.93 mac=7C:2A:31:70:C7:18 protocol=tcp sport=46830 dport=443 + +Mar 17, 2022 @ 12:03:04.000 <134>1 1647478984.507297982 Nash_AP_4 flows allow src=10.0.2.170 dst=239.255.255.250 mac=00:7C:2D:BD:76:F2 protocol=udp sport=56253 dport=15600 + +Mar 17, 2022 @ 12:03:04.000 <134>1 1647478984.510384278 Nash_AP_4 flows allow src=10.0.0.234 dst=10.0.2.170 mac=64:1C:AE:68:2A:01 protocol=udp sport=40098 dport=15600 + +Mar 17, 2022 @ 12:03:04.000 <134>1 1647478984.503585663 Nash_AP_7 flows allow src=10.0.0.34 dst=10.0.2.170 mac=64:1C:B0:BA:F0:EC protocol=udp sport=48692 dport=15600 + +Mar 17, 2022 @ 12:03:04.000 <134>1 1647478984.610747907 KT_Nashville_wireless flows allow src=10.122.208.90 dst=10.128.128.128 mac=98:46:0A:BC:AF:5F protocol=udp sport=52779 dport=53 + +Mar 17, 2022 @ 12:03:04.000 <134>1 1647478984.639046307 KT_Nashville_wireless flows allow src=10.122.208.90 dst=17.248.200.4 mac=98:46:0A:BC:AF:5F protocol=tcp sport=58697 dport=443 + +Mar 17, 2022 @ 12:03:04.000 <134>1 1647478984.880282561 Nashville_MX100 flows src=194.26.29.169 dst=205.171.61.44 protocol=tcp sport=48091 dport=16002 pattern: 1 all + +Mar 17, 2022 @ 12:03:04.000 <134>1 1647478984.927204291 ATT_Primary flows src=74.51.152.224 dst=12.108.190.178 protocol=udp sport=11822 dport=1701 pattern: 1 all + +Mar 17, 2022 @ 12:03:03.000 <134>1 1647478983.207922944 main_GlassConfRoom flows allow src=10.0.2.209 dst=10.0.0.1 mac=3E:19:49:88:DD:E9 protocol=udp sport=62327 dport=53 + +Mar 17, 2022 @ 12:03:03.000 <134>1 1647478983.210294464 main_GlassConfRoom flows allow src=10.0.2.209 dst=17.248.245.6 mac=3E:19:49:88:DD:E9 protocol=tcp sport=65406 dport=443 + +Mar 17, 2022 @ 12:03:03.000 <134>1 1647478983.360369567 ATT_Primary flows src=74.51.152.224 dst=12.108.190.178 protocol=udp sport=11822 dport=1701 pattern: 1 all + +Mar 17, 2022 @ 12:03:03.000 <134>1 1647478983.421119701 Nashville_MX100 flows src=62.233.50.173 dst=205.171.61.40 protocol=tcp sport=46236 dport=51873 pattern: 1 all + +Mar 17, 2022 @ 12:03:03.000 <134>1 1647478983.459775285 Nash_AP_4 flows allow src=10.0.2.170 dst=10.0.0.234 mac=00:7C:2D:BD:76:F2 protocol=tcp sport=54445 dport=15500 + +Mar 17, 2022 @ 12:03:03.000 <134>1 1647478983.464275274 Nash_AP_4 flows allow src=10.0.0.234 dst=10.0.2.170 mac=64:1C:AE:68:2A:01 protocol=tcp sport=15500 dport=54445 + +Mar 17, 2022 @ 12:03:03.000 <134>1 1647478983.473916691 Nash_AP_4 flows allow src=10.0.2.170 dst=10.0.0.34 mac=00:7C:2D:BD:76:F2 protocol=tcp sport=53622 dport=15500 + +Mar 17, 2022 @ 12:03:03.000 <134>1 1647478983.471922302 Nash_AP_7 flows allow src=10.0.0.34 dst=10.0.2.170 mac=64:1C:B0:BA:F0:EC protocol=tcp sport=15500 dport=53622 + +Mar 17, 2022 @ 12:03:03.000 <134>1 1647478983.496271748 Nash_AP_4 flows allow src=10.0.0.234 dst=10.0.3.255 mac=64:1C:AE:68:2A:01 protocol=udp sport=51605 dport=15600 + +Mar 17, 2022 @ 12:03:03.000 <134>1 1647478983.490102462 Nash_AP_7 flows allow src=10.0.0.34 dst=10.0.0.234 mac=64:1C:B0:BA:F0:EC protocol=udp sport=36187 dport=15600 + +Mar 17, 2022 @ 12:03:03.000 <134>1 1647478983.581995265 Nash_AP_4 flows allow src=10.0.2.170 dst=10.0.0.234 mac=00:7C:2D:BD:76:F2 protocol=udp sport=37511 dport=15600 + +Mar 17, 2022 @ 12:03:03.000 <134>1 1647478983.602884975 Nash_AP_4 flows allow src=10.0.0.234 dst=10.0.2.170 mac=64:1C:AE:68:2A:01 protocol=tcp sport=49247 dport=15500 + +Mar 17, 2022 @ 12:03:03.000 <134>1 1647478983.604996558 Nash_AP_4 flows allow src=10.0.2.170 dst=10.0.0.234 mac=00:7C:2D:BD:76:F2 protocol=tcp sport=15500 dport=49247 + +Mar 17, 2022 @ 12:03:03.000 <134>1 1647478983.617243736 Nashville_MX100 flows src=46.17.96.38 dst=205.171.61.40 protocol=tcp sport=48152 dport=2598 pattern: 1 all + +Mar 17, 2022 @ 12:03:03.000 <134>1 1647478983.629667737 Nash_AP_4 flows allow src=10.0.0.234 dst=10.0.0.34 mac=64:1C:AE:68:2A:01 protocol=tcp sport=53120 dport=15500 + +Mar 17, 2022 @ 12:03:03.000 <134>1 1647478983.622439743 Nash_AP_7 flows allow src=10.0.0.34 dst=10.0.0.234 mac=64:1C:B0:BA:F0:EC protocol=tcp sport=15500 dport=53120 + +Mar 17, 2022 @ 12:03:03.000 <134>1 1647478983.106520794 Nashville_MX100 flows src=46.17.96.38 dst=205.171.61.43 protocol=tcp sport=48152 dport=3542 pattern: 1 all + +Mar 17, 2022 @ 12:03:03.000 <134>1 1647478983.071210987 Luella_Bates_Ceiling flows allow src=10.0.1.251 dst=142.251.46.238 mac=00:0E:8E:6D:91:77 protocol=tcp sport=55815 dport=80 + +Mar 17, 2022 @ 12:03:02.000 <134>1 1647478982.232700542 Nash_AP_7 flows allow src=10.0.0.34 dst=10.0.3.255 mac=64:1C:B0:BA:F0:EC protocol=udp sport=39052 dport=15600 + +Mar 17, 2022 @ 12:03:02.000 <134>1 1647478982.246279776 Nash_AP_4 flows allow src=10.0.0.234 dst=10.0.0.34 mac=64:1C:AE:68:2A:01 protocol=udp sport=34786 dport=15600 + +Mar 17, 2022 @ 12:03:02.000 <134>1 1647478982.352799770 Nash_AP_4 flows allow src=10.0.2.170 dst=10.0.0.34 mac=00:7C:2D:BD:76:F2 protocol=udp sport=40351 dport=15600 + +Mar 17, 2022 @ 12:03:02.000 <134>1 1647478982.501246302 Nash_AP_7 flows allow src=10.0.0.34 dst=10.0.0.234 mac=64:1C:B0:BA:F0:EC protocol=tcp sport=49757 dport=15500 + +Mar 17, 2022 @ 12:03:02.000 <134>1 1647478982.514150094 Nash_AP_4 flows allow src=10.0.0.234 dst=10.0.0.34 mac=64:1C:AE:68:2A:01 protocol=tcp sport=15500 dport=49757 + +Mar 17, 2022 @ 12:03:02.000 <134>1 1647478982.520080702 Nash_AP_7 flows allow src=10.0.0.34 dst=10.0.2.170 mac=64:1C:B0:BA:F0:EC protocol=tcp sport=55391 dport=15500 + +Mar 17, 2022 @ 12:03:02.000 <134>1 1647478982.533499775 Nash_AP_4 flows allow src=10.0.2.170 dst=10.0.0.34 mac=00:7C:2D:BD:76:F2 protocol=tcp sport=15500 dport=55391 + +Mar 17, 2022 @ 12:03:02.000 <134>1 1647478982.584581349 Nashville_MX100 flows src=89.248.165.56 dst=205.171.61.45 protocol=tcp sport=50714 dport=3376 pattern: 1 all + +Mar 17, 2022 @ 12:03:02.000 <134>1 1647478982.667480943 4_Front_Desk flows allow src=10.198.201.145 dst=10.128.128.128 mac=2A:BD:6F:6A:A2:19 protocol=udp sport=60036 dport=53 + +Mar 17, 2022 @ 12:03:02.000 <134>1 1647478982.696520943 4_Front_Desk flows allow src=10.198.201.145 dst=17.248.245.50 mac=2A:BD:6F:6A:A2:19 protocol=tcp sport=56081 dport=443 + +Mar 17, 2022 @ 12:03:02.000 <134>1 1647478982.948713663 Nashville_MX100 flows src=222.186.46.200 dst=205.171.61.45 protocol=tcp sport=42260 dport=52981 pattern: 1 all + +Mar 17, 2022 @ 12:03:01.000 <134>1 1647478981.153028062 Nash_AP_7 flows allow src=10.0.0.34 dst=10.0.2.143 mac=64:1C:B0:BA:F0:EC protocol=udp sport=39584 dport=42757 + +Mar 17, 2022 @ 12:03:01.000 <134>1 1647478981.167740916 Nash_AP_4 flows allow src=10.0.0.234 dst=10.0.2.143 mac=64:1C:AE:68:2A:01 protocol=udp sport=48197 dport=42757 + +Mar 17, 2022 @ 12:03:01.000 <134>1 1647478981.175857815 Nash_AP_4 flows allow src=10.0.2.170 dst=10.0.2.143 mac=00:7C:2D:BD:76:F2 protocol=udp sport=37069 dport=42757 + +Mar 17, 2022 @ 12:03:01.000 <134>1 1647478981.409618160 Nashville_MX100 flows src=46.17.96.38 dst=205.171.61.43 protocol=tcp sport=48152 dport=7979 pattern: 1 all + +Mar 17, 2022 @ 12:03:01.000 <134>1 1647478981.508437522 Nash_AP_4 flows allow src=10.0.2.170 dst=10.0.3.255 mac=00:7C:2D:BD:76:F2 protocol=udp sport=44606 dport=15600 + +Mar 17, 2022 @ 12:03:01.000 <134>1 1647478981.499850622 Nash_AP_7 flows allow src=10.0.0.34 dst=10.0.2.170 mac=64:1C:B0:BA:F0:EC protocol=udp sport=56381 dport=15600 + +Mar 17, 2022 @ 12:03:01.000 <134>1 1647478981.511593064 Nash_AP_4 flows allow src=10.0.0.234 dst=10.0.2.170 mac=64:1C:AE:68:2A:01 protocol=udp sport=60324 dport=15600 + +Mar 17, 2022 @ 12:03:00.000 <134>1 1647478980.156618461 Nash_AP_7 flows allow src=10.0.0.34 dst=10.0.2.143 mac=64:1C:B0:BA:F0:EC protocol=udp sport=46347 dport=42757 + +Mar 17, 2022 @ 12:03:00.000 <134>1 1647478980.362078086 Nashville_MX100 flows src=146.88.240.4 dst=205.171.61.42 protocol=udp sport=50801 dport=5683 pattern: 1 all + +Mar 17, 2022 @ 12:03:00.000 <134>1 1647478980.432531904 Nash_AP_4 flows allow src=10.0.2.170 dst=10.0.0.234 mac=00:7C:2D:BD:76:F2 protocol=tcp sport=54443 dport=15500 + +Mar 17, 2022 @ 12:03:00.000 <134>1 1647478980.436605066 Nash_AP_4 flows allow src=10.0.0.234 dst=10.0.2.170 mac=64:1C:AE:68:2A:01 protocol=tcp sport=15500 dport=54443 + +Mar 17, 2022 @ 12:03:00.000 <134>1 1647478980.448867252 Nash_AP_4 flows allow src=10.0.2.170 dst=10.0.0.34 mac=00:7C:2D:BD:76:F2 protocol=tcp sport=53620 dport=15500 + +Mar 17, 2022 @ 12:03:00.000 <134>1 1647478980.439844861 Nash_AP_7 flows allow src=10.0.0.34 dst=10.0.2.170 mac=64:1C:B0:BA:F0:EC protocol=tcp sport=15500 dport=53620 + +Mar 17, 2022 @ 12:03:00.000 <134>1 1647478980.496607370 Nash_AP_4 flows allow src=10.0.0.234 dst=239.255.255.250 mac=64:1C:AE:68:2A:01 protocol=udp sport=44243 dport=15600 + +Mar 17, 2022 @ 12:03:00.000 <134>1 1647478980.493774621 Nash_AP_7 flows allow src=10.0.0.34 dst=10.0.0.234 mac=64:1C:B0:BA:F0:EC protocol=udp sport=48147 dport=15600 + +Mar 17, 2022 @ 12:03:00.000 <134>1 1647478980.506203050 Nash_AP_4 flows allow src=10.0.2.170 dst=10.0.0.234 mac=00:7C:2D:BD:76:F2 protocol=udp sport=58575 dport=15600 + +Mar 17, 2022 @ 12:03:00.000 <134>1 1647478980.574942423 Nash_AP_4 flows allow src=10.0.0.234 dst=10.0.2.170 mac=64:1C:AE:68:2A:01 protocol=tcp sport=49245 dport=15500 + +Mar 17, 2022 @ 12:03:00.000 <134>1 1647478980.576629739 Nash_AP_4 flows allow src=10.0.2.170 dst=10.0.0.234 mac=00:7C:2D:BD:76:F2 protocol=tcp sport=15500 dport=49245 + +Mar 17, 2022 @ 12:03:00.000 <134>1 1647478980.591558431 Nash_AP_4 flows allow src=10.0.0.234 dst=10.0.0.34 mac=64:1C:AE:68:2A:01 protocol=tcp sport=53118 dport=15500 + +Mar 17, 2022 @ 12:03:00.000 <134>1 1647478980.582422141 Nash_AP_7 flows allow src=10.0.0.34 dst=10.0.0.234 mac=64:1C:B0:BA:F0:EC protocol=tcp sport=15500 dport=53118 + +Mar 17, 2022 @ 12:03:00.000 <134>1 1647478980.770305353 4_all_hands flows allow src=10.213.203.232 dst=10.128.128.128 mac=88:66:5A:36:FC:86 protocol=udp sport=61848 dport=53 + +Mar 17, 2022 @ 12:03:00.000 <134>1 1647478980.770527433 4_all_hands flows allow src=10.213.203.232 dst=10.128.128.128 mac=88:66:5A:36:FC:86 protocol=udp sport=40692 dport=53 + +Mar 17, 2022 @ 12:03:00.000 <134>1 1647478980.797930153 4_all_hands flows allow src=10.213.203.232 dst=104.93.150.78 mac=88:66:5A:36:FC:86 protocol=tcp sport=60611 dport=443 + +Mar 17, 2022 @ 12:03:00.000 <134>1 1647478980.164525014 Nash_AP_4 flows allow src=10.0.2.170 dst=10.0.2.143 mac=00:7C:2D:BD:76:F2 protocol=udp sport=37791 dport=42757 + +Mar 17, 2022 @ 12:03:00.000 <134>1 1647478980.165748562 Nash_AP_4 flows allow src=10.0.0.234 dst=10.0.2.143 mac=64:1C:AE:68:2A:01 protocol=udp sport=38332 dport=42757 + +Mar 17, 2022 @ 12:02:59.000 <134>1 1647478979.163757648 Nash_AP_4 flows allow src=10.0.2.170 dst=10.0.2.143 mac=00:7C:2D:BD:76:F2 protocol=udp sport=34263 dport=42757 + +Mar 17, 2022 @ 12:02:59.000 <134>1 1647478979.152716861 Nash_AP_7 flows allow src=10.0.0.34 dst=10.0.2.143 mac=64:1C:B0:BA:F0:EC protocol=udp sport=58577 dport=42757 + +Mar 17, 2022 @ 12:02:59.000 <134>1 1647478979.166245204 Nash_AP_4 flows allow src=10.0.0.234 dst=10.0.2.143 mac=64:1C:AE:68:2A:01 protocol=udp sport=36018 dport=42757 diff --git a/packages/cisco_meraki/_dev/deploy/docker/sample_events/meraki-mx-ndjson.log b/packages/cisco_meraki/_dev/deploy/docker/sample_events/meraki-mx-ndjson.log new file mode 100644 index 000000000000..efed345fcabf --- /dev/null +++ b/packages/cisco_meraki/_dev/deploy/docker/sample_events/meraki-mx-ndjson.log @@ -0,0 +1,2 @@ +{ "version": "0.1", "sharedSecret": "secret", "sentAt": "2021-10-07T08:42:00.926325Z", "organizationId": "2930418", "organizationName": "My organization", "organizationUrl": "https://dashboard.meraki.com/o/VjjsAd/manage/organization/overview", "networkId": "N_24329156", "networkName": "Main Office", "networkUrl": "https://n1.meraki.com//n//manage/nodes/list", "networkTags": [], "deviceSerial": "Q234-ABCD-5678", "deviceMac": "00:11:22:33:44:55", "deviceName": "My appliance", "deviceUrl": "https://n1.meraki.com//n//manage/nodes/new_list/000000000000", "deviceTags": [ "tag1", "tag2" ], "deviceModel": "MX", "alertId": "0000000000000000", "alertType": "Cellular came up", "alertTypeId": "cellular_up", "alertLevel": "informational", "occurredAt": "2018-02-11T00:00:00.123450Z", "alertData": { "provider": "Purview Wireless", "model": "UML290VW", "local": "192.168.1.2", "remote": "1.2.3.5", "connection": "LTE" } } +{ "version": "0.1", "sharedSecret": "secret", "sentAt": "2021-10-07T08:42:00.927486Z", "organizationId": "2930418", "organizationName": "My organization", "organizationUrl": "https://dashboard.meraki.com/o/VjjsAd/manage/organization/overview", "networkId": "N_24329156", "networkName": "Main Office", "networkUrl": "https://n1.meraki.com//n//manage/nodes/list", "networkTags": [], "deviceSerial": "Q234-ABCD-5678", "deviceMac": "00:11:22:33:44:55", "deviceName": "", "deviceUrl": "https://n1.meraki.com//n//manage/nodes/new_list/000000000000", "deviceTags": [ "tag1", "tag2" ], "deviceModel": "", "alertId": "0000000000000000", "alertType": "Insight Alert", "alertTypeId": "mi_alert", "alertLevel": "warning", "occurredAt": "2018-02-11T00:00:00.123450Z", "alertData": {} } diff --git a/packages/cisco_meraki/_dev/deploy/docker/sample_logs/cisco-meraki.log b/packages/cisco_meraki/_dev/deploy/docker/sample_logs/cisco-meraki.log index 05501480e401..9deba27ac64c 100644 --- a/packages/cisco_meraki/_dev/deploy/docker/sample_logs/cisco-meraki.log +++ b/packages/cisco_meraki/_dev/deploy/docker/sample_logs/cisco-meraki.log @@ -1,100 +1,204 @@ -modtempo 1454047799.olab nto_ security_event olaborissecurity_event tur url=https://example.org/odoco/ria.jpg?ritin=uredolor#tatemac src=10.15.44.253:5078 dst=10.193.124.51:5293 mac=01:00:5e:28:ae:7d name=psa sha256=umq disposition=ntium action=deny -umdo 1455282753.itessequ vol_ events dhcp lease of ip 10.102.218.31 from server mac 01:00:5e:9c:c2:9c for client mac 01:00:5e:0f:87:e3 from router 10.15.16.212 on subnet ameaqu with dns aqu -uipexea 1456517708.tatio minim_ flows ceroinBC flows src=10.179.60.216 dst=10.69.53.104 protocol=udp pattern: 0 reprehe -mipsu 1457752662.consec taliquip_ flows radip flows block src=10.155.236.240 dst=10.112.46.169 mac=01:00:5e:7a:74:89 protocol=ipv6 type=roidents -obeataev 1458987616.lor uidexea_appliance events MAC 01:00:5e:e1:89:ac and MAC 01:00:5e:a3:d9:ac both claim IP: 10.14.107.140 -iutal 1460222571.dexe urerep events content_filtering_block url='https://api.example.org/liqu/lorem.gif?ueipsaqu=uidolore#niamqu' category0='ari' server='10.108.180.105:5098' client_mac='01:00:5e:40:9b:83' -ipit 1461457525.idexea riat_appliance events MAC 01:00:5e:25:4f:e4 and MAC 01:00:5e:3f:49:e4 both claim IP: 10.149.88.198 -ntsuntin 1462692479.aecatcup animi events dhcp release for mac 01:00:5e:e3:10:34 -orsitame 1463927433.quiratio ite events MAC 01:00:5e:48:62:22 and MAC 01:00:5e:9f:b6:a6 both claim IP: 10.243.206.225 -olupta turveli.toccae tatno_ ids-alerts taliqu ids-alerts signature=temUten priority=ccusan timestamp=1465162388.iqudirection=outbound protocol=icmp src=10.131.82.116:7307 -uaera 1466397342.sitas ehenderi_ security_event atquovosecurity_event iumto url=https://www5.example.net/sun/essecill.html?saute=vel#quu src=10.210.213.18:7616 dst=10.134.0.141:2703 mac=01:00:5e:aa:42:fa name=idolores sha256=llumquid disposition=tation action=accept -omn ipsumq.atcu oremagna_ security_event remipsum security_event liq signature=ist priority=tnon timestamp=1467632296.ionul shost=01:00:5e:c8:9c:2f direction=outbound protocol=udp src=10.163.72.17 dst=10.74.237.180 message:nsequu -omm 1468867250.idestla Nemoeni_appliance events MAC 01:00:5e:c4:69:7f and MAC 01:00:5e:e2:67:d2 both claim IP: 10.72.31.26 -agna tionemu.eomnisis mqui ids-alerts signature=civeli priority=errorsi timestamp=1470102205.desdirection=internal protocol=tcp src=10.70.95.74:4290 -olupt 1471337159.dit sumquiad events MAC 01:00:5e:ea:e8:7a and MAC 01:00:5e:9c:d2:4a both claim IP: 10.17.21.125 -amqu 1472572113.uines nsec events dhcp lease of ip 10.85.10.165 from server mac 01:00:5e:63:93:48 for client mac 01:00:5e:46:17:35 from router 10.53.150.119 on subnet uiineavo with dns tisetq -giatquov eritquii.dexeac iscinge ids-alerts signature=atvol priority=umiur timestamp=1473807067.imadprotocol=igmp src=10.88.231.224 dst=10.187.77.245message: iadese -agnaali 1475042022.gnam tat events content_filtering_block url='https://internal.example.com/quae/maccusa.htm?rQuisau=idex#xerci' category0='aqu' server='10.186.58.115:7238' client_mac='01:00:5e:8f:16:6d' -apariat 1476276976.tlabore untmolli_ events dhcp lease of ip 10.219.84.37 from server mac 01:00:5e:e8:bf:69 for client mac 01:00:5e:87:e1:a0 from router 10.205.47.51 on subnet uovolup with dns samvolu -ento 1477511930.pic evita events MAC 01:00:5e:ce:61:db and MAC 01:00:5e:ec:f8:cc both claim IP: 10.3.134.237 -tmo 1478746884.fficiade uscipit events aid=vitaedi arp_resp=fugitse arp_src=veniamq auth_neg_dur=one auth_neg_failed=etMalor channel=ipi dns_req_rtt=reseos dns_resp=pariatu dns_server=tin duration=48.123000 full_conn=oquisqu identity=sperna ip_resp=eabilloi ip_src=10.182.178.217 is_8021x=tlab is_wpa=volupt last_auth_ago=osqui radio=xerc reason=iutali rssi=fdeFi type=texp vap=tasuntex client_mac=01:00:5e:e3:b1:24 client_ip=10.194.114.58 instigator=ectio http_resp=dutper dhcp_lease_completed=lamcolab dhcp_ip=ati dhcp_server=tlabo dhcp_server_mac=uames dhcp_resp=iduntu url=https://internal.example.net/ris/uamqu.txt?liqui=quioffi#uptate category0=ncidid server=10.63.194.87 vpn_type=quisno connectivity=sin -emvel 1479981839.tmollita fde events aid=nsecte arp_resp=inculpa arp_src=abo auth_neg_dur=veniamqu auth_neg_failed=nse channel=non dns_req_rtt=paquioff dns_resp=mquisnos dns_server=maven duration=71.798000 full_conn=atcu identity=labor ip_resp=didunt ip_src=10.153.0.77 is_8021x=udan is_wpa=orema last_auth_ago=invento radio=qua reason=aturQui rssi=utlabor type=rau vap=idex client_mac=01:00:5e:9e:7b:a4 client_ip=10.105.88.20 instigator=ecte http_resp=tinvolu dhcp_lease_completed=iurer dhcp_ip=iciadese dhcp_server=quidolor dhcp_server_mac=tessec dhcp_resp=olupta url=https://mail.example.com/icabo/itatio.jpg?eleum=sintoc#volupt category0=siste server=10.163.154.210 vpn_type=ept connectivity=iumtotam -ionevo 1481216793.ugiatnu ciati_appliance events MAC 01:00:5e:b8:7a:96 and MAC 01:00:5e:b9:6b:a8 both claim IP: 10.73.69.176 -spi 1482451747.stquido ommodico_ flows ese flows allow src=10.145.248.111 dst=10.57.6.252 mac=01:00:5e:94:6a:cf protocol=udp -smo etcons.iusmodi uamest_ security_event uiac security_event epte signature=idolo priority=quinesc timestamp=1483686701.madmi shost=01:00:5e:1c:4c:64 direction=internal protocol=icmp src=10.31.77.157 dst=10.12.182.70 message:tev -nisiuta 1484921656.roid inibusB flows cancel -str 1486156610.idolore pid_ flows cteturad flows deny src=10.93.68.231 dst=10.135.217.12 mac=01:00:5e:4a:69:5b protocol=ipv6 type=archite -amnih 1487391564.ium esciuntN_ events dhcp release for mac 01:00:5e:8b:99:98 -isnost 1488626519.queips ncidi_ flows iscinge flows src=10.247.30.212 dst=10.66.89.5 mac=01:00:5e:7f:65:da protocol=igmp pattern: 1 borios -oin 1489861473.mvenia madminim events IDS: fugitsed -dmin fugi.quia iduntu security_event idestlab signature=rnatur priority=ofdeFin timestamp=1491096427.essequam dhost=01:00:5e:c1:53:b1 direction=inbound protocol=tcp src=10.221.102.245 dst=10.173.136.186 message:naal -umqu tinv.adipisc uscipitl_ ids-alerts ritatise ids-alerts signature=uamei priority=siut timestamp=1492331381.ciad dhost=01:00:5e:1f:c6:29 direction=external protocol=udp src=10.58.64.108 dst=10.54.37.86 message: entorev -velitess 1493566336.naali uunturm_ flows veli flows block src=10.147.76.202 dst=10.163.93.20 mac=01:00:5e:1d:85:ec protocol=ipv6 sport=1085 dport=3141 -iumdol tpersp.stla uptatema_ security_event uradi security_event tot signature=llamco priority=nea timestamp=1494801290.psum dhost=01:00:5e:35:71:1e direction=internal protocol=icmp src=10.0.200.27:5905 dst=10.183.44.198:1702 message:asiarc -tiaec 1496036244.rumwrit icabo_ events dhcp lease of ip 10.148.124.84 from server mac 01:00:5e:0b:2c:22 for client mac 01:00:5e:06:12:98 from router 10.28.144.180 on subnet ritin with dns temporin -ica 1497271198.lillum remips_appliance events aid=uisaute arp_resp=imide arp_src=poriss auth_neg_dur=tvolup auth_neg_failed=itesseq channel=dictasun dns_req_rtt=veniamqu dns_resp=rum dns_server=quaea duration=165.611000 full_conn=mvel identity=nof ip_resp=usmodi ip_src=10.204.230.166 is_8021x=dat is_wpa=aincidu last_auth_ago=nimadmin radio=isiu reason=licabo rssi=enimadmi type=utaliqu vap=dic client_mac=01:00:5e:bb:60:a6 client_ip=10.62.71.118 instigator=ineavol http_resp=iosa dhcp_lease_completed=boNemoe dhcp_ip=onsequ dhcp_server=equinesc dhcp_server_mac=cab dhcp_resp=atisund url=https://example.net/ites/isetq.gif?nisiut=tur#avolupt category0=ariatur server=10.98.194.212 vpn_type=nimave connectivity=isciv -dipisci 1498506153.spernatu admi events content_filtering_block url='https://www.example.org/ueipsa/tae.html?eriti=atcupi#corpori' category0='borisnis' server='10.197.13.39:5912' -itsedd 1499741107.leumiur eratvol events dhcp release for mac 01:00:5e:fd:84:bb -leumiu tla.item nimid ids-alerts signature=dat priority=periam timestamp=1500976061.dquprotocol=icmp src=10.242.77.170 dst=10.150.245.88message: orisn -sitam rad.loi isc_ ids-alerts volupt ids-alerts signature=rem priority=idid timestamp=1502211015.tesse shost=01:00:5e:9d:eb:fb direction=external protocol=tcp src=10.247.139.239 dst=10.180.195.43 message: tenatuse -tore 1503445970.elits consequa events dhcp release for mac 01:00:5e:50:48:c4 -undeom uamnihi.risnis uov_ ids-alerts isn ids-alerts signature=sBono priority=loremqu timestamp=1504680924.teturprotocol=rdp src=10.94.6.140 dst=10.147.15.213message: uptat -itasper 1505915878.uae mve_ flows obeata flows block src=10.230.6.127 dst=10.111.157.56 mac=01:00:5e:39:a7:fc protocol=icmp type=aliquamq -archite 1507150832.remq veniamq events aid=occ arp_resp=oloreseo arp_src=iruredol auth_neg_dur=veniamqu auth_neg_failed=licaboN channel=atquo dns_req_rtt=cupi dns_resp=strude dns_server=eritin duration=85.513000 full_conn=litsedq identity=nderiti ip_resp=ntNe ip_src=10.179.40.170 is_8021x=olorema is_wpa=mollita last_auth_ago=tatem radio=iae reason=quido rssi=emip type=inBC vap=mol client_mac=01:00:5e:58:2d:1c client_ip=10.153.81.206 instigator=rsita http_resp=nsequun dhcp_lease_completed=eetd dhcp_ip=illu dhcp_server=iatqu dhcp_server_mac=lorsi dhcp_resp=repreh url=https://www.example.net/irured/illumqui.txt?tionula=ritqu#ecatcupi category0=uamei server=10.193.219.34 vpn_type=onse connectivity=olorem -umwritte 1508385787.vol oremquel_appliance events MAC 01:00:5e:16:5e:b1 and MAC 01:00:5e:ee:e8:77 both claim IP: 10.255.199.16 -unte 1509620741.uamnihil llam_appliance events MAC 01:00:5e:ee:1d:77 and MAC 01:00:5e:f1:21:bd both claim IP: 10.94.88.5 -esci 1510855695.uov quaeab_ events IDS: moles -accusa 1512090649.natu liquid events IDS: enim -dquiaco nibus.vitaed ser security_event etconsec signature=elillum priority=upt timestamp=1513325604.rnat dhost=01:00:5e:01:60:e0 direction=internal protocol=ipv6 src=10.90.99.245 dst=10.124.63.4 message:pta -tetura 1514560558.imadmini moe_appliance events content_filtering_block url='https://mail.example.net/uat/lupta.html?uptassit=ncidi#tlabori' category0='laudan' server='10.249.7.146:2010' -lapar 1515795512.ritati edquia_appliance events IDS: itesse -amvolu mip.tion tobeatae_ security_event Utenima security_event iqua signature=luptat priority=deriti timestamp=1517030466.sintocc dhost=01:00:5e:c9:b7:22 direction=inbound protocol=icmp src=10.196.96.162 dst=10.81.234.34 message:equuntur -uide 1518265421.scivel henderi_appliance events IDS: iusmodt -tiumd 1519500375.ntmoll mexer events dhcp lease of ip 10.40.101.224 from server mac 01:00:5e:0a:df:72 for client mac 01:00:5e:7c:01:ab with hostname remips188.api.invalid from router 10.78.199.43 on subnet ehender with dns ilmole -runtmo 1520735329.ore isund_appliance events MAC 01:00:5e:17:87:3e and MAC 01:00:5e:5f:c1:3e both claim IP: 10.244.29.119 -tutlabor 1521970284.reseosq gna_ flows pteurs flows deny src=10.83.131.245 dst=10.39.172.93 mac=01:00:5e:c4:12:c7 protocol=udp type=uido -osquira 1523205238.umd sciveli_ events dhcp lease of ip 10.86.188.179 from server mac 01:00:5e:48:4b:78 for client mac 01:00:5e:7e:cd:15 from router 10.201.168.116 on subnet umiure with dns laborum -umdolors 1524440192.lumdo acom_ security_event umexercisecurity_event duntut url=https://mail.example.com/prehend/eufug.htm?eufug=est#civelits src=10.148.211.222:2053 dst=10.122.204.151:3903 mac=01:00:5e:c3:a0:dc name=ine sha256=urerepre disposition=asnulap action=deny -atnul 1525675146.umfugi stquidol_ flows luptatem flows accept -essequam ueporro.aliqu upt ids-alerts signature=orum priority=Bonoru timestamp=1526910101.madminimprotocol=ipv6-icmp src=10.97.46.16 dst=10.120.4.9message: teni -lorsitam tanimid.onpr litseddo_ ids-alerts oremqu ids-alerts signature=idex priority=radip timestamp=1528145055.uptaprotocol=ipv6-icmp src=10.171.206.139 dst=10.165.173.162message: lestia -inibusB 1529380009.nostrud cteturad events dhcp lease of ip 10.150.163.151 from server mac 01:00:5e:72:b7:79 for client mac 01:00:5e:f2:d3:12 with hostname uames4985.mail.localdomain from router 10.144.57.239 on subnet oinBCSed with dns orem -eritq rehen.ipsamvol elillum_ ids-alerts tco ids-alerts signature=tvol priority=oluptate timestamp=1530614963.lit shost=01:00:5e:ac:6d:d3 direction=unknown protocol=igmp src=10.52.202.158 dst=10.54.44.231 message: Ute -runtm 1531849918.eturadip olorsi_ events MAC 01:00:5e:67:1d:0f and MAC 01:00:5e:f0:a9:cd both claim IP: 10.101.183.86 -inesciu 1533084872.quid atcupid_ flows orem flows src=10.71.22.225 dst=10.4.76.100 protocol=ggp pattern: allow serrorsi -lamco 1534319826.cit siar events MAC 01:00:5e:80:cd:ca and MAC 01:00:5e:45:aa:51 both claim IP: 10.83.130.95 -hite 1535554780.ianonnum nofdeFi events aid=henderit arp_resp=remq arp_src=unt auth_neg_dur=tla auth_neg_failed=arch channel=lite dns_req_rtt=ugia dns_resp=meum dns_server=borumSec duration=91.439000 full_conn=nvolupta identity=tev ip_resp=nre ip_src=10.2.110.73 is_8021x=eturadip is_wpa=ent last_auth_ago=rumSecti radio=Utenima reason=olore rssi=orumS type=olor vap=radip client_mac=01:00:5e:59:bf:36 client_ip=10.230.98.81 instigator=aaliquaU http_resp=olu dhcp_lease_completed=iameaque dhcp_ip=identsun dhcp_server=ender dhcp_server_mac=inc dhcp_resp=tect url=https://www.example.net/doconse/eni.html?mSec=smoditem#tatisetq category0=uidolo server=10.103.49.129 vpn_type=oquisq connectivity=abori -dunt 1536789735.ames amni events aid=tatio arp_resp=amquisno arp_src=modoc auth_neg_dur=magnam auth_neg_failed=uinesc channel=cid dns_req_rtt=emi dns_resp=Bonorum dns_server=lesti duration=59.289000 full_conn=iosamni identity=idu ip_resp=sis ip_src=10.158.61.228 is_8021x=tsedquia is_wpa=its last_auth_ago=umdolor radio=isiu reason=assi rssi=eserun type=rvelill vap=lupta client_mac=01:00:5e:e6:a6:a2 client_ip=10.186.16.20 instigator=tisu http_resp=remagnam dhcp_lease_completed=nvolupt dhcp_ip=meiusm dhcp_server=nidolo dhcp_server_mac=atquovol dhcp_resp=quunt url=https://www.example.com/seq/moll.htm?sunt=dquianon#urExc category0=tDuis server=10.132.176.96 vpn_type=aria connectivity=inim -oremeumf 1538024689.lesti sintocca events dhcp lease of ip 10.105.136.146 from server mac 01:00:5e:bb:aa:f6 for client mac 01:00:5e:69:92:4a with hostname lors2232.api.example from router 10.46.217.155 on subnet amnihil with dns orissus -nimadmin 1539259643.lumqui quiavolu flows src=10.245.199.23 dst=10.123.62.215 mac=01:00:5e:1f:7f:1d protocol=udp pattern: 0 iusmodt -rep 1540494597.remap deri flows cancel src=10.239.105.121 dst=10.70.7.23 mac=01:00:5e:8e:82:f0 protocol=ipv6 -idexeac 1541729552.nimadmin midest_appliance events aid=modt arp_resp=iduntutl arp_src=rsitam auth_neg_dur=xercit auth_neg_failed=ulpaquio channel=itqu dns_req_rtt=minimav dns_resp=smodtem dns_server=roquisqu duration=116.294000 full_conn=iquid identity=evo ip_resp=mcorpori ip_src=10.196.176.243 is_8021x=itesse is_wpa=expl last_auth_ago=essecill radio=totamre reason=rpo rssi=velites type=nonpro vap=nula client_mac=01:00:5e:99:a6:b4 client_ip=10.90.50.149 instigator=nemulla http_resp=asp dhcp_lease_completed=dexercit dhcp_ip=amn dhcp_server=itessequ dhcp_server_mac=porissu dhcp_resp=umd url=https://www.example.net/sectetur/edquian.html?turQuis=taevi#uames category0=tconsec server=10.16.230.121 vpn_type=laboree connectivity=udantiu -ttenb olor.quiav gna security_event Nem signature=tdolorem priority=eacomm timestamp=1542964506.upidata dhost=01:00:5e:6a:c8:f8 direction=unknown protocol=ipv6 src=10.246.152.72:4293 dst=10.34.62.190:1641 message:eve -quisn 1544199460.rem ulamcola events dhcp no offers for mac 01:00:5e:67:fc:cb -eruntmo 1545434414.nimve usanti_ events dhcp release for mac 01:00:5e:7d:de:f7 -uatu 1546669369.olupta consequu_ events dhcp release for mac 01:00:5e:6b:96:f2 -sitam inibusBo.illoin emUtenim ids-alerts signature=ende priority=dexea timestamp=1547904323.acoprotocol=ipv6 src=10.244.32.189 dst=10.121.9.5message: uptas -edol 1549139277.sequuntu quameius_ events content_filtering_block url='https://www.example.com/totamrem/aliqu.htm?sBonorum=moenimi#lor' category0='auto' server='10.41.124.15:333' -antium 1550374232.remaper eseosq events dhcp no offers for mac 01:00:5e:c3:77:27 -oditau 1551609186.onsec dit events MAC 01:00:5e:19:86:21 and MAC 01:00:5e:ed:ed:79 both claim IP: 10.43.235.230 -asper dictasun.psa lorese_ ids-alerts ctobeat ids-alerts signature=onsec priority=idestl timestamp=1552844140.litani shost=01:00:5e:a0:b2:c9 direction=unknown protocol=icmp src=10.199.19.205:5823 dst=10.103.91.159:7116 message: ntut -estiaec 1554079094.pitlabo tas_appliance flows src=10.17.111.91 dst=10.65.0.157 mac=01:00:5e:49:c4:17 protocol=udp pattern: 1 nostrum -ercitati 1555314049.atem serro flows cancel -amquaera 1556549003.rsitamet leumiur events MAC 01:00:5e:fd:79:9e and MAC 01:00:5e:4d:c0:dd both claim IP: 10.20.130.88 -abill ametcon.ofdeFini tasnu_ ids-alerts tionev ids-alerts signature=uasiarch priority=velites timestamp=1557783957.uredolorprotocol=ipv6 src=10.177.64.152 dst=10.140.242.86message: temporin -lor nvolupt.dquia ora_ security_event dipi security_event ecatc signature=quovolu priority=ite timestamp=1559018911.itse shost=01:00:5e:b8:73:c8 direction=external protocol=icmp src=10.199.103.185:2449 dst=10.51.121.223:24 message:stenat -saq 1560253866.asiarch ssuscipi events MAC 01:00:5e:93:48:61 and MAC 01:00:5e:21:c2:55 both claim IP: 10.126.242.58 -tlab 1561488820.vel ionevo events dhcp release for mac 01:00:5e:8a:1a:f9 -aeab 1562723774.uradipis aerat_ flows uira flows deny src=10.121.37.244 dst=10.113.152.241 mac=01:00:5e:9c:86:62 protocol=udp type=utaliqui -nesciu 1563958728.mali roinBCSe_appliance events aid=eetdolor arp_resp=tpersp arp_src=assi auth_neg_dur=rch auth_neg_failed=psa channel=nreprehe dns_req_rtt=pidatatn dns_resp=isno dns_server=luptatev duration=39.622000 full_conn=lla identity=urau ip_resp=aeca ip_src=10.247.118.132 is_8021x=atcupi is_wpa=enima last_auth_ago=uptateve radio=fugitsed reason=lumqui rssi=ectet type=ionu vap=eratv client_mac=01:00:5e:10:8b:c3 client_ip=10.153.33.99 instigator=liq http_resp=xerc dhcp_lease_completed=atisetqu dhcp_ip=squir dhcp_server=gnaaliq dhcp_server_mac=quam dhcp_resp=deriti url=https://www5.example.org/eturadi/umS.txt?mSecti=henderi#taevitae category0=tevel server=10.254.96.130 vpn_type=ita connectivity=iquipexe -tot 1565193683.reme emeumfu events aid=inBCSedu arp_resp=ita arp_src=ade auth_neg_dur=nihilmol auth_neg_failed=nder channel=ano dns_req_rtt=rumexer dns_resp=eab dns_server=iaconseq duration=18.963000 full_conn=eli identity=rissusci ip_resp=ectetur ip_src=10.101.13.122 is_8021x=oconsequ is_wpa=roqui last_auth_ago=oluptate radio=ntut reason=mremaper rssi=uteirur type=ntium vap=ide client_mac=01:00:5e:95:ae:d0 client_ip=10.78.143.52 instigator=ntiumdol http_resp=conse dhcp_lease_completed=aturve dhcp_ip=edqui dhcp_server=tvolu dhcp_server_mac=psu dhcp_resp=strud url=https://internal.example.org/fdeFi/ratv.htm?sequatu=tiumtot#tate category0=udanti server=10.200.98.243 vpn_type=cteturad connectivity=umq -oinvento 1566428637.mporin orissusc_appliance events content_filtering_block url='https://www5.example.net/uov/pariat.htm?litsed=lumd#tiaec' category0='lorem' server='10.247.205.185:7676' client_mac='01:00:5e:6f:21:c8' -metMa emoen.ptate mipsumqu_ ids-alerts ccusa ids-alerts signature=billo priority=doloremi timestamp=1567663591.ectetura dhost=01:00:5e:0a:88:bb direction=inbound protocol=ipv6 src=10.195.90.73:3914 dst=10.147.165.30:7662 message: idents -veniamqu 1568898545.iconsequ ueporr_appliance events IDS: empor -atDuisa mipsa.uas iat ids-alerts signature=hite priority=adipis timestamp=1570133500.abo dhost=01:00:5e:dd:cb:5b direction=inbound protocol=udp src=10.137.166.97 dst=10.162.202.14 message: ipsaqua -deom 1571368454.tiumdo rautod_appliance events content_filtering_block url='https://www5.example.com/illoinve/etcon.htm?nevolup=erspici#itinvolu' category0='adeserun' server='10.227.135.142:6598' -orese 1572603408.umdolore umqui_appliance events MAC 01:00:5e:f1:b8:3a and MAC 01:00:5e:37:9c:af both claim IP: 10.199.29.19 -explicab 1573838362.samvolu teiru_appliance events dhcp no offers for mac 01:00:5e:b8:06:92 -rissusci 1575073317.uaturQ iusmod_ events aid=mips arp_resp=iduntutl arp_src=mipsumd auth_neg_dur=eiusmo auth_neg_failed=quelauda channel=rcit dns_req_rtt=dolo dns_resp=ulamc dns_server=doe duration=10.574000 full_conn=remquela identity=toreve ip_resp=squirat ip_src=10.85.59.172 is_8021x=mto is_wpa=iae last_auth_ago=dent radio=Uten reason=tatiset rssi=sequat type=modoco vap=beataevi client_mac=01:00:5e:92:d8:95 client_ip=10.158.215.216 instigator=deritin http_resp=ptate dhcp_lease_completed=lloi dhcp_ip=nseq dhcp_server=equunt dhcp_server_mac=tutla dhcp_resp=usmod url=https://example.com/qui/itse.gif?orsitame=tasn#exeaco category0=upta server=10.75.122.111 vpn_type=reprehe connectivity=deFinib -orr 1576308271.pre aute events IDS: rchite +<134>1 1637691198.348361125 MX84 security_event ids_alerted signature=1:29708:4 priority=1 timestamp=1637691198.330873 dhost=D0:AB:D5:7B:43:73 direction=ingress protocol=tcp/ip src=67.43.156.12:80 dst=10.0.3.162:56391 decision=allowed message: BROWSER-IE Microsoft Internet Explorer CSS uninitialized object access attempt detected +<134>1 1647479604.334549372 MX84_5 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:D8:51' src='92:17:C8:C7:D8:51' dst='6A:3A:3E:85:D9:F6' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='23' fc_type='0' fc_subtype='5' +<134>1 1647479580.487048774 MX84_2 airmarshal_events type=rogue_ssid_detected ssid='' bssid='AA:17:C8:C7:D8:51' src='AA:17:C8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='35' fc_type='0' fc_subtype='8' +<134>1 1647479552.047395997 MR36 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:C8:C7:DF:FD' src='BE:17:C8:C7:DF:FD' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:DF:FD' vlan_id='0' channel='11' rssi='14' fc_type='0' fc_subtype='8' +<134>1 1647479537.315779167 MX84_1 airmarshal_events type=ssid_spoofing_detected ssid='AwesomeWifi Guest' vap='1' bssid='AA:17:C8:C7:E1:41' src='AA:17:C8:C7:E1:41' dst='E2:CB:9C:B5:DD:BE' channel='1' rssi='15' fc_type='0' fc_subtype='5' +<134>1 1647479528.067423267 MX84_8 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:D8:51' src='92:17:C8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='15' fc_type='0' fc_subtype='8' +<134>1 1647479493.484285651 MX84_5 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi' bssid='AE:17:D8:C7:D8:51' src='AE:17:D8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='149' rssi='15' fc_type='0' fc_subtype='8' +<134>1 1647479489.882680227 MX84_8 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:E2:9D' src='92:17:C8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='11' rssi='18' fc_type='0' fc_subtype='8' +<134>1 1647479484.972992227 MX84_8 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:E1:41' src='92:17:C8:C7:E1:41' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E1:41' vlan_id='0' channel='1' rssi='39' fc_type='0' fc_subtype='8' +<134>1 1647479466.965046920 MR36 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:D8:C7:E2:9D' src='BE:17:D8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='36' rssi='24' fc_type='0' fc_subtype='8' +<134>1 1647479461.791503607 MX84_6 airmarshal_events type=ssid_spoofing_detected ssid='AwesomeWifi Guest' vap='13' bssid='AA:17:C8:C7:DF:FD' src='AA:17:C8:C7:DF:FD' dst='AE:17:E8:C7:DF:FD' channel='11' rssi='10' fc_type='0' fc_subtype='5' +<134>1 1647479459.181348678 MX84_5 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:D8:C7:D8:51' src='BE:17:D8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='149' rssi='14' fc_type='0' fc_subtype='8' +<134>1 1647479456.670048547 MX84_8 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:DF:FD' src='92:17:C8:C7:DF:FD' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:DF:FD' vlan_id='0' channel='11' rssi='16' fc_type='0' fc_subtype='8' +<134>1 1647479445.786718001 MX84_6 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi Guest' bssid='AA:17:D8:C7:D8:51' src='AA:17:D8:C7:D8:51' dst='6A:3A:3E:85:D9:F6' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='149' rssi='11' fc_type='0' fc_subtype='5' +<134>1 1647479442.047436097 MX84_6 airmarshal_events type=rogue_ssid_detected ssid='' bssid='AA:17:C8:C7:D8:51' src='AA:17:C8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='20' fc_type='0' fc_subtype='8' +<134>1 1647479399.287689295 MR36 airmarshal_events type=rogue_ssid_detected ssid='' bssid='AC:17:C8:C7:E2:9D' src='AC:17:C8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='11' rssi='22' fc_type='0' fc_subtype='8' +<134>1 1647479376.407283267 MX84_8 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:D8:C7:E2:9D' src='BE:17:D8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='36' rssi='11' fc_type='0' fc_subtype='8' +<134>1 1647479375.390251687 MX84_5 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:C8:C7:D8:51' src='BE:17:C8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='24' fc_type='0' fc_subtype='8' +<134>1 1647479371.594697827 MX84_8 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:D8:C7:E2:9D' src='92:17:D8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='36' rssi='13' fc_type='0' fc_subtype='8' +<134>1 1647479356.473299205 MX84_6 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi' bssid='AC:17:C8:C7:DF:FD' src='AC:17:C8:C7:DF:FD' dst='78:55:CD:18:8F:76' wired_mac='AC:17:C8:C7:DF:FD' vlan_id='0' channel='11' rssi='9' fc_type='0' fc_subtype='5' +<134>1 1647479354.489175845 MX84_6 airmarshal_events type=ssid_spoofing_detected ssid='AwesomeWifi' vap='13' bssid='AC:17:C8:C7:DF:FD' src='AC:17:C8:C7:DF:FD' dst='78:28:CA:AA:6A:4A' channel='11' rssi='12' fc_type='0' fc_subtype='5' +<134>1 1647479353.446408965 MX84_6 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:D8:C7:DF:FD' src='92:17:D8:C7:DF:FD' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:DF:FD' vlan_id='0' channel='56' rssi='9' fc_type='0' fc_subtype='8' +<134>1 1647479352.553639439 MR36 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi Guest' bssid='AA:17:D8:C7:E2:9D' src='AA:17:D8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='36' rssi='33' fc_type='0' fc_subtype='8' +<134>1 1647479350.428006877 MX84_5 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi Guest' bssid='AA:17:D8:C7:D8:51' src='AA:17:D8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='149' rssi='15' fc_type='0' fc_subtype='8' +<134>1 1647479350.457045605 MX84_6 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi' bssid='AE:17:D8:C7:D8:51' src='AE:17:D8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='149' rssi='12' fc_type='0' fc_subtype='8' +<134>1 1647479346.794313756 MR36 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:DF:FD' src='92:17:C8:C7:DF:FD' dst='AE:17:E8:C7:D8:51' wired_mac='AC:17:C8:C7:DF:FD' vlan_id='0' channel='11' rssi='18' fc_type='0' fc_subtype='5' +<134>1 1647479345.577452767 MX84_1 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi' bssid='AE:17:D8:C7:D8:51' src='AE:17:D8:C7:D8:51' dst='E2:CB:9C:B5:D4:1E' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='149' rssi='30' fc_type='0' fc_subtype='5' +<134>1 1647479341.816936841 MX84_3 airmarshal_events type=rogue_ssid_detected ssid='' bssid='AA:17:C8:C7:E1:41' src='AA:17:C8:C7:E1:41' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E1:41' vlan_id='0' channel='1' rssi='33' fc_type='0' fc_subtype='8' +<134>1 1647479318.128184987 MX84_7 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi Guest' bssid='AA:17:C8:C7:D8:51' src='AA:17:C8:C7:D8:51' dst='5C:AA:FD:5D:76:0E' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='22' fc_type='0' fc_subtype='5' +<134>1 1647479313.473165785 MX84_7 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:DF:FD' src='92:17:C8:C7:DF:FD' dst='E2:CB:9C:B5:C5:68' wired_mac='AC:17:C8:C7:DF:FD' vlan_id='0' channel='11' rssi='25' fc_type='0' fc_subtype='5' +<134>1 1647479299.143407174 MX84_2 airmarshal_events type=ssid_spoofing_detected ssid='AwesomeWifi Guest' vap='1' bssid='AA:17:C8:C7:E1:41' src='AA:17:C8:C7:E1:41' dst='78:28:CA:AA:6A:0A' channel='1' rssi='21' fc_type='0' fc_subtype='5' +<134>1 1647479299.115949027 MR36 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:C8:C7:E2:9D' src='BE:17:C8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='11' rssi='32' fc_type='0' fc_subtype='8' +<134>1 1647479294.302067007 MX84_1 airmarshal_events type=rogue_ssid_detected ssid='' bssid='AA:17:C8:C7:D8:51' src='AA:17:C8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='27' fc_type='0' fc_subtype='8' +<134>1 1647479288.469042416 MX84_7 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:D8:C7:D8:51' src='92:17:D8:C7:D8:51' dst='0E:8D:FB:70:0F:A8' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='149' rssi='7' fc_type='0' fc_subtype='5' +<134>1 1647479281.848397134 MX84_7 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi Guest' bssid='AA:17:D8:C7:DF:FD' src='AA:17:D8:C7:DF:FD' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:DF:FD' vlan_id='0' channel='56' rssi='12' fc_type='0' fc_subtype='8' +<134>1 1647479278.839671334 MX84_2 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:D8:C7:D8:51' src='92:17:D8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='149' rssi='31' fc_type='0' fc_subtype='8' +<134>1 1647479231.942342036 MX84_4 airmarshal_events type=ssid_spoofing_detected ssid='AwesomeWifi' vap='13' bssid='AE:17:D8:C7:E2:9D' src='AE:17:D8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' channel='36' rssi='9' fc_type='0' fc_subtype='8' +<134>1 1647479227.438567311 MR36 airmarshal_events type=rogue_ssid_detected ssid='' bssid='AC:17:C8:C7:D8:51' src='AC:17:C8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='54' fc_type='0' fc_subtype='8' +<134>1 1647479222.927379747 MR36 airmarshal_events type=rogue_ssid_detected ssid='' bssid='AC:17:C8:C7:E2:9D' src='AC:17:C8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='11' rssi='29' fc_type='0' fc_subtype='8' +<134>1 1647479222.927802947 MR36 airmarshal_events type=rogue_ssid_detected ssid='' bssid='AA:17:C8:C7:E2:9D' src='AA:17:C8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='11' rssi='30' fc_type='0' fc_subtype='8' +<134>1 1647479222.728876109 MR36 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:C8:C7:D8:51' src='BE:17:C8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='55' fc_type='0' fc_subtype='8' +<134>1 1647479218.076400635 MX84_3 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:E2:9D' src='92:17:C8:C7:E2:9D' dst='E2:CB:9C:B5:DC:6E' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='11' rssi='6' fc_type='0' fc_subtype='5' +<134>1 1647479203.375371107 MR36 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:E1:41' src='92:17:C8:C7:E1:41' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E1:41' vlan_id='0' channel='1' rssi='49' fc_type='0' fc_subtype='8' +<134>1 1647479199.622640025 MR36 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi Guest' bssid='AA:17:D8:C7:E2:9D' src='AA:17:D8:C7:E2:9D' dst='6A:3A:3E:85:CA:4E' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='36' rssi='22' fc_type='0' fc_subtype='5' +<134>1 1647479162.641725608 MR36 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:D8:C7:DF:FD' src='BE:17:D8:C7:DF:FD' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:DF:FD' vlan_id='0' channel='56' rssi='34' fc_type='0' fc_subtype='8' +<134>1 1647479162.670104087 MR36 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:D8:C7:DF:FD' src='92:17:D8:C7:DF:FD' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:DF:FD' vlan_id='0' channel='56' rssi='18' fc_type='0' fc_subtype='8' +<134>1 1647479161.182241827 MX84_8 airmarshal_events type=ssid_spoofing_detected ssid='AwesomeWifi Guest' vap='1' bssid='AA:17:D8:C7:D8:51' src='AA:17:D8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' channel='149' rssi='9' fc_type='0' fc_subtype='8' +<134>1 1647479158.314592227 MX84_8 airmarshal_events type=ssid_spoofing_detected ssid='AwesomeWifi' vap='1' bssid='AE:17:D8:C7:D8:51' src='AE:17:D8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' channel='149' rssi='8' fc_type='0' fc_subtype='8' +<134>1 1647479151.958073405 MX84_7 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:D8:C7:E2:9D' src='BE:17:D8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='36' rssi='12' fc_type='0' fc_subtype='8' +<134>1 1647479133.020606043 MX84_3 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:D8:C7:E1:41' src='92:17:D8:C7:E1:41' dst='6A:3A:3E:85:D7:D4' wired_mac='AC:17:C8:C7:E1:41' vlan_id='0' channel='36' rssi='7' fc_type='0' fc_subtype='5' +<134>1 1647479127.384572447 MX84_1 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:C8:C7:D8:51' src='BE:17:C8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='28' fc_type='0' fc_subtype='8' +<134>1 1647479122.570882475 MX84_4 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:D8:51' src='92:17:C8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='26' fc_type='0' fc_subtype='8' +<134>1 1647479122.592807847 MX84_2 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:D8:51' src='92:17:C8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='36' fc_type='0' fc_subtype='8' +<134>1 1647479122.578597672 MR36 airmarshal_events type=rogue_ssid_detected ssid='' bssid='AA:17:C8:C7:D8:51' src='AA:17:C8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='52' fc_type='0' fc_subtype='8' +<134>1 1647479120.544286631 MR36 airmarshal_events type=ssid_spoofing_detected ssid='AwesomeWifi' vap='1' bssid='AC:17:C8:C7:D8:51' src='AC:17:C8:C7:D8:51' dst='90:AC:3F:02:31:59' channel='6' rssi='50' fc_type='0' fc_subtype='5' +<134>1 1647479091.258858944 MX84_4 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:E1:41' src='92:17:C8:C7:E1:41' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E1:41' vlan_id='0' channel='1' rssi='44' fc_type='0' fc_subtype='8' +<134>1 1647479060.425068327 MX84_2 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi' bssid='AC:17:C8:C7:D8:51' src='AC:17:C8:C7:D8:51' dst='78:28:CA:AA:6A:4A' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='34' fc_type='0' fc_subtype='5' +<134>1 1647479037.677902643 MX84_7 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:D8:C7:E2:9D' src='92:17:D8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='36' rssi='11' fc_type='0' fc_subtype='8' +<134>1 1647479036.783442760 MR36 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:E2:9D' src='92:17:C8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='11' rssi='28' fc_type='0' fc_subtype='8' +<134>1 1647479020.949227955 MR36 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:C8:C7:DF:FD' src='BE:17:C8:C7:DF:FD' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:DF:FD' vlan_id='0' channel='11' rssi='37' fc_type='0' fc_subtype='8' +<134>1 1647478974.912056258 MR36 airmarshal_events type=ssid_spoofing_detected ssid='AwesomeWifi Guest' vap='13' bssid='AA:17:C8:C7:DF:FD' src='AA:17:C8:C7:DF:FD' dst='08:A7:C0:3B:5A:95' channel='11' rssi='27' fc_type='0' fc_subtype='5' +<134>1 1647478966.089203455 MR36 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi' bssid='AE:17:D8:C7:E1:41' src='AE:17:D8:C7:E1:41' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E1:41' vlan_id='0' channel='36' rssi='8' fc_type='0' fc_subtype='8' +<134>1 1647478950.860971410 MX84_7 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi' bssid='AC:17:C8:C7:D8:51' src='AC:17:C8:C7:D8:51' dst='78:28:CA:AA:69:96' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='22' fc_type='0' fc_subtype='5' +<134>1 1647478940.142724327 MX84_2 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi' bssid='AE:17:D8:C7:D8:51' src='AE:17:D8:C7:D8:51' dst='AE:17:E8:C7:E2:9D' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='149' rssi='29' fc_type='0' fc_subtype='5' +<134>1 1647478936.678862087 MX84_2 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:DF:FD' src='92:17:C8:C7:DF:FD' dst='E2:CB:9C:B5:DC:6E' wired_mac='AC:17:C8:C7:DF:FD' vlan_id='0' channel='11' rssi='7' fc_type='0' fc_subtype='5' +<134>1 1647478907.739529447 MX84_2 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:E1:41' src='92:17:C8:C7:E1:41' dst='AE:17:E8:C7:DF:FD' wired_mac='AC:17:C8:C7:E1:41' vlan_id='0' channel='1' rssi='35' fc_type='0' fc_subtype='5' +<134>1 1647478855.303776534 MR36 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:C8:C7:E1:41' src='BE:17:C8:C7:E1:41' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E1:41' vlan_id='0' channel='1' rssi='39' fc_type='0' fc_subtype='8' +<134>1 1647478849.532951889 MX84_3 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi' bssid='AE:17:D8:C7:D8:51' src='AE:17:D8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='149' rssi='29' fc_type='0' fc_subtype='8' +<134>1 1647478845.877942207 MX84_1 airmarshal_events type=rogue_ssid_detected ssid='' bssid='AC:17:C8:C7:D8:51' src='AC:17:C8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='26' fc_type='0' fc_subtype='8' +<134>1 1647478822.111692485 MX84_6 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:DF:FD' src='92:17:C8:C7:DF:FD' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:DF:FD' vlan_id='0' channel='11' rssi='13' fc_type='0' fc_subtype='8' +<134>1 1647478818.039157925 MX84_6 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:D8:C7:E2:9D' src='92:17:D8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='36' rssi='4' fc_type='0' fc_subtype='8' +<134>1 1647478800.349145072 MX84_5 airmarshal_events type=ssid_spoofing_detected ssid='AwesomeWifi Guest' vap='13' bssid='AA:17:C8:C7:DF:FD' src='AA:17:C8:C7:DF:FD' dst='6E:DA:36:A2:39:71' channel='11' rssi='7' fc_type='0' fc_subtype='5' +<134>1 1647478799.177625347 MR36 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:D8:C7:E1:41' src='BE:17:D8:C7:E1:41' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E1:41' vlan_id='0' channel='36' rssi='14' fc_type='0' fc_subtype='8' +<134>1 1647478788.838283552 MR36 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:DF:FD' src='92:17:C8:C7:DF:FD' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:DF:FD' vlan_id='0' channel='11' rssi='17' fc_type='0' fc_subtype='8' +<134>1 1647478782.939898885 MX84_6 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi Guest' bssid='AA:17:D8:C7:E2:9D' src='AA:17:D8:C7:E2:9D' dst='E2:CB:9C:B5:C5:68' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='36' rssi='4' fc_type='0' fc_subtype='5' +<134>1 1647478782.932299301 MX84_8 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi Guest' bssid='AA:17:D8:C7:E2:9D' src='AA:17:D8:C7:E2:9D' dst='E2:CB:9C:B5:C5:68' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='36' rssi='13' fc_type='0' fc_subtype='5' +<134>1 1647478782.930289746 MX84_8 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi' bssid='AE:17:D8:C7:E2:9D' src='AE:17:D8:C7:E2:9D' dst='E2:CB:9C:B5:C5:68' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='36' rssi='13' fc_type='0' fc_subtype='5' +<134>1 1647478695.528431433 MR36 airmarshal_events type=ssid_spoofing_detected ssid='AwesomeWifi Guest' vap='1' bssid='AA:17:C8:C7:D8:51' src='AA:17:C8:C7:D8:51' dst='78:28:CA:AA:6A:4A' channel='6' rssi='52' fc_type='0' fc_subtype='5' +<134>1 1647478693.465185593 MR36 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:DF:FD' src='92:17:C8:C7:DF:FD' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:DF:FD' vlan_id='0' channel='11' rssi='29' fc_type='0' fc_subtype='8' +<134>1 1647478669.549413486 MR36 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:E2:9D' src='92:17:C8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='11' rssi='29' fc_type='0' fc_subtype='8' +<134>1 1647478626.517046787 MR36 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:C8:C7:D8:51' src='BE:17:C8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='49' fc_type='0' fc_subtype='8' +<134>1 1647478591.602996834 MR36 airmarshal_events type=rogue_ssid_detected ssid='' bssid='AA:17:C8:C7:DF:FD' src='AA:17:C8:C7:DF:FD' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:DF:FD' vlan_id='0' channel='11' rssi='27' fc_type='0' fc_subtype='8' +<134>1 1647478569.035635205 MX84_6 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:E1:41' src='92:17:C8:C7:E1:41' dst='E2:CB:9C:B5:C5:68' wired_mac='AC:17:C8:C7:E1:41' vlan_id='0' channel='1' rssi='14' fc_type='0' fc_subtype='5' +<134>1 1647478567.751044590 MR36 airmarshal_events type=rogue_ssid_detected ssid='' bssid='AA:17:C8:C7:DF:FD' src='AA:17:C8:C7:DF:FD' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:DF:FD' vlan_id='0' channel='11' rssi='27' fc_type='0' fc_subtype='8' +<134>1 1647478559.571303907 MR36 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi Guest' bssid='AA:17:C8:C7:D8:51' src='AA:17:C8:C7:D8:51' dst='5C:AA:FD:5D:76:0E' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='49' fc_type='0' fc_subtype='5' +<134>1 1647478558.540066660 MX84_3 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:D8:C7:D8:51' src='92:17:D8:C7:D8:51' dst='E2:CB:9C:B5:DC:6E' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='149' rssi='24' fc_type='0' fc_subtype='5' +<134>1 1647478554.934781027 MR36 airmarshal_events type=rogue_ssid_detected ssid='' bssid='AC:17:C8:C7:D8:51' src='AC:17:C8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='50' fc_type='0' fc_subtype='8' +<134>1 1647478541.587558726 MR36 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi Guest' bssid='AA:17:D8:C7:E1:41' src='AA:17:D8:C7:E1:41' dst='E2:CB:9C:B5:DA:7A' wired_mac='AC:17:C8:C7:E1:41' vlan_id='0' channel='36' rssi='9' fc_type='0' fc_subtype='5' +<134>1 1647478534.671579931 MX84_3 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi Guest' bssid='AA:17:D8:C7:D8:51' src='AA:17:D8:C7:D8:51' dst='E2:CB:9C:B5:DA:7A' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='149' rssi='28' fc_type='0' fc_subtype='5' +<134>1 1647478508.007504325 MX84_6 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi' bssid='AE:17:D8:C7:E2:9D' src='AE:17:D8:C7:E2:9D' dst='6A:3A:3E:85:D7:D4' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='36' rssi='5' fc_type='0' fc_subtype='5' +<134>1 1647478487.013169927 MX84_2 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi Guest' bssid='AA:17:D8:C7:D8:51' src='AA:17:D8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='149' rssi='30' fc_type='0' fc_subtype='8' +<134>1 1647478483.410677512 MX84_3 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:D8:51' src='92:17:C8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='33' fc_type='0' fc_subtype='8' +<134>1 1647478478.614722093 MX84_1 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:D8:51' src='92:17:C8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='32' fc_type='0' fc_subtype='8' +<134>1 1647478440.565782942 MR36 airmarshal_events type=rogue_ssid_detected ssid='' bssid='AC:17:C8:C7:DF:FD' src='AC:17:C8:C7:DF:FD' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:DF:FD' vlan_id='0' channel='11' rssi='14' fc_type='0' fc_subtype='8' +<134>1 1647478408.128821330 MR36 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:D8:C7:E2:9D' src='BE:17:D8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='36' rssi='21' fc_type='0' fc_subtype='8' +<134>1 1647478403.005811325 MX84_5 airmarshal_events type=ssid_spoofing_detected ssid='AwesomeWifi' vap='13' bssid='AC:17:C8:C7:DF:FD' src='AC:17:C8:C7:DF:FD' dst='AE:17:E8:C7:DF:FD' channel='11' rssi='8' fc_type='0' fc_subtype='5' +<134>1 1647478383.070405853 MX84_4 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:C8:C7:E1:41' src='BE:17:C8:C7:E1:41' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E1:41' vlan_id='0' channel='1' rssi='44' fc_type='0' fc_subtype='8' +<134>1 1647478373.816434235 MX84_7 airmarshal_events type=rogue_ssid_detected ssid='' bssid='AA:17:C8:C7:E2:9D' src='AA:17:C8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='11' rssi='9' fc_type='0' fc_subtype='8' +<134>1 1647478339.127895652 MR36 airmarshal_events type=ssid_spoofing_detected ssid='AwesomeWifi Guest' vap='1' bssid='AA:17:C8:C7:E1:41' src='AA:17:C8:C7:E1:41' dst='78:28:CA:AA:6A:0A' channel='1' rssi='35' fc_type='0' fc_subtype='5' +<134>1 1647478298.296851316 MR36 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:D8:C7:E2:9D' src='92:17:D8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='36' rssi='35' fc_type='0' fc_subtype='8' +<134>1 1647478293.380396754 MR36 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi' bssid='AE:17:D8:C7:E2:9D' src='AE:17:D8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='36' rssi='35' fc_type='0' fc_subtype='8' +<134>1 1647478268.953109023 MX84_8 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:C8:C7:DF:FD' src='BE:17:C8:C7:DF:FD' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:DF:FD' vlan_id='0' channel='11' rssi='10' fc_type='0' fc_subtype='8' +<134>1 1647478257.084985274 MR36 airmarshal_events type=ssid_spoofing_detected ssid='AwesomeWifi' vap='13' bssid='AC:17:C8:C7:DF:FD' src='AC:17:C8:C7:DF:FD' dst='EE:CE:D5:6A:B6:22' channel='11' rssi='16' fc_type='0' fc_subtype='5' +<134>1 1647478256.341194724 MR36 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:D8:C7:DF:FD' src='BE:17:D8:C7:DF:FD' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:DF:FD' vlan_id='0' channel='56' rssi='19' fc_type='0' fc_subtype='8' +<134>1 1647478221.255609741 MR36 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:C8:C7:E2:9D' src='BE:17:C8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='11' rssi='12' fc_type='0' fc_subtype='8' +<134>1 1647478145.758483684 MX84_4 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi Guest' bssid='AA:17:D8:C7:E2:9D' src='AA:17:D8:C7:E2:9D' dst='6A:3A:3E:85:D7:D4' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='36' rssi='5' fc_type='0' fc_subtype='5' +<134>1 1647478121.589518727 MX84_2 airmarshal_events type=ssid_spoofing_detected ssid='AwesomeWifi' vap='1' bssid='AC:17:C8:C7:E1:41' src='AC:17:C8:C7:E1:41' dst='AE:17:E8:C7:E1:41' channel='1' rssi='22' fc_type='0' fc_subtype='5' +<134>1 1647478119.868477795 MX84_7 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:D8:C7:D8:51' src='BE:17:D8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='149' rssi='7' fc_type='0' fc_subtype='8' +<134>1 1647478114.277373007 MR36 airmarshal_events type=ssid_spoofing_detected ssid='AwesomeWifi' vap='1' bssid='AC:17:C8:C7:D8:51' src='AC:17:C8:C7:D8:51' dst='78:28:CA:AA:69:96' channel='6' rssi='48' fc_type='0' fc_subtype='5' +<134>1 1647478105.395836204 MR36 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:D8:C7:D8:51' src='BE:17:D8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='149' rssi='53' fc_type='0' fc_subtype='8' +<134>1 1647478102.536782923 MR36 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:D8:C7:E1:41' src='92:17:D8:C7:E1:41' dst='E2:CB:9C:B5:D7:80' wired_mac='AC:17:C8:C7:E1:41' vlan_id='0' channel='36' rssi='9' fc_type='0' fc_subtype='5' +<134>1 1647478092.108472035 MX84_7 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:C8:C7:E1:41' src='BE:17:C8:C7:E1:41' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E1:41' vlan_id='0' channel='1' rssi='27' fc_type='0' fc_subtype='8' +<134>1 1647478087.649007204 MR36 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:C8:C7:E2:9D' src='BE:17:C8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='11' rssi='23' fc_type='0' fc_subtype='8' +<134>1 1647478063.434847715 MX84_7 airmarshal_events type=rogue_ssid_detected ssid='' bssid='AC:17:C8:C7:E1:41' src='AC:17:C8:C7:E1:41' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E1:41' vlan_id='0' channel='1' rssi='30' fc_type='0' fc_subtype='8' +<134>1 1647478054.846444450 MX84_4 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:D8:C7:E2:9D' src='92:17:D8:C7:E2:9D' dst='E2:CB:9C:B5:DD:BE' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='36' rssi='3' fc_type='0' fc_subtype='5' +<134>1 1647478039.876640835 MX84_7 airmarshal_events type=rogue_ssid_detected ssid='' bssid='AC:17:C8:C7:E2:9D' src='AC:17:C8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='11' rssi='11' fc_type='0' fc_subtype='8' +<134>1 1647478035.923601924 MR36 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi' bssid='AE:17:D8:C7:E2:9D' src='AE:17:D8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='36' rssi='23' fc_type='0' fc_subtype='8' +<134>1 1647478034.762765475 MX84_7 airmarshal_events type=rogue_ssid_detected ssid='' bssid='AA:17:C8:C7:E1:41' src='AA:17:C8:C7:E1:41' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E1:41' vlan_id='0' channel='1' rssi='27' fc_type='0' fc_subtype='8' +<134>1 1647478026.502834244 MR36 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi Guest' bssid='AA:17:D8:C7:E2:9D' src='AA:17:D8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='36' rssi='23' fc_type='0' fc_subtype='8' +<134>1 1647478020.564810050 MX84_8 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:C8:C7:E1:41' src='BE:17:C8:C7:E1:41' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E1:41' vlan_id='0' channel='1' rssi='29' fc_type='0' fc_subtype='8' +<134>1 1647478015.983013635 MX84_7 airmarshal_events type=rogue_ssid_detected ssid='' bssid='AA:17:C8:C7:DF:FD' src='AA:17:C8:C7:DF:FD' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:DF:FD' vlan_id='0' channel='11' rssi='20' fc_type='0' fc_subtype='8' +<134>1 1647478006.707247789 MR36 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:C8:C7:E1:41' src='BE:17:C8:C7:E1:41' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E1:41' vlan_id='0' channel='1' rssi='38' fc_type='0' fc_subtype='8' +<134>1 1647478001.603867573 MX84_3 airmarshal_events type=rogue_ssid_detected ssid='' bssid='AC:17:C8:C7:D8:51' src='AC:17:C8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='34' fc_type='0' fc_subtype='8' +<134>1 1647477963.236026884 MR36 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:E1:41' src='92:17:C8:C7:E1:41' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E1:41' vlan_id='0' channel='1' rssi='66' fc_type='0' fc_subtype='8' +<134>1 1647477958.900449163 MR36 airmarshal_events type=rogue_ssid_detected ssid='' bssid='AC:17:C8:C7:E2:9D' src='AC:17:C8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='11' rssi='12' fc_type='0' fc_subtype='8' +<134>1 1647477953.907583508 MR36 airmarshal_events type=rogue_ssid_detected ssid='' bssid='AC:17:C8:C7:D8:51' src='AC:17:C8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='43' fc_type='0' fc_subtype='8' +<134>1 1647477953.724449475 MX84_7 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:E1:41' src='92:17:C8:C7:E1:41' dst='E2:CB:9C:B5:C5:68' wired_mac='AC:17:C8:C7:E1:41' vlan_id='0' channel='1' rssi='35' fc_type='0' fc_subtype='5' +<134>1 1647477945.336342244 MR36 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:D8:C7:E2:9D' src='92:17:D8:C7:E2:9D' dst='E2:CB:9C:B5:D8:54' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='36' rssi='24' fc_type='0' fc_subtype='5' +<134>1 1647477944.121686758 MR36 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:E1:41' src='92:17:C8:C7:E1:41' dst='6A:3A:3E:85:CA:4E' wired_mac='AC:17:C8:C7:E1:41' vlan_id='0' channel='1' rssi='67' fc_type='0' fc_subtype='5' +<134>1 1647477940.363429956 MR36 airmarshal_events type=ssid_spoofing_detected ssid='AwesomeWifi Guest' vap='13' bssid='AA:17:C8:C7:DF:FD' src='AA:17:C8:C7:DF:FD' dst='34:8F:27:25:CC:48' channel='11' rssi='16' fc_type='0' fc_subtype='5' +<134>1 1647477930.038516204 MR36 airmarshal_events type=rogue_ssid_detected ssid='' bssid='AA:17:C8:C7:D8:51' src='AA:17:C8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='40' fc_type='0' fc_subtype='8' +<134>1 1647477927.225784460 MR36 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:D8:C7:DF:FD' src='92:17:D8:C7:DF:FD' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:DF:FD' vlan_id='0' channel='56' rssi='34' fc_type='0' fc_subtype='8' +<134>1 1647477920.683178115 MX84_7 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:E2:9D' src='92:17:C8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='11' rssi='15' fc_type='0' fc_subtype='8' +<134>1 1647477920.510699794 MR36 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:C8:C7:D8:51' src='BE:17:C8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='40' fc_type='0' fc_subtype='8' +<134>1 1647477891.986568005 MX84_6 airmarshal_events type=rogue_ssid_detected ssid='' bssid='AA:17:C8:C7:DF:FD' src='AA:17:C8:C7:DF:FD' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:DF:FD' vlan_id='0' channel='11' rssi='8' fc_type='0' fc_subtype='8' +<134>1 1647477881.304873506 MX84_4 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:D8:C7:D8:51' src='92:17:D8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='149' rssi='12' fc_type='0' fc_subtype='8' +<134>1 1647477873.769683395 MX84_7 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi Guest' bssid='AA:17:D8:C7:E2:9D' src='AA:17:D8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='36' rssi='11' fc_type='0' fc_subtype='8' +<134>1 1647477872.782332783 MR36 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:D8:51' src='92:17:C8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='52' fc_type='0' fc_subtype='8' +<134>1 1647477871.675119845 MX84_6 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:D8:C7:D8:51' src='92:17:D8:C7:D8:51' dst='E2:CB:9C:B5:DD:BE' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='149' rssi='14' fc_type='0' fc_subtype='5' +<134>1 1647477864.088023180 MR36 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:D8:C7:E1:41' src='BE:17:D8:C7:E1:41' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E1:41' vlan_id='0' channel='36' rssi='9' fc_type='0' fc_subtype='8' +<134>1 1647477834.810489249 MR36 airmarshal_events type=rogue_ssid_detected ssid='' bssid='AA:17:C8:C7:E2:9D' src='AA:17:C8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='11' rssi='26' fc_type='0' fc_subtype='8' +<134>1 1647477828.886032606 MR36 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:D8:C7:D8:51' src='92:17:D8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='149' rssi='52' fc_type='0' fc_subtype='8' +<134>1 1647477828.885258686 MR36 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi Guest' bssid='AA:17:D8:C7:D8:51' src='AA:17:D8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='149' rssi='50' fc_type='0' fc_subtype='8' +<134>1 1647477828.799864712 MX84_5 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:D8:C7:D8:51' src='92:17:D8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='149' rssi='16' fc_type='0' fc_subtype='8' +<134>1 1647477825.209110701 MR36 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:E2:9D' src='92:17:C8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='11' rssi='38' fc_type='0' fc_subtype='8' +<134>1 1647477825.021409913 MR36 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:D8:51' src='92:17:C8:C7:D8:51' dst='6A:3A:3E:85:CA:4E' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='63' fc_type='0' fc_subtype='5' +<134>1 1647477825.024707684 MR36 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:D8:51' src='92:17:C8:C7:D8:51' dst='AE:17:E8:C7:DF:FD' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='59' fc_type='0' fc_subtype='5' +<134>1 1647477821.364087032 MR36 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:D8:C7:E1:41' src='BE:17:D8:C7:E1:41' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E1:41' vlan_id='0' channel='36' rssi='29' fc_type='0' fc_subtype='8' +<134>1 1647477796.382660565 MR36 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:C8:C7:D8:51' src='BE:17:C8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='62' fc_type='0' fc_subtype='8' +<134>1 1647477796.382227661 MR36 airmarshal_events type=rogue_ssid_detected ssid='' bssid='AA:17:C8:C7:D8:51' src='AA:17:C8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='61' fc_type='0' fc_subtype='8' +<134>1 1647477796.381818586 MR36 airmarshal_events type=rogue_ssid_detected ssid='' bssid='AC:17:C8:C7:D8:51' src='AC:17:C8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='61' fc_type='0' fc_subtype='8' +<134>1 1647477795.407019364 MR36 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:D8:C7:D8:51' src='BE:17:D8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='149' rssi='46' fc_type='0' fc_subtype='8' +<134>1 1647477795.385494917 MR36 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi' bssid='AE:17:D8:C7:D8:51' src='AE:17:D8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='149' rssi='58' fc_type='0' fc_subtype='8' +<134>1 1647477795.385835866 MR36 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi Guest' bssid='AA:17:D8:C7:D8:51' src='AA:17:D8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='149' rssi='58' fc_type='0' fc_subtype='8' +<134>1 1647477793.576467473 MR36 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi' bssid='AE:17:D8:C7:DF:FD' src='AE:17:D8:C7:DF:FD' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:DF:FD' vlan_id='0' channel='56' rssi='33' fc_type='0' fc_subtype='8' +<134>1 1647477793.576769233 MR36 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi Guest' bssid='AA:17:D8:C7:DF:FD' src='AA:17:D8:C7:DF:FD' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:DF:FD' vlan_id='0' channel='56' rssi='34' fc_type='0' fc_subtype='8' +<134>1 1647477786.805604872 MX84_5 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:E1:41' src='92:17:C8:C7:E1:41' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E1:41' vlan_id='0' channel='1' rssi='24' fc_type='0' fc_subtype='8' +<134>1 1647477780.705460109 MR36 airmarshal_events type=rogue_ssid_detected ssid='' bssid='AC:17:C8:C7:DF:FD' src='AC:17:C8:C7:DF:FD' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:DF:FD' vlan_id='0' channel='11' rssi='37' fc_type='0' fc_subtype='8' +<134>1 1647477778.398160444 MR36 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:D8:C7:E2:9D' src='BE:17:D8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='36' rssi='40' fc_type='0' fc_subtype='8' +<134>1 1647477773.586461164 MR36 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:D8:C7:E2:9D' src='92:17:D8:C7:E2:9D' dst='AE:17:E8:C7:D8:51' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='36' rssi='22' fc_type='0' fc_subtype='5' +<134>1 1647477764.149946084 MR36 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:D8:C7:E1:41' src='BE:17:D8:C7:E1:41' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E1:41' vlan_id='0' channel='36' rssi='33' fc_type='0' fc_subtype='8' +<134>1 1647477764.145077176 MR36 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:D8:C7:E1:41' src='92:17:D8:C7:E1:41' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E1:41' vlan_id='0' channel='36' rssi='31' fc_type='0' fc_subtype='8' +<134>1 1647477764.143985243 MR36 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi' bssid='AE:17:D8:C7:E1:41' src='AE:17:D8:C7:E1:41' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E1:41' vlan_id='0' channel='36' rssi='30' fc_type='0' fc_subtype='8' +<134>1 1647477764.144283174 MR36 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi Guest' bssid='AA:17:D8:C7:E1:41' src='AA:17:D8:C7:E1:41' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E1:41' vlan_id='0' channel='36' rssi='30' fc_type='0' fc_subtype='8' +<134>1 1647477763.225832662 MX84_4 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:E2:9D' src='92:17:C8:C7:E2:9D' dst='E2:CB:9C:B5:D4:1E' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='11' rssi='9' fc_type='0' fc_subtype='5' +<134>1 1647477744.039850991 MR36 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:D8:51' src='92:17:C8:C7:D8:51' dst='AE:17:E8:C7:DF:FD' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='50' fc_type='0' fc_subtype='5' +<134>1 1647477733.453967364 MR36 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:D8:C7:D8:51' src='92:17:D8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='149' rssi='48' fc_type='0' fc_subtype='8' +<134>1 1647477733.446493073 MX84_3 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:D8:C7:D8:51' src='BE:17:D8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='149' rssi='28' fc_type='0' fc_subtype='8' +<134>1 1647477733.420037284 MR36 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi Guest' bssid='AA:17:D8:C7:D8:51' src='AA:17:D8:C7:D8:51' dst='38:BA:F8:CC:82:2E' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='149' rssi='48' fc_type='0' fc_subtype='5' +<134>1 1647477733.419042244 MR36 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi' bssid='AE:17:D8:C7:D8:51' src='AE:17:D8:C7:D8:51' dst='38:BA:F8:CC:82:2E' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='149' rssi='48' fc_type='0' fc_subtype='5' +<134>1 1647477733.411410011 MR36 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi' bssid='AE:17:D8:C7:D8:51' src='AE:17:D8:C7:D8:51' dst='38:BA:F8:CC:82:2E' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='149' rssi='51' fc_type='0' fc_subtype='5' +<134>1 1647477716.431936901 MR36 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi Guest' bssid='AA:17:D8:C7:E2:9D' src='AA:17:D8:C7:E2:9D' dst='E2:CB:9C:B5:D8:54' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='36' rssi='39' fc_type='0' fc_subtype='5' +<134>1 1647477716.431151781 MR36 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:D8:C7:E2:9D' src='92:17:D8:C7:E2:9D' dst='E2:CB:9C:B5:D8:54' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='36' rssi='39' fc_type='0' fc_subtype='5' +<134>1 1647477716.429168101 MR36 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi' bssid='AE:17:D8:C7:E2:9D' src='AE:17:D8:C7:E2:9D' dst='E2:CB:9C:B5:D8:54' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='36' rssi='39' fc_type='0' fc_subtype='5' +<134>1 1647477715.612600884 MR36 airmarshal_events type=rogue_ssid_detected ssid='' bssid='AC:17:C8:C7:E2:9D' src='AC:17:C8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='11' rssi='28' fc_type='0' fc_subtype='8' +<134>1 1647477702.046252324 MR36 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:D8:C7:E1:41' src='92:17:D8:C7:E1:41' dst='E2:CB:9C:B5:DC:6E' wired_mac='AC:17:C8:C7:E1:41' vlan_id='0' channel='36' rssi='35' fc_type='0' fc_subtype='5' +<134>1 1647479055.795119971 MR_device_2 events type=dfs_event channel='136' radio='2' +<134>1 1647478401.421090826 MR_device_2 events type=wpa_deauth radio='1' vap='1' client_mac='E5:A4:98:71:9A:FE' aid='1034533358' +<134>1 1647478402.126325721 MR_device_2 events type=wpa_auth radio='1' vap='1' client_mac='E4:F4:18:79:1F:E1' aid='910537108' +<134>1 1647478709.602628785 MR_device_2 events type=disassociation radio='1' vap='1' client_mac='12:8D:1B:8A:D4:C8' channel='108' duration='309.163703632' auth_neg_dur='0.005547865' last_auth_ago='309.154547226' is_wpa='1' full_conn='0.121500990' ip_resp='0.121500990' ip_src='67.43.156.14' dns_req_rtt='0.018446771' dns_resp='0.190431042' dhcp_lease_completed='1.373967135' dhcp_server='8.8.8.8' dhcp_server_mac='18:3B:2E:5C:A7:F6' dhcp_resp='1.373967135' aid='1478558813' +<134>1 1647478402.117726086 MR_device_2 events type=association radio='1' vap='1' client_mac='12:8D:1B:8A:D4:C8' channel='140' rssi='20' aid='910537108' +<134>1 1647478093.022430458 MX_device_1 events Site-to-Site VPN: CHILD_SA net-1{272} established with SPIs c6abe8d0(inbound) 4f04c590(outbound) and TS 89.160.20.112/32[udp/l2f] === 81.2.69.144/32[udp/l2f] +<134>1 1647478092.029594666 MX_device_1 events Site-to-Site VPN: IKE_SA l2tp-over-ipsec-1[241] established between 89.160.20.112[89.160.20.112]...81.2.69.144[192.168.1.201] +<134>1 1647478222.583851938 MX84 events type=vpn_connectivity_change vpn_type='site-to-site' peer_contact='216.160.83.61:51856' peer_ident='2814ee002c075181bb1b7478ee073860' connectivity='false' +<134>1 1647479420.148681168 MX84 events dhcp lease of ip 10.0.2.213 from mx mac 68:3A:1E:42:60:59 for client mac E0:CB:BC:02:4F:80 from router 10.0.0.1 on subnet 255.255.252.0 with dns 10.0.0.1 +<134>1 1647479961.535491111 MX84 events dhcp no offers for mac A4:83:E7:02:A2:F1 host = 192.168.10.1 +<134>1 1647478092.669153546 MX_device_4 events client_vpn_connect user id 'jwick@wwvpn.net' local ip 172.16.0.145 connected from 81.2.69.193 +<134>1 1647478988.289402144 MX84_4 flows allow src=10.0.2.170 dst=10.0.0.34 mac=00:7C:2D:BD:76:F2 protocol=udp sport=54841 dport=15600 +<134>1 1647478988.476061795 MX84 flows src=216.160.83.57 dst=216.160.83.61 protocol=tcp sport=54445 dport=44210 pattern: 1 all +<134>1 1647478988.596151424 MX84_7 flows allow src=10.0.0.34 dst=10.0.0.234 mac=64:1C:B0:BA:F0:EC protocol=tcp sport=49761 dport=15500 +<134>1 1647479278.997155282 MX100 ip_flow_start src=10.0.0.234 dst=81.2.69.145 protocol=tcp sport=34294 dport=80 translated_src_ip=1.128.3.4 translated_port=34294 +<134>1 1647479278.995279215 MX100 ip_flow_start src=10.0.0.234 dst=81.2.69.143 protocol=udp sport=45061 dport=53 translated_src_ip=1.128.3.4 translated_port=45061 +<134>1 1647479278.974067126 MX100 ip_flow_start src=10.0.0.234 dst=81.2.69.143 protocol=udp sport=37401 dport=53 translated_src_ip=1.128.3.4 translated_port=37401 +<134>1 1647479278.911594876 MX84 ip_flow_start src=10.0.3.138 dst=89.160.20.156 protocol=tcp sport=61272 dport=443 translated_src_ip=216.160.83.61 translated_port=61272 +<134>1 1647479325.891451682 MX84 ip_flow_end src=10.0.2.249 dst=10.0.0.1 protocol=udp sport=7421 dport=53 translated_dst_ip=89.160.20.112 translated_port=53 +<134>1 1647479325.842384731 MX84 ip_flow_end src=10.0.3.116 dst=67.43.156.14 protocol=udp sport=38422 dport=443 translated_src_ip=216.160.83.61 translated_port=38422 +<134>1 1647479325.842377481 MX84 ip_flow_end src=10.0.2.99 dst=10.0.0.1 protocol=udp sport=29534 dport=53 translated_dst_ip=89.160.20.112 translated_port=53 +<134>1 1647479325.755292025 MX100 ip_flow_end src=10.0.0.234 dst=81.2.69.144 protocol=tcp sport=36498 dport=80 translated_src_ip=1.128.3.4 translated_port=36498 +<134>1 1637691298.984398273 MX84 security_event security_filtering_file_scanned url=http://www.eicar.org/download/eicar.com.txt src=192.168.128.2:53150 dst=67.43.156.15:80 mac=98:5A:EB:E1:81:2F name='EICAR:EICAR_Test_file_not_a_virus-tpd' sha256=275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f disposition=malicious action=block +<134>1 1637783435.239819833 MX84 security_event security_filtering_disposition_change name=EICAR:EICAR_Test_file_not_a_virus-tpd sha256=275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f disposition=malicious action=allow +<134>1 1637783891.345984502 MX84 ids-alerts signature=129:4:1 priority=3 timestamp=1637783891.512569 direction=ingress protocol=tcp/ip src=67.43.156.15:80 +<134>1 1637790201.246576346 MX84 ids-alerts signature=119:15:1 priority=2 timestamp=1637790201.238064 direction=egress protocol=tcp/ip src=192.168.111.254:56240 +<134>1 1647479503.348215340 MX84 urls src=10.0.1.29:60336 dst=89.160.20.156:80 mac=78:7B:8A:CC:05:18 request: UNKNOWN https://bitbucket.org/... +<134>1 1647479503.676404537 MX84 urls src=10.0.0.234:56424 dst=89.160.20.112:443 mac=64:1C:AE:68:2A:01 request: GET https://lh3.googleusercontent.com/p/AFVnnY=w2048-h1024 diff --git a/packages/cisco_meraki/changelog.yml b/packages/cisco_meraki/changelog.yml index b82d96e87e56..cf4226f784a6 100644 --- a/packages/cisco_meraki/changelog.yml +++ b/packages/cisco_meraki/changelog.yml @@ -1,9 +1,9 @@ -# newer versions go on top +# newer versions go on topA - version: "0.5.0" changes: - - description: Update to ECS 8.2.0 + - description: Replace RSA2ELK with Syslog and Webhook integration type: enhancement - link: https://github.com/elastic/integrations/pull/2778 + link: https://github.com/elastic/integrations/pull/2897 - version: "0.4.1" changes: - description: Add documentation for multi-fields diff --git a/packages/cisco_meraki/data_stream/events/_dev/test/pipeline/test-mx-events.json b/packages/cisco_meraki/data_stream/events/_dev/test/pipeline/test-mx-events.json new file mode 100644 index 000000000000..9c0907b47e06 --- /dev/null +++ b/packages/cisco_meraki/data_stream/events/_dev/test/pipeline/test-mx-events.json @@ -0,0 +1,105 @@ +{ + "events": [ + { + "json": { + "version": "0.1", + "sharedSecret": "secret", + "sentAt": "2021-10-07T08:42:00.926325Z", + "organizationId": "2930418", + "organizationName": "My organization", + "organizationUrl": "https://dashboard.meraki.com/o/VjjsAd/manage/organization/overview", + "networkId": "N_24329156", + "networkName": "Main Office", + "networkUrl": "https://n1.meraki.com//n//manage/nodes/list", + "networkTags": [], + "deviceSerial": "Q234-ABCD-5678", + "deviceMac": "00:11:22:33:44:55", + "deviceName": "My appliance", + "deviceUrl": "https://n1.meraki.com//n//manage/nodes/new_list/000000000000", + "deviceTags": [ + "tag1", + "tag2" + ], + "deviceModel": "MX", + "alertId": "0000000000000000", + "alertType": "Cellular came up", + "alertTypeId": "cellular_up", + "alertLevel": "informational", + "occurredAt": "2018-02-11T00:00:00.123450Z", + "alertData": { + "provider": "Purview Wireless", + "model": "UML290VW", + "local": "192.168.1.2", + "remote": "1.2.3.5", + "connection": "LTE" + } + } + }, + { + "json": { + "version": "0.1", + "sharedSecret": "secret", + "sentAt": "2021-10-07T08:42:00.927486Z", + "organizationId": "2930418", + "organizationName": "My organization", + "organizationUrl": "https://dashboard.meraki.com/o/VjjsAd/manage/organization/overview", + "networkId": "N_24329156", + "networkName": "Main Office", + "networkUrl": "https://n1.meraki.com//n//manage/nodes/list", + "networkTags": [], + "deviceSerial": "Q234-ABCD-5678", + "deviceMac": "00:11:22:33:44:55", + "deviceName": "", + "deviceUrl": "https://n1.meraki.com//n//manage/nodes/new_list/000000000000", + "deviceTags": [ + "tag1", + "tag2" + ], + "deviceModel": "", + "alertId": "0000000000000000", + "alertType": "Insight Alert", + "alertTypeId": "mi_alert", + "alertLevel": "warning", + "occurredAt": "2018-02-11T00:00:00.123450Z", + "alertData": {} + } + }, + { + "json": { + "version": "0.1", + "sharedSecret": "secret", + "sentAt": "2021-10-07T08:42:00.937240Z", + "organizationId": "2930418", + "organizationName": "My organization", + "organizationUrl": "https://dashboard.meraki.com/o/VjjsAd/manage/organization/overview", + "networkId": "N_24329156", + "networkName": "Main Office", + "networkUrl": "https://n1.meraki.com//n//manage/nodes/list", + "networkTags": [], + "deviceSerial": "Q234-ABCD-5678", + "deviceMac": "00:11:22:33:44:55", + "deviceName": "My switch", + "deviceUrl": "https://n1.meraki.com//n//manage/nodes/new_list/000000000000", + "deviceTags": [ + "tag1", + "tag2" + ], + "deviceModel": "MS", + "alertId": "0000000000000000", + "alertType": "Failover event detected", + "alertTypeId": "vrrp", + "alertLevel": "critical", + "occurredAt": "2018-02-11T00:00:00.123450Z", + "alertData": { + "oldIfUp": "0", + "oldMode": "detect", + "oldPrio": "75", + "electorState": "master", + "mode": "detect", + "prio": "75", + "ifUp": "1" + } + } + } + ] +} \ No newline at end of file diff --git a/packages/cisco_meraki/data_stream/events/_dev/test/pipeline/test-mx-events.json-expected.json b/packages/cisco_meraki/data_stream/events/_dev/test/pipeline/test-mx-events.json-expected.json new file mode 100644 index 000000000000..48303a383d98 --- /dev/null +++ b/packages/cisco_meraki/data_stream/events/_dev/test/pipeline/test-mx-events.json-expected.json @@ -0,0 +1,168 @@ +{ + "expected": [ + { + "@timestamp": "2018-02-11T00:00:00.123Z", + "cisco_meraki": { + "event": { + "alertData": { + "connection": "LTE", + "local": "192.168.1.2", + "model": "UML290VW", + "provider": "Purview Wireless", + "remote": "1.2.3.5" + }, + "alertId": "0000000000000000", + "alertTypeId": "cellular_up", + "deviceTags": [ + "tag1", + "tag2" + ], + "deviceUrl": "https://n1.meraki.com//n//manage/nodes/new_list/000000000000", + "networkId": "N_24329156", + "networkUrl": "https://n1.meraki.com//n//manage/nodes/list", + "organizationUrl": "https://dashboard.meraki.com/o/VjjsAd/manage/organization/overview", + "sentAt": "2021-10-07T08:42:00.926325Z", + "sharedSecret": "secret", + "version": "0.1" + } + }, + "ecs": { + "version": "8.0.0" + }, + "event": { + "action": "Cellular came up", + "category": [ + "network" + ], + "type": [ + "info", + "start" + ] + }, + "log": { + "level": "informational" + }, + "network": { + "name": "Main Office" + }, + "observer": { + "mac": "00-11-22-33-44-55", + "name": "My appliance", + "product": "MX", + "serial_number": "Q234-ABCD-5678", + "vendor": "Cisco" + }, + "organization": { + "id": "2930418", + "name": "My organization" + } + }, + { + "@timestamp": "2018-02-11T00:00:00.123Z", + "cisco_meraki": { + "event": { + "alertId": "0000000000000000", + "alertTypeId": "mi_alert", + "deviceTags": [ + "tag1", + "tag2" + ], + "deviceUrl": "https://n1.meraki.com//n//manage/nodes/new_list/000000000000", + "networkId": "N_24329156", + "networkUrl": "https://n1.meraki.com//n//manage/nodes/list", + "organizationUrl": "https://dashboard.meraki.com/o/VjjsAd/manage/organization/overview", + "sentAt": "2021-10-07T08:42:00.927486Z", + "sharedSecret": "secret", + "version": "0.1" + } + }, + "ecs": { + "version": "8.0.0" + }, + "event": { + "action": "Insight Alert", + "category": [ + "network" + ], + "type": [ + "info" + ] + }, + "log": { + "level": "warning" + }, + "network": { + "name": "Main Office" + }, + "observer": { + "mac": "00-11-22-33-44-55", + "serial_number": "Q234-ABCD-5678", + "vendor": "Cisco" + }, + "organization": { + "id": "2930418", + "name": "My organization" + } + }, + { + "@timestamp": "2018-02-11T00:00:00.123Z", + "cisco_meraki": { + "event": { + "alertData": { + "electorState": "master", + "ifUp": "1", + "mode": "detect", + "oldIfUp": "0", + "oldMode": "detect", + "oldPrio": "75", + "prio": "75" + }, + "alertId": "0000000000000000", + "alertTypeId": "vrrp", + "deviceTags": [ + "tag1", + "tag2" + ], + "deviceUrl": "https://n1.meraki.com//n//manage/nodes/new_list/000000000000", + "networkId": "N_24329156", + "networkUrl": "https://n1.meraki.com//n//manage/nodes/list", + "organizationUrl": "https://dashboard.meraki.com/o/VjjsAd/manage/organization/overview", + "sentAt": "2021-10-07T08:42:00.937240Z", + "sharedSecret": "secret", + "version": "0.1" + } + }, + "ecs": { + "version": "8.0.0" + }, + "event": { + "action": "Failover event detected", + "category": [ + "network", + "configuration" + ], + "type": [ + "info", + "change" + ] + }, + "log": { + "level": "critical" + }, + "network": { + "name": "Main Office" + }, + "observer": { + "mac": "00-11-22-33-44-55", + "name": "My switch", + "product": "MS", + "serial_number": "Q234-ABCD-5678", + "vendor": "Cisco" + }, + "organization": { + "id": "2930418", + "name": "My organization" + } + } + ] +} \ No newline at end of file diff --git a/packages/cisco_meraki/data_stream/events/_dev/test/system/test-meraki-http-config.yml b/packages/cisco_meraki/data_stream/events/_dev/test/system/test-meraki-http-config.yml new file mode 100644 index 000000000000..54290741aff7 --- /dev/null +++ b/packages/cisco_meraki/data_stream/events/_dev/test/system/test-meraki-http-config.yml @@ -0,0 +1,10 @@ +service: meraki-webhook-http +service_notify_signal: SIGHUP +input: webhook +data_stream: + vars: + listen_address: 0.0.0.0 + listen_port: 8686 + url: /meraki/events + secret_value: abc123 + preserve_original_event: true diff --git a/packages/cisco_meraki/data_stream/events/_dev/test/system/test-meraki-https-config.yml b/packages/cisco_meraki/data_stream/events/_dev/test/system/test-meraki-https-config.yml new file mode 100644 index 000000000000..dd02536ccc6a --- /dev/null +++ b/packages/cisco_meraki/data_stream/events/_dev/test/system/test-meraki-https-config.yml @@ -0,0 +1,61 @@ +service: meraki-webhook-https +service_notify_signal: SIGHUP +input: webhook +data_stream: + vars: + listen_address: 0.0.0.0 + listen_port: 8686 + preserve_original_event: true + url: /meraki/events + secret_value: abc123 + ssl: |- + certificate: | + -----BEGIN CERTIFICATE----- + MIIDJjCCAg6gAwIBAgIRAO76bP2QhJVqbLjcsWD6gkUwDQYJKoZIhvcNAQELBQAw + JjEkMCIGA1UEChMbVEVTVCAtIEVsYXN0aWMgSW50ZWdyYXRpb25zMB4XDTIxMDIw + MjE2NTUzOVoXDTQxMDEyODE2NTUzOVowJjEkMCIGA1UEChMbVEVTVCAtIEVsYXN0 + aWMgSW50ZWdyYXRpb25zMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA + vUs3YgX4RnEKzSyqH599ffHMDidw3JUTNzp/alRByiGN2gnC2YLLeB8gbZHn2Xkl + YCET1oUrVmPAijwV2RzPYwIn0kIh4zVOKO7+RDCCrgq8CgIG1xZyUhMF3uwn868r + SmX5FZ3T3/max51EsAJmzawef1TqrQRdEKxuPBQs/4qWaYeQCeYeZBVcg2b8CUmg + 3w1lB072Xzt7cJUp8FU1s7U9Hfgg2Dslh9+DSVX0yoqwN8Ynw4FXMSyqAu/OdBbG + aidOR6YjlKx3OSUUYsuB7q3XDyigb6Va7W737QTLIhtEb56l4E0iO4jDT41LaYyw + vRpWegfvHoFBHXbXT6AxtQIDAQABo08wTTAOBgNVHQ8BAf8EBAMCBaAwEwYDVR0l + BAwwCgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADAYBgNVHREEETAPgg1lbGFzdGlj + LWFnZW50MA0GCSqGSIb3DQEBCwUAA4IBAQAcFeQS0QtPFpGMQ55NO+ycsXAsYZsJ + XvdUMoGygkkbrUQXmQbMMSMPGAGdMfc9V6BMA8x6JgGyKZBcIN/RTkBKjpXFwL03 + su+9liQnIMbYFvBfc1HDjAN5u2HpMdH0sCOe0W4XF5r6n8Q+6WuCl51HND6ObsyR + nU/7PySQ6Bv2PftPI1LMFeLsmgQsCJ/z8jcP4oW4PtgyK7vb+NWGLzRnkgaHYqh3 + oT7VnxPZQtWBJQa2LJhcp+u5k2Y6PipAyh4mCm/IRr1UHpGT/qBGnaUC+DRWd/pk + T4UnmUgq6eJL4IY+v/wpUPS+uHVtFhPSvRp+5hhicuK1YN4Ug/qKirVs + -----END CERTIFICATE----- + key: | + -----BEGIN PRIVATE KEY----- + MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQC9SzdiBfhGcQrN + LKofn3198cwOJ3DclRM3On9qVEHKIY3aCcLZgst4HyBtkefZeSVgIRPWhStWY8CK + PBXZHM9jAifSQiHjNU4o7v5EMIKuCrwKAgbXFnJSEwXe7CfzrytKZfkVndPf+ZrH + nUSwAmbNrB5/VOqtBF0QrG48FCz/ipZph5AJ5h5kFVyDZvwJSaDfDWUHTvZfO3tw + lSnwVTWztT0d+CDYOyWH34NJVfTKirA3xifDgVcxLKoC7850FsZqJ05HpiOUrHc5 + JRRiy4HurdcPKKBvpVrtbvftBMsiG0RvnqXgTSI7iMNPjUtpjLC9GlZ6B+8egUEd + dtdPoDG1AgMBAAECggEAP2ks+ldJnj9MAQNPUhyZa1FOrAcmVZ5Su5OLD1F+YHnx + DPNsJHUeN/UlZc8UvdNJY/RwstIVfHEaFLSgFQUDrAUS1ep1c6ltr2SwJKOjgy3x + Y+Dd7buFPF1HADBYCdfKRrf2QvmF+mehI/FZCyUizw8zgDAwFRl7G5THsLSJhmiQ + wDc9WbPFLyswtmeKoAqMiHHqV63PtJunqvGbrDTHh9f4P5JVtreMoPWzE9czQ2ZI + 5nBHOFP/EA6twyRalqOsm3XoFmyrWMmJtm/JJsDlGr/LZcVbtghxybEYo8p/VLpo + JmBSJgM17rwGhniDWXWXXOfx2fkNZEhVIeGvZYJRgQKBgQDOHnepihIu650pTfRD + fcUyPN9oYLzI2mwv70H3FzJQftt3pqmWhlX2adaXYJ65/8xwr6SmkHmYjTvfuCoT + SFApzv9fnYcD6vCsk5AhLpbarWR3MEU1SCvaiFuRNrdTcR8MGSglWPLLVXCI6f/g + F9kZ/Ngz7MkvD2bNT/WjNj3LMQKBgQDrGmPo0gvfk+QoFtL05+dDDrB2IxUokdqa + RzdecC8wV01l8lIj4TDqo7W1wwxdEUvCbUYriE2BoXi1v3jF+wfluqJOL30Ex5kb + UO5At+DWakxzgy3v0F32AOZRISAGMdbrNFaLpjD9t9NGbL8kiestfs2QuTISHJwU + fD47jFDlxQKBgHrczGVh6O7RAVByqCxm1tnYUS8torpzAFQeYQrBZ/t1cqrCzInu + L2V/tytqq5KheKKfAB1NNz4IyezUITh3PVl+itja1HUwYR/todc1pzRYcO9e9ZIK + ICHWcAaCQArb/i6+/CAvAiLUHg1utlhEvuNvxQxGk7Gak6PEit4r4e+xAoGBAIOR + rT/p7IMefJyCyWQNM7qvScmTMJAXr8KPAEl1drMS6FmZFqbFq15kZ5hko1KiD0er + Z42NJfLZrnfnw2roZS8HFzWyFcDLAr/qtqq5PLZBnq82RkrizPKS5lGYvBc7ZQ8T + pytXwir66N2MlhuYo2g+gkPvoDnKkP5V2W3xxIQRAoGBAIDayGKqE1iZwF72R0xQ + Vg8y2x9JoxY1lDGA8oLzYKcp7OslI6sPhv/NGnkQBwV964dcffnn6dezFyKKBGir + DSiM9duWTttlzzUhUQMHCua2z/LXjz1XMb0LoSEOVdk00TDgRMSFhBLhr3ZXmoLb + Iqi7is4z2mP8pbcIIlmloogE + -----END PRIVATE KEY----- + verification_mode: none diff --git a/packages/cisco_meraki/data_stream/events/agent/stream/http_endpoint.yml.hbs b/packages/cisco_meraki/data_stream/events/agent/stream/http_endpoint.yml.hbs new file mode 100644 index 000000000000..1203728f1459 --- /dev/null +++ b/packages/cisco_meraki/data_stream/events/agent/stream/http_endpoint.yml.hbs @@ -0,0 +1,41 @@ +type: http_endpoint +enabled: true +prefix: json + +{{#if listen_address}} +listen_address: {{listen_address}} +{{/if}} +{{#if listen_port}} +listen_port: {{listen_port}} +{{/if}} +{{#if url}} +url: {{url}} +{{/if}} + +{{#if secret_value}} +secret.header: Authorization +secret.value: "{{secret_value}}" +{{/if}} + +{{#if ssl}} +ssl: {{ssl}} +{{/if}} + +{{#if preserve_original_event}} +preserve_original_event: true +{{/if}} + +tags: +{{#if preserve_original_event}} + - preserve_original_event +{{/if}} +{{#each tags as |tag i|}} + - {{tag}} +{{/each}} +{{#contains "forwarded" tags}} +publisher_pipeline.disable_host: true +{{/contains}} +{{#if processors}} +processors: +{{processors}} +{{/if}} diff --git a/packages/cisco_meraki/data_stream/events/elasticsearch/ingest_pipeline/default.yml b/packages/cisco_meraki/data_stream/events/elasticsearch/ingest_pipeline/default.yml new file mode 100644 index 000000000000..dbd99aecc4cd --- /dev/null +++ b/packages/cisco_meraki/data_stream/events/elasticsearch/ingest_pipeline/default.yml @@ -0,0 +1,300 @@ +--- +description: Pipeline for processing Cisco Meraki events +processors: +- set: + field: ecs.version + value: '8.0.0' +- set: + field: observer.serial_number + copy_from: json.deviceSerial +- gsub: + field: json.deviceMac + target_field: observer.mac + pattern: '[-:.]' + replacement: '-' +- set: + field: observer.name + copy_from: json.deviceName +- set: + field: observer.vendor + value: Cisco +- set: + field: observer.product + copy_from: json.deviceModel +- set: + field: network.name + copy_from: json.networkName +- date: + field: json.occurredAt + formats: + - ISO8601 +- set: + field: organization.id + copy_from: json.organizationId +- set: + field: organization.name + copy_from: json.organizationName +- set: + field: log.level + copy_from: json.alertLevel +- append: + field: event.category + value: network +- append: + field: event.type + value: info +- script: + lang: painless + description: The script sets event type, action and category based on type and sub-type fields + params: + eventmap: + "started_reporting": + type: + - start + "stopped_reporting": + type: + - end + "foreign_ap": + category: + - intrusion_detection + - threat + type: + - indicator + "bluetooth_in": + type: + - start + "bluetooth_out": + type: + - end + "port_cable_error": + type: + - connection + "node_hardware_failure": + category: + - host + type: + - end + "cellular_up": + type: + - start + "cellular_down": + type: + - end + "umbrella_expiring": + category: + - configuration + "ip_conflict": + type: + - protocol + "rogue_ap_association": + category: + - threat + type: + - indicator + "client_connectivity": + category: + - session + type: + - connection + "pcc_security_compliance": + category: + - configuration + "pcc_security_violation": + category: + - configuration + - threat + type: + - change + - indicator + "pcc_outage_end": + category: + - host + type: + - connection + "pcc_enrollment": + category: + - session + type: + - connection + - start + "geofencing_out": + type: + - connection + "pcc_outage_begin": + category: + - host + type: + - connection + - end + "dhcp_no_leases": + type: + - connection + - denied + - protocol + "vrrp": + category: + - configuration + type: + - change + "pcc_expired_apns_cert": + category: + - authentication + "amp_malware_blocked": + category: + - threat + - intrusion_detection + type: + - indicator + - denied + "amp_malware_detected": + category: + - threat + - intrusion_detection + type: + - indicator + - allowed + "pcc_sw_found": + category: + - host + - configuration + type: + - change + "pcc_unmanaged": + category: + - configuration + - iam + type: + - change + - deletion + "dhcp_alerts": + type: + - protocol + "power_supply_up": + type: + - start + "power_supply_down": + category: + - host + type: + - end + "unreachable_radius_server": + category: + - authentication + type: + - end + - denied + "rogue_ap": + category: + - threat + type: + - indicator + "rogue_dhcp": + category: + - threat + type: + - indicator + "settings_changed": + category: + - configuration + type: + - change + "port_connected": + type: + - connection + "port_disconnected": + type: + - end + "port_speed_change": + category: + - configuration + type: + - change + - protocol + "udld_error": + type: + - connection + - end + "uplink_ip6_conflict": + type: + - protocol + if: ctx?.json?.alertTypeId != null + source: |- + def alertTypeId = ctx.json.alertTypeId; + def eventMap = params.get('eventmap'); + def eventData = eventMap.get(alertTypeId); + ctx.event.action = ctx.json.alertType; + if (eventData == null) { + // Unclassified events + // - geofencing_in, critical_temperature + // - gateway_to_repeater, mi_alert + // - motion_alert, usage_alert + // - new_splash_signup, rps_base_supply_up + // - rps_backup, vpn_connectivity_change + return; + } + def eventCategory = eventData.get('category'); + if (eventCategory != null) { + for (def c : eventCategory) { + ctx.event.category.add(c); + } + } + def eventType = eventData.get('type'); + if (eventType != null) { + for (def t : eventType) { + ctx.event.type.add(t); + } + } +- rename: + field: json + target_field: cisco_meraki.event +## +# Clean up +## +- remove: + field: + - cisco_meraki.event.deviceSerial + - cisco_meraki.event.deviceMac + - cisco_meraki.event.deviceName + - cisco_meraki.event.deviceModel + - cisco_meraki.event.occurredAt + - cisco_meraki.event.networkName + - cisco_meraki.event.organizationId + - cisco_meraki.event.organizationName + - cisco_meraki.event.alertType + - cisco_meraki.event.alertLevel + ignore_missing: true +- remove: + field: event.original + if: "ctx?.tags == null || !(ctx.tags.contains('preserve_original_event'))" + ignore_failure: true + ignore_missing: true +- script: + lang: painless + description: This script processor iterates over the whole document to remove fields with null values. + source: | + void handleMap(Map map) { + for (def x : map.values()) { + if (x instanceof Map) { + handleMap(x); + } else if (x instanceof List) { + handleList(x); + } + } + map.values().removeIf(v -> v == null || v == '' || (v instanceof Map && v.size() == 0) || (v instanceof List && v.size() == 0)); + } + void handleList(List list) { + for (def x : list) { + if (x instanceof Map) { + handleMap(x); + } else if (x instanceof List) { + handleList(x); + } + } + list.removeIf(v -> v == null || v == '' || (v instanceof Map && v.size() == 0) || (v instanceof List && v.size() == 0)); + } + handleMap(ctx); + +on_failure: +- set: + field: error.message + value: '{{ _ingest.on_failure_message }}' diff --git a/packages/cisco_meraki/data_stream/events/fields/agent.yml b/packages/cisco_meraki/data_stream/events/fields/agent.yml new file mode 100644 index 000000000000..162c9f3aa38e --- /dev/null +++ b/packages/cisco_meraki/data_stream/events/fields/agent.yml @@ -0,0 +1,207 @@ +- name: cloud + title: Cloud + group: 2 + description: Fields related to the cloud or infrastructure the events are coming from. + footnote: 'Examples: If Metricbeat is running on an EC2 host and fetches data from its host, the cloud info contains the data about this machine. If Metricbeat runs on a remote machine outside the cloud and fetches data from a service running in the cloud, the field contains cloud data from the machine the service is running on.' + type: group + fields: + - name: account.id + level: extended + type: keyword + ignore_above: 1024 + description: 'The cloud account or organization id used to identify different entities in a multi-tenant environment. + + Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.' + example: 666777888999 + - name: availability_zone + level: extended + type: keyword + ignore_above: 1024 + description: Availability zone in which this host is running. + example: us-east-1c + - name: instance.id + level: extended + type: keyword + ignore_above: 1024 + description: Instance ID of the host machine. + example: i-1234567890abcdef0 + - name: instance.name + level: extended + type: keyword + ignore_above: 1024 + description: Instance name of the host machine. + - name: machine.type + level: extended + type: keyword + ignore_above: 1024 + description: Machine type of the host machine. + example: t2.medium + - name: provider + level: extended + type: keyword + ignore_above: 1024 + description: Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. + example: aws + - name: region + level: extended + type: keyword + ignore_above: 1024 + description: Region in which this host is running. + example: us-east-1 + - name: project.id + type: keyword + description: Name of the project in Google Cloud. + - name: image.id + type: keyword + description: Image ID for the cloud instance. +- name: container + title: Container + group: 2 + description: 'Container fields are used for meta information about the specific container that is the source of information. + + These fields help correlate data based containers from any runtime.' + type: group + fields: + - name: id + level: core + type: keyword + ignore_above: 1024 + description: Unique container id. + - name: image.name + level: extended + type: keyword + ignore_above: 1024 + description: Name of the image the container was built on. + - name: labels + level: extended + type: object + object_type: keyword + description: Image labels. + - name: name + level: extended + type: keyword + ignore_above: 1024 + description: Container name. +- name: host + title: Host + group: 2 + description: 'A host is defined as a general computing instance. + + ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.' + type: group + fields: + - name: architecture + level: core + type: keyword + ignore_above: 1024 + description: Operating system architecture. + example: x86_64 + - name: domain + level: extended + type: keyword + ignore_above: 1024 + description: 'Name of the domain of which the host is a member. + + For example, on Windows this could be the host''s Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host''s LDAP provider.' + example: CONTOSO + default_field: false + - name: hostname + level: core + type: keyword + ignore_above: 1024 + description: 'Hostname of the host. + + It normally contains what the `hostname` command returns on the host machine.' + - name: id + level: core + type: keyword + ignore_above: 1024 + description: 'Unique host id. + + As hostname is not always unique, use values that are meaningful in your environment. + + Example: The current usage of `beat.name`.' + - name: ip + level: core + type: ip + description: Host ip addresses. + - name: mac + level: core + type: keyword + ignore_above: 1024 + description: Host mac addresses. + - name: name + level: core + type: keyword + ignore_above: 1024 + description: 'Name of the host. + + It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use.' + - name: os.family + level: extended + type: keyword + ignore_above: 1024 + description: OS family (such as redhat, debian, freebsd, windows). + example: debian + - name: os.kernel + level: extended + type: keyword + ignore_above: 1024 + description: Operating system kernel version as a raw string. + example: 4.4.0-112-generic + - name: os.name + level: extended + type: keyword + ignore_above: 1024 + multi_fields: + - name: text + type: text + norms: false + default_field: false + description: Operating system name, without the version. + example: Mac OS X + - name: os.platform + level: extended + type: keyword + ignore_above: 1024 + description: Operating system platform (such centos, ubuntu, windows). + example: darwin + - name: os.version + level: extended + type: keyword + ignore_above: 1024 + description: Operating system version as a raw string. + example: 10.14.1 + - name: type + level: core + type: keyword + ignore_above: 1024 + description: 'Type of host. + + For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment.' + - name: containerized + type: boolean + description: > + If the host is a container. + + - name: os.build + type: keyword + example: "18D109" + description: > + OS build information. + + - name: os.codename + type: keyword + example: "stretch" + description: > + OS codename, if any. + +- name: input.type + type: keyword + description: Input type. +- name: log.source.address + type: keyword + description: Source address from which the log event was read / sent from. +- name: log.offset + type: long + description: Offset of the entry in the log file. diff --git a/packages/cisco_meraki/data_stream/events/fields/base-fields.yml b/packages/cisco_meraki/data_stream/events/fields/base-fields.yml new file mode 100644 index 000000000000..ebba8d4244ba --- /dev/null +++ b/packages/cisco_meraki/data_stream/events/fields/base-fields.yml @@ -0,0 +1,32 @@ +- name: data_stream.type + type: constant_keyword + description: Data stream type. +- name: data_stream.dataset + type: constant_keyword + description: Data stream dataset. +- name: data_stream.namespace + type: constant_keyword + description: Data stream namespace. +- name: "@timestamp" + type: date + description: Event timestamp. +- name: event.module + type: constant_keyword + description: Event module + value: cisco_meraki +- name: event.dataset + type: constant_keyword + description: Event dataset + value: cisco_meraki.events +- name: container.id + description: Unique container id. + ignore_above: 1024 + type: keyword +- name: input.type + description: Type of Filebeat input. + type: keyword +- name: log.file.path + description: Full path to the log file this event came from. + example: /var/log/fun-times.log + ignore_above: 1024 + type: keyword diff --git a/packages/cisco_meraki/data_stream/events/fields/ecs.yml b/packages/cisco_meraki/data_stream/events/fields/ecs.yml new file mode 100644 index 000000000000..1689c91fbc3f --- /dev/null +++ b/packages/cisco_meraki/data_stream/events/fields/ecs.yml @@ -0,0 +1,308 @@ +- external: ecs + name: '@timestamp' +- external: ecs + name: client.ip +- external: ecs + name: client.mac +- external: ecs + name: client.domain +- external: ecs + name: client.registered_domain +- external: ecs + name: client.subdomain +- external: ecs + name: client.top_level_domain +- external: ecs + name: destination.address +- external: ecs + name: destination.as.number +- external: ecs + name: destination.as.organization.name +- external: ecs + name: destination.bytes +- external: ecs + name: destination.domain +- external: ecs + name: destination.geo.city_name +- external: ecs + name: destination.geo.country_name +- description: Longitude and latitude. + level: core + name: destination.geo.location + type: geo_point +- external: ecs + name: destination.ip +- external: ecs + name: destination.mac +- external: ecs + name: destination.nat.ip +- external: ecs + name: destination.nat.port +- external: ecs + name: destination.port +- external: ecs + name: destination.registered_domain +- external: ecs + name: destination.subdomain +- external: ecs + name: destination.top_level_domain +- external: ecs + name: dns.answers.name +- external: ecs + name: dns.answers.type +- external: ecs + name: dns.question.registered_domain +- external: ecs + name: dns.question.subdomain +- external: ecs + name: dns.question.top_level_domain +- external: ecs + name: dns.question.type +- external: ecs + name: ecs.version +- external: ecs + name: error.message +- external: ecs + name: event.action +- external: ecs + name: event.code +- external: ecs + name: event.ingested +- external: ecs + name: event.original +- external: ecs + name: event.outcome +- external: ecs + name: event.timezone +- external: ecs + name: event.type +- external: ecs + name: event.category +- external: ecs + name: file.attributes +- external: ecs + name: file.directory +- external: ecs + name: file.extension +- external: ecs + name: file.name +- external: ecs + name: file.path +- external: ecs + name: file.size +- external: ecs + name: file.type +- external: ecs + name: geo.city_name +- external: ecs + name: geo.country_name +- external: ecs + name: geo.name +- external: ecs + name: geo.region_name +- external: ecs + name: group.id +- external: ecs + name: group.name +- external: ecs + name: host.hostname +- external: ecs + name: host.ip +- external: ecs + name: host.mac +- external: ecs + name: host.name +- external: ecs + name: http.request.method +- external: ecs + name: http.request.referrer +- external: ecs + name: log.level +- external: ecs + name: log.syslog.facility.code +- external: ecs + name: log.syslog.priority +- external: ecs + name: log.syslog.severity.code +- external: ecs + name: log.file.path +- external: ecs + name: tags +- external: ecs + name: message +- external: ecs + name: network.application +- external: ecs + name: network.bytes +- external: ecs + name: network.direction +- external: ecs + name: network.forwarded_ip +- external: ecs + name: network.packets +- external: ecs + name: network.protocol +- external: ecs + name: observer.egress.interface.name +- external: ecs + name: observer.ingress.interface.name +- external: ecs + name: observer.product +- external: ecs + name: observer.type +- external: ecs + name: observer.vendor +- external: ecs + name: observer.version +- external: ecs + name: observer.mac +- external: ecs + name: observer.name +- external: ecs + name: observer.serial_number +- external: ecs + name: process.name +- external: ecs + name: process.parent.name +- external: ecs + name: process.parent.title +- external: ecs + name: process.pid +- external: ecs + name: process.parent.pid +- external: ecs + name: process.title +- external: ecs + name: related.hosts +- external: ecs + name: related.ip +- external: ecs + name: related.user +- external: ecs + name: rule.name +- external: ecs + name: server.mac +- external: ecs + name: server.domain +- external: ecs + name: server.registered_domain +- external: ecs + name: server.subdomain +- external: ecs + name: server.top_level_domain +- external: ecs + name: service.name +- external: ecs + name: source.address +- external: ecs + name: source.as.number +- external: ecs + name: source.as.organization.name +- external: ecs + name: source.bytes +- external: ecs + name: source.domain +- external: ecs + name: source.geo.city_name +- external: ecs + name: source.geo.country_name +- description: Longitude and latitude. + level: core + name: source.geo.location + type: geo_point +- external: ecs + name: source.ip +- external: ecs + name: source.mac +- external: ecs + name: source.nat.ip +- external: ecs + name: source.nat.port +- external: ecs + name: source.port +- external: ecs + name: source.registered_domain +- external: ecs + name: source.subdomain +- external: ecs + name: source.top_level_domain +- external: ecs + name: url.domain +- external: ecs + name: url.original +- external: ecs + name: url.path +- external: ecs + name: url.query +- external: ecs + name: url.registered_domain +- external: ecs + name: url.top_level_domain +- external: ecs + name: user.domain +- external: ecs + name: user.full_name +- external: ecs + name: user.id +- external: ecs + name: user.name +- external: ecs + name: user_agent.original +- external: ecs + name: observer.hostname +- external: ecs + name: destination.geo.continent_name +- external: ecs + name: destination.geo.country_iso_code +- external: ecs + name: destination.geo.region_iso_code +- external: ecs + name: destination.geo.region_name +- external: ecs + name: source.geo.continent_name +- external: ecs + name: source.geo.country_iso_code +- external: ecs + name: source.geo.region_iso_code +- external: ecs + name: source.geo.region_name +- external: ecs + name: network.vlan.id +- external: ecs + name: threat.software.type +- external: ecs + name: threat.indicator.last_seen +- external: ecs + name: threat.indicator.description +- external: ecs + name: threat.indicator.reference +- external: ecs + name: threat.indicator.file.name +- external: ecs + name: threat.indicator.file.hash.sha256 +- external: ecs + name: network.direction +- external: ecs + name: network.protocol +- external: ecs + name: client.geo.city_name +- external: ecs + name: client.geo.continent_name +- external: ecs + name: client.geo.country_iso_code +- external: ecs + name: client.geo.country_name +- external: ecs + name: client.geo.location.lat +- external: ecs + name: client.geo.location.lon +- external: ecs + name: client.geo.region_iso_code +- external: ecs + name: client.geo.region_name +- external: ecs + name: organization.id +- external: ecs + name: organization.name +- external: ecs + name: network.name diff --git a/packages/cisco_meraki/data_stream/events/fields/fields.yml b/packages/cisco_meraki/data_stream/events/fields/fields.yml new file mode 100644 index 000000000000..7443e7680aeb --- /dev/null +++ b/packages/cisco_meraki/data_stream/events/fields/fields.yml @@ -0,0 +1,72 @@ +- name: cisco_meraki + type: group + fields: + - name: event + type: group + fields: + - name: version + type: keyword + description: Current version of webhook format + - name: sharedSecret + type: keyword + description: User defined secret to be validated by the webhook receiver (optional) + - name: sentAt + type: date + description: Timestamp of the sent message (UTC) + - name: organizationId + type: keyword + description: ID of the Meraki organization + - name: organizationName + type: keyword + description: Name of the Meraki organization + - name: organizationUrl + type: keyword + description: URL of the Meraki Dashboard organization + - name: networkId + type: keyword + description: ID for the Meraki network + - name: networkName + type: keyword + description: Name for the Meraki network + - name: networkUrl + type: keyword + description: URL of the Meraki Dashboard network + - name: networkTags + type: keyword + description: Tags assigned to the Meraki network + - name: deviceSerial + type: keyword + description: Serial number of the Meraki device + - name: deviceMac + type: keyword + description: MAC address of the Meraki device + - name: deviceName + type: keyword + description: Name assigned to the Meraki device + - name: deviceUrl + type: keyword + description: URL of the Meraki device + - name: deviceTags + type: keyword + description: Tags assigned to the Meraki device + - name: deviceModel + type: keyword + description: Meraki device model + - name: alertId + type: keyword + description: ID for this alert message + - name: alertType + type: keyword + description: Type of alert (“Network usage alert”, “Settings changed”, etc.) + - name: alertTypeId + type: keyword + description: Unique ID for the type of alert + - name: alertLevel + type: keyword + description: Alert level (informational, critical etc.) + - name: occurredAt + type: date + description: Timestamp of the alert (UTC) + - name: alertData + type: flattened + description: Additional alert data (differs based on alert type) diff --git a/packages/cisco_meraki/data_stream/events/manifest.yml b/packages/cisco_meraki/data_stream/events/manifest.yml new file mode 100644 index 000000000000..bc4b29aa4508 --- /dev/null +++ b/packages/cisco_meraki/data_stream/events/manifest.yml @@ -0,0 +1,76 @@ +title: Cisco Meraki webhook events +release: experimental +type: logs +streams: + - input: http_endpoint + title: Cisco Meraki webhook events + description: Receives events from Cisco Meraki webhook + template_path: http_endpoint.yml.hbs + enabled: false + vars: + - name: listen_address + type: text + title: Listen Address + description: Bind address for the listener. Use 0.0.0.0 to listen on all interfaces. + multi: false + required: true + show_user: true + default: localhost + - name: listen_port + type: integer + title: Listen Port + multi: false + required: true + show_user: true + default: 8686 + - name: url + type: text + title: Webhook path + description: URL path where the webhook will accept requests. + multi: false + required: true + show_user: false + default: /meraki/events + - name: secret_value + type: text + description: Authorization token + multi: false + required: false + show_user: true + - name: ssl + type: yaml + title: TLS + description: Options for enabling TLS for the listening webhook endpoint. See the [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html) for a list of all options. + multi: false + required: false + show_user: false + default: | + enabled: false + certificate: "/etc/pki/client/cert.pem" + key: "/etc/pki/client/cert.key" + - name: tags + type: text + title: Tags + multi: true + required: true + show_user: false + default: + - forwarded + - meraki-events + - name: preserve_original_event + required: true + show_user: true + title: Preserve original event + description: Preserves a raw copy of the original event, added to the field `event.original` + type: bool + multi: false + default: false + - name: processors + type: yaml + title: Processors + multi: false + required: false + show_user: false + description: > + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + diff --git a/packages/cisco_meraki/data_stream/events/sample_event.json b/packages/cisco_meraki/data_stream/events/sample_event.json new file mode 100644 index 000000000000..198d32bfbe52 --- /dev/null +++ b/packages/cisco_meraki/data_stream/events/sample_event.json @@ -0,0 +1,87 @@ +{ + "@timestamp": "2018-02-11T00:00:00.123Z", + "agent": { + "ephemeral_id": "4dfea986-5bfd-4b6a-a1b0-00b3043870bd", + "hostname": "docker-fleet-agent", + "id": "9e1c0aac-8d48-4c33-a9f5-98e770f2028e", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "7.17.0" + }, + "cisco_meraki": { + "event": { + "alertData": { + "connection": "LTE", + "local": "192.168.1.2", + "model": "UML290VW", + "provider": "Purview Wireless", + "remote": "1.2.3.5" + }, + "alertId": "0000000000000000", + "alertTypeId": "cellular_up", + "deviceTags": [ + "tag1", + "tag2" + ], + "deviceUrl": "https://n1.meraki.com//n//manage/nodes/new_list/000000000000", + "networkId": "N_24329156", + "networkUrl": "https://n1.meraki.com//n//manage/nodes/list", + "organizationUrl": "https://dashboard.meraki.com/o/VjjsAd/manage/organization/overview", + "sentAt": "2021-10-07T08:42:00.926325Z", + "sharedSecret": "secret", + "version": "0.1" + } + }, + "data_stream": { + "dataset": "cisco_meraki.events", + "namespace": "ep", + "type": "logs" + }, + "ecs": { + "version": "8.0.0" + }, + "elastic_agent": { + "id": "9e1c0aac-8d48-4c33-a9f5-98e770f2028e", + "snapshot": false, + "version": "7.17.0" + }, + "event": { + "action": "Cellular came up", + "agent_id_status": "verified", + "category": [ + "network" + ], + "dataset": "cisco_meraki.events", + "ingested": "2022-04-26T04:00:40Z", + "original": "{\"alertData\":{\"connection\":\"LTE\",\"local\":\"192.168.1.2\",\"model\":\"UML290VW\",\"provider\":\"Purview Wireless\",\"remote\":\"1.2.3.5\"},\"alertId\":\"0000000000000000\",\"alertLevel\":\"informational\",\"alertType\":\"Cellular came up\",\"alertTypeId\":\"cellular_up\",\"deviceMac\":\"00:11:22:33:44:55\",\"deviceModel\":\"MX\",\"deviceName\":\"My appliance\",\"deviceSerial\":\"Q234-ABCD-5678\",\"deviceTags\":[\"tag1\",\"tag2\"],\"deviceUrl\":\"https://n1.meraki.com//n//manage/nodes/new_list/000000000000\",\"networkId\":\"N_24329156\",\"networkName\":\"Main Office\",\"networkTags\":[],\"networkUrl\":\"https://n1.meraki.com//n//manage/nodes/list\",\"occurredAt\":\"2018-02-11T00:00:00.123450Z\",\"organizationId\":\"2930418\",\"organizationName\":\"My organization\",\"organizationUrl\":\"https://dashboard.meraki.com/o/VjjsAd/manage/organization/overview\",\"sentAt\":\"2021-10-07T08:42:00.926325Z\",\"sharedSecret\":\"secret\",\"version\":\"0.1\"}", + "type": [ + "info", + "start" + ] + }, + "input": { + "type": "http_endpoint" + }, + "log": { + "level": "informational" + }, + "network": { + "name": "Main Office" + }, + "observer": { + "mac": "00-11-22-33-44-55", + "name": "My appliance", + "product": "MX", + "serial_number": "Q234-ABCD-5678", + "vendor": "Cisco" + }, + "organization": { + "id": "2930418", + "name": "My organization" + }, + "tags": [ + "preserve_original_event", + "forwarded", + "meraki-events" + ] +} \ No newline at end of file diff --git a/packages/cisco_meraki/data_stream/log/_dev/test/pipeline/test-airmarshal-events.log b/packages/cisco_meraki/data_stream/log/_dev/test/pipeline/test-airmarshal-events.log new file mode 100644 index 000000000000..777b6d1a05ba --- /dev/null +++ b/packages/cisco_meraki/data_stream/log/_dev/test/pipeline/test-airmarshal-events.log @@ -0,0 +1,175 @@ +<134>1 1647479604.334549372 MX84_5 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:D8:51' src='92:17:C8:C7:D8:51' dst='6A:3A:3E:85:D9:F6' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='23' fc_type='0' fc_subtype='5' +<134>1 1647479580.487048774 MX84_2 airmarshal_events type=rogue_ssid_detected ssid='' bssid='AA:17:C8:C7:D8:51' src='AA:17:C8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='35' fc_type='0' fc_subtype='8' +<134>1 1647479552.047395997 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:C8:C7:DF:FD' src='BE:17:C8:C7:DF:FD' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:DF:FD' vlan_id='0' channel='11' rssi='14' fc_type='0' fc_subtype='8' +<134>1 1647479537.315779167 MX84_1 airmarshal_events type=ssid_spoofing_detected ssid='AwesomeWifi Guest' vap='1' bssid='AA:17:C8:C7:E1:41' src='AA:17:C8:C7:E1:41' dst='E2:CB:9C:B5:DD:BE' channel='1' rssi='15' fc_type='0' fc_subtype='5' +<134>1 1647479528.067423267 MX84_8 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:D8:51' src='92:17:C8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='15' fc_type='0' fc_subtype='8' +<134>1 1647479493.484285651 MX84_5 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi' bssid='AE:17:D8:C7:D8:51' src='AE:17:D8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='149' rssi='15' fc_type='0' fc_subtype='8' +<134>1 1647479489.882680227 MX84_8 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:E2:9D' src='92:17:C8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='11' rssi='18' fc_type='0' fc_subtype='8' +<134>1 1647479484.972992227 MX84_8 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:E1:41' src='92:17:C8:C7:E1:41' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E1:41' vlan_id='0' channel='1' rssi='39' fc_type='0' fc_subtype='8' +<134>1 1647479466.965046920 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:D8:C7:E2:9D' src='BE:17:D8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='36' rssi='24' fc_type='0' fc_subtype='8' +<134>1 1647479461.791503607 MX84_6 airmarshal_events type=ssid_spoofing_detected ssid='AwesomeWifi Guest' vap='13' bssid='AA:17:C8:C7:DF:FD' src='AA:17:C8:C7:DF:FD' dst='AE:17:E8:C7:DF:FD' channel='11' rssi='10' fc_type='0' fc_subtype='5' +<134>1 1647479459.181348678 MX84_5 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:D8:C7:D8:51' src='BE:17:D8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='149' rssi='14' fc_type='0' fc_subtype='8' +<134>1 1647479456.670048547 MX84_8 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:DF:FD' src='92:17:C8:C7:DF:FD' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:DF:FD' vlan_id='0' channel='11' rssi='16' fc_type='0' fc_subtype='8' +<134>1 1647479445.786718001 MX84_6 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi Guest' bssid='AA:17:D8:C7:D8:51' src='AA:17:D8:C7:D8:51' dst='6A:3A:3E:85:D9:F6' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='149' rssi='11' fc_type='0' fc_subtype='5' +<134>1 1647479442.047436097 MX84_6 airmarshal_events type=rogue_ssid_detected ssid='' bssid='AA:17:C8:C7:D8:51' src='AA:17:C8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='20' fc_type='0' fc_subtype='8' +<134>1 1647479399.287689295 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='AC:17:C8:C7:E2:9D' src='AC:17:C8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='11' rssi='22' fc_type='0' fc_subtype='8' +<134>1 1647479376.407283267 MX84_8 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:D8:C7:E2:9D' src='BE:17:D8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='36' rssi='11' fc_type='0' fc_subtype='8' +<134>1 1647479375.390251687 MX84_5 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:C8:C7:D8:51' src='BE:17:C8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='24' fc_type='0' fc_subtype='8' +<134>1 1647479371.594697827 MX84_8 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:D8:C7:E2:9D' src='92:17:D8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='36' rssi='13' fc_type='0' fc_subtype='8' +<134>1 1647479356.473299205 MX84_6 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi' bssid='AC:17:C8:C7:DF:FD' src='AC:17:C8:C7:DF:FD' dst='78:55:CD:18:8F:76' wired_mac='AC:17:C8:C7:DF:FD' vlan_id='0' channel='11' rssi='9' fc_type='0' fc_subtype='5' +<134>1 1647479354.489175845 MX84_6 airmarshal_events type=ssid_spoofing_detected ssid='AwesomeWifi' vap='13' bssid='AC:17:C8:C7:DF:FD' src='AC:17:C8:C7:DF:FD' dst='78:28:CA:AA:6A:4A' channel='11' rssi='12' fc_type='0' fc_subtype='5' +<134>1 1647479353.446408965 MX84_6 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:D8:C7:DF:FD' src='92:17:D8:C7:DF:FD' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:DF:FD' vlan_id='0' channel='56' rssi='9' fc_type='0' fc_subtype='8' +<134>1 1647479352.553639439 MX84 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi Guest' bssid='AA:17:D8:C7:E2:9D' src='AA:17:D8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='36' rssi='33' fc_type='0' fc_subtype='8' +<134>1 1647479350.428006877 MX84_5 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi Guest' bssid='AA:17:D8:C7:D8:51' src='AA:17:D8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='149' rssi='15' fc_type='0' fc_subtype='8' +<134>1 1647479350.457045605 MX84_6 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi' bssid='AE:17:D8:C7:D8:51' src='AE:17:D8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='149' rssi='12' fc_type='0' fc_subtype='8' +<134>1 1647479346.794313756 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:DF:FD' src='92:17:C8:C7:DF:FD' dst='AE:17:E8:C7:D8:51' wired_mac='AC:17:C8:C7:DF:FD' vlan_id='0' channel='11' rssi='18' fc_type='0' fc_subtype='5' +<134>1 1647479345.577452767 MX84_1 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi' bssid='AE:17:D8:C7:D8:51' src='AE:17:D8:C7:D8:51' dst='E2:CB:9C:B5:D4:1E' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='149' rssi='30' fc_type='0' fc_subtype='5' +<134>1 1647479341.816936841 MX84_3 airmarshal_events type=rogue_ssid_detected ssid='' bssid='AA:17:C8:C7:E1:41' src='AA:17:C8:C7:E1:41' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E1:41' vlan_id='0' channel='1' rssi='33' fc_type='0' fc_subtype='8' +<134>1 1647479318.128184987 MX84_7 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi Guest' bssid='AA:17:C8:C7:D8:51' src='AA:17:C8:C7:D8:51' dst='5C:AA:FD:5D:76:0E' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='22' fc_type='0' fc_subtype='5' +<134>1 1647479313.473165785 MX84_7 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:DF:FD' src='92:17:C8:C7:DF:FD' dst='E2:CB:9C:B5:C5:68' wired_mac='AC:17:C8:C7:DF:FD' vlan_id='0' channel='11' rssi='25' fc_type='0' fc_subtype='5' +<134>1 1647479299.143407174 MX84_2 airmarshal_events type=ssid_spoofing_detected ssid='AwesomeWifi Guest' vap='1' bssid='AA:17:C8:C7:E1:41' src='AA:17:C8:C7:E1:41' dst='78:28:CA:AA:6A:0A' channel='1' rssi='21' fc_type='0' fc_subtype='5' +<134>1 1647479299.115949027 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:C8:C7:E2:9D' src='BE:17:C8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='11' rssi='32' fc_type='0' fc_subtype='8' +<134>1 1647479294.302067007 MX84_1 airmarshal_events type=rogue_ssid_detected ssid='' bssid='AA:17:C8:C7:D8:51' src='AA:17:C8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='27' fc_type='0' fc_subtype='8' +<134>1 1647479288.469042416 MX84_7 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:D8:C7:D8:51' src='92:17:D8:C7:D8:51' dst='0E:8D:FB:70:0F:A8' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='149' rssi='7' fc_type='0' fc_subtype='5' +<134>1 1647479281.848397134 MX84_7 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi Guest' bssid='AA:17:D8:C7:DF:FD' src='AA:17:D8:C7:DF:FD' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:DF:FD' vlan_id='0' channel='56' rssi='12' fc_type='0' fc_subtype='8' +<134>1 1647479278.839671334 MX84_2 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:D8:C7:D8:51' src='92:17:D8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='149' rssi='31' fc_type='0' fc_subtype='8' +<134>1 1647479231.942342036 MX84_4 airmarshal_events type=ssid_spoofing_detected ssid='AwesomeWifi' vap='13' bssid='AE:17:D8:C7:E2:9D' src='AE:17:D8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' channel='36' rssi='9' fc_type='0' fc_subtype='8' +<134>1 1647479227.438567311 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='AC:17:C8:C7:D8:51' src='AC:17:C8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='54' fc_type='0' fc_subtype='8' +<134>1 1647479222.927379747 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='AC:17:C8:C7:E2:9D' src='AC:17:C8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='11' rssi='29' fc_type='0' fc_subtype='8' +<134>1 1647479222.927802947 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='AA:17:C8:C7:E2:9D' src='AA:17:C8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='11' rssi='30' fc_type='0' fc_subtype='8' +<134>1 1647479222.728876109 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:C8:C7:D8:51' src='BE:17:C8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='55' fc_type='0' fc_subtype='8' +<134>1 1647479218.076400635 MX84_3 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:E2:9D' src='92:17:C8:C7:E2:9D' dst='E2:CB:9C:B5:DC:6E' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='11' rssi='6' fc_type='0' fc_subtype='5' +<134>1 1647479203.375371107 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:E1:41' src='92:17:C8:C7:E1:41' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E1:41' vlan_id='0' channel='1' rssi='49' fc_type='0' fc_subtype='8' +<134>1 1647479199.622640025 MX84 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi Guest' bssid='AA:17:D8:C7:E2:9D' src='AA:17:D8:C7:E2:9D' dst='6A:3A:3E:85:CA:4E' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='36' rssi='22' fc_type='0' fc_subtype='5' +<134>1 1647479162.641725608 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:D8:C7:DF:FD' src='BE:17:D8:C7:DF:FD' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:DF:FD' vlan_id='0' channel='56' rssi='34' fc_type='0' fc_subtype='8' +<134>1 1647479162.670104087 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:D8:C7:DF:FD' src='92:17:D8:C7:DF:FD' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:DF:FD' vlan_id='0' channel='56' rssi='18' fc_type='0' fc_subtype='8' +<134>1 1647479161.182241827 MX84_8 airmarshal_events type=ssid_spoofing_detected ssid='AwesomeWifi Guest' vap='1' bssid='AA:17:D8:C7:D8:51' src='AA:17:D8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' channel='149' rssi='9' fc_type='0' fc_subtype='8' +<134>1 1647479158.314592227 MX84_8 airmarshal_events type=ssid_spoofing_detected ssid='AwesomeWifi' vap='1' bssid='AE:17:D8:C7:D8:51' src='AE:17:D8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' channel='149' rssi='8' fc_type='0' fc_subtype='8' +<134>1 1647479151.958073405 MX84_7 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:D8:C7:E2:9D' src='BE:17:D8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='36' rssi='12' fc_type='0' fc_subtype='8' +<134>1 1647479133.020606043 MX84_3 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:D8:C7:E1:41' src='92:17:D8:C7:E1:41' dst='6A:3A:3E:85:D7:D4' wired_mac='AC:17:C8:C7:E1:41' vlan_id='0' channel='36' rssi='7' fc_type='0' fc_subtype='5' +<134>1 1647479127.384572447 MX84_1 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:C8:C7:D8:51' src='BE:17:C8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='28' fc_type='0' fc_subtype='8' +<134>1 1647479122.570882475 MX84_4 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:D8:51' src='92:17:C8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='26' fc_type='0' fc_subtype='8' +<134>1 1647479122.592807847 MX84_2 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:D8:51' src='92:17:C8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='36' fc_type='0' fc_subtype='8' +<134>1 1647479122.578597672 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='AA:17:C8:C7:D8:51' src='AA:17:C8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='52' fc_type='0' fc_subtype='8' +<134>1 1647479120.544286631 MX84 airmarshal_events type=ssid_spoofing_detected ssid='AwesomeWifi' vap='1' bssid='AC:17:C8:C7:D8:51' src='AC:17:C8:C7:D8:51' dst='90:AC:3F:02:31:59' channel='6' rssi='50' fc_type='0' fc_subtype='5' +<134>1 1647479091.258858944 MX84_4 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:E1:41' src='92:17:C8:C7:E1:41' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E1:41' vlan_id='0' channel='1' rssi='44' fc_type='0' fc_subtype='8' +<134>1 1647479060.425068327 MX84_2 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi' bssid='AC:17:C8:C7:D8:51' src='AC:17:C8:C7:D8:51' dst='78:28:CA:AA:6A:4A' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='34' fc_type='0' fc_subtype='5' +<134>1 1647479037.677902643 MX84_7 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:D8:C7:E2:9D' src='92:17:D8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='36' rssi='11' fc_type='0' fc_subtype='8' +<134>1 1647479036.783442760 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:E2:9D' src='92:17:C8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='11' rssi='28' fc_type='0' fc_subtype='8' +<134>1 1647479020.949227955 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:C8:C7:DF:FD' src='BE:17:C8:C7:DF:FD' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:DF:FD' vlan_id='0' channel='11' rssi='37' fc_type='0' fc_subtype='8' +<134>1 1647478974.912056258 MX84 airmarshal_events type=ssid_spoofing_detected ssid='AwesomeWifi Guest' vap='13' bssid='AA:17:C8:C7:DF:FD' src='AA:17:C8:C7:DF:FD' dst='08:A7:C0:3B:5A:95' channel='11' rssi='27' fc_type='0' fc_subtype='5' +<134>1 1647478966.089203455 MX84 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi' bssid='AE:17:D8:C7:E1:41' src='AE:17:D8:C7:E1:41' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E1:41' vlan_id='0' channel='36' rssi='8' fc_type='0' fc_subtype='8' +<134>1 1647478950.860971410 MX84_7 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi' bssid='AC:17:C8:C7:D8:51' src='AC:17:C8:C7:D8:51' dst='78:28:CA:AA:69:96' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='22' fc_type='0' fc_subtype='5' +<134>1 1647478940.142724327 MX84_2 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi' bssid='AE:17:D8:C7:D8:51' src='AE:17:D8:C7:D8:51' dst='AE:17:E8:C7:E2:9D' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='149' rssi='29' fc_type='0' fc_subtype='5' +<134>1 1647478936.678862087 MX84_2 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:DF:FD' src='92:17:C8:C7:DF:FD' dst='E2:CB:9C:B5:DC:6E' wired_mac='AC:17:C8:C7:DF:FD' vlan_id='0' channel='11' rssi='7' fc_type='0' fc_subtype='5' +<134>1 1647478907.739529447 MX84_2 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:E1:41' src='92:17:C8:C7:E1:41' dst='AE:17:E8:C7:DF:FD' wired_mac='AC:17:C8:C7:E1:41' vlan_id='0' channel='1' rssi='35' fc_type='0' fc_subtype='5' +<134>1 1647478855.303776534 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:C8:C7:E1:41' src='BE:17:C8:C7:E1:41' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E1:41' vlan_id='0' channel='1' rssi='39' fc_type='0' fc_subtype='8' +<134>1 1647478849.532951889 MX84_3 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi' bssid='AE:17:D8:C7:D8:51' src='AE:17:D8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='149' rssi='29' fc_type='0' fc_subtype='8' +<134>1 1647478845.877942207 MX84_1 airmarshal_events type=rogue_ssid_detected ssid='' bssid='AC:17:C8:C7:D8:51' src='AC:17:C8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='26' fc_type='0' fc_subtype='8' +<134>1 1647478822.111692485 MX84_6 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:DF:FD' src='92:17:C8:C7:DF:FD' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:DF:FD' vlan_id='0' channel='11' rssi='13' fc_type='0' fc_subtype='8' +<134>1 1647478818.039157925 MX84_6 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:D8:C7:E2:9D' src='92:17:D8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='36' rssi='4' fc_type='0' fc_subtype='8' +<134>1 1647478800.349145072 MX84_5 airmarshal_events type=ssid_spoofing_detected ssid='AwesomeWifi Guest' vap='13' bssid='AA:17:C8:C7:DF:FD' src='AA:17:C8:C7:DF:FD' dst='6E:DA:36:A2:39:71' channel='11' rssi='7' fc_type='0' fc_subtype='5' +<134>1 1647478799.177625347 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:D8:C7:E1:41' src='BE:17:D8:C7:E1:41' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E1:41' vlan_id='0' channel='36' rssi='14' fc_type='0' fc_subtype='8' +<134>1 1647478788.838283552 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:DF:FD' src='92:17:C8:C7:DF:FD' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:DF:FD' vlan_id='0' channel='11' rssi='17' fc_type='0' fc_subtype='8' +<134>1 1647478782.939898885 MX84_6 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi Guest' bssid='AA:17:D8:C7:E2:9D' src='AA:17:D8:C7:E2:9D' dst='E2:CB:9C:B5:C5:68' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='36' rssi='4' fc_type='0' fc_subtype='5' +<134>1 1647478782.932299301 MX84_8 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi Guest' bssid='AA:17:D8:C7:E2:9D' src='AA:17:D8:C7:E2:9D' dst='E2:CB:9C:B5:C5:68' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='36' rssi='13' fc_type='0' fc_subtype='5' +<134>1 1647478782.930289746 MX84_8 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi' bssid='AE:17:D8:C7:E2:9D' src='AE:17:D8:C7:E2:9D' dst='E2:CB:9C:B5:C5:68' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='36' rssi='13' fc_type='0' fc_subtype='5' +<134>1 1647478695.528431433 MX84 airmarshal_events type=ssid_spoofing_detected ssid='AwesomeWifi Guest' vap='1' bssid='AA:17:C8:C7:D8:51' src='AA:17:C8:C7:D8:51' dst='78:28:CA:AA:6A:4A' channel='6' rssi='52' fc_type='0' fc_subtype='5' +<134>1 1647478693.465185593 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:DF:FD' src='92:17:C8:C7:DF:FD' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:DF:FD' vlan_id='0' channel='11' rssi='29' fc_type='0' fc_subtype='8' +<134>1 1647478669.549413486 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:E2:9D' src='92:17:C8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='11' rssi='29' fc_type='0' fc_subtype='8' +<134>1 1647478626.517046787 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:C8:C7:D8:51' src='BE:17:C8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='49' fc_type='0' fc_subtype='8' +<134>1 1647478591.602996834 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='AA:17:C8:C7:DF:FD' src='AA:17:C8:C7:DF:FD' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:DF:FD' vlan_id='0' channel='11' rssi='27' fc_type='0' fc_subtype='8' +<134>1 1647478569.035635205 MX84_6 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:E1:41' src='92:17:C8:C7:E1:41' dst='E2:CB:9C:B5:C5:68' wired_mac='AC:17:C8:C7:E1:41' vlan_id='0' channel='1' rssi='14' fc_type='0' fc_subtype='5' +<134>1 1647478567.751044590 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='AA:17:C8:C7:DF:FD' src='AA:17:C8:C7:DF:FD' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:DF:FD' vlan_id='0' channel='11' rssi='27' fc_type='0' fc_subtype='8' +<134>1 1647478559.571303907 MX84 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi Guest' bssid='AA:17:C8:C7:D8:51' src='AA:17:C8:C7:D8:51' dst='5C:AA:FD:5D:76:0E' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='49' fc_type='0' fc_subtype='5' +<134>1 1647478558.540066660 MX84_3 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:D8:C7:D8:51' src='92:17:D8:C7:D8:51' dst='E2:CB:9C:B5:DC:6E' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='149' rssi='24' fc_type='0' fc_subtype='5' +<134>1 1647478554.934781027 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='AC:17:C8:C7:D8:51' src='AC:17:C8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='50' fc_type='0' fc_subtype='8' +<134>1 1647478541.587558726 MX84 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi Guest' bssid='AA:17:D8:C7:E1:41' src='AA:17:D8:C7:E1:41' dst='E2:CB:9C:B5:DA:7A' wired_mac='AC:17:C8:C7:E1:41' vlan_id='0' channel='36' rssi='9' fc_type='0' fc_subtype='5' +<134>1 1647478534.671579931 MX84_3 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi Guest' bssid='AA:17:D8:C7:D8:51' src='AA:17:D8:C7:D8:51' dst='E2:CB:9C:B5:DA:7A' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='149' rssi='28' fc_type='0' fc_subtype='5' +<134>1 1647478508.007504325 MX84_6 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi' bssid='AE:17:D8:C7:E2:9D' src='AE:17:D8:C7:E2:9D' dst='6A:3A:3E:85:D7:D4' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='36' rssi='5' fc_type='0' fc_subtype='5' +<134>1 1647478487.013169927 MX84_2 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi Guest' bssid='AA:17:D8:C7:D8:51' src='AA:17:D8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='149' rssi='30' fc_type='0' fc_subtype='8' +<134>1 1647478483.410677512 MX84_3 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:D8:51' src='92:17:C8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='33' fc_type='0' fc_subtype='8' +<134>1 1647478478.614722093 MX84_1 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:D8:51' src='92:17:C8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='32' fc_type='0' fc_subtype='8' +<134>1 1647478440.565782942 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='AC:17:C8:C7:DF:FD' src='AC:17:C8:C7:DF:FD' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:DF:FD' vlan_id='0' channel='11' rssi='14' fc_type='0' fc_subtype='8' +<134>1 1647478408.128821330 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:D8:C7:E2:9D' src='BE:17:D8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='36' rssi='21' fc_type='0' fc_subtype='8' +<134>1 1647478403.005811325 MX84_5 airmarshal_events type=ssid_spoofing_detected ssid='AwesomeWifi' vap='13' bssid='AC:17:C8:C7:DF:FD' src='AC:17:C8:C7:DF:FD' dst='AE:17:E8:C7:DF:FD' channel='11' rssi='8' fc_type='0' fc_subtype='5' +<134>1 1647478383.070405853 MX84_4 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:C8:C7:E1:41' src='BE:17:C8:C7:E1:41' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E1:41' vlan_id='0' channel='1' rssi='44' fc_type='0' fc_subtype='8' +<134>1 1647478373.816434235 MX84_7 airmarshal_events type=rogue_ssid_detected ssid='' bssid='AA:17:C8:C7:E2:9D' src='AA:17:C8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='11' rssi='9' fc_type='0' fc_subtype='8' +<134>1 1647478339.127895652 MX84 airmarshal_events type=ssid_spoofing_detected ssid='AwesomeWifi Guest' vap='1' bssid='AA:17:C8:C7:E1:41' src='AA:17:C8:C7:E1:41' dst='78:28:CA:AA:6A:0A' channel='1' rssi='35' fc_type='0' fc_subtype='5' +<134>1 1647478298.296851316 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:D8:C7:E2:9D' src='92:17:D8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='36' rssi='35' fc_type='0' fc_subtype='8' +<134>1 1647478293.380396754 MX84 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi' bssid='AE:17:D8:C7:E2:9D' src='AE:17:D8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='36' rssi='35' fc_type='0' fc_subtype='8' +<134>1 1647478268.953109023 MX84_8 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:C8:C7:DF:FD' src='BE:17:C8:C7:DF:FD' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:DF:FD' vlan_id='0' channel='11' rssi='10' fc_type='0' fc_subtype='8' +<134>1 1647478257.084985274 MX84 airmarshal_events type=ssid_spoofing_detected ssid='AwesomeWifi' vap='13' bssid='AC:17:C8:C7:DF:FD' src='AC:17:C8:C7:DF:FD' dst='EE:CE:D5:6A:B6:22' channel='11' rssi='16' fc_type='0' fc_subtype='5' +<134>1 1647478256.341194724 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:D8:C7:DF:FD' src='BE:17:D8:C7:DF:FD' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:DF:FD' vlan_id='0' channel='56' rssi='19' fc_type='0' fc_subtype='8' +<134>1 1647478221.255609741 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:C8:C7:E2:9D' src='BE:17:C8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='11' rssi='12' fc_type='0' fc_subtype='8' +<134>1 1647478145.758483684 MX84_4 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi Guest' bssid='AA:17:D8:C7:E2:9D' src='AA:17:D8:C7:E2:9D' dst='6A:3A:3E:85:D7:D4' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='36' rssi='5' fc_type='0' fc_subtype='5' +<134>1 1647478121.589518727 MX84_2 airmarshal_events type=ssid_spoofing_detected ssid='AwesomeWifi' vap='1' bssid='AC:17:C8:C7:E1:41' src='AC:17:C8:C7:E1:41' dst='AE:17:E8:C7:E1:41' channel='1' rssi='22' fc_type='0' fc_subtype='5' +<134>1 1647478119.868477795 MX84_7 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:D8:C7:D8:51' src='BE:17:D8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='149' rssi='7' fc_type='0' fc_subtype='8' +<134>1 1647478114.277373007 MX84 airmarshal_events type=ssid_spoofing_detected ssid='AwesomeWifi' vap='1' bssid='AC:17:C8:C7:D8:51' src='AC:17:C8:C7:D8:51' dst='78:28:CA:AA:69:96' channel='6' rssi='48' fc_type='0' fc_subtype='5' +<134>1 1647478105.395836204 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:D8:C7:D8:51' src='BE:17:D8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='149' rssi='53' fc_type='0' fc_subtype='8' +<134>1 1647478102.536782923 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:D8:C7:E1:41' src='92:17:D8:C7:E1:41' dst='E2:CB:9C:B5:D7:80' wired_mac='AC:17:C8:C7:E1:41' vlan_id='0' channel='36' rssi='9' fc_type='0' fc_subtype='5' +<134>1 1647478092.108472035 MX84_7 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:C8:C7:E1:41' src='BE:17:C8:C7:E1:41' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E1:41' vlan_id='0' channel='1' rssi='27' fc_type='0' fc_subtype='8' +<134>1 1647478087.649007204 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:C8:C7:E2:9D' src='BE:17:C8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='11' rssi='23' fc_type='0' fc_subtype='8' +<134>1 1647478063.434847715 MX84_7 airmarshal_events type=rogue_ssid_detected ssid='' bssid='AC:17:C8:C7:E1:41' src='AC:17:C8:C7:E1:41' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E1:41' vlan_id='0' channel='1' rssi='30' fc_type='0' fc_subtype='8' +<134>1 1647478054.846444450 MX84_4 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:D8:C7:E2:9D' src='92:17:D8:C7:E2:9D' dst='E2:CB:9C:B5:DD:BE' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='36' rssi='3' fc_type='0' fc_subtype='5' +<134>1 1647478039.876640835 MX84_7 airmarshal_events type=rogue_ssid_detected ssid='' bssid='AC:17:C8:C7:E2:9D' src='AC:17:C8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='11' rssi='11' fc_type='0' fc_subtype='8' +<134>1 1647478035.923601924 MX84 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi' bssid='AE:17:D8:C7:E2:9D' src='AE:17:D8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='36' rssi='23' fc_type='0' fc_subtype='8' +<134>1 1647478034.762765475 MX84_7 airmarshal_events type=rogue_ssid_detected ssid='' bssid='AA:17:C8:C7:E1:41' src='AA:17:C8:C7:E1:41' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E1:41' vlan_id='0' channel='1' rssi='27' fc_type='0' fc_subtype='8' +<134>1 1647478026.502834244 MX84 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi Guest' bssid='AA:17:D8:C7:E2:9D' src='AA:17:D8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='36' rssi='23' fc_type='0' fc_subtype='8' +<134>1 1647478020.564810050 MX84_8 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:C8:C7:E1:41' src='BE:17:C8:C7:E1:41' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E1:41' vlan_id='0' channel='1' rssi='29' fc_type='0' fc_subtype='8' +<134>1 1647478015.983013635 MX84_7 airmarshal_events type=rogue_ssid_detected ssid='' bssid='AA:17:C8:C7:DF:FD' src='AA:17:C8:C7:DF:FD' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:DF:FD' vlan_id='0' channel='11' rssi='20' fc_type='0' fc_subtype='8' +<134>1 1647478006.707247789 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:C8:C7:E1:41' src='BE:17:C8:C7:E1:41' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E1:41' vlan_id='0' channel='1' rssi='38' fc_type='0' fc_subtype='8' +<134>1 1647478001.603867573 MX84_3 airmarshal_events type=rogue_ssid_detected ssid='' bssid='AC:17:C8:C7:D8:51' src='AC:17:C8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='34' fc_type='0' fc_subtype='8' +<134>1 1647477963.236026884 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:E1:41' src='92:17:C8:C7:E1:41' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E1:41' vlan_id='0' channel='1' rssi='66' fc_type='0' fc_subtype='8' +<134>1 1647477958.900449163 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='AC:17:C8:C7:E2:9D' src='AC:17:C8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='11' rssi='12' fc_type='0' fc_subtype='8' +<134>1 1647477953.907583508 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='AC:17:C8:C7:D8:51' src='AC:17:C8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='43' fc_type='0' fc_subtype='8' +<134>1 1647477953.724449475 MX84_7 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:E1:41' src='92:17:C8:C7:E1:41' dst='E2:CB:9C:B5:C5:68' wired_mac='AC:17:C8:C7:E1:41' vlan_id='0' channel='1' rssi='35' fc_type='0' fc_subtype='5' +<134>1 1647477945.336342244 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:D8:C7:E2:9D' src='92:17:D8:C7:E2:9D' dst='E2:CB:9C:B5:D8:54' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='36' rssi='24' fc_type='0' fc_subtype='5' +<134>1 1647477944.121686758 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:E1:41' src='92:17:C8:C7:E1:41' dst='6A:3A:3E:85:CA:4E' wired_mac='AC:17:C8:C7:E1:41' vlan_id='0' channel='1' rssi='67' fc_type='0' fc_subtype='5' +<134>1 1647477940.363429956 MX84 airmarshal_events type=ssid_spoofing_detected ssid='AwesomeWifi Guest' vap='13' bssid='AA:17:C8:C7:DF:FD' src='AA:17:C8:C7:DF:FD' dst='34:8F:27:25:CC:48' channel='11' rssi='16' fc_type='0' fc_subtype='5' +<134>1 1647477930.038516204 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='AA:17:C8:C7:D8:51' src='AA:17:C8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='40' fc_type='0' fc_subtype='8' +<134>1 1647477927.225784460 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:D8:C7:DF:FD' src='92:17:D8:C7:DF:FD' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:DF:FD' vlan_id='0' channel='56' rssi='34' fc_type='0' fc_subtype='8' +<134>1 1647477920.683178115 MX84_7 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:E2:9D' src='92:17:C8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='11' rssi='15' fc_type='0' fc_subtype='8' +<134>1 1647477920.510699794 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:C8:C7:D8:51' src='BE:17:C8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='40' fc_type='0' fc_subtype='8' +<134>1 1647477891.986568005 MX84_6 airmarshal_events type=rogue_ssid_detected ssid='' bssid='AA:17:C8:C7:DF:FD' src='AA:17:C8:C7:DF:FD' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:DF:FD' vlan_id='0' channel='11' rssi='8' fc_type='0' fc_subtype='8' +<134>1 1647477881.304873506 MX84_4 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:D8:C7:D8:51' src='92:17:D8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='149' rssi='12' fc_type='0' fc_subtype='8' +<134>1 1647477873.769683395 MX84_7 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi Guest' bssid='AA:17:D8:C7:E2:9D' src='AA:17:D8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='36' rssi='11' fc_type='0' fc_subtype='8' +<134>1 1647477872.782332783 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:D8:51' src='92:17:C8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='52' fc_type='0' fc_subtype='8' +<134>1 1647477871.675119845 MX84_6 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:D8:C7:D8:51' src='92:17:D8:C7:D8:51' dst='E2:CB:9C:B5:DD:BE' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='149' rssi='14' fc_type='0' fc_subtype='5' +<134>1 1647477864.088023180 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:D8:C7:E1:41' src='BE:17:D8:C7:E1:41' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E1:41' vlan_id='0' channel='36' rssi='9' fc_type='0' fc_subtype='8' +<134>1 1647477834.810489249 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='AA:17:C8:C7:E2:9D' src='AA:17:C8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='11' rssi='26' fc_type='0' fc_subtype='8' +<134>1 1647477828.886032606 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:D8:C7:D8:51' src='92:17:D8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='149' rssi='52' fc_type='0' fc_subtype='8' +<134>1 1647477828.885258686 MX84 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi Guest' bssid='AA:17:D8:C7:D8:51' src='AA:17:D8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='149' rssi='50' fc_type='0' fc_subtype='8' +<134>1 1647477828.799864712 MX84_5 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:D8:C7:D8:51' src='92:17:D8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='149' rssi='16' fc_type='0' fc_subtype='8' +<134>1 1647477825.209110701 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:E2:9D' src='92:17:C8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='11' rssi='38' fc_type='0' fc_subtype='8' +<134>1 1647477825.021409913 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:D8:51' src='92:17:C8:C7:D8:51' dst='6A:3A:3E:85:CA:4E' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='63' fc_type='0' fc_subtype='5' +<134>1 1647477825.024707684 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:D8:51' src='92:17:C8:C7:D8:51' dst='AE:17:E8:C7:DF:FD' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='59' fc_type='0' fc_subtype='5' +<134>1 1647477821.364087032 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:D8:C7:E1:41' src='BE:17:D8:C7:E1:41' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E1:41' vlan_id='0' channel='36' rssi='29' fc_type='0' fc_subtype='8' +<134>1 1647477796.382660565 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:C8:C7:D8:51' src='BE:17:C8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='62' fc_type='0' fc_subtype='8' +<134>1 1647477796.382227661 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='AA:17:C8:C7:D8:51' src='AA:17:C8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='61' fc_type='0' fc_subtype='8' +<134>1 1647477796.381818586 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='AC:17:C8:C7:D8:51' src='AC:17:C8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='61' fc_type='0' fc_subtype='8' +<134>1 1647477795.407019364 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:D8:C7:D8:51' src='BE:17:D8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='149' rssi='46' fc_type='0' fc_subtype='8' +<134>1 1647477795.385494917 MX84 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi' bssid='AE:17:D8:C7:D8:51' src='AE:17:D8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='149' rssi='58' fc_type='0' fc_subtype='8' +<134>1 1647477795.385835866 MX84 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi Guest' bssid='AA:17:D8:C7:D8:51' src='AA:17:D8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='149' rssi='58' fc_type='0' fc_subtype='8' +<134>1 1647477793.576467473 MX84 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi' bssid='AE:17:D8:C7:DF:FD' src='AE:17:D8:C7:DF:FD' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:DF:FD' vlan_id='0' channel='56' rssi='33' fc_type='0' fc_subtype='8' +<134>1 1647477793.576769233 MX84 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi Guest' bssid='AA:17:D8:C7:DF:FD' src='AA:17:D8:C7:DF:FD' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:DF:FD' vlan_id='0' channel='56' rssi='34' fc_type='0' fc_subtype='8' +<134>1 1647477786.805604872 MX84_5 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:E1:41' src='92:17:C8:C7:E1:41' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E1:41' vlan_id='0' channel='1' rssi='24' fc_type='0' fc_subtype='8' +<134>1 1647477780.705460109 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='AC:17:C8:C7:DF:FD' src='AC:17:C8:C7:DF:FD' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:DF:FD' vlan_id='0' channel='11' rssi='37' fc_type='0' fc_subtype='8' +<134>1 1647477778.398160444 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:D8:C7:E2:9D' src='BE:17:D8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='36' rssi='40' fc_type='0' fc_subtype='8' +<134>1 1647477773.586461164 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:D8:C7:E2:9D' src='92:17:D8:C7:E2:9D' dst='AE:17:E8:C7:D8:51' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='36' rssi='22' fc_type='0' fc_subtype='5' +<134>1 1647477764.149946084 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:D8:C7:E1:41' src='BE:17:D8:C7:E1:41' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E1:41' vlan_id='0' channel='36' rssi='33' fc_type='0' fc_subtype='8' +<134>1 1647477764.145077176 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:D8:C7:E1:41' src='92:17:D8:C7:E1:41' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E1:41' vlan_id='0' channel='36' rssi='31' fc_type='0' fc_subtype='8' +<134>1 1647477764.143985243 MX84 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi' bssid='AE:17:D8:C7:E1:41' src='AE:17:D8:C7:E1:41' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E1:41' vlan_id='0' channel='36' rssi='30' fc_type='0' fc_subtype='8' +<134>1 1647477764.144283174 MX84 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi Guest' bssid='AA:17:D8:C7:E1:41' src='AA:17:D8:C7:E1:41' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E1:41' vlan_id='0' channel='36' rssi='30' fc_type='0' fc_subtype='8' +<134>1 1647477763.225832662 MX84_4 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:E2:9D' src='92:17:C8:C7:E2:9D' dst='E2:CB:9C:B5:D4:1E' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='11' rssi='9' fc_type='0' fc_subtype='5' +<134>1 1647477744.039850991 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:D8:51' src='92:17:C8:C7:D8:51' dst='AE:17:E8:C7:DF:FD' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='50' fc_type='0' fc_subtype='5' +<134>1 1647477733.453967364 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:D8:C7:D8:51' src='92:17:D8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='149' rssi='48' fc_type='0' fc_subtype='8' +<134>1 1647477733.446493073 MX84_3 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:D8:C7:D8:51' src='BE:17:D8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='149' rssi='28' fc_type='0' fc_subtype='8' +<134>1 1647477733.420037284 MX84 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi Guest' bssid='AA:17:D8:C7:D8:51' src='AA:17:D8:C7:D8:51' dst='38:BA:F8:CC:82:2E' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='149' rssi='48' fc_type='0' fc_subtype='5' +<134>1 1647477733.419042244 MX84 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi' bssid='AE:17:D8:C7:D8:51' src='AE:17:D8:C7:D8:51' dst='38:BA:F8:CC:82:2E' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='149' rssi='48' fc_type='0' fc_subtype='5' +<134>1 1647477733.411410011 MX84 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi' bssid='AE:17:D8:C7:D8:51' src='AE:17:D8:C7:D8:51' dst='38:BA:F8:CC:82:2E' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='149' rssi='51' fc_type='0' fc_subtype='5' +<134>1 1647477716.431936901 MX84 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi Guest' bssid='AA:17:D8:C7:E2:9D' src='AA:17:D8:C7:E2:9D' dst='E2:CB:9C:B5:D8:54' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='36' rssi='39' fc_type='0' fc_subtype='5' +<134>1 1647477716.431151781 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:D8:C7:E2:9D' src='92:17:D8:C7:E2:9D' dst='E2:CB:9C:B5:D8:54' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='36' rssi='39' fc_type='0' fc_subtype='5' +<134>1 1647477716.429168101 MX84 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi' bssid='AE:17:D8:C7:E2:9D' src='AE:17:D8:C7:E2:9D' dst='E2:CB:9C:B5:D8:54' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='36' rssi='39' fc_type='0' fc_subtype='5' +<134>1 1647477715.612600884 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='AC:17:C8:C7:E2:9D' src='AC:17:C8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='11' rssi='28' fc_type='0' fc_subtype='8' +<134>1 1647477702.046252324 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:D8:C7:E1:41' src='92:17:D8:C7:E1:41' dst='E2:CB:9C:B5:DC:6E' wired_mac='AC:17:C8:C7:E1:41' vlan_id='0' channel='36' rssi='35' fc_type='0' fc_subtype='5' diff --git a/packages/cisco_meraki/data_stream/log/_dev/test/pipeline/test-airmarshal-events.log-expected.json b/packages/cisco_meraki/data_stream/log/_dev/test/pipeline/test-airmarshal-events.log-expected.json new file mode 100644 index 000000000000..ab3bf32c4847 --- /dev/null +++ b/packages/cisco_meraki/data_stream/log/_dev/test/pipeline/test-airmarshal-events.log-expected.json @@ -0,0 +1,7885 @@ +{ + "expected": [ + { + "@timestamp": "2022-03-17T01:13:24.334Z", + "cisco_meraki": { + "bssid": "92:17:C8:C7:D8:51", + "channel": "6", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "5", + "fc_type": "0" + }, + "destination": { + "mac": "6A-3A-3E-85-D9-F6" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647479604.334549372 MX84_5 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:D8:51' src='92:17:C8:C7:D8:51' dst='6A:3A:3E:85:D9:F6' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='23' fc_type='0' fc_subtype='5'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84_5", + "mac": "AC-17-C8-C7-D8-51" + }, + "source": { + "mac": "92-17-C8-C7-D8-51" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T01:13:00.487Z", + "cisco_meraki": { + "bssid": "AA:17:C8:C7:D8:51", + "channel": "6", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647479580.487048774 MX84_2 airmarshal_events type=rogue_ssid_detected ssid='' bssid='AA:17:C8:C7:D8:51' src='AA:17:C8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='35' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84_2", + "mac": "AC-17-C8-C7-D8-51" + }, + "source": { + "mac": "AA-17-C8-C7-D8-51" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T01:12:32.047Z", + "cisco_meraki": { + "bssid": "BE:17:C8:C7:DF:FD", + "channel": "11", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647479552.047395997 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:C8:C7:DF:FD' src='BE:17:C8:C7:DF:FD' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:DF:FD' vlan_id='0' channel='11' rssi='14' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84", + "mac": "AC-17-C8-C7-DF-FD" + }, + "source": { + "mac": "BE-17-C8-C7-DF-FD" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T01:12:17.315Z", + "cisco_meraki": { + "bssid": "AA:17:C8:C7:E1:41", + "channel": "1", + "event_subtype": "ssid_spoofing_detected", + "event_type": "airmarshal_events", + "fc_subtype": "5", + "fc_type": "0", + "vap": "1" + }, + "destination": { + "mac": "E2-CB-9C-B5-DD-BE" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "ssid-spoofing-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647479537.315779167 MX84_1 airmarshal_events type=ssid_spoofing_detected ssid='AwesomeWifi Guest' vap='1' bssid='AA:17:C8:C7:E1:41' src='AA:17:C8:C7:E1:41' dst='E2:CB:9C:B5:DD:BE' channel='1' rssi='15' fc_type='0' fc_subtype='5'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "name": "AwesomeWifi Guest" + }, + "observer": { + "hostname": "MX84_1" + }, + "source": { + "mac": "AA-17-C8-C7-E1-41" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T01:12:08.067Z", + "cisco_meraki": { + "bssid": "92:17:C8:C7:D8:51", + "channel": "6", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647479528.067423267 MX84_8 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:D8:51' src='92:17:C8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='15' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84_8", + "mac": "AC-17-C8-C7-D8-51" + }, + "source": { + "mac": "92-17-C8-C7-D8-51" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T01:11:33.484Z", + "cisco_meraki": { + "bssid": "AE:17:D8:C7:D8:51", + "channel": "149", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647479493.484285651 MX84_5 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi' bssid='AE:17:D8:C7:D8:51' src='AE:17:D8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='149' rssi='15' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "name": "AwesomeWifi", + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84_5", + "mac": "AC-17-C8-C7-D8-51" + }, + "source": { + "mac": "AE-17-D8-C7-D8-51" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T01:11:29.882Z", + "cisco_meraki": { + "bssid": "92:17:C8:C7:E2:9D", + "channel": "11", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647479489.882680227 MX84_8 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:E2:9D' src='92:17:C8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='11' rssi='18' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84_8", + "mac": "AC-17-C8-C7-E2-9D" + }, + "source": { + "mac": "92-17-C8-C7-E2-9D" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T01:11:24.972Z", + "cisco_meraki": { + "bssid": "92:17:C8:C7:E1:41", + "channel": "1", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647479484.972992227 MX84_8 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:E1:41' src='92:17:C8:C7:E1:41' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E1:41' vlan_id='0' channel='1' rssi='39' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84_8", + "mac": "AC-17-C8-C7-E1-41" + }, + "source": { + "mac": "92-17-C8-C7-E1-41" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T01:11:06.965Z", + "cisco_meraki": { + "bssid": "BE:17:D8:C7:E2:9D", + "channel": "36", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647479466.965046920 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:D8:C7:E2:9D' src='BE:17:D8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='36' rssi='24' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84", + "mac": "AC-17-C8-C7-E2-9D" + }, + "source": { + "mac": "BE-17-D8-C7-E2-9D" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T01:11:01.791Z", + "cisco_meraki": { + "bssid": "AA:17:C8:C7:DF:FD", + "channel": "11", + "event_subtype": "ssid_spoofing_detected", + "event_type": "airmarshal_events", + "fc_subtype": "5", + "fc_type": "0", + "vap": "13" + }, + "destination": { + "mac": "AE-17-E8-C7-DF-FD" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "ssid-spoofing-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647479461.791503607 MX84_6 airmarshal_events type=ssid_spoofing_detected ssid='AwesomeWifi Guest' vap='13' bssid='AA:17:C8:C7:DF:FD' src='AA:17:C8:C7:DF:FD' dst='AE:17:E8:C7:DF:FD' channel='11' rssi='10' fc_type='0' fc_subtype='5'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "name": "AwesomeWifi Guest" + }, + "observer": { + "hostname": "MX84_6" + }, + "source": { + "mac": "AA-17-C8-C7-DF-FD" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T01:10:59.181Z", + "cisco_meraki": { + "bssid": "BE:17:D8:C7:D8:51", + "channel": "149", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647479459.181348678 MX84_5 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:D8:C7:D8:51' src='BE:17:D8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='149' rssi='14' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84_5", + "mac": "AC-17-C8-C7-D8-51" + }, + "source": { + "mac": "BE-17-D8-C7-D8-51" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T01:10:56.670Z", + "cisco_meraki": { + "bssid": "92:17:C8:C7:DF:FD", + "channel": "11", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647479456.670048547 MX84_8 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:DF:FD' src='92:17:C8:C7:DF:FD' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:DF:FD' vlan_id='0' channel='11' rssi='16' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84_8", + "mac": "AC-17-C8-C7-DF-FD" + }, + "source": { + "mac": "92-17-C8-C7-DF-FD" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T01:10:45.786Z", + "cisco_meraki": { + "bssid": "AA:17:D8:C7:D8:51", + "channel": "149", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "5", + "fc_type": "0" + }, + "destination": { + "mac": "6A-3A-3E-85-D9-F6" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647479445.786718001 MX84_6 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi Guest' bssid='AA:17:D8:C7:D8:51' src='AA:17:D8:C7:D8:51' dst='6A:3A:3E:85:D9:F6' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='149' rssi='11' fc_type='0' fc_subtype='5'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "name": "AwesomeWifi Guest", + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84_6", + "mac": "AC-17-C8-C7-D8-51" + }, + "source": { + "mac": "AA-17-D8-C7-D8-51" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T01:10:42.047Z", + "cisco_meraki": { + "bssid": "AA:17:C8:C7:D8:51", + "channel": "6", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647479442.047436097 MX84_6 airmarshal_events type=rogue_ssid_detected ssid='' bssid='AA:17:C8:C7:D8:51' src='AA:17:C8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='20' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84_6", + "mac": "AC-17-C8-C7-D8-51" + }, + "source": { + "mac": "AA-17-C8-C7-D8-51" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T01:09:59.287Z", + "cisco_meraki": { + "bssid": "AC:17:C8:C7:E2:9D", + "channel": "11", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647479399.287689295 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='AC:17:C8:C7:E2:9D' src='AC:17:C8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='11' rssi='22' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84", + "mac": "AC-17-C8-C7-E2-9D" + }, + "source": { + "mac": "AC-17-C8-C7-E2-9D" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T01:09:36.407Z", + "cisco_meraki": { + "bssid": "BE:17:D8:C7:E2:9D", + "channel": "36", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647479376.407283267 MX84_8 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:D8:C7:E2:9D' src='BE:17:D8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='36' rssi='11' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84_8", + "mac": "AC-17-C8-C7-E2-9D" + }, + "source": { + "mac": "BE-17-D8-C7-E2-9D" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T01:09:35.390Z", + "cisco_meraki": { + "bssid": "BE:17:C8:C7:D8:51", + "channel": "6", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647479375.390251687 MX84_5 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:C8:C7:D8:51' src='BE:17:C8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='24' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84_5", + "mac": "AC-17-C8-C7-D8-51" + }, + "source": { + "mac": "BE-17-C8-C7-D8-51" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T01:09:31.594Z", + "cisco_meraki": { + "bssid": "92:17:D8:C7:E2:9D", + "channel": "36", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647479371.594697827 MX84_8 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:D8:C7:E2:9D' src='92:17:D8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='36' rssi='13' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84_8", + "mac": "AC-17-C8-C7-E2-9D" + }, + "source": { + "mac": "92-17-D8-C7-E2-9D" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T01:09:16.473Z", + "cisco_meraki": { + "bssid": "AC:17:C8:C7:DF:FD", + "channel": "11", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "5", + "fc_type": "0" + }, + "destination": { + "mac": "78-55-CD-18-8F-76" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647479356.473299205 MX84_6 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi' bssid='AC:17:C8:C7:DF:FD' src='AC:17:C8:C7:DF:FD' dst='78:55:CD:18:8F:76' wired_mac='AC:17:C8:C7:DF:FD' vlan_id='0' channel='11' rssi='9' fc_type='0' fc_subtype='5'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "name": "AwesomeWifi", + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84_6", + "mac": "AC-17-C8-C7-DF-FD" + }, + "source": { + "mac": "AC-17-C8-C7-DF-FD" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T01:09:14.489Z", + "cisco_meraki": { + "bssid": "AC:17:C8:C7:DF:FD", + "channel": "11", + "event_subtype": "ssid_spoofing_detected", + "event_type": "airmarshal_events", + "fc_subtype": "5", + "fc_type": "0", + "vap": "13" + }, + "destination": { + "mac": "78-28-CA-AA-6A-4A" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "ssid-spoofing-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647479354.489175845 MX84_6 airmarshal_events type=ssid_spoofing_detected ssid='AwesomeWifi' vap='13' bssid='AC:17:C8:C7:DF:FD' src='AC:17:C8:C7:DF:FD' dst='78:28:CA:AA:6A:4A' channel='11' rssi='12' fc_type='0' fc_subtype='5'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "name": "AwesomeWifi" + }, + "observer": { + "hostname": "MX84_6" + }, + "source": { + "mac": "AC-17-C8-C7-DF-FD" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T01:09:13.446Z", + "cisco_meraki": { + "bssid": "92:17:D8:C7:DF:FD", + "channel": "56", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647479353.446408965 MX84_6 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:D8:C7:DF:FD' src='92:17:D8:C7:DF:FD' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:DF:FD' vlan_id='0' channel='56' rssi='9' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84_6", + "mac": "AC-17-C8-C7-DF-FD" + }, + "source": { + "mac": "92-17-D8-C7-DF-FD" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T01:09:12.553Z", + "cisco_meraki": { + "bssid": "AA:17:D8:C7:E2:9D", + "channel": "36", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647479352.553639439 MX84 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi Guest' bssid='AA:17:D8:C7:E2:9D' src='AA:17:D8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='36' rssi='33' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "name": "AwesomeWifi Guest", + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84", + "mac": "AC-17-C8-C7-E2-9D" + }, + "source": { + "mac": "AA-17-D8-C7-E2-9D" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T01:09:10.428Z", + "cisco_meraki": { + "bssid": "AA:17:D8:C7:D8:51", + "channel": "149", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647479350.428006877 MX84_5 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi Guest' bssid='AA:17:D8:C7:D8:51' src='AA:17:D8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='149' rssi='15' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "name": "AwesomeWifi Guest", + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84_5", + "mac": "AC-17-C8-C7-D8-51" + }, + "source": { + "mac": "AA-17-D8-C7-D8-51" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T01:09:10.457Z", + "cisco_meraki": { + "bssid": "AE:17:D8:C7:D8:51", + "channel": "149", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647479350.457045605 MX84_6 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi' bssid='AE:17:D8:C7:D8:51' src='AE:17:D8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='149' rssi='12' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "name": "AwesomeWifi", + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84_6", + "mac": "AC-17-C8-C7-D8-51" + }, + "source": { + "mac": "AE-17-D8-C7-D8-51" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T01:09:06.794Z", + "cisco_meraki": { + "bssid": "92:17:C8:C7:DF:FD", + "channel": "11", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "5", + "fc_type": "0" + }, + "destination": { + "mac": "AE-17-E8-C7-D8-51" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647479346.794313756 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:DF:FD' src='92:17:C8:C7:DF:FD' dst='AE:17:E8:C7:D8:51' wired_mac='AC:17:C8:C7:DF:FD' vlan_id='0' channel='11' rssi='18' fc_type='0' fc_subtype='5'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84", + "mac": "AC-17-C8-C7-DF-FD" + }, + "source": { + "mac": "92-17-C8-C7-DF-FD" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T01:09:05.577Z", + "cisco_meraki": { + "bssid": "AE:17:D8:C7:D8:51", + "channel": "149", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "5", + "fc_type": "0" + }, + "destination": { + "mac": "E2-CB-9C-B5-D4-1E" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647479345.577452767 MX84_1 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi' bssid='AE:17:D8:C7:D8:51' src='AE:17:D8:C7:D8:51' dst='E2:CB:9C:B5:D4:1E' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='149' rssi='30' fc_type='0' fc_subtype='5'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "name": "AwesomeWifi", + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84_1", + "mac": "AC-17-C8-C7-D8-51" + }, + "source": { + "mac": "AE-17-D8-C7-D8-51" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T01:09:01.816Z", + "cisco_meraki": { + "bssid": "AA:17:C8:C7:E1:41", + "channel": "1", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647479341.816936841 MX84_3 airmarshal_events type=rogue_ssid_detected ssid='' bssid='AA:17:C8:C7:E1:41' src='AA:17:C8:C7:E1:41' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E1:41' vlan_id='0' channel='1' rssi='33' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84_3", + "mac": "AC-17-C8-C7-E1-41" + }, + "source": { + "mac": "AA-17-C8-C7-E1-41" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T01:08:38.128Z", + "cisco_meraki": { + "bssid": "AA:17:C8:C7:D8:51", + "channel": "6", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "5", + "fc_type": "0" + }, + "destination": { + "mac": "5C-AA-FD-5D-76-0E" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647479318.128184987 MX84_7 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi Guest' bssid='AA:17:C8:C7:D8:51' src='AA:17:C8:C7:D8:51' dst='5C:AA:FD:5D:76:0E' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='22' fc_type='0' fc_subtype='5'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "name": "AwesomeWifi Guest", + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84_7", + "mac": "AC-17-C8-C7-D8-51" + }, + "source": { + "mac": "AA-17-C8-C7-D8-51" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T01:08:33.473Z", + "cisco_meraki": { + "bssid": "92:17:C8:C7:DF:FD", + "channel": "11", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "5", + "fc_type": "0" + }, + "destination": { + "mac": "E2-CB-9C-B5-C5-68" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647479313.473165785 MX84_7 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:DF:FD' src='92:17:C8:C7:DF:FD' dst='E2:CB:9C:B5:C5:68' wired_mac='AC:17:C8:C7:DF:FD' vlan_id='0' channel='11' rssi='25' fc_type='0' fc_subtype='5'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84_7", + "mac": "AC-17-C8-C7-DF-FD" + }, + "source": { + "mac": "92-17-C8-C7-DF-FD" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T01:08:19.143Z", + "cisco_meraki": { + "bssid": "AA:17:C8:C7:E1:41", + "channel": "1", + "event_subtype": "ssid_spoofing_detected", + "event_type": "airmarshal_events", + "fc_subtype": "5", + "fc_type": "0", + "vap": "1" + }, + "destination": { + "mac": "78-28-CA-AA-6A-0A" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "ssid-spoofing-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647479299.143407174 MX84_2 airmarshal_events type=ssid_spoofing_detected ssid='AwesomeWifi Guest' vap='1' bssid='AA:17:C8:C7:E1:41' src='AA:17:C8:C7:E1:41' dst='78:28:CA:AA:6A:0A' channel='1' rssi='21' fc_type='0' fc_subtype='5'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "name": "AwesomeWifi Guest" + }, + "observer": { + "hostname": "MX84_2" + }, + "source": { + "mac": "AA-17-C8-C7-E1-41" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T01:08:19.115Z", + "cisco_meraki": { + "bssid": "BE:17:C8:C7:E2:9D", + "channel": "11", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647479299.115949027 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:C8:C7:E2:9D' src='BE:17:C8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='11' rssi='32' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84", + "mac": "AC-17-C8-C7-E2-9D" + }, + "source": { + "mac": "BE-17-C8-C7-E2-9D" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T01:08:14.302Z", + "cisco_meraki": { + "bssid": "AA:17:C8:C7:D8:51", + "channel": "6", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647479294.302067007 MX84_1 airmarshal_events type=rogue_ssid_detected ssid='' bssid='AA:17:C8:C7:D8:51' src='AA:17:C8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='27' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84_1", + "mac": "AC-17-C8-C7-D8-51" + }, + "source": { + "mac": "AA-17-C8-C7-D8-51" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T01:08:08.469Z", + "cisco_meraki": { + "bssid": "92:17:D8:C7:D8:51", + "channel": "149", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "5", + "fc_type": "0" + }, + "destination": { + "mac": "0E-8D-FB-70-0F-A8" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647479288.469042416 MX84_7 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:D8:C7:D8:51' src='92:17:D8:C7:D8:51' dst='0E:8D:FB:70:0F:A8' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='149' rssi='7' fc_type='0' fc_subtype='5'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84_7", + "mac": "AC-17-C8-C7-D8-51" + }, + "source": { + "mac": "92-17-D8-C7-D8-51" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T01:08:01.848Z", + "cisco_meraki": { + "bssid": "AA:17:D8:C7:DF:FD", + "channel": "56", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647479281.848397134 MX84_7 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi Guest' bssid='AA:17:D8:C7:DF:FD' src='AA:17:D8:C7:DF:FD' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:DF:FD' vlan_id='0' channel='56' rssi='12' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "name": "AwesomeWifi Guest", + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84_7", + "mac": "AC-17-C8-C7-DF-FD" + }, + "source": { + "mac": "AA-17-D8-C7-DF-FD" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T01:07:58.839Z", + "cisco_meraki": { + "bssid": "92:17:D8:C7:D8:51", + "channel": "149", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647479278.839671334 MX84_2 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:D8:C7:D8:51' src='92:17:D8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='149' rssi='31' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84_2", + "mac": "AC-17-C8-C7-D8-51" + }, + "source": { + "mac": "92-17-D8-C7-D8-51" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T01:07:11.942Z", + "cisco_meraki": { + "bssid": "AE:17:D8:C7:E2:9D", + "channel": "36", + "event_subtype": "ssid_spoofing_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0", + "vap": "13" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "ssid-spoofing-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647479231.942342036 MX84_4 airmarshal_events type=ssid_spoofing_detected ssid='AwesomeWifi' vap='13' bssid='AE:17:D8:C7:E2:9D' src='AE:17:D8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' channel='36' rssi='9' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "name": "AwesomeWifi" + }, + "observer": { + "hostname": "MX84_4" + }, + "source": { + "mac": "AE-17-D8-C7-E2-9D" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T01:07:07.438Z", + "cisco_meraki": { + "bssid": "AC:17:C8:C7:D8:51", + "channel": "6", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647479227.438567311 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='AC:17:C8:C7:D8:51' src='AC:17:C8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='54' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84", + "mac": "AC-17-C8-C7-D8-51" + }, + "source": { + "mac": "AC-17-C8-C7-D8-51" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T01:07:02.927Z", + "cisco_meraki": { + "bssid": "AC:17:C8:C7:E2:9D", + "channel": "11", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647479222.927379747 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='AC:17:C8:C7:E2:9D' src='AC:17:C8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='11' rssi='29' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84", + "mac": "AC-17-C8-C7-E2-9D" + }, + "source": { + "mac": "AC-17-C8-C7-E2-9D" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T01:07:02.927Z", + "cisco_meraki": { + "bssid": "AA:17:C8:C7:E2:9D", + "channel": "11", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647479222.927802947 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='AA:17:C8:C7:E2:9D' src='AA:17:C8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='11' rssi='30' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84", + "mac": "AC-17-C8-C7-E2-9D" + }, + "source": { + "mac": "AA-17-C8-C7-E2-9D" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T01:07:02.728Z", + "cisco_meraki": { + "bssid": "BE:17:C8:C7:D8:51", + "channel": "6", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647479222.728876109 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:C8:C7:D8:51' src='BE:17:C8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='55' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84", + "mac": "AC-17-C8-C7-D8-51" + }, + "source": { + "mac": "BE-17-C8-C7-D8-51" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T01:06:58.076Z", + "cisco_meraki": { + "bssid": "92:17:C8:C7:E2:9D", + "channel": "11", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "5", + "fc_type": "0" + }, + "destination": { + "mac": "E2-CB-9C-B5-DC-6E" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647479218.076400635 MX84_3 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:E2:9D' src='92:17:C8:C7:E2:9D' dst='E2:CB:9C:B5:DC:6E' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='11' rssi='6' fc_type='0' fc_subtype='5'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84_3", + "mac": "AC-17-C8-C7-E2-9D" + }, + "source": { + "mac": "92-17-C8-C7-E2-9D" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T01:06:43.375Z", + "cisco_meraki": { + "bssid": "92:17:C8:C7:E1:41", + "channel": "1", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647479203.375371107 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:E1:41' src='92:17:C8:C7:E1:41' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E1:41' vlan_id='0' channel='1' rssi='49' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84", + "mac": "AC-17-C8-C7-E1-41" + }, + "source": { + "mac": "92-17-C8-C7-E1-41" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T01:06:39.622Z", + "cisco_meraki": { + "bssid": "AA:17:D8:C7:E2:9D", + "channel": "36", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "5", + "fc_type": "0" + }, + "destination": { + "mac": "6A-3A-3E-85-CA-4E" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647479199.622640025 MX84 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi Guest' bssid='AA:17:D8:C7:E2:9D' src='AA:17:D8:C7:E2:9D' dst='6A:3A:3E:85:CA:4E' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='36' rssi='22' fc_type='0' fc_subtype='5'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "name": "AwesomeWifi Guest", + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84", + "mac": "AC-17-C8-C7-E2-9D" + }, + "source": { + "mac": "AA-17-D8-C7-E2-9D" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T01:06:02.641Z", + "cisco_meraki": { + "bssid": "BE:17:D8:C7:DF:FD", + "channel": "56", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647479162.641725608 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:D8:C7:DF:FD' src='BE:17:D8:C7:DF:FD' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:DF:FD' vlan_id='0' channel='56' rssi='34' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84", + "mac": "AC-17-C8-C7-DF-FD" + }, + "source": { + "mac": "BE-17-D8-C7-DF-FD" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T01:06:02.670Z", + "cisco_meraki": { + "bssid": "92:17:D8:C7:DF:FD", + "channel": "56", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647479162.670104087 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:D8:C7:DF:FD' src='92:17:D8:C7:DF:FD' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:DF:FD' vlan_id='0' channel='56' rssi='18' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84", + "mac": "AC-17-C8-C7-DF-FD" + }, + "source": { + "mac": "92-17-D8-C7-DF-FD" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T01:06:01.182Z", + "cisco_meraki": { + "bssid": "AA:17:D8:C7:D8:51", + "channel": "149", + "event_subtype": "ssid_spoofing_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0", + "vap": "1" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "ssid-spoofing-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647479161.182241827 MX84_8 airmarshal_events type=ssid_spoofing_detected ssid='AwesomeWifi Guest' vap='1' bssid='AA:17:D8:C7:D8:51' src='AA:17:D8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' channel='149' rssi='9' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "name": "AwesomeWifi Guest" + }, + "observer": { + "hostname": "MX84_8" + }, + "source": { + "mac": "AA-17-D8-C7-D8-51" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T01:05:58.314Z", + "cisco_meraki": { + "bssid": "AE:17:D8:C7:D8:51", + "channel": "149", + "event_subtype": "ssid_spoofing_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0", + "vap": "1" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "ssid-spoofing-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647479158.314592227 MX84_8 airmarshal_events type=ssid_spoofing_detected ssid='AwesomeWifi' vap='1' bssid='AE:17:D8:C7:D8:51' src='AE:17:D8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' channel='149' rssi='8' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "name": "AwesomeWifi" + }, + "observer": { + "hostname": "MX84_8" + }, + "source": { + "mac": "AE-17-D8-C7-D8-51" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T01:05:51.958Z", + "cisco_meraki": { + "bssid": "BE:17:D8:C7:E2:9D", + "channel": "36", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647479151.958073405 MX84_7 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:D8:C7:E2:9D' src='BE:17:D8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='36' rssi='12' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84_7", + "mac": "AC-17-C8-C7-E2-9D" + }, + "source": { + "mac": "BE-17-D8-C7-E2-9D" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T01:05:33.020Z", + "cisco_meraki": { + "bssid": "92:17:D8:C7:E1:41", + "channel": "36", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "5", + "fc_type": "0" + }, + "destination": { + "mac": "6A-3A-3E-85-D7-D4" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647479133.020606043 MX84_3 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:D8:C7:E1:41' src='92:17:D8:C7:E1:41' dst='6A:3A:3E:85:D7:D4' wired_mac='AC:17:C8:C7:E1:41' vlan_id='0' channel='36' rssi='7' fc_type='0' fc_subtype='5'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84_3", + "mac": "AC-17-C8-C7-E1-41" + }, + "source": { + "mac": "92-17-D8-C7-E1-41" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T01:05:27.384Z", + "cisco_meraki": { + "bssid": "BE:17:C8:C7:D8:51", + "channel": "6", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647479127.384572447 MX84_1 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:C8:C7:D8:51' src='BE:17:C8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='28' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84_1", + "mac": "AC-17-C8-C7-D8-51" + }, + "source": { + "mac": "BE-17-C8-C7-D8-51" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T01:05:22.570Z", + "cisco_meraki": { + "bssid": "92:17:C8:C7:D8:51", + "channel": "6", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647479122.570882475 MX84_4 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:D8:51' src='92:17:C8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='26' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84_4", + "mac": "AC-17-C8-C7-D8-51" + }, + "source": { + "mac": "92-17-C8-C7-D8-51" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T01:05:22.592Z", + "cisco_meraki": { + "bssid": "92:17:C8:C7:D8:51", + "channel": "6", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647479122.592807847 MX84_2 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:D8:51' src='92:17:C8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='36' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84_2", + "mac": "AC-17-C8-C7-D8-51" + }, + "source": { + "mac": "92-17-C8-C7-D8-51" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T01:05:22.578Z", + "cisco_meraki": { + "bssid": "AA:17:C8:C7:D8:51", + "channel": "6", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647479122.578597672 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='AA:17:C8:C7:D8:51' src='AA:17:C8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='52' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84", + "mac": "AC-17-C8-C7-D8-51" + }, + "source": { + "mac": "AA-17-C8-C7-D8-51" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T01:05:20.544Z", + "cisco_meraki": { + "bssid": "AC:17:C8:C7:D8:51", + "channel": "6", + "event_subtype": "ssid_spoofing_detected", + "event_type": "airmarshal_events", + "fc_subtype": "5", + "fc_type": "0", + "vap": "1" + }, + "destination": { + "mac": "90-AC-3F-02-31-59" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "ssid-spoofing-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647479120.544286631 MX84 airmarshal_events type=ssid_spoofing_detected ssid='AwesomeWifi' vap='1' bssid='AC:17:C8:C7:D8:51' src='AC:17:C8:C7:D8:51' dst='90:AC:3F:02:31:59' channel='6' rssi='50' fc_type='0' fc_subtype='5'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "name": "AwesomeWifi" + }, + "observer": { + "hostname": "MX84" + }, + "source": { + "mac": "AC-17-C8-C7-D8-51" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T01:04:51.258Z", + "cisco_meraki": { + "bssid": "92:17:C8:C7:E1:41", + "channel": "1", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647479091.258858944 MX84_4 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:E1:41' src='92:17:C8:C7:E1:41' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E1:41' vlan_id='0' channel='1' rssi='44' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84_4", + "mac": "AC-17-C8-C7-E1-41" + }, + "source": { + "mac": "92-17-C8-C7-E1-41" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T01:04:20.425Z", + "cisco_meraki": { + "bssid": "AC:17:C8:C7:D8:51", + "channel": "6", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "5", + "fc_type": "0" + }, + "destination": { + "mac": "78-28-CA-AA-6A-4A" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647479060.425068327 MX84_2 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi' bssid='AC:17:C8:C7:D8:51' src='AC:17:C8:C7:D8:51' dst='78:28:CA:AA:6A:4A' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='34' fc_type='0' fc_subtype='5'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "name": "AwesomeWifi", + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84_2", + "mac": "AC-17-C8-C7-D8-51" + }, + "source": { + "mac": "AC-17-C8-C7-D8-51" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T01:03:57.677Z", + "cisco_meraki": { + "bssid": "92:17:D8:C7:E2:9D", + "channel": "36", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647479037.677902643 MX84_7 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:D8:C7:E2:9D' src='92:17:D8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='36' rssi='11' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84_7", + "mac": "AC-17-C8-C7-E2-9D" + }, + "source": { + "mac": "92-17-D8-C7-E2-9D" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T01:03:56.783Z", + "cisco_meraki": { + "bssid": "92:17:C8:C7:E2:9D", + "channel": "11", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647479036.783442760 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:E2:9D' src='92:17:C8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='11' rssi='28' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84", + "mac": "AC-17-C8-C7-E2-9D" + }, + "source": { + "mac": "92-17-C8-C7-E2-9D" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T01:03:40.949Z", + "cisco_meraki": { + "bssid": "BE:17:C8:C7:DF:FD", + "channel": "11", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647479020.949227955 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:C8:C7:DF:FD' src='BE:17:C8:C7:DF:FD' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:DF:FD' vlan_id='0' channel='11' rssi='37' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84", + "mac": "AC-17-C8-C7-DF-FD" + }, + "source": { + "mac": "BE-17-C8-C7-DF-FD" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T01:02:54.912Z", + "cisco_meraki": { + "bssid": "AA:17:C8:C7:DF:FD", + "channel": "11", + "event_subtype": "ssid_spoofing_detected", + "event_type": "airmarshal_events", + "fc_subtype": "5", + "fc_type": "0", + "vap": "13" + }, + "destination": { + "mac": "08-A7-C0-3B-5A-95" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "ssid-spoofing-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647478974.912056258 MX84 airmarshal_events type=ssid_spoofing_detected ssid='AwesomeWifi Guest' vap='13' bssid='AA:17:C8:C7:DF:FD' src='AA:17:C8:C7:DF:FD' dst='08:A7:C0:3B:5A:95' channel='11' rssi='27' fc_type='0' fc_subtype='5'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "name": "AwesomeWifi Guest" + }, + "observer": { + "hostname": "MX84" + }, + "source": { + "mac": "AA-17-C8-C7-DF-FD" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T01:02:46.089Z", + "cisco_meraki": { + "bssid": "AE:17:D8:C7:E1:41", + "channel": "36", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647478966.089203455 MX84 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi' bssid='AE:17:D8:C7:E1:41' src='AE:17:D8:C7:E1:41' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E1:41' vlan_id='0' channel='36' rssi='8' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "name": "AwesomeWifi", + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84", + "mac": "AC-17-C8-C7-E1-41" + }, + "source": { + "mac": "AE-17-D8-C7-E1-41" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T01:02:30.860Z", + "cisco_meraki": { + "bssid": "AC:17:C8:C7:D8:51", + "channel": "6", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "5", + "fc_type": "0" + }, + "destination": { + "mac": "78-28-CA-AA-69-96" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647478950.860971410 MX84_7 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi' bssid='AC:17:C8:C7:D8:51' src='AC:17:C8:C7:D8:51' dst='78:28:CA:AA:69:96' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='22' fc_type='0' fc_subtype='5'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "name": "AwesomeWifi", + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84_7", + "mac": "AC-17-C8-C7-D8-51" + }, + "source": { + "mac": "AC-17-C8-C7-D8-51" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T01:02:20.142Z", + "cisco_meraki": { + "bssid": "AE:17:D8:C7:D8:51", + "channel": "149", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "5", + "fc_type": "0" + }, + "destination": { + "mac": "AE-17-E8-C7-E2-9D" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647478940.142724327 MX84_2 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi' bssid='AE:17:D8:C7:D8:51' src='AE:17:D8:C7:D8:51' dst='AE:17:E8:C7:E2:9D' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='149' rssi='29' fc_type='0' fc_subtype='5'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "name": "AwesomeWifi", + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84_2", + "mac": "AC-17-C8-C7-D8-51" + }, + "source": { + "mac": "AE-17-D8-C7-D8-51" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T01:02:16.678Z", + "cisco_meraki": { + "bssid": "92:17:C8:C7:DF:FD", + "channel": "11", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "5", + "fc_type": "0" + }, + "destination": { + "mac": "E2-CB-9C-B5-DC-6E" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647478936.678862087 MX84_2 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:DF:FD' src='92:17:C8:C7:DF:FD' dst='E2:CB:9C:B5:DC:6E' wired_mac='AC:17:C8:C7:DF:FD' vlan_id='0' channel='11' rssi='7' fc_type='0' fc_subtype='5'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84_2", + "mac": "AC-17-C8-C7-DF-FD" + }, + "source": { + "mac": "92-17-C8-C7-DF-FD" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T01:01:47.739Z", + "cisco_meraki": { + "bssid": "92:17:C8:C7:E1:41", + "channel": "1", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "5", + "fc_type": "0" + }, + "destination": { + "mac": "AE-17-E8-C7-DF-FD" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647478907.739529447 MX84_2 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:E1:41' src='92:17:C8:C7:E1:41' dst='AE:17:E8:C7:DF:FD' wired_mac='AC:17:C8:C7:E1:41' vlan_id='0' channel='1' rssi='35' fc_type='0' fc_subtype='5'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84_2", + "mac": "AC-17-C8-C7-E1-41" + }, + "source": { + "mac": "92-17-C8-C7-E1-41" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T01:00:55.303Z", + "cisco_meraki": { + "bssid": "BE:17:C8:C7:E1:41", + "channel": "1", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647478855.303776534 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:C8:C7:E1:41' src='BE:17:C8:C7:E1:41' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E1:41' vlan_id='0' channel='1' rssi='39' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84", + "mac": "AC-17-C8-C7-E1-41" + }, + "source": { + "mac": "BE-17-C8-C7-E1-41" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T01:00:49.532Z", + "cisco_meraki": { + "bssid": "AE:17:D8:C7:D8:51", + "channel": "149", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647478849.532951889 MX84_3 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi' bssid='AE:17:D8:C7:D8:51' src='AE:17:D8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='149' rssi='29' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "name": "AwesomeWifi", + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84_3", + "mac": "AC-17-C8-C7-D8-51" + }, + "source": { + "mac": "AE-17-D8-C7-D8-51" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T01:00:45.877Z", + "cisco_meraki": { + "bssid": "AC:17:C8:C7:D8:51", + "channel": "6", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647478845.877942207 MX84_1 airmarshal_events type=rogue_ssid_detected ssid='' bssid='AC:17:C8:C7:D8:51' src='AC:17:C8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='26' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84_1", + "mac": "AC-17-C8-C7-D8-51" + }, + "source": { + "mac": "AC-17-C8-C7-D8-51" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T01:00:22.111Z", + "cisco_meraki": { + "bssid": "92:17:C8:C7:DF:FD", + "channel": "11", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647478822.111692485 MX84_6 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:DF:FD' src='92:17:C8:C7:DF:FD' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:DF:FD' vlan_id='0' channel='11' rssi='13' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84_6", + "mac": "AC-17-C8-C7-DF-FD" + }, + "source": { + "mac": "92-17-C8-C7-DF-FD" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T01:00:18.039Z", + "cisco_meraki": { + "bssid": "92:17:D8:C7:E2:9D", + "channel": "36", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647478818.039157925 MX84_6 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:D8:C7:E2:9D' src='92:17:D8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='36' rssi='4' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84_6", + "mac": "AC-17-C8-C7-E2-9D" + }, + "source": { + "mac": "92-17-D8-C7-E2-9D" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T01:00:00.349Z", + "cisco_meraki": { + "bssid": "AA:17:C8:C7:DF:FD", + "channel": "11", + "event_subtype": "ssid_spoofing_detected", + "event_type": "airmarshal_events", + "fc_subtype": "5", + "fc_type": "0", + "vap": "13" + }, + "destination": { + "mac": "6E-DA-36-A2-39-71" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "ssid-spoofing-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647478800.349145072 MX84_5 airmarshal_events type=ssid_spoofing_detected ssid='AwesomeWifi Guest' vap='13' bssid='AA:17:C8:C7:DF:FD' src='AA:17:C8:C7:DF:FD' dst='6E:DA:36:A2:39:71' channel='11' rssi='7' fc_type='0' fc_subtype='5'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "name": "AwesomeWifi Guest" + }, + "observer": { + "hostname": "MX84_5" + }, + "source": { + "mac": "AA-17-C8-C7-DF-FD" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:59:59.177Z", + "cisco_meraki": { + "bssid": "BE:17:D8:C7:E1:41", + "channel": "36", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647478799.177625347 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:D8:C7:E1:41' src='BE:17:D8:C7:E1:41' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E1:41' vlan_id='0' channel='36' rssi='14' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84", + "mac": "AC-17-C8-C7-E1-41" + }, + "source": { + "mac": "BE-17-D8-C7-E1-41" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:59:48.838Z", + "cisco_meraki": { + "bssid": "92:17:C8:C7:DF:FD", + "channel": "11", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647478788.838283552 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:DF:FD' src='92:17:C8:C7:DF:FD' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:DF:FD' vlan_id='0' channel='11' rssi='17' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84", + "mac": "AC-17-C8-C7-DF-FD" + }, + "source": { + "mac": "92-17-C8-C7-DF-FD" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:59:42.939Z", + "cisco_meraki": { + "bssid": "AA:17:D8:C7:E2:9D", + "channel": "36", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "5", + "fc_type": "0" + }, + "destination": { + "mac": "E2-CB-9C-B5-C5-68" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647478782.939898885 MX84_6 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi Guest' bssid='AA:17:D8:C7:E2:9D' src='AA:17:D8:C7:E2:9D' dst='E2:CB:9C:B5:C5:68' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='36' rssi='4' fc_type='0' fc_subtype='5'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "name": "AwesomeWifi Guest", + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84_6", + "mac": "AC-17-C8-C7-E2-9D" + }, + "source": { + "mac": "AA-17-D8-C7-E2-9D" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:59:42.932Z", + "cisco_meraki": { + "bssid": "AA:17:D8:C7:E2:9D", + "channel": "36", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "5", + "fc_type": "0" + }, + "destination": { + "mac": "E2-CB-9C-B5-C5-68" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647478782.932299301 MX84_8 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi Guest' bssid='AA:17:D8:C7:E2:9D' src='AA:17:D8:C7:E2:9D' dst='E2:CB:9C:B5:C5:68' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='36' rssi='13' fc_type='0' fc_subtype='5'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "name": "AwesomeWifi Guest", + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84_8", + "mac": "AC-17-C8-C7-E2-9D" + }, + "source": { + "mac": "AA-17-D8-C7-E2-9D" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:59:42.930Z", + "cisco_meraki": { + "bssid": "AE:17:D8:C7:E2:9D", + "channel": "36", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "5", + "fc_type": "0" + }, + "destination": { + "mac": "E2-CB-9C-B5-C5-68" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647478782.930289746 MX84_8 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi' bssid='AE:17:D8:C7:E2:9D' src='AE:17:D8:C7:E2:9D' dst='E2:CB:9C:B5:C5:68' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='36' rssi='13' fc_type='0' fc_subtype='5'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "name": "AwesomeWifi", + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84_8", + "mac": "AC-17-C8-C7-E2-9D" + }, + "source": { + "mac": "AE-17-D8-C7-E2-9D" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:58:15.528Z", + "cisco_meraki": { + "bssid": "AA:17:C8:C7:D8:51", + "channel": "6", + "event_subtype": "ssid_spoofing_detected", + "event_type": "airmarshal_events", + "fc_subtype": "5", + "fc_type": "0", + "vap": "1" + }, + "destination": { + "mac": "78-28-CA-AA-6A-4A" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "ssid-spoofing-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647478695.528431433 MX84 airmarshal_events type=ssid_spoofing_detected ssid='AwesomeWifi Guest' vap='1' bssid='AA:17:C8:C7:D8:51' src='AA:17:C8:C7:D8:51' dst='78:28:CA:AA:6A:4A' channel='6' rssi='52' fc_type='0' fc_subtype='5'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "name": "AwesomeWifi Guest" + }, + "observer": { + "hostname": "MX84" + }, + "source": { + "mac": "AA-17-C8-C7-D8-51" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:58:13.465Z", + "cisco_meraki": { + "bssid": "92:17:C8:C7:DF:FD", + "channel": "11", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647478693.465185593 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:DF:FD' src='92:17:C8:C7:DF:FD' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:DF:FD' vlan_id='0' channel='11' rssi='29' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84", + "mac": "AC-17-C8-C7-DF-FD" + }, + "source": { + "mac": "92-17-C8-C7-DF-FD" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:57:49.549Z", + "cisco_meraki": { + "bssid": "92:17:C8:C7:E2:9D", + "channel": "11", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647478669.549413486 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:E2:9D' src='92:17:C8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='11' rssi='29' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84", + "mac": "AC-17-C8-C7-E2-9D" + }, + "source": { + "mac": "92-17-C8-C7-E2-9D" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:57:06.517Z", + "cisco_meraki": { + "bssid": "BE:17:C8:C7:D8:51", + "channel": "6", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647478626.517046787 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:C8:C7:D8:51' src='BE:17:C8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='49' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84", + "mac": "AC-17-C8-C7-D8-51" + }, + "source": { + "mac": "BE-17-C8-C7-D8-51" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:56:31.602Z", + "cisco_meraki": { + "bssid": "AA:17:C8:C7:DF:FD", + "channel": "11", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647478591.602996834 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='AA:17:C8:C7:DF:FD' src='AA:17:C8:C7:DF:FD' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:DF:FD' vlan_id='0' channel='11' rssi='27' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84", + "mac": "AC-17-C8-C7-DF-FD" + }, + "source": { + "mac": "AA-17-C8-C7-DF-FD" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:56:09.035Z", + "cisco_meraki": { + "bssid": "92:17:C8:C7:E1:41", + "channel": "1", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "5", + "fc_type": "0" + }, + "destination": { + "mac": "E2-CB-9C-B5-C5-68" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647478569.035635205 MX84_6 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:E1:41' src='92:17:C8:C7:E1:41' dst='E2:CB:9C:B5:C5:68' wired_mac='AC:17:C8:C7:E1:41' vlan_id='0' channel='1' rssi='14' fc_type='0' fc_subtype='5'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84_6", + "mac": "AC-17-C8-C7-E1-41" + }, + "source": { + "mac": "92-17-C8-C7-E1-41" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:56:07.751Z", + "cisco_meraki": { + "bssid": "AA:17:C8:C7:DF:FD", + "channel": "11", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647478567.751044590 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='AA:17:C8:C7:DF:FD' src='AA:17:C8:C7:DF:FD' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:DF:FD' vlan_id='0' channel='11' rssi='27' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84", + "mac": "AC-17-C8-C7-DF-FD" + }, + "source": { + "mac": "AA-17-C8-C7-DF-FD" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:55:59.571Z", + "cisco_meraki": { + "bssid": "AA:17:C8:C7:D8:51", + "channel": "6", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "5", + "fc_type": "0" + }, + "destination": { + "mac": "5C-AA-FD-5D-76-0E" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647478559.571303907 MX84 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi Guest' bssid='AA:17:C8:C7:D8:51' src='AA:17:C8:C7:D8:51' dst='5C:AA:FD:5D:76:0E' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='49' fc_type='0' fc_subtype='5'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "name": "AwesomeWifi Guest", + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84", + "mac": "AC-17-C8-C7-D8-51" + }, + "source": { + "mac": "AA-17-C8-C7-D8-51" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:55:58.540Z", + "cisco_meraki": { + "bssid": "92:17:D8:C7:D8:51", + "channel": "149", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "5", + "fc_type": "0" + }, + "destination": { + "mac": "E2-CB-9C-B5-DC-6E" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647478558.540066660 MX84_3 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:D8:C7:D8:51' src='92:17:D8:C7:D8:51' dst='E2:CB:9C:B5:DC:6E' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='149' rssi='24' fc_type='0' fc_subtype='5'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84_3", + "mac": "AC-17-C8-C7-D8-51" + }, + "source": { + "mac": "92-17-D8-C7-D8-51" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:55:54.934Z", + "cisco_meraki": { + "bssid": "AC:17:C8:C7:D8:51", + "channel": "6", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647478554.934781027 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='AC:17:C8:C7:D8:51' src='AC:17:C8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='50' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84", + "mac": "AC-17-C8-C7-D8-51" + }, + "source": { + "mac": "AC-17-C8-C7-D8-51" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:55:41.587Z", + "cisco_meraki": { + "bssid": "AA:17:D8:C7:E1:41", + "channel": "36", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "5", + "fc_type": "0" + }, + "destination": { + "mac": "E2-CB-9C-B5-DA-7A" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647478541.587558726 MX84 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi Guest' bssid='AA:17:D8:C7:E1:41' src='AA:17:D8:C7:E1:41' dst='E2:CB:9C:B5:DA:7A' wired_mac='AC:17:C8:C7:E1:41' vlan_id='0' channel='36' rssi='9' fc_type='0' fc_subtype='5'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "name": "AwesomeWifi Guest", + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84", + "mac": "AC-17-C8-C7-E1-41" + }, + "source": { + "mac": "AA-17-D8-C7-E1-41" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:55:34.671Z", + "cisco_meraki": { + "bssid": "AA:17:D8:C7:D8:51", + "channel": "149", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "5", + "fc_type": "0" + }, + "destination": { + "mac": "E2-CB-9C-B5-DA-7A" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647478534.671579931 MX84_3 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi Guest' bssid='AA:17:D8:C7:D8:51' src='AA:17:D8:C7:D8:51' dst='E2:CB:9C:B5:DA:7A' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='149' rssi='28' fc_type='0' fc_subtype='5'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "name": "AwesomeWifi Guest", + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84_3", + "mac": "AC-17-C8-C7-D8-51" + }, + "source": { + "mac": "AA-17-D8-C7-D8-51" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:55:08.007Z", + "cisco_meraki": { + "bssid": "AE:17:D8:C7:E2:9D", + "channel": "36", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "5", + "fc_type": "0" + }, + "destination": { + "mac": "6A-3A-3E-85-D7-D4" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647478508.007504325 MX84_6 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi' bssid='AE:17:D8:C7:E2:9D' src='AE:17:D8:C7:E2:9D' dst='6A:3A:3E:85:D7:D4' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='36' rssi='5' fc_type='0' fc_subtype='5'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "name": "AwesomeWifi", + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84_6", + "mac": "AC-17-C8-C7-E2-9D" + }, + "source": { + "mac": "AE-17-D8-C7-E2-9D" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:54:47.013Z", + "cisco_meraki": { + "bssid": "AA:17:D8:C7:D8:51", + "channel": "149", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647478487.013169927 MX84_2 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi Guest' bssid='AA:17:D8:C7:D8:51' src='AA:17:D8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='149' rssi='30' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "name": "AwesomeWifi Guest", + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84_2", + "mac": "AC-17-C8-C7-D8-51" + }, + "source": { + "mac": "AA-17-D8-C7-D8-51" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:54:43.410Z", + "cisco_meraki": { + "bssid": "92:17:C8:C7:D8:51", + "channel": "6", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647478483.410677512 MX84_3 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:D8:51' src='92:17:C8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='33' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84_3", + "mac": "AC-17-C8-C7-D8-51" + }, + "source": { + "mac": "92-17-C8-C7-D8-51" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:54:38.614Z", + "cisco_meraki": { + "bssid": "92:17:C8:C7:D8:51", + "channel": "6", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647478478.614722093 MX84_1 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:D8:51' src='92:17:C8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='32' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84_1", + "mac": "AC-17-C8-C7-D8-51" + }, + "source": { + "mac": "92-17-C8-C7-D8-51" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:54:00.565Z", + "cisco_meraki": { + "bssid": "AC:17:C8:C7:DF:FD", + "channel": "11", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647478440.565782942 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='AC:17:C8:C7:DF:FD' src='AC:17:C8:C7:DF:FD' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:DF:FD' vlan_id='0' channel='11' rssi='14' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84", + "mac": "AC-17-C8-C7-DF-FD" + }, + "source": { + "mac": "AC-17-C8-C7-DF-FD" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:53:28.128Z", + "cisco_meraki": { + "bssid": "BE:17:D8:C7:E2:9D", + "channel": "36", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647478408.128821330 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:D8:C7:E2:9D' src='BE:17:D8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='36' rssi='21' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84", + "mac": "AC-17-C8-C7-E2-9D" + }, + "source": { + "mac": "BE-17-D8-C7-E2-9D" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:53:23.005Z", + "cisco_meraki": { + "bssid": "AC:17:C8:C7:DF:FD", + "channel": "11", + "event_subtype": "ssid_spoofing_detected", + "event_type": "airmarshal_events", + "fc_subtype": "5", + "fc_type": "0", + "vap": "13" + }, + "destination": { + "mac": "AE-17-E8-C7-DF-FD" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "ssid-spoofing-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647478403.005811325 MX84_5 airmarshal_events type=ssid_spoofing_detected ssid='AwesomeWifi' vap='13' bssid='AC:17:C8:C7:DF:FD' src='AC:17:C8:C7:DF:FD' dst='AE:17:E8:C7:DF:FD' channel='11' rssi='8' fc_type='0' fc_subtype='5'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "name": "AwesomeWifi" + }, + "observer": { + "hostname": "MX84_5" + }, + "source": { + "mac": "AC-17-C8-C7-DF-FD" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:53:03.070Z", + "cisco_meraki": { + "bssid": "BE:17:C8:C7:E1:41", + "channel": "1", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647478383.070405853 MX84_4 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:C8:C7:E1:41' src='BE:17:C8:C7:E1:41' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E1:41' vlan_id='0' channel='1' rssi='44' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84_4", + "mac": "AC-17-C8-C7-E1-41" + }, + "source": { + "mac": "BE-17-C8-C7-E1-41" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:52:53.816Z", + "cisco_meraki": { + "bssid": "AA:17:C8:C7:E2:9D", + "channel": "11", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647478373.816434235 MX84_7 airmarshal_events type=rogue_ssid_detected ssid='' bssid='AA:17:C8:C7:E2:9D' src='AA:17:C8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='11' rssi='9' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84_7", + "mac": "AC-17-C8-C7-E2-9D" + }, + "source": { + "mac": "AA-17-C8-C7-E2-9D" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:52:19.127Z", + "cisco_meraki": { + "bssid": "AA:17:C8:C7:E1:41", + "channel": "1", + "event_subtype": "ssid_spoofing_detected", + "event_type": "airmarshal_events", + "fc_subtype": "5", + "fc_type": "0", + "vap": "1" + }, + "destination": { + "mac": "78-28-CA-AA-6A-0A" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "ssid-spoofing-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647478339.127895652 MX84 airmarshal_events type=ssid_spoofing_detected ssid='AwesomeWifi Guest' vap='1' bssid='AA:17:C8:C7:E1:41' src='AA:17:C8:C7:E1:41' dst='78:28:CA:AA:6A:0A' channel='1' rssi='35' fc_type='0' fc_subtype='5'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "name": "AwesomeWifi Guest" + }, + "observer": { + "hostname": "MX84" + }, + "source": { + "mac": "AA-17-C8-C7-E1-41" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:51:38.296Z", + "cisco_meraki": { + "bssid": "92:17:D8:C7:E2:9D", + "channel": "36", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647478298.296851316 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:D8:C7:E2:9D' src='92:17:D8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='36' rssi='35' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84", + "mac": "AC-17-C8-C7-E2-9D" + }, + "source": { + "mac": "92-17-D8-C7-E2-9D" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:51:33.380Z", + "cisco_meraki": { + "bssid": "AE:17:D8:C7:E2:9D", + "channel": "36", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647478293.380396754 MX84 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi' bssid='AE:17:D8:C7:E2:9D' src='AE:17:D8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='36' rssi='35' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "name": "AwesomeWifi", + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84", + "mac": "AC-17-C8-C7-E2-9D" + }, + "source": { + "mac": "AE-17-D8-C7-E2-9D" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:51:08.953Z", + "cisco_meraki": { + "bssid": "BE:17:C8:C7:DF:FD", + "channel": "11", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647478268.953109023 MX84_8 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:C8:C7:DF:FD' src='BE:17:C8:C7:DF:FD' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:DF:FD' vlan_id='0' channel='11' rssi='10' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84_8", + "mac": "AC-17-C8-C7-DF-FD" + }, + "source": { + "mac": "BE-17-C8-C7-DF-FD" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:50:57.084Z", + "cisco_meraki": { + "bssid": "AC:17:C8:C7:DF:FD", + "channel": "11", + "event_subtype": "ssid_spoofing_detected", + "event_type": "airmarshal_events", + "fc_subtype": "5", + "fc_type": "0", + "vap": "13" + }, + "destination": { + "mac": "EE-CE-D5-6A-B6-22" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "ssid-spoofing-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647478257.084985274 MX84 airmarshal_events type=ssid_spoofing_detected ssid='AwesomeWifi' vap='13' bssid='AC:17:C8:C7:DF:FD' src='AC:17:C8:C7:DF:FD' dst='EE:CE:D5:6A:B6:22' channel='11' rssi='16' fc_type='0' fc_subtype='5'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "name": "AwesomeWifi" + }, + "observer": { + "hostname": "MX84" + }, + "source": { + "mac": "AC-17-C8-C7-DF-FD" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:50:56.341Z", + "cisco_meraki": { + "bssid": "BE:17:D8:C7:DF:FD", + "channel": "56", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647478256.341194724 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:D8:C7:DF:FD' src='BE:17:D8:C7:DF:FD' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:DF:FD' vlan_id='0' channel='56' rssi='19' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84", + "mac": "AC-17-C8-C7-DF-FD" + }, + "source": { + "mac": "BE-17-D8-C7-DF-FD" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:50:21.255Z", + "cisco_meraki": { + "bssid": "BE:17:C8:C7:E2:9D", + "channel": "11", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647478221.255609741 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:C8:C7:E2:9D' src='BE:17:C8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='11' rssi='12' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84", + "mac": "AC-17-C8-C7-E2-9D" + }, + "source": { + "mac": "BE-17-C8-C7-E2-9D" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:49:05.758Z", + "cisco_meraki": { + "bssid": "AA:17:D8:C7:E2:9D", + "channel": "36", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "5", + "fc_type": "0" + }, + "destination": { + "mac": "6A-3A-3E-85-D7-D4" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647478145.758483684 MX84_4 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi Guest' bssid='AA:17:D8:C7:E2:9D' src='AA:17:D8:C7:E2:9D' dst='6A:3A:3E:85:D7:D4' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='36' rssi='5' fc_type='0' fc_subtype='5'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "name": "AwesomeWifi Guest", + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84_4", + "mac": "AC-17-C8-C7-E2-9D" + }, + "source": { + "mac": "AA-17-D8-C7-E2-9D" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:48:41.589Z", + "cisco_meraki": { + "bssid": "AC:17:C8:C7:E1:41", + "channel": "1", + "event_subtype": "ssid_spoofing_detected", + "event_type": "airmarshal_events", + "fc_subtype": "5", + "fc_type": "0", + "vap": "1" + }, + "destination": { + "mac": "AE-17-E8-C7-E1-41" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "ssid-spoofing-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647478121.589518727 MX84_2 airmarshal_events type=ssid_spoofing_detected ssid='AwesomeWifi' vap='1' bssid='AC:17:C8:C7:E1:41' src='AC:17:C8:C7:E1:41' dst='AE:17:E8:C7:E1:41' channel='1' rssi='22' fc_type='0' fc_subtype='5'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "name": "AwesomeWifi" + }, + "observer": { + "hostname": "MX84_2" + }, + "source": { + "mac": "AC-17-C8-C7-E1-41" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:48:39.868Z", + "cisco_meraki": { + "bssid": "BE:17:D8:C7:D8:51", + "channel": "149", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647478119.868477795 MX84_7 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:D8:C7:D8:51' src='BE:17:D8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='149' rssi='7' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84_7", + "mac": "AC-17-C8-C7-D8-51" + }, + "source": { + "mac": "BE-17-D8-C7-D8-51" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:48:34.277Z", + "cisco_meraki": { + "bssid": "AC:17:C8:C7:D8:51", + "channel": "6", + "event_subtype": "ssid_spoofing_detected", + "event_type": "airmarshal_events", + "fc_subtype": "5", + "fc_type": "0", + "vap": "1" + }, + "destination": { + "mac": "78-28-CA-AA-69-96" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "ssid-spoofing-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647478114.277373007 MX84 airmarshal_events type=ssid_spoofing_detected ssid='AwesomeWifi' vap='1' bssid='AC:17:C8:C7:D8:51' src='AC:17:C8:C7:D8:51' dst='78:28:CA:AA:69:96' channel='6' rssi='48' fc_type='0' fc_subtype='5'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "name": "AwesomeWifi" + }, + "observer": { + "hostname": "MX84" + }, + "source": { + "mac": "AC-17-C8-C7-D8-51" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:48:25.395Z", + "cisco_meraki": { + "bssid": "BE:17:D8:C7:D8:51", + "channel": "149", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647478105.395836204 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:D8:C7:D8:51' src='BE:17:D8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='149' rssi='53' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84", + "mac": "AC-17-C8-C7-D8-51" + }, + "source": { + "mac": "BE-17-D8-C7-D8-51" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:48:22.536Z", + "cisco_meraki": { + "bssid": "92:17:D8:C7:E1:41", + "channel": "36", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "5", + "fc_type": "0" + }, + "destination": { + "mac": "E2-CB-9C-B5-D7-80" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647478102.536782923 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:D8:C7:E1:41' src='92:17:D8:C7:E1:41' dst='E2:CB:9C:B5:D7:80' wired_mac='AC:17:C8:C7:E1:41' vlan_id='0' channel='36' rssi='9' fc_type='0' fc_subtype='5'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84", + "mac": "AC-17-C8-C7-E1-41" + }, + "source": { + "mac": "92-17-D8-C7-E1-41" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:48:12.108Z", + "cisco_meraki": { + "bssid": "BE:17:C8:C7:E1:41", + "channel": "1", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647478092.108472035 MX84_7 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:C8:C7:E1:41' src='BE:17:C8:C7:E1:41' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E1:41' vlan_id='0' channel='1' rssi='27' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84_7", + "mac": "AC-17-C8-C7-E1-41" + }, + "source": { + "mac": "BE-17-C8-C7-E1-41" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:48:07.649Z", + "cisco_meraki": { + "bssid": "BE:17:C8:C7:E2:9D", + "channel": "11", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647478087.649007204 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:C8:C7:E2:9D' src='BE:17:C8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='11' rssi='23' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84", + "mac": "AC-17-C8-C7-E2-9D" + }, + "source": { + "mac": "BE-17-C8-C7-E2-9D" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:47:43.434Z", + "cisco_meraki": { + "bssid": "AC:17:C8:C7:E1:41", + "channel": "1", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647478063.434847715 MX84_7 airmarshal_events type=rogue_ssid_detected ssid='' bssid='AC:17:C8:C7:E1:41' src='AC:17:C8:C7:E1:41' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E1:41' vlan_id='0' channel='1' rssi='30' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84_7", + "mac": "AC-17-C8-C7-E1-41" + }, + "source": { + "mac": "AC-17-C8-C7-E1-41" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:47:34.846Z", + "cisco_meraki": { + "bssid": "92:17:D8:C7:E2:9D", + "channel": "36", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "5", + "fc_type": "0" + }, + "destination": { + "mac": "E2-CB-9C-B5-DD-BE" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647478054.846444450 MX84_4 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:D8:C7:E2:9D' src='92:17:D8:C7:E2:9D' dst='E2:CB:9C:B5:DD:BE' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='36' rssi='3' fc_type='0' fc_subtype='5'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84_4", + "mac": "AC-17-C8-C7-E2-9D" + }, + "source": { + "mac": "92-17-D8-C7-E2-9D" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:47:19.876Z", + "cisco_meraki": { + "bssid": "AC:17:C8:C7:E2:9D", + "channel": "11", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647478039.876640835 MX84_7 airmarshal_events type=rogue_ssid_detected ssid='' bssid='AC:17:C8:C7:E2:9D' src='AC:17:C8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='11' rssi='11' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84_7", + "mac": "AC-17-C8-C7-E2-9D" + }, + "source": { + "mac": "AC-17-C8-C7-E2-9D" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:47:15.923Z", + "cisco_meraki": { + "bssid": "AE:17:D8:C7:E2:9D", + "channel": "36", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647478035.923601924 MX84 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi' bssid='AE:17:D8:C7:E2:9D' src='AE:17:D8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='36' rssi='23' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "name": "AwesomeWifi", + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84", + "mac": "AC-17-C8-C7-E2-9D" + }, + "source": { + "mac": "AE-17-D8-C7-E2-9D" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:47:14.762Z", + "cisco_meraki": { + "bssid": "AA:17:C8:C7:E1:41", + "channel": "1", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647478034.762765475 MX84_7 airmarshal_events type=rogue_ssid_detected ssid='' bssid='AA:17:C8:C7:E1:41' src='AA:17:C8:C7:E1:41' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E1:41' vlan_id='0' channel='1' rssi='27' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84_7", + "mac": "AC-17-C8-C7-E1-41" + }, + "source": { + "mac": "AA-17-C8-C7-E1-41" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:47:06.502Z", + "cisco_meraki": { + "bssid": "AA:17:D8:C7:E2:9D", + "channel": "36", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647478026.502834244 MX84 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi Guest' bssid='AA:17:D8:C7:E2:9D' src='AA:17:D8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='36' rssi='23' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "name": "AwesomeWifi Guest", + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84", + "mac": "AC-17-C8-C7-E2-9D" + }, + "source": { + "mac": "AA-17-D8-C7-E2-9D" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:47:00.564Z", + "cisco_meraki": { + "bssid": "BE:17:C8:C7:E1:41", + "channel": "1", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647478020.564810050 MX84_8 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:C8:C7:E1:41' src='BE:17:C8:C7:E1:41' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E1:41' vlan_id='0' channel='1' rssi='29' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84_8", + "mac": "AC-17-C8-C7-E1-41" + }, + "source": { + "mac": "BE-17-C8-C7-E1-41" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:46:55.983Z", + "cisco_meraki": { + "bssid": "AA:17:C8:C7:DF:FD", + "channel": "11", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647478015.983013635 MX84_7 airmarshal_events type=rogue_ssid_detected ssid='' bssid='AA:17:C8:C7:DF:FD' src='AA:17:C8:C7:DF:FD' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:DF:FD' vlan_id='0' channel='11' rssi='20' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84_7", + "mac": "AC-17-C8-C7-DF-FD" + }, + "source": { + "mac": "AA-17-C8-C7-DF-FD" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:46:46.707Z", + "cisco_meraki": { + "bssid": "BE:17:C8:C7:E1:41", + "channel": "1", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647478006.707247789 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:C8:C7:E1:41' src='BE:17:C8:C7:E1:41' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E1:41' vlan_id='0' channel='1' rssi='38' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84", + "mac": "AC-17-C8-C7-E1-41" + }, + "source": { + "mac": "BE-17-C8-C7-E1-41" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:46:41.603Z", + "cisco_meraki": { + "bssid": "AC:17:C8:C7:D8:51", + "channel": "6", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647478001.603867573 MX84_3 airmarshal_events type=rogue_ssid_detected ssid='' bssid='AC:17:C8:C7:D8:51' src='AC:17:C8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='34' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84_3", + "mac": "AC-17-C8-C7-D8-51" + }, + "source": { + "mac": "AC-17-C8-C7-D8-51" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:46:03.236Z", + "cisco_meraki": { + "bssid": "92:17:C8:C7:E1:41", + "channel": "1", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647477963.236026884 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:E1:41' src='92:17:C8:C7:E1:41' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E1:41' vlan_id='0' channel='1' rssi='66' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84", + "mac": "AC-17-C8-C7-E1-41" + }, + "source": { + "mac": "92-17-C8-C7-E1-41" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:45:58.900Z", + "cisco_meraki": { + "bssid": "AC:17:C8:C7:E2:9D", + "channel": "11", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647477958.900449163 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='AC:17:C8:C7:E2:9D' src='AC:17:C8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='11' rssi='12' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84", + "mac": "AC-17-C8-C7-E2-9D" + }, + "source": { + "mac": "AC-17-C8-C7-E2-9D" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:45:53.907Z", + "cisco_meraki": { + "bssid": "AC:17:C8:C7:D8:51", + "channel": "6", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647477953.907583508 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='AC:17:C8:C7:D8:51' src='AC:17:C8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='43' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84", + "mac": "AC-17-C8-C7-D8-51" + }, + "source": { + "mac": "AC-17-C8-C7-D8-51" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:45:53.724Z", + "cisco_meraki": { + "bssid": "92:17:C8:C7:E1:41", + "channel": "1", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "5", + "fc_type": "0" + }, + "destination": { + "mac": "E2-CB-9C-B5-C5-68" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647477953.724449475 MX84_7 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:E1:41' src='92:17:C8:C7:E1:41' dst='E2:CB:9C:B5:C5:68' wired_mac='AC:17:C8:C7:E1:41' vlan_id='0' channel='1' rssi='35' fc_type='0' fc_subtype='5'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84_7", + "mac": "AC-17-C8-C7-E1-41" + }, + "source": { + "mac": "92-17-C8-C7-E1-41" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:45:45.336Z", + "cisco_meraki": { + "bssid": "92:17:D8:C7:E2:9D", + "channel": "36", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "5", + "fc_type": "0" + }, + "destination": { + "mac": "E2-CB-9C-B5-D8-54" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647477945.336342244 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:D8:C7:E2:9D' src='92:17:D8:C7:E2:9D' dst='E2:CB:9C:B5:D8:54' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='36' rssi='24' fc_type='0' fc_subtype='5'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84", + "mac": "AC-17-C8-C7-E2-9D" + }, + "source": { + "mac": "92-17-D8-C7-E2-9D" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:45:44.121Z", + "cisco_meraki": { + "bssid": "92:17:C8:C7:E1:41", + "channel": "1", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "5", + "fc_type": "0" + }, + "destination": { + "mac": "6A-3A-3E-85-CA-4E" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647477944.121686758 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:E1:41' src='92:17:C8:C7:E1:41' dst='6A:3A:3E:85:CA:4E' wired_mac='AC:17:C8:C7:E1:41' vlan_id='0' channel='1' rssi='67' fc_type='0' fc_subtype='5'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84", + "mac": "AC-17-C8-C7-E1-41" + }, + "source": { + "mac": "92-17-C8-C7-E1-41" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:45:40.363Z", + "cisco_meraki": { + "bssid": "AA:17:C8:C7:DF:FD", + "channel": "11", + "event_subtype": "ssid_spoofing_detected", + "event_type": "airmarshal_events", + "fc_subtype": "5", + "fc_type": "0", + "vap": "13" + }, + "destination": { + "mac": "34-8F-27-25-CC-48" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "ssid-spoofing-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647477940.363429956 MX84 airmarshal_events type=ssid_spoofing_detected ssid='AwesomeWifi Guest' vap='13' bssid='AA:17:C8:C7:DF:FD' src='AA:17:C8:C7:DF:FD' dst='34:8F:27:25:CC:48' channel='11' rssi='16' fc_type='0' fc_subtype='5'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "name": "AwesomeWifi Guest" + }, + "observer": { + "hostname": "MX84" + }, + "source": { + "mac": "AA-17-C8-C7-DF-FD" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:45:30.038Z", + "cisco_meraki": { + "bssid": "AA:17:C8:C7:D8:51", + "channel": "6", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647477930.038516204 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='AA:17:C8:C7:D8:51' src='AA:17:C8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='40' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84", + "mac": "AC-17-C8-C7-D8-51" + }, + "source": { + "mac": "AA-17-C8-C7-D8-51" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:45:27.225Z", + "cisco_meraki": { + "bssid": "92:17:D8:C7:DF:FD", + "channel": "56", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647477927.225784460 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:D8:C7:DF:FD' src='92:17:D8:C7:DF:FD' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:DF:FD' vlan_id='0' channel='56' rssi='34' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84", + "mac": "AC-17-C8-C7-DF-FD" + }, + "source": { + "mac": "92-17-D8-C7-DF-FD" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:45:20.683Z", + "cisco_meraki": { + "bssid": "92:17:C8:C7:E2:9D", + "channel": "11", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647477920.683178115 MX84_7 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:E2:9D' src='92:17:C8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='11' rssi='15' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84_7", + "mac": "AC-17-C8-C7-E2-9D" + }, + "source": { + "mac": "92-17-C8-C7-E2-9D" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:45:20.510Z", + "cisco_meraki": { + "bssid": "BE:17:C8:C7:D8:51", + "channel": "6", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647477920.510699794 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:C8:C7:D8:51' src='BE:17:C8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='40' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84", + "mac": "AC-17-C8-C7-D8-51" + }, + "source": { + "mac": "BE-17-C8-C7-D8-51" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:44:51.986Z", + "cisco_meraki": { + "bssid": "AA:17:C8:C7:DF:FD", + "channel": "11", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647477891.986568005 MX84_6 airmarshal_events type=rogue_ssid_detected ssid='' bssid='AA:17:C8:C7:DF:FD' src='AA:17:C8:C7:DF:FD' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:DF:FD' vlan_id='0' channel='11' rssi='8' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84_6", + "mac": "AC-17-C8-C7-DF-FD" + }, + "source": { + "mac": "AA-17-C8-C7-DF-FD" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:44:41.304Z", + "cisco_meraki": { + "bssid": "92:17:D8:C7:D8:51", + "channel": "149", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647477881.304873506 MX84_4 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:D8:C7:D8:51' src='92:17:D8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='149' rssi='12' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84_4", + "mac": "AC-17-C8-C7-D8-51" + }, + "source": { + "mac": "92-17-D8-C7-D8-51" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:44:33.769Z", + "cisco_meraki": { + "bssid": "AA:17:D8:C7:E2:9D", + "channel": "36", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647477873.769683395 MX84_7 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi Guest' bssid='AA:17:D8:C7:E2:9D' src='AA:17:D8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='36' rssi='11' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "name": "AwesomeWifi Guest", + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84_7", + "mac": "AC-17-C8-C7-E2-9D" + }, + "source": { + "mac": "AA-17-D8-C7-E2-9D" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:44:32.782Z", + "cisco_meraki": { + "bssid": "92:17:C8:C7:D8:51", + "channel": "6", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647477872.782332783 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:D8:51' src='92:17:C8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='52' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84", + "mac": "AC-17-C8-C7-D8-51" + }, + "source": { + "mac": "92-17-C8-C7-D8-51" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:44:31.675Z", + "cisco_meraki": { + "bssid": "92:17:D8:C7:D8:51", + "channel": "149", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "5", + "fc_type": "0" + }, + "destination": { + "mac": "E2-CB-9C-B5-DD-BE" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647477871.675119845 MX84_6 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:D8:C7:D8:51' src='92:17:D8:C7:D8:51' dst='E2:CB:9C:B5:DD:BE' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='149' rssi='14' fc_type='0' fc_subtype='5'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84_6", + "mac": "AC-17-C8-C7-D8-51" + }, + "source": { + "mac": "92-17-D8-C7-D8-51" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:44:24.088Z", + "cisco_meraki": { + "bssid": "BE:17:D8:C7:E1:41", + "channel": "36", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647477864.088023180 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:D8:C7:E1:41' src='BE:17:D8:C7:E1:41' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E1:41' vlan_id='0' channel='36' rssi='9' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84", + "mac": "AC-17-C8-C7-E1-41" + }, + "source": { + "mac": "BE-17-D8-C7-E1-41" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:43:54.810Z", + "cisco_meraki": { + "bssid": "AA:17:C8:C7:E2:9D", + "channel": "11", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647477834.810489249 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='AA:17:C8:C7:E2:9D' src='AA:17:C8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='11' rssi='26' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84", + "mac": "AC-17-C8-C7-E2-9D" + }, + "source": { + "mac": "AA-17-C8-C7-E2-9D" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:43:48.886Z", + "cisco_meraki": { + "bssid": "92:17:D8:C7:D8:51", + "channel": "149", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647477828.886032606 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:D8:C7:D8:51' src='92:17:D8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='149' rssi='52' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84", + "mac": "AC-17-C8-C7-D8-51" + }, + "source": { + "mac": "92-17-D8-C7-D8-51" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:43:48.885Z", + "cisco_meraki": { + "bssid": "AA:17:D8:C7:D8:51", + "channel": "149", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647477828.885258686 MX84 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi Guest' bssid='AA:17:D8:C7:D8:51' src='AA:17:D8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='149' rssi='50' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "name": "AwesomeWifi Guest", + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84", + "mac": "AC-17-C8-C7-D8-51" + }, + "source": { + "mac": "AA-17-D8-C7-D8-51" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:43:48.799Z", + "cisco_meraki": { + "bssid": "92:17:D8:C7:D8:51", + "channel": "149", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647477828.799864712 MX84_5 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:D8:C7:D8:51' src='92:17:D8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='149' rssi='16' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84_5", + "mac": "AC-17-C8-C7-D8-51" + }, + "source": { + "mac": "92-17-D8-C7-D8-51" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:43:45.209Z", + "cisco_meraki": { + "bssid": "92:17:C8:C7:E2:9D", + "channel": "11", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647477825.209110701 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:E2:9D' src='92:17:C8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='11' rssi='38' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84", + "mac": "AC-17-C8-C7-E2-9D" + }, + "source": { + "mac": "92-17-C8-C7-E2-9D" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:43:45.021Z", + "cisco_meraki": { + "bssid": "92:17:C8:C7:D8:51", + "channel": "6", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "5", + "fc_type": "0" + }, + "destination": { + "mac": "6A-3A-3E-85-CA-4E" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647477825.021409913 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:D8:51' src='92:17:C8:C7:D8:51' dst='6A:3A:3E:85:CA:4E' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='63' fc_type='0' fc_subtype='5'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84", + "mac": "AC-17-C8-C7-D8-51" + }, + "source": { + "mac": "92-17-C8-C7-D8-51" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:43:45.024Z", + "cisco_meraki": { + "bssid": "92:17:C8:C7:D8:51", + "channel": "6", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "5", + "fc_type": "0" + }, + "destination": { + "mac": "AE-17-E8-C7-DF-FD" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647477825.024707684 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:D8:51' src='92:17:C8:C7:D8:51' dst='AE:17:E8:C7:DF:FD' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='59' fc_type='0' fc_subtype='5'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84", + "mac": "AC-17-C8-C7-D8-51" + }, + "source": { + "mac": "92-17-C8-C7-D8-51" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:43:41.364Z", + "cisco_meraki": { + "bssid": "BE:17:D8:C7:E1:41", + "channel": "36", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647477821.364087032 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:D8:C7:E1:41' src='BE:17:D8:C7:E1:41' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E1:41' vlan_id='0' channel='36' rssi='29' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84", + "mac": "AC-17-C8-C7-E1-41" + }, + "source": { + "mac": "BE-17-D8-C7-E1-41" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:43:16.382Z", + "cisco_meraki": { + "bssid": "BE:17:C8:C7:D8:51", + "channel": "6", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647477796.382660565 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:C8:C7:D8:51' src='BE:17:C8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='62' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84", + "mac": "AC-17-C8-C7-D8-51" + }, + "source": { + "mac": "BE-17-C8-C7-D8-51" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:43:16.382Z", + "cisco_meraki": { + "bssid": "AA:17:C8:C7:D8:51", + "channel": "6", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647477796.382227661 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='AA:17:C8:C7:D8:51' src='AA:17:C8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='61' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84", + "mac": "AC-17-C8-C7-D8-51" + }, + "source": { + "mac": "AA-17-C8-C7-D8-51" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:43:16.381Z", + "cisco_meraki": { + "bssid": "AC:17:C8:C7:D8:51", + "channel": "6", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647477796.381818586 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='AC:17:C8:C7:D8:51' src='AC:17:C8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='61' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84", + "mac": "AC-17-C8-C7-D8-51" + }, + "source": { + "mac": "AC-17-C8-C7-D8-51" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:43:15.407Z", + "cisco_meraki": { + "bssid": "BE:17:D8:C7:D8:51", + "channel": "149", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647477795.407019364 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:D8:C7:D8:51' src='BE:17:D8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='149' rssi='46' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84", + "mac": "AC-17-C8-C7-D8-51" + }, + "source": { + "mac": "BE-17-D8-C7-D8-51" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:43:15.385Z", + "cisco_meraki": { + "bssid": "AE:17:D8:C7:D8:51", + "channel": "149", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647477795.385494917 MX84 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi' bssid='AE:17:D8:C7:D8:51' src='AE:17:D8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='149' rssi='58' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "name": "AwesomeWifi", + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84", + "mac": "AC-17-C8-C7-D8-51" + }, + "source": { + "mac": "AE-17-D8-C7-D8-51" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:43:15.385Z", + "cisco_meraki": { + "bssid": "AA:17:D8:C7:D8:51", + "channel": "149", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647477795.385835866 MX84 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi Guest' bssid='AA:17:D8:C7:D8:51' src='AA:17:D8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='149' rssi='58' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "name": "AwesomeWifi Guest", + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84", + "mac": "AC-17-C8-C7-D8-51" + }, + "source": { + "mac": "AA-17-D8-C7-D8-51" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:43:13.576Z", + "cisco_meraki": { + "bssid": "AE:17:D8:C7:DF:FD", + "channel": "56", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647477793.576467473 MX84 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi' bssid='AE:17:D8:C7:DF:FD' src='AE:17:D8:C7:DF:FD' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:DF:FD' vlan_id='0' channel='56' rssi='33' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "name": "AwesomeWifi", + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84", + "mac": "AC-17-C8-C7-DF-FD" + }, + "source": { + "mac": "AE-17-D8-C7-DF-FD" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:43:13.576Z", + "cisco_meraki": { + "bssid": "AA:17:D8:C7:DF:FD", + "channel": "56", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647477793.576769233 MX84 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi Guest' bssid='AA:17:D8:C7:DF:FD' src='AA:17:D8:C7:DF:FD' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:DF:FD' vlan_id='0' channel='56' rssi='34' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "name": "AwesomeWifi Guest", + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84", + "mac": "AC-17-C8-C7-DF-FD" + }, + "source": { + "mac": "AA-17-D8-C7-DF-FD" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:43:06.805Z", + "cisco_meraki": { + "bssid": "92:17:C8:C7:E1:41", + "channel": "1", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647477786.805604872 MX84_5 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:E1:41' src='92:17:C8:C7:E1:41' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E1:41' vlan_id='0' channel='1' rssi='24' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84_5", + "mac": "AC-17-C8-C7-E1-41" + }, + "source": { + "mac": "92-17-C8-C7-E1-41" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:43:00.705Z", + "cisco_meraki": { + "bssid": "AC:17:C8:C7:DF:FD", + "channel": "11", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647477780.705460109 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='AC:17:C8:C7:DF:FD' src='AC:17:C8:C7:DF:FD' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:DF:FD' vlan_id='0' channel='11' rssi='37' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84", + "mac": "AC-17-C8-C7-DF-FD" + }, + "source": { + "mac": "AC-17-C8-C7-DF-FD" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:42:58.398Z", + "cisco_meraki": { + "bssid": "BE:17:D8:C7:E2:9D", + "channel": "36", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647477778.398160444 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:D8:C7:E2:9D' src='BE:17:D8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='36' rssi='40' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84", + "mac": "AC-17-C8-C7-E2-9D" + }, + "source": { + "mac": "BE-17-D8-C7-E2-9D" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:42:53.586Z", + "cisco_meraki": { + "bssid": "92:17:D8:C7:E2:9D", + "channel": "36", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "5", + "fc_type": "0" + }, + "destination": { + "mac": "AE-17-E8-C7-D8-51" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647477773.586461164 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:D8:C7:E2:9D' src='92:17:D8:C7:E2:9D' dst='AE:17:E8:C7:D8:51' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='36' rssi='22' fc_type='0' fc_subtype='5'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84", + "mac": "AC-17-C8-C7-E2-9D" + }, + "source": { + "mac": "92-17-D8-C7-E2-9D" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:42:44.149Z", + "cisco_meraki": { + "bssid": "BE:17:D8:C7:E1:41", + "channel": "36", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647477764.149946084 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:D8:C7:E1:41' src='BE:17:D8:C7:E1:41' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E1:41' vlan_id='0' channel='36' rssi='33' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84", + "mac": "AC-17-C8-C7-E1-41" + }, + "source": { + "mac": "BE-17-D8-C7-E1-41" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:42:44.145Z", + "cisco_meraki": { + "bssid": "92:17:D8:C7:E1:41", + "channel": "36", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647477764.145077176 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:D8:C7:E1:41' src='92:17:D8:C7:E1:41' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E1:41' vlan_id='0' channel='36' rssi='31' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84", + "mac": "AC-17-C8-C7-E1-41" + }, + "source": { + "mac": "92-17-D8-C7-E1-41" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:42:44.143Z", + "cisco_meraki": { + "bssid": "AE:17:D8:C7:E1:41", + "channel": "36", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647477764.143985243 MX84 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi' bssid='AE:17:D8:C7:E1:41' src='AE:17:D8:C7:E1:41' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E1:41' vlan_id='0' channel='36' rssi='30' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "name": "AwesomeWifi", + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84", + "mac": "AC-17-C8-C7-E1-41" + }, + "source": { + "mac": "AE-17-D8-C7-E1-41" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:42:44.144Z", + "cisco_meraki": { + "bssid": "AA:17:D8:C7:E1:41", + "channel": "36", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647477764.144283174 MX84 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi Guest' bssid='AA:17:D8:C7:E1:41' src='AA:17:D8:C7:E1:41' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E1:41' vlan_id='0' channel='36' rssi='30' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "name": "AwesomeWifi Guest", + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84", + "mac": "AC-17-C8-C7-E1-41" + }, + "source": { + "mac": "AA-17-D8-C7-E1-41" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:42:43.225Z", + "cisco_meraki": { + "bssid": "92:17:C8:C7:E2:9D", + "channel": "11", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "5", + "fc_type": "0" + }, + "destination": { + "mac": "E2-CB-9C-B5-D4-1E" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647477763.225832662 MX84_4 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:E2:9D' src='92:17:C8:C7:E2:9D' dst='E2:CB:9C:B5:D4:1E' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='11' rssi='9' fc_type='0' fc_subtype='5'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84_4", + "mac": "AC-17-C8-C7-E2-9D" + }, + "source": { + "mac": "92-17-C8-C7-E2-9D" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:42:24.039Z", + "cisco_meraki": { + "bssid": "92:17:C8:C7:D8:51", + "channel": "6", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "5", + "fc_type": "0" + }, + "destination": { + "mac": "AE-17-E8-C7-DF-FD" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647477744.039850991 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:C8:C7:D8:51' src='92:17:C8:C7:D8:51' dst='AE:17:E8:C7:DF:FD' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='6' rssi='50' fc_type='0' fc_subtype='5'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84", + "mac": "AC-17-C8-C7-D8-51" + }, + "source": { + "mac": "92-17-C8-C7-D8-51" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:42:13.453Z", + "cisco_meraki": { + "bssid": "92:17:D8:C7:D8:51", + "channel": "149", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647477733.453967364 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:D8:C7:D8:51' src='92:17:D8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='149' rssi='48' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84", + "mac": "AC-17-C8-C7-D8-51" + }, + "source": { + "mac": "92-17-D8-C7-D8-51" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:42:13.446Z", + "cisco_meraki": { + "bssid": "BE:17:D8:C7:D8:51", + "channel": "149", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647477733.446493073 MX84_3 airmarshal_events type=rogue_ssid_detected ssid='' bssid='BE:17:D8:C7:D8:51' src='BE:17:D8:C7:D8:51' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='149' rssi='28' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84_3", + "mac": "AC-17-C8-C7-D8-51" + }, + "source": { + "mac": "BE-17-D8-C7-D8-51" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:42:13.420Z", + "cisco_meraki": { + "bssid": "AA:17:D8:C7:D8:51", + "channel": "149", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "5", + "fc_type": "0" + }, + "destination": { + "mac": "38-BA-F8-CC-82-2E" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647477733.420037284 MX84 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi Guest' bssid='AA:17:D8:C7:D8:51' src='AA:17:D8:C7:D8:51' dst='38:BA:F8:CC:82:2E' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='149' rssi='48' fc_type='0' fc_subtype='5'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "name": "AwesomeWifi Guest", + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84", + "mac": "AC-17-C8-C7-D8-51" + }, + "source": { + "mac": "AA-17-D8-C7-D8-51" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:42:13.419Z", + "cisco_meraki": { + "bssid": "AE:17:D8:C7:D8:51", + "channel": "149", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "5", + "fc_type": "0" + }, + "destination": { + "mac": "38-BA-F8-CC-82-2E" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647477733.419042244 MX84 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi' bssid='AE:17:D8:C7:D8:51' src='AE:17:D8:C7:D8:51' dst='38:BA:F8:CC:82:2E' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='149' rssi='48' fc_type='0' fc_subtype='5'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "name": "AwesomeWifi", + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84", + "mac": "AC-17-C8-C7-D8-51" + }, + "source": { + "mac": "AE-17-D8-C7-D8-51" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:42:13.411Z", + "cisco_meraki": { + "bssid": "AE:17:D8:C7:D8:51", + "channel": "149", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "5", + "fc_type": "0" + }, + "destination": { + "mac": "38-BA-F8-CC-82-2E" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647477733.411410011 MX84 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi' bssid='AE:17:D8:C7:D8:51' src='AE:17:D8:C7:D8:51' dst='38:BA:F8:CC:82:2E' wired_mac='AC:17:C8:C7:D8:51' vlan_id='0' channel='149' rssi='51' fc_type='0' fc_subtype='5'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "name": "AwesomeWifi", + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84", + "mac": "AC-17-C8-C7-D8-51" + }, + "source": { + "mac": "AE-17-D8-C7-D8-51" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:41:56.431Z", + "cisco_meraki": { + "bssid": "AA:17:D8:C7:E2:9D", + "channel": "36", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "5", + "fc_type": "0" + }, + "destination": { + "mac": "E2-CB-9C-B5-D8-54" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647477716.431936901 MX84 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi Guest' bssid='AA:17:D8:C7:E2:9D' src='AA:17:D8:C7:E2:9D' dst='E2:CB:9C:B5:D8:54' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='36' rssi='39' fc_type='0' fc_subtype='5'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "name": "AwesomeWifi Guest", + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84", + "mac": "AC-17-C8-C7-E2-9D" + }, + "source": { + "mac": "AA-17-D8-C7-E2-9D" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:41:56.431Z", + "cisco_meraki": { + "bssid": "92:17:D8:C7:E2:9D", + "channel": "36", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "5", + "fc_type": "0" + }, + "destination": { + "mac": "E2-CB-9C-B5-D8-54" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647477716.431151781 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:D8:C7:E2:9D' src='92:17:D8:C7:E2:9D' dst='E2:CB:9C:B5:D8:54' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='36' rssi='39' fc_type='0' fc_subtype='5'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84", + "mac": "AC-17-C8-C7-E2-9D" + }, + "source": { + "mac": "92-17-D8-C7-E2-9D" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:41:56.429Z", + "cisco_meraki": { + "bssid": "AE:17:D8:C7:E2:9D", + "channel": "36", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "5", + "fc_type": "0" + }, + "destination": { + "mac": "E2-CB-9C-B5-D8-54" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647477716.429168101 MX84 airmarshal_events type=rogue_ssid_detected ssid='AwesomeWifi' bssid='AE:17:D8:C7:E2:9D' src='AE:17:D8:C7:E2:9D' dst='E2:CB:9C:B5:D8:54' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='36' rssi='39' fc_type='0' fc_subtype='5'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "name": "AwesomeWifi", + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84", + "mac": "AC-17-C8-C7-E2-9D" + }, + "source": { + "mac": "AE-17-D8-C7-E2-9D" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:41:55.612Z", + "cisco_meraki": { + "bssid": "AC:17:C8:C7:E2:9D", + "channel": "11", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "8", + "fc_type": "0" + }, + "destination": { + "mac": "FF-FF-FF-FF-FF-FF" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647477715.612600884 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='AC:17:C8:C7:E2:9D' src='AC:17:C8:C7:E2:9D' dst='FF:FF:FF:FF:FF:FF' wired_mac='AC:17:C8:C7:E2:9D' vlan_id='0' channel='11' rssi='28' fc_type='0' fc_subtype='8'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84", + "mac": "AC-17-C8-C7-E2-9D" + }, + "source": { + "mac": "AC-17-C8-C7-E2-9D" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:41:42.046Z", + "cisco_meraki": { + "bssid": "92:17:D8:C7:E1:41", + "channel": "36", + "event_subtype": "rogue_ssid_detected", + "event_type": "airmarshal_events", + "fc_subtype": "5", + "fc_type": "0" + }, + "destination": { + "mac": "E2-CB-9C-B5-DC-6E" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "rogue-ssid-detected", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1647477702.046252324 MX84 airmarshal_events type=rogue_ssid_detected ssid='' bssid='92:17:D8:C7:E1:41' src='92:17:D8:C7:E1:41' dst='E2:CB:9C:B5:DC:6E' wired_mac='AC:17:C8:C7:E1:41' vlan_id='0' channel='36' rssi='35' fc_type='0' fc_subtype='5'", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "vlan": { + "id": "0" + } + }, + "observer": { + "hostname": "MX84", + "mac": "AC-17-C8-C7-E1-41" + }, + "source": { + "mac": "92-17-D8-C7-E1-41" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + } + ] +} \ No newline at end of file diff --git a/packages/cisco_meraki/data_stream/log/_dev/test/pipeline/test-generated.log-config.yml b/packages/cisco_meraki/data_stream/log/_dev/test/pipeline/test-common-config.yml similarity index 51% rename from packages/cisco_meraki/data_stream/log/_dev/test/pipeline/test-generated.log-config.yml rename to packages/cisco_meraki/data_stream/log/_dev/test/pipeline/test-common-config.yml index 5622947e4b84..00d4f1de2beb 100644 --- a/packages/cisco_meraki/data_stream/log/_dev/test/pipeline/test-generated.log-config.yml +++ b/packages/cisco_meraki/data_stream/log/_dev/test/pipeline/test-common-config.yml @@ -1,5 +1,6 @@ -dynamic_fields: - event.ingested: ".*" fields: tags: + - forwarded - preserve_original_event + _conf: + tz_offset: UTC diff --git a/packages/cisco_meraki/data_stream/log/_dev/test/pipeline/test-events.log b/packages/cisco_meraki/data_stream/log/_dev/test/pipeline/test-events.log new file mode 100644 index 000000000000..1baeaa6cbba5 --- /dev/null +++ b/packages/cisco_meraki/data_stream/log/_dev/test/pipeline/test-events.log @@ -0,0 +1,23 @@ +<134>1 1647479055.795119971 MR_device_2 events type=dfs_event channel='136' radio='2' +<134>1 1647478401.421090826 MR_device_2 events type=wpa_deauth radio='1' vap='1' client_mac='E5:A4:98:71:9A:FE' aid='1034533358' +<134>1 1647478402.126325721 MR_device_2 events type=wpa_auth radio='1' vap='1' client_mac='E4:F4:18:79:1F:E1' aid='910537108' +<134>1 1647478709.602628785 MR_device_2 events type=disassociation radio='1' vap='1' client_mac='12:8D:1B:8A:D4:C8' channel='108' duration='309.163703632' auth_neg_dur='0.005547865' last_auth_ago='309.154547226' is_wpa='1' full_conn='0.121500990' ip_resp='0.121500990' ip_src='67.43.156.14' dns_req_rtt='0.018446771' dns_resp='0.190431042' dhcp_lease_completed='1.373967135' dhcp_server='8.8.8.8' dhcp_server_mac='18:3B:2E:5C:A7:F6' dhcp_resp='1.373967135' aid='1478558813' +<134>1 1647478402.117726086 MR_device_2 events type=association radio='1' vap='1' client_mac='12:8D:1B:8A:D4:C8' channel='140' rssi='20' aid='910537108' +<134>1 1647478093.022430458 MX_device_1 events Site-to-Site VPN: CHILD_SA net-1{272} established with SPIs c6abe8d0(inbound) 4f04c590(outbound) and TS 89.160.20.112/32[udp/l2f] === 81.2.69.144/32[udp/l2f] +<134>1 1647478092.029594666 MX_device_1 events Site-to-Site VPN: IKE_SA l2tp-over-ipsec-1[241] established between 89.160.20.112[89.160.20.112]...81.2.69.144[192.168.1.201] +<134>1 1647478222.583851938 MX84 events type=vpn_connectivity_change vpn_type='site-to-site' peer_contact='216.160.83.61:51856' peer_ident='2814ee002c075181bb1b7478ee073860' connectivity='false' +<134>1 1647479420.148681168 MX84 events dhcp lease of ip 10.0.2.213 from mx mac 68:3A:1E:42:60:59 for client mac E0:CB:BC:02:4F:80 from router 10.0.0.1 on subnet 255.255.252.0 with dns 10.0.0.1 +<134>1 1647479961.535491111 MX84 events dhcp no offers for mac A4:83:E7:02:A2:F1 host = 192.168.10.1 +<134>1 1647478092.669153546 MX_device_4 events client_vpn_connect user id 'jwick@wwvpn.net' local ip 172.16.0.145 connected from 81.2.69.193 +<134>1 1639132850.430422377 AP1 events type=disassociation radio='1' vap='1' client_mac='B0:A4:60:9B:3B:A6' channel='100' reason='1' instigator='2' duration='223.031691642' auth_neg_dur='0.005054229' last_auth_ago='223.020414600' is_wpa='1' full_conn='0.384002374' ip_resp='0.384002374' ip_src='10.197.39.50' http_resp='0.647356228' arp_resp='0.013562625' arp_src='10.197.39.50' dns_server='10.128.128.128' dns_req_rtt='0.023370084' dns_resp='0.263616104' dhcp_lease_completed='0.009196083' dhcp_server='10.128.128.128' dhcp_server_mac='E0:CB:BC:31:23:60' dhcp_resp='0.009196083' aid='977866432' +<134>1 1639132851.416656563 AP1 events type=aps_association_reject load='3' best_ap='192.168.128.38' best_ap_load='0' best_ap_rssi='37' +<134>1 1639132851.608053271 AP1 events type=association radio='1' vap='0' client_mac='B0:A4:60:9B:3B:A6' last_known_client_ip='0.0.0.0' channel='100' rssi='40' aid='125455944' +<134>1 1639132851.615363021 AP1 events type=wpa_auth radio='1' vap='0' client_mac='B0:A4:60:9B:3B:A6' last_known_client_ip='0.0.0.0' aid='125455944' +<134>1 1639132852.193892187 AP1 events type=multiple_dhcp_servers_detected vap='0' original_server_ip='192.168.130.2' original_server_mac='C8:E7:F0:C4:B0:B1' server_ip='192.168.130.3' server_mac='E8:B6:C2:57:C7:85' +<134>1 1639132852.718221083 AP1 events type=multiple_dhcp_servers_detected vap='0' original_server_ip='192.168.130.3' original_server_mac='E8:B6:C2:57:C7:85' server_ip='192.168.130.2' server_mac='C8:E7:F0:C4:B0:B1' +<134>1 1639132860.489500682 1_2_AP_1 events type=association radio='1' vap='3' client_mac='54:8D:5A:EA:30:E9' last_known_client_ip='0.0.0.0' channel='104' rssi='29' aid='1187092323' +<134>1 1639132861.230797660 1_2_AP_1 events type=8021x_eap_success radio='1' vap='3' client_mac='54:8D:5A:EA:30:E9' client_ip='0.0.0.0' identity='anonymous@gousto.co.uk' aid='1187092323' +<134>1 1639132861.280798139 1_2_AP_1 events type=8021x_auth radio='1' vap='3' client_mac='54:8D:5A:EA:30:E9' last_known_client_ip='0.0.0.0' identity='anonymous@gousto.co.uk' aid='1187092323' +<134>1 1639132875.360638431 1_2_AP_4 events type=disassociation radio='1' vap='1' client_mac='36:E7:E9:AE:04:3D' channel='132' reason='8' apple_da_reason='7' instigator='2' duration='40.260521941' auth_neg_dur='0.024206187' last_auth_ago='40.229666962' is_wpa='1' full_conn='0.477861916' ip_resp='1.005954707' ip_src='10.68.128.113' http_resp='0.477861916' arp_resp='0.179876562' arp_src='10.68.128.113' dns_server='10.128.128.128' dns_req_rtt='0.095675854' dns_resp='0.416596437' dhcp_lease_completed='0.182086020' dhcp_server='10.128.128.128' dhcp_server_mac='E0:CB:BC:49:F7:26' dhcp_resp='0.182086020' aid='1750957891' +<134>1 1639132903.129587239 LG2_AP_01 events type=disassociation radio='1' vap='1' client_mac='8E:2F:69:33:FA:6A' channel='36' reason='8' apple_da_reason='7' instigator='2' duration='27.641499140' auth_neg_dur='0.008153688' last_auth_ago='27.627178619' is_wpa='1' full_conn='0.395120958' ip_resp='0.520431812' ip_src='10.72.66.49' http_resp='0.395120958' arp_resp='0.132684875' arp_src='10.72.66.49' dns_server='10.128.128.128' dns_req_rtt='0.121687' dns_resp='0.335365542' dhcp_lease_completed='0.133589958' dhcp_server='10.128.128.128' dhcp_server_mac='F8:9E:28:70:1A:7C' dhcp_resp='0.133589958' aid='1899362895' +<134>1 1639132917.085087788 LG2_AP_01 events type=wpa_auth radio='1' vap='1' client_mac='8E:2F:69:33:FA:6A' aid='1546367691' diff --git a/packages/cisco_meraki/data_stream/log/_dev/test/pipeline/test-events.log-expected.json b/packages/cisco_meraki/data_stream/log/_dev/test/pipeline/test-events.log-expected.json new file mode 100644 index 000000000000..83285a4e714e --- /dev/null +++ b/packages/cisco_meraki/data_stream/log/_dev/test/pipeline/test-events.log-expected.json @@ -0,0 +1,1053 @@ +{ + "expected": [ + { + "@timestamp": "2022-03-17T01:04:15.795Z", + "cisco_meraki": { + "dfs_event": { + "channel": "136", + "radio": "2", + "type": "dfs_event" + }, + "event_subtype": "dfs_event", + "event_type": "events" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "dynamic-frequency-selection-detected", + "category": [ + "network" + ], + "original": "\u003c134\u003e1 1647479055.795119971 MR_device_2 events type=dfs_event channel='136' radio='2'", + "type": [ + "info" + ] + }, + "log": { + "syslog": { + "priority": 134 + } + }, + "observer": { + "hostname": "MR_device_2" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:53:21.421Z", + "cisco_meraki": { + "event_subtype": "wpa_deauth", + "event_type": "events", + "wpa_deauth": { + "aid": "1034533358", + "radio": "1", + "type": "wpa_deauth", + "vap": "1" + } + }, + "client": { + "mac": "E5:A4:98:71:9A:FE" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "wifi-wpa-failed-auth-or-deauth", + "category": [ + "network", + "authentication" + ], + "original": "\u003c134\u003e1 1647478401.421090826 MR_device_2 events type=wpa_deauth radio='1' vap='1' client_mac='E5:A4:98:71:9A:FE' aid='1034533358'", + "type": [ + "info", + "end", + "denied" + ] + }, + "log": { + "syslog": { + "priority": 134 + } + }, + "observer": { + "hostname": "MR_device_2" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:53:22.126Z", + "cisco_meraki": { + "event_subtype": "wpa_auth", + "event_type": "events", + "wpa_auth": { + "aid": "910537108", + "client_mac": "E4:F4:18:79:1F:E1", + "radio": "1", + "type": "wpa_auth", + "vap": "1" + } + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "wifi-wpa-authentication", + "category": [ + "network", + "authentication" + ], + "original": "\u003c134\u003e1 1647478402.126325721 MR_device_2 events type=wpa_auth radio='1' vap='1' client_mac='E4:F4:18:79:1F:E1' aid='910537108'", + "type": [ + "info", + "start", + "access" + ] + }, + "log": { + "syslog": { + "priority": 134 + } + }, + "observer": { + "hostname": "MR_device_2" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:58:29.602Z", + "cisco_meraki": { + "disassociation": { + "aid": "1478558813", + "auth_neg_dur": "0.005547865", + "channel": "108", + "client_mac": "12:8D:1B:8A:D4:C8", + "dhcp_lease_completed": "1.373967135", + "dhcp_resp": "1.373967135", + "dhcp_server": "8.8.8.8", + "dhcp_server_mac": "18:3B:2E:5C:A7:F6", + "dns_req_rtt": "0.018446771", + "dns_resp": "0.190431042", + "duration": "309.163703632", + "full_conn": "0.121500990", + "ip_resp": "0.121500990", + "ip_src": "67.43.156.14", + "is_wpa": "1", + "last_auth_ago": "309.154547226", + "radio": "1", + "type": "disassociation", + "vap": "1" + }, + "event_subtype": "disassociation", + "event_type": "events" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "wifi-disassociation-request", + "category": [ + "network", + "session" + ], + "original": "\u003c134\u003e1 1647478709.602628785 MR_device_2 events type=disassociation radio='1' vap='1' client_mac='12:8D:1B:8A:D4:C8' channel='108' duration='309.163703632' auth_neg_dur='0.005547865' last_auth_ago='309.154547226' is_wpa='1' full_conn='0.121500990' ip_resp='0.121500990' ip_src='67.43.156.14' dns_req_rtt='0.018446771' dns_resp='0.190431042' dhcp_lease_completed='1.373967135' dhcp_server='8.8.8.8' dhcp_server_mac='18:3B:2E:5C:A7:F6' dhcp_resp='1.373967135' aid='1478558813'", + "type": [ + "info", + "access", + "end" + ] + }, + "log": { + "syslog": { + "priority": 134 + } + }, + "observer": { + "hostname": "MR_device_2" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:53:22.117Z", + "cisco_meraki": { + "association": { + "aid": "910537108", + "channel": "140", + "client_mac": "12:8D:1B:8A:D4:C8", + "radio": "1", + "rssi": "20", + "type": "association", + "vap": "1" + }, + "event_subtype": "association", + "event_type": "events" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "wifi-association-request", + "category": [ + "network" + ], + "original": "\u003c134\u003e1 1647478402.117726086 MR_device_2 events type=association radio='1' vap='1' client_mac='12:8D:1B:8A:D4:C8' channel='140' rssi='20' aid='910537108'", + "type": [ + "info", + "access", + "connection" + ] + }, + "log": { + "syslog": { + "priority": 134 + } + }, + "observer": { + "hostname": "MR_device_2" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:48:13.022Z", + "cisco_meraki": { + "event_subtype": "Site-to-Site VPN", + "event_type": "events", + "site_to_site_vpn": { + "raw": " \u003cl2tp-over-ipsec-1|241\u003e CHILD_SA net-1{272} established with SPIs c6abe8d0(inbound) 4f04c590(outbound) and TS 89.160.20.112/32[udp/l2f] === 81.2.69.144/32[udp/l2f]" + } + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "site-to-site-vpn", + "category": [ + "network" + ], + "original": "\u003c134\u003e1 1647478093.022430458 MX_device_1 events Site-to-Site VPN: \u003cl2tp-over-ipsec-1|241\u003e CHILD_SA net-1{272} established with SPIs c6abe8d0(inbound) 4f04c590(outbound) and TS 89.160.20.112/32[udp/l2f] === 81.2.69.144/32[udp/l2f]", + "type": [ + "info", + "access" + ] + }, + "log": { + "syslog": { + "priority": 134 + } + }, + "observer": { + "hostname": "MX_device_1" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:48:12.029Z", + "cisco_meraki": { + "event_subtype": "Site-to-Site VPN", + "event_type": "events", + "site_to_site_vpn": { + "raw": " \u003cl2tp-over-ipsec-1|241\u003e IKE_SA l2tp-over-ipsec-1[241] established between 89.160.20.112[89.160.20.112]...81.2.69.144[192.168.1.201]" + } + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "site-to-site-vpn", + "category": [ + "network" + ], + "original": "\u003c134\u003e1 1647478092.029594666 MX_device_1 events Site-to-Site VPN: \u003cl2tp-over-ipsec-1|241\u003e IKE_SA l2tp-over-ipsec-1[241] established between 89.160.20.112[89.160.20.112]...81.2.69.144[192.168.1.201]", + "type": [ + "info", + "access" + ] + }, + "log": { + "syslog": { + "priority": 134 + } + }, + "observer": { + "hostname": "MX_device_1" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:50:22.583Z", + "cisco_meraki": { + "event_subtype": "vpn_connectivity_change", + "event_type": "events", + "site_to_site_vpn": { + "connectivity_change": { + "connectivity": "false", + "peer_contact": "216.160.83.61:51856", + "peer_ident": "2814ee002c075181bb1b7478ee073860", + "type": "vpn_connectivity_change", + "vpn_type": "site-to-site" + } + } + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "vpn-connectivity-change", + "category": [ + "network", + "session" + ], + "original": "\u003c134\u003e1 1647478222.583851938 MX84 events type=vpn_connectivity_change vpn_type='site-to-site' peer_contact='216.160.83.61:51856' peer_ident='2814ee002c075181bb1b7478ee073860' connectivity='false'", + "type": [ + "info", + "connection" + ] + }, + "log": { + "syslog": { + "priority": 134 + } + }, + "observer": { + "hostname": "MX84" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T01:10:20.148Z", + "cisco_meraki": { + "event_subtype": "dhcp_offer", + "event_type": "events" + }, + "client": { + "ip": "10.0.2.213", + "mac": "E0-CB-BC-02-4F-80" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "dhcp-offer", + "category": [ + "network" + ], + "original": "\u003c134\u003e1 1647479420.148681168 MX84 events dhcp lease of ip 10.0.2.213 from mx mac 68:3A:1E:42:60:59 for client mac E0:CB:BC:02:4F:80 from router 10.0.0.1 on subnet 255.255.252.0 with dns 10.0.0.1", + "type": [ + "info", + "access", + "allowed" + ] + }, + "network": { + "protocol": "dhcp" + }, + "observer": { + "hostname": "MX84" + }, + "server": { + "mac": "68-3A-1E-42-60-59" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T01:19:21.535Z", + "cisco_meraki": { + "event_subtype": "dhcp_no_offer", + "event_type": "events" + }, + "client": { + "mac": "A4-83-E7-02-A2-F1" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "dhcp-no-offer", + "category": [ + "network" + ], + "original": "\u003c134\u003e1 1647479961.535491111 MX84 events dhcp no offers for mac A4:83:E7:02:A2:F1 host = 192.168.10.1", + "type": [ + "info", + "access", + "denied" + ] + }, + "network": { + "protocol": "dhcp" + }, + "observer": { + "hostname": "MX84" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T00:48:12.669Z", + "cisco_meraki": { + "event_subtype": "client_vpn_connect", + "event_type": "events" + }, + "client": { + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": "81.2.69.193" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "site-to-site-vpn", + "category": [ + "network", + "session" + ], + "original": "\u003c134\u003e1 1647478092.669153546 MX_device_4 events client_vpn_connect user id 'jwick@wwvpn.net' local ip 172.16.0.145 connected from 81.2.69.193", + "type": [ + "info", + "access", + "allowed", + "start" + ] + }, + "network": { + "forwarded_ip": "172.16.0.145" + }, + "observer": { + "hostname": "MX_device_4" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ], + "user": { + "name": "jwick@wwvpn.net" + } + }, + { + "@timestamp": "2021-12-10T10:40:50.430Z", + "cisco_meraki": { + "disassociation": { + "aid": "977866432", + "arp_resp": "0.013562625", + "arp_src": "10.197.39.50", + "auth_neg_dur": "0.005054229", + "channel": "100", + "client_mac": "B0:A4:60:9B:3B:A6", + "dhcp_lease_completed": "0.009196083", + "dhcp_resp": "0.009196083", + "dhcp_server": "10.128.128.128", + "dhcp_server_mac": "E0:CB:BC:31:23:60", + "dns_req_rtt": "0.023370084", + "dns_resp": "0.263616104", + "dns_server": "10.128.128.128", + "duration": "223.031691642", + "full_conn": "0.384002374", + "http_resp": "0.647356228", + "instigator": "2", + "ip_resp": "0.384002374", + "ip_src": "10.197.39.50", + "is_wpa": "1", + "last_auth_ago": "223.020414600", + "radio": "1", + "reason": "1", + "type": "disassociation", + "vap": "1" + }, + "event_subtype": "disassociation", + "event_type": "events" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "wifi-disassociation-request", + "category": [ + "network", + "session" + ], + "original": "\u003c134\u003e1 1639132850.430422377 AP1 events type=disassociation radio='1' vap='1' client_mac='B0:A4:60:9B:3B:A6' channel='100' reason='1' instigator='2' duration='223.031691642' auth_neg_dur='0.005054229' last_auth_ago='223.020414600' is_wpa='1' full_conn='0.384002374' ip_resp='0.384002374' ip_src='10.197.39.50' http_resp='0.647356228' arp_resp='0.013562625' arp_src='10.197.39.50' dns_server='10.128.128.128' dns_req_rtt='0.023370084' dns_resp='0.263616104' dhcp_lease_completed='0.009196083' dhcp_server='10.128.128.128' dhcp_server_mac='E0:CB:BC:31:23:60' dhcp_resp='0.009196083' aid='977866432'", + "type": [ + "info", + "access", + "end" + ] + }, + "log": { + "syslog": { + "priority": 134 + } + }, + "observer": { + "hostname": "AP1" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2021-12-10T10:40:51.416Z", + "cisco_meraki": { + "aps_association_reject": { + "best_ap": "192.168.128.38", + "best_ap_load": "0", + "best_ap_rssi": "37", + "load": "3", + "type": "aps_association_reject" + }, + "event_subtype": "aps_association_reject", + "event_type": "events" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "association-rejected-for-load-balancing", + "category": [ + "network" + ], + "original": "\u003c134\u003e1 1639132851.416656563 AP1 events type=aps_association_reject load='3' best_ap='192.168.128.38' best_ap_load='0' best_ap_rssi='37'", + "type": [ + "info" + ] + }, + "log": { + "syslog": { + "priority": 134 + } + }, + "observer": { + "hostname": "AP1" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2021-12-10T10:40:51.608Z", + "cisco_meraki": { + "association": { + "aid": "125455944", + "channel": "100", + "client_mac": "B0:A4:60:9B:3B:A6", + "last_known_client_ip": "0.0.0.0", + "radio": "1", + "rssi": "40", + "type": "association", + "vap": "0" + }, + "event_subtype": "association", + "event_type": "events" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "wifi-association-request", + "category": [ + "network" + ], + "original": "\u003c134\u003e1 1639132851.608053271 AP1 events type=association radio='1' vap='0' client_mac='B0:A4:60:9B:3B:A6' last_known_client_ip='0.0.0.0' channel='100' rssi='40' aid='125455944'", + "type": [ + "info", + "access", + "connection" + ] + }, + "log": { + "syslog": { + "priority": 134 + } + }, + "observer": { + "hostname": "AP1" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2021-12-10T10:40:51.615Z", + "cisco_meraki": { + "event_subtype": "wpa_auth", + "event_type": "events", + "wpa_auth": { + "aid": "125455944", + "client_mac": "B0:A4:60:9B:3B:A6", + "last_known_client_ip": "0.0.0.0", + "radio": "1", + "type": "wpa_auth", + "vap": "0" + } + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "wifi-wpa-authentication", + "category": [ + "network", + "authentication" + ], + "original": "\u003c134\u003e1 1639132851.615363021 AP1 events type=wpa_auth radio='1' vap='0' client_mac='B0:A4:60:9B:3B:A6' last_known_client_ip='0.0.0.0' aid='125455944'", + "type": [ + "info", + "start", + "access" + ] + }, + "log": { + "syslog": { + "priority": 134 + } + }, + "observer": { + "hostname": "AP1" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2021-12-10T10:40:52.193Z", + "cisco_meraki": { + "event_subtype": "multiple_dhcp_servers_detected", + "event_type": "events", + "multiple_dhcp_servers_detected": { + "server_ip": "192.168.130.3", + "server_mac": "E8:B6:C2:57:C7:85", + "type": "multiple_dhcp_servers_detected", + "vap": "0" + } + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "category": [ + "network" + ], + "original": "\u003c134\u003e1 1639132852.193892187 AP1 events type=multiple_dhcp_servers_detected vap='0' original_server_ip='192.168.130.2' original_server_mac='C8:E7:F0:C4:B0:B1' server_ip='192.168.130.3' server_mac='E8:B6:C2:57:C7:85'", + "type": [ + "info", + "protocol" + ] + }, + "log": { + "syslog": { + "priority": 134 + } + }, + "network": { + "protocol": "dhcp" + }, + "observer": { + "hostname": "AP1" + }, + "related": { + "ip": [ + "192.168.130.2", + "192.168.130.3" + ] + }, + "server": { + "ip": "192.168.130.2", + "mac": "C8-E7-F0-C4-B0-B1" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2021-12-10T10:40:52.718Z", + "cisco_meraki": { + "event_subtype": "multiple_dhcp_servers_detected", + "event_type": "events", + "multiple_dhcp_servers_detected": { + "server_ip": "192.168.130.2", + "server_mac": "C8:E7:F0:C4:B0:B1", + "type": "multiple_dhcp_servers_detected", + "vap": "0" + } + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "category": [ + "network" + ], + "original": "\u003c134\u003e1 1639132852.718221083 AP1 events type=multiple_dhcp_servers_detected vap='0' original_server_ip='192.168.130.3' original_server_mac='E8:B6:C2:57:C7:85' server_ip='192.168.130.2' server_mac='C8:E7:F0:C4:B0:B1'", + "type": [ + "info", + "protocol" + ] + }, + "log": { + "syslog": { + "priority": 134 + } + }, + "network": { + "protocol": "dhcp" + }, + "observer": { + "hostname": "AP1" + }, + "related": { + "ip": [ + "192.168.130.3", + "192.168.130.2" + ] + }, + "server": { + "ip": "192.168.130.3", + "mac": "E8-B6-C2-57-C7-85" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2021-12-10T10:41:00.489Z", + "cisco_meraki": { + "association": { + "aid": "1187092323", + "channel": "104", + "client_mac": "54:8D:5A:EA:30:E9", + "last_known_client_ip": "0.0.0.0", + "radio": "1", + "rssi": "29", + "type": "association", + "vap": "3" + }, + "event_subtype": "association", + "event_type": "events" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "wifi-association-request", + "category": [ + "network" + ], + "original": "\u003c134\u003e1 1639132860.489500682 1_2_AP_1 events type=association radio='1' vap='3' client_mac='54:8D:5A:EA:30:E9' last_known_client_ip='0.0.0.0' channel='104' rssi='29' aid='1187092323'", + "type": [ + "info", + "access", + "connection" + ] + }, + "log": { + "syslog": { + "priority": 134 + } + }, + "observer": { + "hostname": "1_2_AP_1" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2021-12-10T10:41:01.230Z", + "cisco_meraki": { + "8021x_eap_success": { + "aid": "1187092323", + "client_ip": "0.0.0.0", + "client_mac": "54:8D:5A:EA:30:E9", + "identity": "anonymous@gousto.co.uk", + "radio": "1", + "type": "8021x_eap_success", + "vap": "3" + }, + "event_subtype": "8021x_eap_success", + "event_type": "events" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "wifi-8021x-auth", + "category": [ + "network", + "authentication" + ], + "original": "\u003c134\u003e1 1639132861.230797660 1_2_AP_1 events type=8021x_eap_success radio='1' vap='3' client_mac='54:8D:5A:EA:30:E9' client_ip='0.0.0.0' identity='anonymous@gousto.co.uk' aid='1187092323'", + "type": [ + "info", + "start" + ] + }, + "log": { + "syslog": { + "priority": 134 + } + }, + "observer": { + "hostname": "1_2_AP_1" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2021-12-10T10:41:01.280Z", + "cisco_meraki": { + "8021x_auth": { + "aid": "1187092323", + "client_mac": "54:8D:5A:EA:30:E9", + "identity": "anonymous@gousto.co.uk", + "last_known_client_ip": "0.0.0.0", + "radio": "1", + "type": "8021x_auth", + "vap": "3" + }, + "event_subtype": "8021x_auth", + "event_type": "events" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "8021x_auth", + "category": [ + "network" + ], + "original": "\u003c134\u003e1 1639132861.280798139 1_2_AP_1 events type=8021x_auth radio='1' vap='3' client_mac='54:8D:5A:EA:30:E9' last_known_client_ip='0.0.0.0' identity='anonymous@gousto.co.uk' aid='1187092323'", + "type": [ + "info" + ] + }, + "log": { + "syslog": { + "priority": 134 + } + }, + "observer": { + "hostname": "1_2_AP_1" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2021-12-10T10:41:15.360Z", + "cisco_meraki": { + "disassociation": { + "aid": "1750957891", + "apple_da_reason": "7", + "arp_resp": "0.179876562", + "arp_src": "10.68.128.113", + "auth_neg_dur": "0.024206187", + "channel": "132", + "client_mac": "36:E7:E9:AE:04:3D", + "dhcp_lease_completed": "0.182086020", + "dhcp_resp": "0.182086020", + "dhcp_server": "10.128.128.128", + "dhcp_server_mac": "E0:CB:BC:49:F7:26", + "dns_req_rtt": "0.095675854", + "dns_resp": "0.416596437", + "dns_server": "10.128.128.128", + "duration": "40.260521941", + "full_conn": "0.477861916", + "http_resp": "0.477861916", + "instigator": "2", + "ip_resp": "1.005954707", + "ip_src": "10.68.128.113", + "is_wpa": "1", + "last_auth_ago": "40.229666962", + "radio": "1", + "reason": "8", + "type": "disassociation", + "vap": "1" + }, + "event_subtype": "disassociation", + "event_type": "events" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "wifi-disassociation-request", + "category": [ + "network", + "session" + ], + "original": "\u003c134\u003e1 1639132875.360638431 1_2_AP_4 events type=disassociation radio='1' vap='1' client_mac='36:E7:E9:AE:04:3D' channel='132' reason='8' apple_da_reason='7' instigator='2' duration='40.260521941' auth_neg_dur='0.024206187' last_auth_ago='40.229666962' is_wpa='1' full_conn='0.477861916' ip_resp='1.005954707' ip_src='10.68.128.113' http_resp='0.477861916' arp_resp='0.179876562' arp_src='10.68.128.113' dns_server='10.128.128.128' dns_req_rtt='0.095675854' dns_resp='0.416596437' dhcp_lease_completed='0.182086020' dhcp_server='10.128.128.128' dhcp_server_mac='E0:CB:BC:49:F7:26' dhcp_resp='0.182086020' aid='1750957891'", + "type": [ + "info", + "access", + "end" + ] + }, + "log": { + "syslog": { + "priority": 134 + } + }, + "observer": { + "hostname": "1_2_AP_4" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2021-12-10T10:41:43.129Z", + "cisco_meraki": { + "disassociation": { + "aid": "1899362895", + "apple_da_reason": "7", + "arp_resp": "0.132684875", + "arp_src": "10.72.66.49", + "auth_neg_dur": "0.008153688", + "channel": "36", + "client_mac": "8E:2F:69:33:FA:6A", + "dhcp_lease_completed": "0.133589958", + "dhcp_resp": "0.133589958", + "dhcp_server": "10.128.128.128", + "dhcp_server_mac": "F8:9E:28:70:1A:7C", + "dns_req_rtt": "0.121687", + "dns_resp": "0.335365542", + "dns_server": "10.128.128.128", + "duration": "27.641499140", + "full_conn": "0.395120958", + "http_resp": "0.395120958", + "instigator": "2", + "ip_resp": "0.520431812", + "ip_src": "10.72.66.49", + "is_wpa": "1", + "last_auth_ago": "27.627178619", + "radio": "1", + "reason": "8", + "type": "disassociation", + "vap": "1" + }, + "event_subtype": "disassociation", + "event_type": "events" + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "wifi-disassociation-request", + "category": [ + "network", + "session" + ], + "original": "\u003c134\u003e1 1639132903.129587239 LG2_AP_01 events type=disassociation radio='1' vap='1' client_mac='8E:2F:69:33:FA:6A' channel='36' reason='8' apple_da_reason='7' instigator='2' duration='27.641499140' auth_neg_dur='0.008153688' last_auth_ago='27.627178619' is_wpa='1' full_conn='0.395120958' ip_resp='0.520431812' ip_src='10.72.66.49' http_resp='0.395120958' arp_resp='0.132684875' arp_src='10.72.66.49' dns_server='10.128.128.128' dns_req_rtt='0.121687' dns_resp='0.335365542' dhcp_lease_completed='0.133589958' dhcp_server='10.128.128.128' dhcp_server_mac='F8:9E:28:70:1A:7C' dhcp_resp='0.133589958' aid='1899362895'", + "type": [ + "info", + "access", + "end" + ] + }, + "log": { + "syslog": { + "priority": 134 + } + }, + "observer": { + "hostname": "LG2_AP_01" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2021-12-10T10:41:57.085Z", + "cisco_meraki": { + "event_subtype": "wpa_auth", + "event_type": "events", + "wpa_auth": { + "aid": "1546367691", + "client_mac": "8E:2F:69:33:FA:6A", + "radio": "1", + "type": "wpa_auth", + "vap": "1" + } + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "wifi-wpa-authentication", + "category": [ + "network", + "authentication" + ], + "original": "\u003c134\u003e1 1639132917.085087788 LG2_AP_01 events type=wpa_auth radio='1' vap='1' client_mac='8E:2F:69:33:FA:6A' aid='1546367691'", + "type": [ + "info", + "start", + "access" + ] + }, + "log": { + "syslog": { + "priority": 134 + } + }, + "observer": { + "hostname": "LG2_AP_01" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + } + ] +} \ No newline at end of file diff --git a/packages/cisco_meraki/data_stream/log/_dev/test/pipeline/test-flows.log b/packages/cisco_meraki/data_stream/log/_dev/test/pipeline/test-flows.log new file mode 100644 index 000000000000..2dd020a31c7e --- /dev/null +++ b/packages/cisco_meraki/data_stream/log/_dev/test/pipeline/test-flows.log @@ -0,0 +1,3 @@ +<134>1 1647478988.289402144 MX84_4 flows allow src=10.0.2.170 dst=10.0.0.34 mac=00:7C:2D:BD:76:F2 protocol=udp sport=54841 dport=15600 +<134>1 1647478988.476061795 MX84 flows src=216.160.83.57 dst=216.160.83.61 protocol=tcp sport=54445 dport=44210 pattern: 1 all +<134>1 1647478988.596151424 MX84_7 flows allow src=10.0.0.34 dst=10.0.0.234 mac=64:1C:B0:BA:F0:EC protocol=tcp sport=49761 dport=15500 diff --git a/packages/cisco_meraki/data_stream/log/_dev/test/pipeline/test-flows.log-expected.json b/packages/cisco_meraki/data_stream/log/_dev/test/pipeline/test-flows.log-expected.json new file mode 100644 index 000000000000..2e5498a7fff8 --- /dev/null +++ b/packages/cisco_meraki/data_stream/log/_dev/test/pipeline/test-flows.log-expected.json @@ -0,0 +1,162 @@ +{ + "expected": [ + { + "@timestamp": "2022-03-17T01:03:08.289Z", + "cisco_meraki": { + "event_subtype": "flow_allowed", + "event_type": "flows", + "flows": { + "op": "allow" + } + }, + "destination": { + "ip": "10.0.0.34", + "port": 15600 + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "layer3-firewall-allowed-flow", + "category": [ + "network" + ], + "original": "\u003c134\u003e1 1647478988.289402144 MX84_4 flows allow src=10.0.2.170 dst=10.0.0.34 mac=00:7C:2D:BD:76:F2 protocol=udp sport=54841 dport=15600", + "type": [ + "info", + "connection", + "start" + ] + }, + "network": { + "protocol": "udp" + }, + "observer": { + "hostname": "MX84_4" + }, + "source": { + "ip": "10.0.2.170", + "mac": "00-7C-2D-BD-76-F2", + "port": 54841 + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T01:03:08.476Z", + "cisco_meraki": { + "event_subtype": "ip_session_initiated", + "event_type": "flows" + }, + "destination": { + "as": { + "number": 209 + }, + "geo": { + "city_name": "Milton", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 47.2513, + "lon": -122.3149 + }, + "region_iso_code": "US-WA", + "region_name": "Washington" + }, + "ip": "216.160.83.61", + "port": 44210 + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "ip-session-initiated", + "category": [ + "network" + ], + "original": "\u003c134\u003e1 1647478988.476061795 MX84 flows src=216.160.83.57 dst=216.160.83.61 protocol=tcp sport=54445 dport=44210 pattern: 1 all", + "type": [ + "info", + "access", + "start" + ] + }, + "network": { + "protocol": "tcp" + }, + "observer": { + "hostname": "MX84" + }, + "source": { + "as": { + "number": 209 + }, + "geo": { + "city_name": "Milton", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 47.2513, + "lon": -122.3149 + }, + "region_iso_code": "US-WA", + "region_name": "Washington" + }, + "ip": "216.160.83.57", + "port": 54445 + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T01:03:08.596Z", + "cisco_meraki": { + "event_subtype": "flow_allowed", + "event_type": "flows", + "flows": { + "op": "allow" + } + }, + "destination": { + "ip": "10.0.0.234", + "port": 15500 + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "layer3-firewall-allowed-flow", + "category": [ + "network" + ], + "original": "\u003c134\u003e1 1647478988.596151424 MX84_7 flows allow src=10.0.0.34 dst=10.0.0.234 mac=64:1C:B0:BA:F0:EC protocol=tcp sport=49761 dport=15500", + "type": [ + "info", + "connection", + "start" + ] + }, + "network": { + "protocol": "tcp" + }, + "observer": { + "hostname": "MX84_7" + }, + "source": { + "ip": "10.0.0.34", + "mac": "64-1C-B0-BA-F0-EC", + "port": 49761 + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + } + ] +} \ No newline at end of file diff --git a/packages/cisco_meraki/data_stream/log/_dev/test/pipeline/test-generated.log b/packages/cisco_meraki/data_stream/log/_dev/test/pipeline/test-generated.log deleted file mode 100644 index 05501480e401..000000000000 --- a/packages/cisco_meraki/data_stream/log/_dev/test/pipeline/test-generated.log +++ /dev/null @@ -1,100 +0,0 @@ -modtempo 1454047799.olab nto_ security_event olaborissecurity_event tur url=https://example.org/odoco/ria.jpg?ritin=uredolor#tatemac src=10.15.44.253:5078 dst=10.193.124.51:5293 mac=01:00:5e:28:ae:7d name=psa sha256=umq disposition=ntium action=deny -umdo 1455282753.itessequ vol_ events dhcp lease of ip 10.102.218.31 from server mac 01:00:5e:9c:c2:9c for client mac 01:00:5e:0f:87:e3 from router 10.15.16.212 on subnet ameaqu with dns aqu -uipexea 1456517708.tatio minim_ flows ceroinBC flows src=10.179.60.216 dst=10.69.53.104 protocol=udp pattern: 0 reprehe -mipsu 1457752662.consec taliquip_ flows radip flows block src=10.155.236.240 dst=10.112.46.169 mac=01:00:5e:7a:74:89 protocol=ipv6 type=roidents -obeataev 1458987616.lor uidexea_appliance events MAC 01:00:5e:e1:89:ac and MAC 01:00:5e:a3:d9:ac both claim IP: 10.14.107.140 -iutal 1460222571.dexe urerep events content_filtering_block url='https://api.example.org/liqu/lorem.gif?ueipsaqu=uidolore#niamqu' category0='ari' server='10.108.180.105:5098' client_mac='01:00:5e:40:9b:83' -ipit 1461457525.idexea riat_appliance events MAC 01:00:5e:25:4f:e4 and MAC 01:00:5e:3f:49:e4 both claim IP: 10.149.88.198 -ntsuntin 1462692479.aecatcup animi events dhcp release for mac 01:00:5e:e3:10:34 -orsitame 1463927433.quiratio ite events MAC 01:00:5e:48:62:22 and MAC 01:00:5e:9f:b6:a6 both claim IP: 10.243.206.225 -olupta turveli.toccae tatno_ ids-alerts taliqu ids-alerts signature=temUten priority=ccusan timestamp=1465162388.iqudirection=outbound protocol=icmp src=10.131.82.116:7307 -uaera 1466397342.sitas ehenderi_ security_event atquovosecurity_event iumto url=https://www5.example.net/sun/essecill.html?saute=vel#quu src=10.210.213.18:7616 dst=10.134.0.141:2703 mac=01:00:5e:aa:42:fa name=idolores sha256=llumquid disposition=tation action=accept -omn ipsumq.atcu oremagna_ security_event remipsum security_event liq signature=ist priority=tnon timestamp=1467632296.ionul shost=01:00:5e:c8:9c:2f direction=outbound protocol=udp src=10.163.72.17 dst=10.74.237.180 message:nsequu -omm 1468867250.idestla Nemoeni_appliance events MAC 01:00:5e:c4:69:7f and MAC 01:00:5e:e2:67:d2 both claim IP: 10.72.31.26 -agna tionemu.eomnisis mqui ids-alerts signature=civeli priority=errorsi timestamp=1470102205.desdirection=internal protocol=tcp src=10.70.95.74:4290 -olupt 1471337159.dit sumquiad events MAC 01:00:5e:ea:e8:7a and MAC 01:00:5e:9c:d2:4a both claim IP: 10.17.21.125 -amqu 1472572113.uines nsec events dhcp lease of ip 10.85.10.165 from server mac 01:00:5e:63:93:48 for client mac 01:00:5e:46:17:35 from router 10.53.150.119 on subnet uiineavo with dns tisetq -giatquov eritquii.dexeac iscinge ids-alerts signature=atvol priority=umiur timestamp=1473807067.imadprotocol=igmp src=10.88.231.224 dst=10.187.77.245message: iadese -agnaali 1475042022.gnam tat events content_filtering_block url='https://internal.example.com/quae/maccusa.htm?rQuisau=idex#xerci' category0='aqu' server='10.186.58.115:7238' client_mac='01:00:5e:8f:16:6d' -apariat 1476276976.tlabore untmolli_ events dhcp lease of ip 10.219.84.37 from server mac 01:00:5e:e8:bf:69 for client mac 01:00:5e:87:e1:a0 from router 10.205.47.51 on subnet uovolup with dns samvolu -ento 1477511930.pic evita events MAC 01:00:5e:ce:61:db and MAC 01:00:5e:ec:f8:cc both claim IP: 10.3.134.237 -tmo 1478746884.fficiade uscipit events aid=vitaedi arp_resp=fugitse arp_src=veniamq auth_neg_dur=one auth_neg_failed=etMalor channel=ipi dns_req_rtt=reseos dns_resp=pariatu dns_server=tin duration=48.123000 full_conn=oquisqu identity=sperna ip_resp=eabilloi ip_src=10.182.178.217 is_8021x=tlab is_wpa=volupt last_auth_ago=osqui radio=xerc reason=iutali rssi=fdeFi type=texp vap=tasuntex client_mac=01:00:5e:e3:b1:24 client_ip=10.194.114.58 instigator=ectio http_resp=dutper dhcp_lease_completed=lamcolab dhcp_ip=ati dhcp_server=tlabo dhcp_server_mac=uames dhcp_resp=iduntu url=https://internal.example.net/ris/uamqu.txt?liqui=quioffi#uptate category0=ncidid server=10.63.194.87 vpn_type=quisno connectivity=sin -emvel 1479981839.tmollita fde events aid=nsecte arp_resp=inculpa arp_src=abo auth_neg_dur=veniamqu auth_neg_failed=nse channel=non dns_req_rtt=paquioff dns_resp=mquisnos dns_server=maven duration=71.798000 full_conn=atcu identity=labor ip_resp=didunt ip_src=10.153.0.77 is_8021x=udan is_wpa=orema last_auth_ago=invento radio=qua reason=aturQui rssi=utlabor type=rau vap=idex client_mac=01:00:5e:9e:7b:a4 client_ip=10.105.88.20 instigator=ecte http_resp=tinvolu dhcp_lease_completed=iurer dhcp_ip=iciadese dhcp_server=quidolor dhcp_server_mac=tessec dhcp_resp=olupta url=https://mail.example.com/icabo/itatio.jpg?eleum=sintoc#volupt category0=siste server=10.163.154.210 vpn_type=ept connectivity=iumtotam -ionevo 1481216793.ugiatnu ciati_appliance events MAC 01:00:5e:b8:7a:96 and MAC 01:00:5e:b9:6b:a8 both claim IP: 10.73.69.176 -spi 1482451747.stquido ommodico_ flows ese flows allow src=10.145.248.111 dst=10.57.6.252 mac=01:00:5e:94:6a:cf protocol=udp -smo etcons.iusmodi uamest_ security_event uiac security_event epte signature=idolo priority=quinesc timestamp=1483686701.madmi shost=01:00:5e:1c:4c:64 direction=internal protocol=icmp src=10.31.77.157 dst=10.12.182.70 message:tev -nisiuta 1484921656.roid inibusB flows cancel -str 1486156610.idolore pid_ flows cteturad flows deny src=10.93.68.231 dst=10.135.217.12 mac=01:00:5e:4a:69:5b protocol=ipv6 type=archite -amnih 1487391564.ium esciuntN_ events dhcp release for mac 01:00:5e:8b:99:98 -isnost 1488626519.queips ncidi_ flows iscinge flows src=10.247.30.212 dst=10.66.89.5 mac=01:00:5e:7f:65:da protocol=igmp pattern: 1 borios -oin 1489861473.mvenia madminim events IDS: fugitsed -dmin fugi.quia iduntu security_event idestlab signature=rnatur priority=ofdeFin timestamp=1491096427.essequam dhost=01:00:5e:c1:53:b1 direction=inbound protocol=tcp src=10.221.102.245 dst=10.173.136.186 message:naal -umqu tinv.adipisc uscipitl_ ids-alerts ritatise ids-alerts signature=uamei priority=siut timestamp=1492331381.ciad dhost=01:00:5e:1f:c6:29 direction=external protocol=udp src=10.58.64.108 dst=10.54.37.86 message: entorev -velitess 1493566336.naali uunturm_ flows veli flows block src=10.147.76.202 dst=10.163.93.20 mac=01:00:5e:1d:85:ec protocol=ipv6 sport=1085 dport=3141 -iumdol tpersp.stla uptatema_ security_event uradi security_event tot signature=llamco priority=nea timestamp=1494801290.psum dhost=01:00:5e:35:71:1e direction=internal protocol=icmp src=10.0.200.27:5905 dst=10.183.44.198:1702 message:asiarc -tiaec 1496036244.rumwrit icabo_ events dhcp lease of ip 10.148.124.84 from server mac 01:00:5e:0b:2c:22 for client mac 01:00:5e:06:12:98 from router 10.28.144.180 on subnet ritin with dns temporin -ica 1497271198.lillum remips_appliance events aid=uisaute arp_resp=imide arp_src=poriss auth_neg_dur=tvolup auth_neg_failed=itesseq channel=dictasun dns_req_rtt=veniamqu dns_resp=rum dns_server=quaea duration=165.611000 full_conn=mvel identity=nof ip_resp=usmodi ip_src=10.204.230.166 is_8021x=dat is_wpa=aincidu last_auth_ago=nimadmin radio=isiu reason=licabo rssi=enimadmi type=utaliqu vap=dic client_mac=01:00:5e:bb:60:a6 client_ip=10.62.71.118 instigator=ineavol http_resp=iosa dhcp_lease_completed=boNemoe dhcp_ip=onsequ dhcp_server=equinesc dhcp_server_mac=cab dhcp_resp=atisund url=https://example.net/ites/isetq.gif?nisiut=tur#avolupt category0=ariatur server=10.98.194.212 vpn_type=nimave connectivity=isciv -dipisci 1498506153.spernatu admi events content_filtering_block url='https://www.example.org/ueipsa/tae.html?eriti=atcupi#corpori' category0='borisnis' server='10.197.13.39:5912' -itsedd 1499741107.leumiur eratvol events dhcp release for mac 01:00:5e:fd:84:bb -leumiu tla.item nimid ids-alerts signature=dat priority=periam timestamp=1500976061.dquprotocol=icmp src=10.242.77.170 dst=10.150.245.88message: orisn -sitam rad.loi isc_ ids-alerts volupt ids-alerts signature=rem priority=idid timestamp=1502211015.tesse shost=01:00:5e:9d:eb:fb direction=external protocol=tcp src=10.247.139.239 dst=10.180.195.43 message: tenatuse -tore 1503445970.elits consequa events dhcp release for mac 01:00:5e:50:48:c4 -undeom uamnihi.risnis uov_ ids-alerts isn ids-alerts signature=sBono priority=loremqu timestamp=1504680924.teturprotocol=rdp src=10.94.6.140 dst=10.147.15.213message: uptat -itasper 1505915878.uae mve_ flows obeata flows block src=10.230.6.127 dst=10.111.157.56 mac=01:00:5e:39:a7:fc protocol=icmp type=aliquamq -archite 1507150832.remq veniamq events aid=occ arp_resp=oloreseo arp_src=iruredol auth_neg_dur=veniamqu auth_neg_failed=licaboN channel=atquo dns_req_rtt=cupi dns_resp=strude dns_server=eritin duration=85.513000 full_conn=litsedq identity=nderiti ip_resp=ntNe ip_src=10.179.40.170 is_8021x=olorema is_wpa=mollita last_auth_ago=tatem radio=iae reason=quido rssi=emip type=inBC vap=mol client_mac=01:00:5e:58:2d:1c client_ip=10.153.81.206 instigator=rsita http_resp=nsequun dhcp_lease_completed=eetd dhcp_ip=illu dhcp_server=iatqu dhcp_server_mac=lorsi dhcp_resp=repreh url=https://www.example.net/irured/illumqui.txt?tionula=ritqu#ecatcupi category0=uamei server=10.193.219.34 vpn_type=onse connectivity=olorem -umwritte 1508385787.vol oremquel_appliance events MAC 01:00:5e:16:5e:b1 and MAC 01:00:5e:ee:e8:77 both claim IP: 10.255.199.16 -unte 1509620741.uamnihil llam_appliance events MAC 01:00:5e:ee:1d:77 and MAC 01:00:5e:f1:21:bd both claim IP: 10.94.88.5 -esci 1510855695.uov quaeab_ events IDS: moles -accusa 1512090649.natu liquid events IDS: enim -dquiaco nibus.vitaed ser security_event etconsec signature=elillum priority=upt timestamp=1513325604.rnat dhost=01:00:5e:01:60:e0 direction=internal protocol=ipv6 src=10.90.99.245 dst=10.124.63.4 message:pta -tetura 1514560558.imadmini moe_appliance events content_filtering_block url='https://mail.example.net/uat/lupta.html?uptassit=ncidi#tlabori' category0='laudan' server='10.249.7.146:2010' -lapar 1515795512.ritati edquia_appliance events IDS: itesse -amvolu mip.tion tobeatae_ security_event Utenima security_event iqua signature=luptat priority=deriti timestamp=1517030466.sintocc dhost=01:00:5e:c9:b7:22 direction=inbound protocol=icmp src=10.196.96.162 dst=10.81.234.34 message:equuntur -uide 1518265421.scivel henderi_appliance events IDS: iusmodt -tiumd 1519500375.ntmoll mexer events dhcp lease of ip 10.40.101.224 from server mac 01:00:5e:0a:df:72 for client mac 01:00:5e:7c:01:ab with hostname remips188.api.invalid from router 10.78.199.43 on subnet ehender with dns ilmole -runtmo 1520735329.ore isund_appliance events MAC 01:00:5e:17:87:3e and MAC 01:00:5e:5f:c1:3e both claim IP: 10.244.29.119 -tutlabor 1521970284.reseosq gna_ flows pteurs flows deny src=10.83.131.245 dst=10.39.172.93 mac=01:00:5e:c4:12:c7 protocol=udp type=uido -osquira 1523205238.umd sciveli_ events dhcp lease of ip 10.86.188.179 from server mac 01:00:5e:48:4b:78 for client mac 01:00:5e:7e:cd:15 from router 10.201.168.116 on subnet umiure with dns laborum -umdolors 1524440192.lumdo acom_ security_event umexercisecurity_event duntut url=https://mail.example.com/prehend/eufug.htm?eufug=est#civelits src=10.148.211.222:2053 dst=10.122.204.151:3903 mac=01:00:5e:c3:a0:dc name=ine sha256=urerepre disposition=asnulap action=deny -atnul 1525675146.umfugi stquidol_ flows luptatem flows accept -essequam ueporro.aliqu upt ids-alerts signature=orum priority=Bonoru timestamp=1526910101.madminimprotocol=ipv6-icmp src=10.97.46.16 dst=10.120.4.9message: teni -lorsitam tanimid.onpr litseddo_ ids-alerts oremqu ids-alerts signature=idex priority=radip timestamp=1528145055.uptaprotocol=ipv6-icmp src=10.171.206.139 dst=10.165.173.162message: lestia -inibusB 1529380009.nostrud cteturad events dhcp lease of ip 10.150.163.151 from server mac 01:00:5e:72:b7:79 for client mac 01:00:5e:f2:d3:12 with hostname uames4985.mail.localdomain from router 10.144.57.239 on subnet oinBCSed with dns orem -eritq rehen.ipsamvol elillum_ ids-alerts tco ids-alerts signature=tvol priority=oluptate timestamp=1530614963.lit shost=01:00:5e:ac:6d:d3 direction=unknown protocol=igmp src=10.52.202.158 dst=10.54.44.231 message: Ute -runtm 1531849918.eturadip olorsi_ events MAC 01:00:5e:67:1d:0f and MAC 01:00:5e:f0:a9:cd both claim IP: 10.101.183.86 -inesciu 1533084872.quid atcupid_ flows orem flows src=10.71.22.225 dst=10.4.76.100 protocol=ggp pattern: allow serrorsi -lamco 1534319826.cit siar events MAC 01:00:5e:80:cd:ca and MAC 01:00:5e:45:aa:51 both claim IP: 10.83.130.95 -hite 1535554780.ianonnum nofdeFi events aid=henderit arp_resp=remq arp_src=unt auth_neg_dur=tla auth_neg_failed=arch channel=lite dns_req_rtt=ugia dns_resp=meum dns_server=borumSec duration=91.439000 full_conn=nvolupta identity=tev ip_resp=nre ip_src=10.2.110.73 is_8021x=eturadip is_wpa=ent last_auth_ago=rumSecti radio=Utenima reason=olore rssi=orumS type=olor vap=radip client_mac=01:00:5e:59:bf:36 client_ip=10.230.98.81 instigator=aaliquaU http_resp=olu dhcp_lease_completed=iameaque dhcp_ip=identsun dhcp_server=ender dhcp_server_mac=inc dhcp_resp=tect url=https://www.example.net/doconse/eni.html?mSec=smoditem#tatisetq category0=uidolo server=10.103.49.129 vpn_type=oquisq connectivity=abori -dunt 1536789735.ames amni events aid=tatio arp_resp=amquisno arp_src=modoc auth_neg_dur=magnam auth_neg_failed=uinesc channel=cid dns_req_rtt=emi dns_resp=Bonorum dns_server=lesti duration=59.289000 full_conn=iosamni identity=idu ip_resp=sis ip_src=10.158.61.228 is_8021x=tsedquia is_wpa=its last_auth_ago=umdolor radio=isiu reason=assi rssi=eserun type=rvelill vap=lupta client_mac=01:00:5e:e6:a6:a2 client_ip=10.186.16.20 instigator=tisu http_resp=remagnam dhcp_lease_completed=nvolupt dhcp_ip=meiusm dhcp_server=nidolo dhcp_server_mac=atquovol dhcp_resp=quunt url=https://www.example.com/seq/moll.htm?sunt=dquianon#urExc category0=tDuis server=10.132.176.96 vpn_type=aria connectivity=inim -oremeumf 1538024689.lesti sintocca events dhcp lease of ip 10.105.136.146 from server mac 01:00:5e:bb:aa:f6 for client mac 01:00:5e:69:92:4a with hostname lors2232.api.example from router 10.46.217.155 on subnet amnihil with dns orissus -nimadmin 1539259643.lumqui quiavolu flows src=10.245.199.23 dst=10.123.62.215 mac=01:00:5e:1f:7f:1d protocol=udp pattern: 0 iusmodt -rep 1540494597.remap deri flows cancel src=10.239.105.121 dst=10.70.7.23 mac=01:00:5e:8e:82:f0 protocol=ipv6 -idexeac 1541729552.nimadmin midest_appliance events aid=modt arp_resp=iduntutl arp_src=rsitam auth_neg_dur=xercit auth_neg_failed=ulpaquio channel=itqu dns_req_rtt=minimav dns_resp=smodtem dns_server=roquisqu duration=116.294000 full_conn=iquid identity=evo ip_resp=mcorpori ip_src=10.196.176.243 is_8021x=itesse is_wpa=expl last_auth_ago=essecill radio=totamre reason=rpo rssi=velites type=nonpro vap=nula client_mac=01:00:5e:99:a6:b4 client_ip=10.90.50.149 instigator=nemulla http_resp=asp dhcp_lease_completed=dexercit dhcp_ip=amn dhcp_server=itessequ dhcp_server_mac=porissu dhcp_resp=umd url=https://www.example.net/sectetur/edquian.html?turQuis=taevi#uames category0=tconsec server=10.16.230.121 vpn_type=laboree connectivity=udantiu -ttenb olor.quiav gna security_event Nem signature=tdolorem priority=eacomm timestamp=1542964506.upidata dhost=01:00:5e:6a:c8:f8 direction=unknown protocol=ipv6 src=10.246.152.72:4293 dst=10.34.62.190:1641 message:eve -quisn 1544199460.rem ulamcola events dhcp no offers for mac 01:00:5e:67:fc:cb -eruntmo 1545434414.nimve usanti_ events dhcp release for mac 01:00:5e:7d:de:f7 -uatu 1546669369.olupta consequu_ events dhcp release for mac 01:00:5e:6b:96:f2 -sitam inibusBo.illoin emUtenim ids-alerts signature=ende priority=dexea timestamp=1547904323.acoprotocol=ipv6 src=10.244.32.189 dst=10.121.9.5message: uptas -edol 1549139277.sequuntu quameius_ events content_filtering_block url='https://www.example.com/totamrem/aliqu.htm?sBonorum=moenimi#lor' category0='auto' server='10.41.124.15:333' -antium 1550374232.remaper eseosq events dhcp no offers for mac 01:00:5e:c3:77:27 -oditau 1551609186.onsec dit events MAC 01:00:5e:19:86:21 and MAC 01:00:5e:ed:ed:79 both claim IP: 10.43.235.230 -asper dictasun.psa lorese_ ids-alerts ctobeat ids-alerts signature=onsec priority=idestl timestamp=1552844140.litani shost=01:00:5e:a0:b2:c9 direction=unknown protocol=icmp src=10.199.19.205:5823 dst=10.103.91.159:7116 message: ntut -estiaec 1554079094.pitlabo tas_appliance flows src=10.17.111.91 dst=10.65.0.157 mac=01:00:5e:49:c4:17 protocol=udp pattern: 1 nostrum -ercitati 1555314049.atem serro flows cancel -amquaera 1556549003.rsitamet leumiur events MAC 01:00:5e:fd:79:9e and MAC 01:00:5e:4d:c0:dd both claim IP: 10.20.130.88 -abill ametcon.ofdeFini tasnu_ ids-alerts tionev ids-alerts signature=uasiarch priority=velites timestamp=1557783957.uredolorprotocol=ipv6 src=10.177.64.152 dst=10.140.242.86message: temporin -lor nvolupt.dquia ora_ security_event dipi security_event ecatc signature=quovolu priority=ite timestamp=1559018911.itse shost=01:00:5e:b8:73:c8 direction=external protocol=icmp src=10.199.103.185:2449 dst=10.51.121.223:24 message:stenat -saq 1560253866.asiarch ssuscipi events MAC 01:00:5e:93:48:61 and MAC 01:00:5e:21:c2:55 both claim IP: 10.126.242.58 -tlab 1561488820.vel ionevo events dhcp release for mac 01:00:5e:8a:1a:f9 -aeab 1562723774.uradipis aerat_ flows uira flows deny src=10.121.37.244 dst=10.113.152.241 mac=01:00:5e:9c:86:62 protocol=udp type=utaliqui -nesciu 1563958728.mali roinBCSe_appliance events aid=eetdolor arp_resp=tpersp arp_src=assi auth_neg_dur=rch auth_neg_failed=psa channel=nreprehe dns_req_rtt=pidatatn dns_resp=isno dns_server=luptatev duration=39.622000 full_conn=lla identity=urau ip_resp=aeca ip_src=10.247.118.132 is_8021x=atcupi is_wpa=enima last_auth_ago=uptateve radio=fugitsed reason=lumqui rssi=ectet type=ionu vap=eratv client_mac=01:00:5e:10:8b:c3 client_ip=10.153.33.99 instigator=liq http_resp=xerc dhcp_lease_completed=atisetqu dhcp_ip=squir dhcp_server=gnaaliq dhcp_server_mac=quam dhcp_resp=deriti url=https://www5.example.org/eturadi/umS.txt?mSecti=henderi#taevitae category0=tevel server=10.254.96.130 vpn_type=ita connectivity=iquipexe -tot 1565193683.reme emeumfu events aid=inBCSedu arp_resp=ita arp_src=ade auth_neg_dur=nihilmol auth_neg_failed=nder channel=ano dns_req_rtt=rumexer dns_resp=eab dns_server=iaconseq duration=18.963000 full_conn=eli identity=rissusci ip_resp=ectetur ip_src=10.101.13.122 is_8021x=oconsequ is_wpa=roqui last_auth_ago=oluptate radio=ntut reason=mremaper rssi=uteirur type=ntium vap=ide client_mac=01:00:5e:95:ae:d0 client_ip=10.78.143.52 instigator=ntiumdol http_resp=conse dhcp_lease_completed=aturve dhcp_ip=edqui dhcp_server=tvolu dhcp_server_mac=psu dhcp_resp=strud url=https://internal.example.org/fdeFi/ratv.htm?sequatu=tiumtot#tate category0=udanti server=10.200.98.243 vpn_type=cteturad connectivity=umq -oinvento 1566428637.mporin orissusc_appliance events content_filtering_block url='https://www5.example.net/uov/pariat.htm?litsed=lumd#tiaec' category0='lorem' server='10.247.205.185:7676' client_mac='01:00:5e:6f:21:c8' -metMa emoen.ptate mipsumqu_ ids-alerts ccusa ids-alerts signature=billo priority=doloremi timestamp=1567663591.ectetura dhost=01:00:5e:0a:88:bb direction=inbound protocol=ipv6 src=10.195.90.73:3914 dst=10.147.165.30:7662 message: idents -veniamqu 1568898545.iconsequ ueporr_appliance events IDS: empor -atDuisa mipsa.uas iat ids-alerts signature=hite priority=adipis timestamp=1570133500.abo dhost=01:00:5e:dd:cb:5b direction=inbound protocol=udp src=10.137.166.97 dst=10.162.202.14 message: ipsaqua -deom 1571368454.tiumdo rautod_appliance events content_filtering_block url='https://www5.example.com/illoinve/etcon.htm?nevolup=erspici#itinvolu' category0='adeserun' server='10.227.135.142:6598' -orese 1572603408.umdolore umqui_appliance events MAC 01:00:5e:f1:b8:3a and MAC 01:00:5e:37:9c:af both claim IP: 10.199.29.19 -explicab 1573838362.samvolu teiru_appliance events dhcp no offers for mac 01:00:5e:b8:06:92 -rissusci 1575073317.uaturQ iusmod_ events aid=mips arp_resp=iduntutl arp_src=mipsumd auth_neg_dur=eiusmo auth_neg_failed=quelauda channel=rcit dns_req_rtt=dolo dns_resp=ulamc dns_server=doe duration=10.574000 full_conn=remquela identity=toreve ip_resp=squirat ip_src=10.85.59.172 is_8021x=mto is_wpa=iae last_auth_ago=dent radio=Uten reason=tatiset rssi=sequat type=modoco vap=beataevi client_mac=01:00:5e:92:d8:95 client_ip=10.158.215.216 instigator=deritin http_resp=ptate dhcp_lease_completed=lloi dhcp_ip=nseq dhcp_server=equunt dhcp_server_mac=tutla dhcp_resp=usmod url=https://example.com/qui/itse.gif?orsitame=tasn#exeaco category0=upta server=10.75.122.111 vpn_type=reprehe connectivity=deFinib -orr 1576308271.pre aute events IDS: rchite diff --git a/packages/cisco_meraki/data_stream/log/_dev/test/pipeline/test-ip-flow.log b/packages/cisco_meraki/data_stream/log/_dev/test/pipeline/test-ip-flow.log new file mode 100644 index 000000000000..7b28b1d30718 --- /dev/null +++ b/packages/cisco_meraki/data_stream/log/_dev/test/pipeline/test-ip-flow.log @@ -0,0 +1,8 @@ +<134>1 1647479278.997155282 MX100 ip_flow_start src=10.0.0.234 dst=81.2.69.145 protocol=tcp sport=34294 dport=80 translated_src_ip=1.128.3.4 translated_port=34294 +<134>1 1647479278.995279215 MX100 ip_flow_start src=10.0.0.234 dst=81.2.69.143 protocol=udp sport=45061 dport=53 translated_src_ip=1.128.3.4 translated_port=45061 +<134>1 1647479278.974067126 MX100 ip_flow_start src=10.0.0.234 dst=81.2.69.143 protocol=udp sport=37401 dport=53 translated_src_ip=1.128.3.4 translated_port=37401 +<134>1 1647479278.911594876 MX84 ip_flow_start src=10.0.3.138 dst=89.160.20.156 protocol=tcp sport=61272 dport=443 translated_src_ip=216.160.83.61 translated_port=61272 +<134>1 1647479325.891451682 MX84 ip_flow_end src=10.0.2.249 dst=10.0.0.1 protocol=udp sport=7421 dport=53 translated_dst_ip=89.160.20.112 translated_port=53 +<134>1 1647479325.842384731 MX84 ip_flow_end src=10.0.3.116 dst=67.43.156.14 protocol=udp sport=38422 dport=443 translated_src_ip=216.160.83.61 translated_port=38422 +<134>1 1647479325.842377481 MX84 ip_flow_end src=10.0.2.99 dst=10.0.0.1 protocol=udp sport=29534 dport=53 translated_dst_ip=89.160.20.112 translated_port=53 +<134>1 1647479325.755292025 MX100 ip_flow_end src=10.0.0.234 dst=81.2.69.144 protocol=tcp sport=36498 dport=80 translated_src_ip=1.128.3.4 translated_port=36498 diff --git a/packages/cisco_meraki/data_stream/log/_dev/test/pipeline/test-ip-flow.log-expected.json b/packages/cisco_meraki/data_stream/log/_dev/test/pipeline/test-ip-flow.log-expected.json new file mode 100644 index 000000000000..e60dc6a8d8c1 --- /dev/null +++ b/packages/cisco_meraki/data_stream/log/_dev/test/pipeline/test-ip-flow.log-expected.json @@ -0,0 +1,460 @@ +{ + "expected": [ + { + "@timestamp": "2022-03-17T01:07:58.997Z", + "cisco_meraki": { + "event_type": "ip_flow_start" + }, + "destination": { + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": "81.2.69.145", + "port": 80 + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "category": [ + "network" + ], + "original": "\u003c134\u003e1 1647479278.997155282 MX100 ip_flow_start src=10.0.0.234 dst=81.2.69.145 protocol=tcp sport=34294 dport=80 translated_src_ip=1.128.3.4 translated_port=34294", + "type": [ + "info" + ] + }, + "network": { + "protocol": "tcp" + }, + "observer": { + "hostname": "MX100" + }, + "source": { + "as": { + "number": 1221, + "organization": { + "name": "Telstra Pty Ltd" + } + }, + "ip": "1.128.3.4", + "port": 34294 + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T01:07:58.995Z", + "cisco_meraki": { + "event_type": "ip_flow_start" + }, + "destination": { + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": "81.2.69.143", + "port": 53 + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "category": [ + "network" + ], + "original": "\u003c134\u003e1 1647479278.995279215 MX100 ip_flow_start src=10.0.0.234 dst=81.2.69.143 protocol=udp sport=45061 dport=53 translated_src_ip=1.128.3.4 translated_port=45061", + "type": [ + "info" + ] + }, + "network": { + "protocol": "udp" + }, + "observer": { + "hostname": "MX100" + }, + "source": { + "as": { + "number": 1221, + "organization": { + "name": "Telstra Pty Ltd" + } + }, + "ip": "1.128.3.4", + "port": 45061 + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T01:07:58.974Z", + "cisco_meraki": { + "event_type": "ip_flow_start" + }, + "destination": { + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": "81.2.69.143", + "port": 53 + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "category": [ + "network" + ], + "original": "\u003c134\u003e1 1647479278.974067126 MX100 ip_flow_start src=10.0.0.234 dst=81.2.69.143 protocol=udp sport=37401 dport=53 translated_src_ip=1.128.3.4 translated_port=37401", + "type": [ + "info" + ] + }, + "network": { + "protocol": "udp" + }, + "observer": { + "hostname": "MX100" + }, + "source": { + "as": { + "number": 1221, + "organization": { + "name": "Telstra Pty Ltd" + } + }, + "ip": "1.128.3.4", + "port": 37401 + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T01:07:58.911Z", + "cisco_meraki": { + "event_type": "ip_flow_start" + }, + "destination": { + "as": { + "number": 29518, + "organization": { + "name": "Bredband2 AB" + } + }, + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": "89.160.20.156", + "port": 443 + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "category": [ + "network" + ], + "original": "\u003c134\u003e1 1647479278.911594876 MX84 ip_flow_start src=10.0.3.138 dst=89.160.20.156 protocol=tcp sport=61272 dport=443 translated_src_ip=216.160.83.61 translated_port=61272", + "type": [ + "info" + ] + }, + "network": { + "protocol": "tcp" + }, + "observer": { + "hostname": "MX84" + }, + "source": { + "as": { + "number": 209 + }, + "geo": { + "city_name": "Milton", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 47.2513, + "lon": -122.3149 + }, + "region_iso_code": "US-WA", + "region_name": "Washington" + }, + "ip": "216.160.83.61", + "port": 61272 + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T01:08:45.891Z", + "cisco_meraki": { + "event_type": "ip_flow_end" + }, + "destination": { + "as": { + "number": 29518, + "organization": { + "name": "Bredband2 AB" + } + }, + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": "89.160.20.112", + "port": 53 + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "category": [ + "network" + ], + "original": "\u003c134\u003e1 1647479325.891451682 MX84 ip_flow_end src=10.0.2.249 dst=10.0.0.1 protocol=udp sport=7421 dport=53 translated_dst_ip=89.160.20.112 translated_port=53", + "type": [ + "info" + ] + }, + "network": { + "protocol": "udp" + }, + "observer": { + "hostname": "MX84" + }, + "source": { + "ip": "10.0.2.249", + "port": 7421 + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T01:08:45.842Z", + "cisco_meraki": { + "event_type": "ip_flow_end" + }, + "destination": { + "as": { + "number": 35908 + }, + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": "67.43.156.14", + "port": 443 + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "category": [ + "network" + ], + "original": "\u003c134\u003e1 1647479325.842384731 MX84 ip_flow_end src=10.0.3.116 dst=67.43.156.14 protocol=udp sport=38422 dport=443 translated_src_ip=216.160.83.61 translated_port=38422", + "type": [ + "info" + ] + }, + "network": { + "protocol": "udp" + }, + "observer": { + "hostname": "MX84" + }, + "source": { + "as": { + "number": 209 + }, + "geo": { + "city_name": "Milton", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 47.2513, + "lon": -122.3149 + }, + "region_iso_code": "US-WA", + "region_name": "Washington" + }, + "ip": "216.160.83.61", + "port": 38422 + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T01:08:45.842Z", + "cisco_meraki": { + "event_type": "ip_flow_end" + }, + "destination": { + "as": { + "number": 29518, + "organization": { + "name": "Bredband2 AB" + } + }, + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": "89.160.20.112", + "port": 53 + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "category": [ + "network" + ], + "original": "\u003c134\u003e1 1647479325.842377481 MX84 ip_flow_end src=10.0.2.99 dst=10.0.0.1 protocol=udp sport=29534 dport=53 translated_dst_ip=89.160.20.112 translated_port=53", + "type": [ + "info" + ] + }, + "network": { + "protocol": "udp" + }, + "observer": { + "hostname": "MX84" + }, + "source": { + "ip": "10.0.2.99", + "port": 29534 + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-03-17T01:08:45.755Z", + "cisco_meraki": { + "event_type": "ip_flow_end" + }, + "destination": { + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": "81.2.69.144", + "port": 80 + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "category": [ + "network" + ], + "original": "\u003c134\u003e1 1647479325.755292025 MX100 ip_flow_end src=10.0.0.234 dst=81.2.69.144 protocol=tcp sport=36498 dport=80 translated_src_ip=1.128.3.4 translated_port=36498", + "type": [ + "info" + ] + }, + "network": { + "protocol": "tcp" + }, + "observer": { + "hostname": "MX100" + }, + "source": { + "as": { + "number": 1221, + "organization": { + "name": "Telstra Pty Ltd" + } + }, + "ip": "1.128.3.4", + "port": 36498 + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + } + ] +} \ No newline at end of file diff --git a/packages/cisco_meraki/data_stream/log/_dev/test/pipeline/test-security-events.log b/packages/cisco_meraki/data_stream/log/_dev/test/pipeline/test-security-events.log new file mode 100644 index 000000000000..10ed204c19c3 --- /dev/null +++ b/packages/cisco_meraki/data_stream/log/_dev/test/pipeline/test-security-events.log @@ -0,0 +1,5 @@ +<134>1 1637691198.348361125 MX84 security_event ids_alerted signature=1:29708:4 priority=1 timestamp=1637691198.330873 dhost=D0:AB:D5:7B:43:73 direction=ingress protocol=tcp/ip src=67.43.156.12:80 dst=10.0.3.162:56391 decision=allowed message: BROWSER-IE Microsoft Internet Explorer CSS uninitialized object access attempt detected +<134>1 1637691298.984398273 MX84 security_event security_filtering_file_scanned url=http://www.eicar.org/download/eicar.com.txt src=192.168.128.2:53150 dst=67.43.156.15:80 mac=98:5A:EB:E1:81:2F name='EICAR:EICAR_Test_file_not_a_virus-tpd' sha256=275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f disposition=malicious action=block +<134>1 1637783435.239819833 MX84 security_event security_filtering_disposition_change name=EICAR:EICAR_Test_file_not_a_virus-tpd sha256=275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f disposition=malicious action=allow +<134>1 1637783891.345984502 MX84 ids-alerts signature=129:4:1 priority=3 timestamp=1637783891.512569 direction=ingress protocol=tcp/ip src=67.43.156.15:80 +<134>1 1637790201.246576346 MX84 ids-alerts signature=119:15:1 priority=2 timestamp=1637790201.238064 direction=egress protocol=tcp/ip src=192.168.111.254:56240 diff --git a/packages/cisco_meraki/data_stream/log/_dev/test/pipeline/test-security-events.log-expected.json b/packages/cisco_meraki/data_stream/log/_dev/test/pipeline/test-security-events.log-expected.json new file mode 100644 index 000000000000..a05c6438aa07 --- /dev/null +++ b/packages/cisco_meraki/data_stream/log/_dev/test/pipeline/test-security-events.log-expected.json @@ -0,0 +1,289 @@ +{ + "expected": [ + { + "@timestamp": "2021-11-23T18:13:18.348Z", + "cisco_meraki": { + "event_subtype": "ids_alerted", + "event_type": "security_event", + "security": { + "decision": "allowed", + "dhost": "D0-AB-D5-7B-43-73", + "priority": "1", + "signature": "1:29708:4" + } + }, + "destination": { + "ip": "10.0.3.162", + "port": 56391 + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "ids-signature-matched", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1637691198.348361125 MX84 security_event ids_alerted signature=1:29708:4 priority=1 timestamp=1637691198.330873 dhost=D0:AB:D5:7B:43:73 direction=ingress protocol=tcp/ip src=67.43.156.12:80 dst=10.0.3.162:56391 decision=allowed message: BROWSER-IE Microsoft Internet Explorer CSS uninitialized object access attempt detected", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "direction": "ingress", + "protocol": "tcp/ip" + }, + "observer": { + "hostname": "MX84" + }, + "source": { + "as": { + "number": 35908 + }, + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": "67.43.156.12", + "port": 80 + }, + "tags": [ + "forwarded", + "preserve_original_event" + ], + "threat": { + "indicator": { + "description": " BROWSER-IE Microsoft Internet Explorer CSS uninitialized object access attempt detected", + "last_seen": "2021-11-23T18:13:18.330Z" + } + } + }, + { + "@timestamp": "2021-11-23T18:14:58.984Z", + "cisco_meraki": { + "event_subtype": "security_filtering_file_scanned", + "event_type": "security_event", + "security": { + "action": "block", + "mac": "98-5A-EB-E1-81-2F" + } + }, + "destination": { + "as": { + "number": 35908 + }, + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": "67.43.156.15", + "port": 80 + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "malicious-file-actioned", + "category": [ + "network", + "threat", + "malware" + ], + "original": "\u003c134\u003e1 1637691298.984398273 MX84 security_event security_filtering_file_scanned url=http://www.eicar.org/download/eicar.com.txt src=192.168.128.2:53150 dst=67.43.156.15:80 mac=98:5A:EB:E1:81:2F name='EICAR:EICAR_Test_file_not_a_virus-tpd' sha256=275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f disposition=malicious action=block", + "type": [ + "info", + "indicator", + "info" + ] + }, + "observer": { + "hostname": "MX84" + }, + "source": { + "ip": "192.168.128.2", + "port": 53150 + }, + "tags": [ + "forwarded", + "preserve_original_event" + ], + "threat": { + "indicator": { + "file": { + "hash": { + "sha256": "275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f" + }, + "name": "EICAR:EICAR_Test_file_not_a_virus-tpd" + }, + "reference": "http://www.eicar.org/download/eicar.com.txt" + }, + "software": { + "type": "malicious" + } + } + }, + { + "@timestamp": "2021-11-24T19:50:35.239Z", + "cisco_meraki": { + "event_subtype": "security_filtering_disposition_change", + "event_type": "security_event", + "security": { + "action": "allow" + } + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "issued-retrospective-malicious-disposition", + "category": [ + "network", + "threat", + "malware" + ], + "original": "\u003c134\u003e1 1637783435.239819833 MX84 security_event security_filtering_disposition_change name=EICAR:EICAR_Test_file_not_a_virus-tpd sha256=275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f disposition=malicious action=allow", + "type": [ + "info", + "indicator", + "info" + ] + }, + "observer": { + "hostname": "MX84" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ], + "threat": { + "indicator": { + "file": { + "hash": { + "sha256": "275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f" + }, + "name": "EICAR:EICAR_Test_file_not_a_virus-tpd" + } + }, + "software": { + "type": "malicious" + } + } + }, + { + "@timestamp": "2021-11-24T19:58:11.345Z", + "cisco_meraki": { + "event_subtype": "ids_alerted", + "event_type": "ids-alerts", + "security": { + "priority": "3", + "signature": "129:4:1" + } + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "ids-signature-matched", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1637783891.345984502 MX84 ids-alerts signature=129:4:1 priority=3 timestamp=1637783891.512569 direction=ingress protocol=tcp/ip src=67.43.156.15:80", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "direction": "ingress", + "protocol": "tcp/ip" + }, + "observer": { + "hostname": "MX84" + }, + "source": { + "as": { + "number": 35908 + }, + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": "67.43.156.15", + "port": 80 + }, + "tags": [ + "forwarded", + "preserve_original_event" + ], + "threat": { + "indicator": { + "last_seen": "2021-11-24T19:58:11.512Z" + } + } + }, + { + "@timestamp": "2021-11-24T21:43:21.246Z", + "cisco_meraki": { + "event_subtype": "ids_alerted", + "event_type": "ids-alerts", + "security": { + "priority": "2", + "signature": "119:15:1" + } + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "ids-signature-matched", + "category": [ + "network", + "threat" + ], + "original": "\u003c134\u003e1 1637790201.246576346 MX84 ids-alerts signature=119:15:1 priority=2 timestamp=1637790201.238064 direction=egress protocol=tcp/ip src=192.168.111.254:56240", + "type": [ + "info", + "indicator" + ] + }, + "network": { + "direction": "egress", + "protocol": "tcp/ip" + }, + "observer": { + "hostname": "MX84" + }, + "source": { + "ip": "192.168.111.254", + "port": 56240 + }, + "tags": [ + "forwarded", + "preserve_original_event" + ], + "threat": { + "indicator": { + "last_seen": "2021-11-24T21:43:21.238Z" + } + } + } + ] +} \ No newline at end of file diff --git a/packages/cisco_meraki/data_stream/log/_dev/test/pipeline/test-urls.log b/packages/cisco_meraki/data_stream/log/_dev/test/pipeline/test-urls.log new file mode 100644 index 000000000000..1ac88e104f50 --- /dev/null +++ b/packages/cisco_meraki/data_stream/log/_dev/test/pipeline/test-urls.log @@ -0,0 +1,2 @@ +<134>1 1647479503.348215340 MX84 urls src=10.0.1.29:60336 dst=89.160.20.156:80 mac=78:7B:8A:CC:05:18 request: UNKNOWN https://bitbucket.org/... +<134>1 1647479503.676404537 MX84 urls src=10.0.0.234:56424 dst=89.160.20.112:443 mac=64:1C:AE:68:2A:01 request: GET https://lh3.googleusercontent.com/p/AFVnnY=w2048-h1024 diff --git a/packages/cisco_meraki/data_stream/log/_dev/test/pipeline/test-urls.log-expected.json b/packages/cisco_meraki/data_stream/log/_dev/test/pipeline/test-urls.log-expected.json new file mode 100644 index 000000000000..3b28ec4f96c0 --- /dev/null +++ b/packages/cisco_meraki/data_stream/log/_dev/test/pipeline/test-urls.log-expected.json @@ -0,0 +1,136 @@ +{ + "expected": [ + { + "@timestamp": "2022-03-17T01:11:43.348Z", + "cisco_meraki": { + "event_subtype": "http_access_error", + "event_type": "urls", + "urls": { + "mac": "78-7B-8A-CC-05-18" + } + }, + "destination": { + "as": { + "number": 29518, + "organization": { + "name": "Bredband2 AB" + } + }, + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": "89.160.20.156", + "port": 80 + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "http-access-error", + "category": [ + "network", + "web" + ], + "original": "\u003c134\u003e1 1647479503.348215340 MX84 urls src=10.0.1.29:60336 dst=89.160.20.156:80 mac=78:7B:8A:CC:05:18 request: UNKNOWN https://bitbucket.org/...", + "type": [ + "info", + "error" + ] + }, + "http": { + "request": { + "method": "UNKNOWN" + } + }, + "observer": { + "hostname": "MX84" + }, + "source": { + "ip": "10.0.1.29", + "port": 60336 + }, + "tags": [ + "forwarded", + "preserve_original_event" + ], + "url": { + "original": "https://bitbucket.org/..." + } + }, + { + "@timestamp": "2022-03-17T01:11:43.676Z", + "cisco_meraki": { + "event_subtype": "http_access", + "event_type": "urls", + "urls": { + "mac": "64-1C-AE-68-2A-01" + } + }, + "destination": { + "as": { + "number": 29518, + "organization": { + "name": "Bredband2 AB" + } + }, + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": "89.160.20.112", + "port": 443 + }, + "ecs": { + "version": "8.2.0" + }, + "event": { + "action": "http-access", + "category": [ + "network", + "web" + ], + "original": "\u003c134\u003e1 1647479503.676404537 MX84 urls src=10.0.0.234:56424 dst=89.160.20.112:443 mac=64:1C:AE:68:2A:01 request: GET https://lh3.googleusercontent.com/p/AFVnnY=w2048-h1024", + "type": [ + "info", + "access" + ] + }, + "http": { + "request": { + "method": "GET" + } + }, + "observer": { + "hostname": "MX84" + }, + "source": { + "ip": "10.0.0.234", + "port": 56424 + }, + "tags": [ + "forwarded", + "preserve_original_event" + ], + "url": { + "original": "https://lh3.googleusercontent.com/p/AFVnnY=w2048-h1024" + } + } + ] +} \ No newline at end of file diff --git a/packages/cisco_meraki/data_stream/log/_dev/test/system/test-logfile-config.yml b/packages/cisco_meraki/data_stream/log/_dev/test/system/test-logfile-config.yml index 0d305dcddaf9..075ff2cfb2c7 100644 --- a/packages/cisco_meraki/data_stream/log/_dev/test/system/test-logfile-config.yml +++ b/packages/cisco_meraki/data_stream/log/_dev/test/system/test-logfile-config.yml @@ -1,7 +1,7 @@ -service: cisco-logfile +service: cisco_meraki-log-logfile input: logfile data_stream: vars: paths: - - "{{SERVICE_LOGS_DIR}}/*meraki*.log" + - "{{SERVICE_LOGS_DIR}}/cisco-meraki*.log" preserve_original_event: true diff --git a/packages/cisco_meraki/data_stream/log/_dev/test/system/test-tcp-config.yml b/packages/cisco_meraki/data_stream/log/_dev/test/system/test-tcp-config.yml index bb7635fa915e..1a0939ace909 100644 --- a/packages/cisco_meraki/data_stream/log/_dev/test/system/test-tcp-config.yml +++ b/packages/cisco_meraki/data_stream/log/_dev/test/system/test-tcp-config.yml @@ -1,8 +1,8 @@ -service: cisco-meraki-tcp +service: cisco_meraki-log-tcp service_notify_signal: SIGHUP input: tcp data_stream: vars: - tcp_host: 0.0.0.0 - tcp_port: 9514 + listen_address: 0.0.0.0 + listen_port: 8685 preserve_original_event: true diff --git a/packages/cisco_meraki/data_stream/log/_dev/test/system/test-udp-config.yml b/packages/cisco_meraki/data_stream/log/_dev/test/system/test-udp-config.yml index 74d27a82e695..5699b412d515 100644 --- a/packages/cisco_meraki/data_stream/log/_dev/test/system/test-udp-config.yml +++ b/packages/cisco_meraki/data_stream/log/_dev/test/system/test-udp-config.yml @@ -1,8 +1,8 @@ -service: cisco-meraki-udp +service: cisco_meraki-log-udp service_notify_signal: SIGHUP input: udp data_stream: vars: - udp_host: 0.0.0.0 - udp_port: 9514 + listen_address: 0.0.0.0 + listen_port: 8685 preserve_original_event: true diff --git a/packages/cisco_meraki/data_stream/log/agent/stream/logfile.yml.hbs b/packages/cisco_meraki/data_stream/log/agent/stream/logfile.yml.hbs new file mode 100644 index 000000000000..52b248876b54 --- /dev/null +++ b/packages/cisco_meraki/data_stream/log/agent/stream/logfile.yml.hbs @@ -0,0 +1,27 @@ +paths: +{{#each paths as |path i|}} + - {{path}} +{{/each}} +exclude_files: [".gz$"] + +tags: +{{#if preserve_original_event}} + - preserve_original_event +{{/if}} +{{#each tags as |tag i|}} + - {{tag}} +{{/each}} + +{{#contains "forwarded" tags}} +publisher_pipeline.disable_host: true +{{/contains}} + +fields_under_root: true +fields: + _conf: + tz_offset: '{{tz_offset}}' + +{{#if processors}} +processors: +{{processors}} +{{/if}} diff --git a/packages/cisco_meraki/data_stream/log/agent/stream/stream.yml.hbs b/packages/cisco_meraki/data_stream/log/agent/stream/stream.yml.hbs deleted file mode 100644 index 7789762c763f..000000000000 --- a/packages/cisco_meraki/data_stream/log/agent/stream/stream.yml.hbs +++ /dev/null @@ -1,3256 +0,0 @@ -paths: -{{#each paths as |path i|}} - - {{path}} -{{/each}} -exclude_files: [".gz$"] -tags: -{{#if preserve_original_event}} - - preserve_original_event -{{/if}} -{{#each tags as |tag i|}} - - {{tag}} -{{/each}} -fields_under_root: true -fields: - observer: - vendor: "Cisco" - product: "Meraki" - type: "Wireless" -{{#contains "forwarded" tags}} -publisher_pipeline.disable_host: true -{{/contains}} -processors: -{{#if processors}} -{{processors}} -{{/if}} -- script: - lang: javascript - params: - ecs: true - rsa: {{rsa_fields}} - tz_offset: {{tz_offset}} - keep_raw: {{keep_raw_fields}} - debug: {{debug}} - source: | - // Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one - // or more contributor license agreements. Licensed under the Elastic License; - // you may not use this file except in compliance with the Elastic License. - - /* jshint -W014,-W016,-W097,-W116 */ - - var processor = require("processor"); - var console = require("console"); - - var FLAG_FIELD = "log.flags"; - var FIELDS_OBJECT = "nwparser"; - var FIELDS_PREFIX = FIELDS_OBJECT + "."; - - var defaults = { - debug: false, - ecs: true, - rsa: false, - keep_raw: false, - tz_offset: "local", - strip_priority: true - }; - - var saved_flags = null; - var debug; - var map_ecs; - var map_rsa; - var keep_raw; - var device; - var tz_offset; - var strip_priority; - - // Register params from configuration. - function register(params) { - debug = params.debug !== undefined ? params.debug : defaults.debug; - map_ecs = params.ecs !== undefined ? params.ecs : defaults.ecs; - map_rsa = params.rsa !== undefined ? params.rsa : defaults.rsa; - keep_raw = params.keep_raw !== undefined ? params.keep_raw : defaults.keep_raw; - tz_offset = parse_tz_offset(params.tz_offset !== undefined? params.tz_offset : defaults.tz_offset); - strip_priority = params.strip_priority !== undefined? params.strip_priority : defaults.strip_priority; - device = new DeviceProcessor(); - } - - function parse_tz_offset(offset) { - var date; - var m; - switch(offset) { - // local uses the tz offset from the JS VM. - case "local": - date = new Date(); - // Reversing the sign as we the offset from UTC, not to UTC. - return parse_local_tz_offset(-date.getTimezoneOffset()); - // event uses the tz offset from event.timezone (add_locale processor). - case "event": - return offset; - // Otherwise a tz offset in the form "[+-][0-9]{4}" is required. - default: - m = offset.match(/^([+\-])([0-9]{2}):?([0-9]{2})?$/); - if (m === null || m.length !== 4) { - throw("bad timezone offset: '" + offset + "'. Must have the form +HH:MM"); - } - return m[1] + m[2] + ":" + (m[3]!==undefined? m[3] : "00"); - } - } - - function parse_local_tz_offset(minutes) { - var neg = minutes < 0; - minutes = Math.abs(minutes); - var min = minutes % 60; - var hours = Math.floor(minutes / 60); - var pad2digit = function(n) { - if (n < 10) { return "0" + n;} - return "" + n; - }; - return (neg? "-" : "+") + pad2digit(hours) + ":" + pad2digit(min); - } - - function process(evt) { - // Function register is only called by the processor when `params` are set - // in the processor config. - if (device === undefined) { - register(defaults); - } - return device.process(evt); - } - - function processor_chain(subprocessors) { - var builder = new processor.Chain(); - subprocessors.forEach(builder.Add); - return builder.Build().Run; - } - - function linear_select(subprocessors) { - return function (evt) { - var flags = evt.Get(FLAG_FIELD); - var i; - for (i = 0; i < subprocessors.length; i++) { - evt.Delete(FLAG_FIELD); - if (debug) console.warn("linear_select trying entry " + i); - subprocessors[i](evt); - // Dissect processor succeeded? - if (evt.Get(FLAG_FIELD) == null) break; - if (debug) console.warn("linear_select failed entry " + i); - } - if (flags !== null) { - evt.Put(FLAG_FIELD, flags); - } - if (debug) { - if (i < subprocessors.length) { - console.warn("linear_select matched entry " + i); - } else { - console.warn("linear_select didn't match"); - } - } - }; - } - - function conditional(opt) { - return function(evt) { - if (opt.if(evt)) { - opt.then(evt); - } else if (opt.else) { - opt.else(evt); - } - }; - } - - var strip_syslog_priority = (function() { - var isEnabled = function() { return strip_priority === true; }; - var fetchPRI = field("_pri"); - var fetchPayload = field("payload"); - var removePayload = remove(["payload"]); - var cleanup = remove(["_pri", "payload"]); - var onMatch = function(evt) { - var pri, priStr = fetchPRI(evt); - if (priStr != null - && 0 < priStr.length && priStr.length < 4 - && !isNaN((pri = Number(priStr))) - && 0 <= pri && pri < 192) { - var severity = pri & 7, - facility = pri >> 3; - setc("_severity", "" + severity)(evt); - setc("_facility", "" + facility)(evt); - // Replace message with priority stripped. - evt.Put("message", fetchPayload(evt)); - removePayload(evt); - } else { - // not a valid syslog PRI, cleanup. - cleanup(evt); - } - }; - return conditional({ - if: isEnabled, - then: cleanup_flags(match( - "STRIP_PRI", - "message", - "<%{_pri}>%{payload}", - onMatch - )) - }); - })(); - - function match(id, src, pattern, on_success) { - var dissect = new processor.Dissect({ - field: src, - tokenizer: pattern, - target_prefix: FIELDS_OBJECT, - ignore_failure: true, - overwrite_keys: true, - trim_values: "right" - }); - return function (evt) { - var msg = evt.Get(src); - dissect.Run(evt); - var failed = evt.Get(FLAG_FIELD) != null; - if (debug) { - if (failed) { - console.debug("dissect fail: " + id + " field:" + src); - } else { - console.debug("dissect OK: " + id + " field:" + src); - } - console.debug(" expr: <<" + pattern + ">>"); - console.debug(" input: <<" + msg + ">>"); - } - if (on_success != null && !failed) { - on_success(evt); - } - }; - } - - function match_copy(id, src, dst, on_success) { - dst = FIELDS_PREFIX + dst; - if (dst === FIELDS_PREFIX || dst === src) { - return function (evt) { - if (debug) { - console.debug("noop OK: " + id + " field:" + src); - console.debug(" input: <<" + evt.Get(src) + ">>"); - } - if (on_success != null) on_success(evt); - } - } - return function (evt) { - var msg = evt.Get(src); - evt.Put(dst, msg); - if (debug) { - console.debug("copy OK: " + id + " field:" + src); - console.debug(" target: '" + dst + "'"); - console.debug(" input: <<" + msg + ">>"); - } - if (on_success != null) on_success(evt); - } - } - - function cleanup_flags(processor) { - return function(evt) { - processor(evt); - evt.Delete(FLAG_FIELD); - }; - } - - function all_match(opts) { - return function (evt) { - var i; - for (i = 0; i < opts.processors.length; i++) { - evt.Delete(FLAG_FIELD); - opts.processors[i](evt); - // Dissect processor succeeded? - if (evt.Get(FLAG_FIELD) != null) { - if (debug) console.warn("all_match failure at " + i); - if (opts.on_failure != null) opts.on_failure(evt); - return; - } - if (debug) console.warn("all_match success at " + i); - } - if (opts.on_success != null) opts.on_success(evt); - }; - } - - function msgid_select(mapping) { - return function (evt) { - var msgid = evt.Get(FIELDS_PREFIX + "messageid"); - if (msgid == null) { - if (debug) console.warn("msgid_select: no messageid captured!"); - return; - } - var next = mapping[msgid]; - if (next === undefined) { - if (debug) console.warn("msgid_select: no mapping for messageid:" + msgid); - return; - } - if (debug) console.info("msgid_select: matched key=" + msgid); - return next(evt); - }; - } - - function msg(msg_id, match) { - return function (evt) { - match(evt); - if (evt.Get(FLAG_FIELD) == null) { - evt.Put(FIELDS_PREFIX + "msg_id1", msg_id); - } - }; - } - - var start; - - function save_flags(evt) { - saved_flags = evt.Get(FLAG_FIELD); - evt.Put("event.original", evt.Get("message")); - } - - function restore_flags(evt) { - if (saved_flags !== null) { - evt.Put(FLAG_FIELD, saved_flags); - } - evt.Delete("message"); - } - - function constant(value) { - return function (evt) { - return value; - }; - } - - function field(name) { - var fullname = FIELDS_PREFIX + name; - return function (evt) { - return evt.Get(fullname); - }; - } - - function STRCAT(args) { - var s = ""; - var i; - for (i = 0; i < args.length; i++) { - s += args[i]; - } - return s; - } - - // TODO: Implement - function DIRCHK(args) { - unimplemented("DIRCHK"); - } - - function strictToInt(str) { - return str * 1; - } - - function CALC(args) { - if (args.length !== 3) { - console.warn("skipped call to CALC with " + args.length + " arguments."); - return; - } - var a = strictToInt(args[0]); - var b = strictToInt(args[2]); - if (isNaN(a) || isNaN(b)) { - console.warn("failed evaluating CALC arguments a='" + args[0] + "' b='" + args[2] + "'."); - return; - } - var result; - switch (args[1]) { - case "+": - result = a + b; - break; - case "-": - result = a - b; - break; - case "*": - result = a * b; - break; - default: - // Only * and + seen in the parsers. - console.warn("unknown CALC operation '" + args[1] + "'."); - return; - } - // Always return a string - return result !== undefined ? "" + result : result; - } - - var quoteChars = "\"'`"; - function RMQ(args) { - if(args.length !== 1) { - console.warn("RMQ: only one argument expected"); - return; - } - var value = args[0].trim(); - var n = value.length; - var char; - return n > 1 - && (char=value.charAt(0)) === value.charAt(n-1) - && quoteChars.indexOf(char) !== -1? - value.substr(1, n-2) - : value; - } - - function call(opts) { - var args = new Array(opts.args.length); - return function (evt) { - for (var i = 0; i < opts.args.length; i++) - if ((args[i] = opts.args[i](evt)) == null) return; - var result = opts.fn(args); - if (result != null) { - evt.Put(opts.dest, result); - } - }; - } - - function nop(evt) { - } - - function appendErrorMsg(evt, msg) { - var value = evt.Get("error.message"); - if (value == null) { - value = [msg]; - } else if (msg instanceof Array) { - value.push(msg); - } else { - value = [value, msg]; - } - evt.Put("error.message", value); - } - - function unimplemented(name) { - appendErrorMsg("unimplemented feature: " + name); - } - - function lookup(opts) { - return function (evt) { - var key = opts.key(evt); - if (key == null) return; - var value = opts.map.keyvaluepairs[key]; - if (value === undefined) { - value = opts.map.default; - } - if (value !== undefined) { - evt.Put(opts.dest, value(evt)); - } - }; - } - - function set(fields) { - return new processor.AddFields({ - target: FIELDS_OBJECT, - fields: fields, - }); - } - - function setf(dst, src) { - return function (evt) { - var val = evt.Get(FIELDS_PREFIX + src); - if (val != null) evt.Put(FIELDS_PREFIX + dst, val); - }; - } - - function setc(dst, value) { - return function (evt) { - evt.Put(FIELDS_PREFIX + dst, value); - }; - } - - function set_field(opts) { - return function (evt) { - var val = opts.value(evt); - if (val != null) evt.Put(opts.dest, val); - }; - } - - function dump(label) { - return function (evt) { - console.log("Dump of event at " + label + ": " + JSON.stringify(evt, null, "\t")); - }; - } - - function date_time_join_args(evt, arglist) { - var str = ""; - for (var i = 0; i < arglist.length; i++) { - var fname = FIELDS_PREFIX + arglist[i]; - var val = evt.Get(fname); - if (val != null) { - if (str !== "") str += " "; - str += val; - } else { - if (debug) console.warn("in date_time: input arg " + fname + " is not set"); - } - } - return str; - } - - function to2Digit(num) { - return num? (num < 10? "0" + num : num) : "00"; - } - - // Make two-digit dates 00-69 interpreted as 2000-2069 - // and dates 70-99 translated to 1970-1999. - var twoDigitYearEpoch = 70; - var twoDigitYearCentury = 2000; - - // This is to accept dates up to 2 days in the future, only used when - // no year is specified in a date. 2 days should be enough to account for - // time differences between systems and different tz offsets. - var maxFutureDelta = 2*24*60*60*1000; - - // DateContainer stores date fields and then converts those fields into - // a Date. Necessary because building a Date using its set() methods gives - // different results depending on the order of components. - function DateContainer(tzOffset) { - this.offset = tzOffset === undefined? "Z" : tzOffset; - } - - DateContainer.prototype = { - setYear: function(v) {this.year = v;}, - setMonth: function(v) {this.month = v;}, - setDay: function(v) {this.day = v;}, - setHours: function(v) {this.hours = v;}, - setMinutes: function(v) {this.minutes = v;}, - setSeconds: function(v) {this.seconds = v;}, - - setUNIX: function(v) {this.unix = v;}, - - set2DigitYear: function(v) { - this.year = v < twoDigitYearEpoch? twoDigitYearCentury + v : twoDigitYearCentury + v - 100; - }, - - toDate: function() { - if (this.unix !== undefined) { - return new Date(this.unix * 1000); - } - if (this.day === undefined || this.month === undefined) { - // Can't make a date from this. - return undefined; - } - if (this.year === undefined) { - // A date without a year. Set current year, or previous year - // if date would be in the future. - var now = new Date(); - this.year = now.getFullYear(); - var date = this.toDate(); - if (date.getTime() - now.getTime() > maxFutureDelta) { - date.setFullYear(now.getFullYear() - 1); - } - return date; - } - var MM = to2Digit(this.month); - var DD = to2Digit(this.day); - var hh = to2Digit(this.hours); - var mm = to2Digit(this.minutes); - var ss = to2Digit(this.seconds); - return new Date(this.year + "-" + MM + "-" + DD + "T" + hh + ":" + mm + ":" + ss + this.offset); - } - } - - function date_time_try_pattern(fmt, str, tzOffset) { - var date = new DateContainer(tzOffset); - var pos = date_time_try_pattern_at_pos(fmt, str, 0, date); - return pos !== undefined? date.toDate() : undefined; - } - - function date_time_try_pattern_at_pos(fmt, str, pos, date) { - var len = str.length; - for (var proc = 0; pos !== undefined && pos < len && proc < fmt.length; proc++) { - pos = fmt[proc](str, pos, date); - } - return pos; - } - - function date_time(opts) { - return function (evt) { - var tzOffset = opts.tz || tz_offset; - if (tzOffset === "event") { - tzOffset = evt.Get("event.timezone"); - } - var str = date_time_join_args(evt, opts.args); - for (var i = 0; i < opts.fmts.length; i++) { - var date = date_time_try_pattern(opts.fmts[i], str, tzOffset); - if (date !== undefined) { - evt.Put(FIELDS_PREFIX + opts.dest, date); - return; - } - } - if (debug) console.warn("in date_time: id=" + opts.id + " FAILED: " + str); - }; - } - - var uA = 60 * 60 * 24; - var uD = 60 * 60 * 24; - var uF = 60 * 60; - var uG = 60 * 60 * 24 * 30; - var uH = 60 * 60; - var uI = 60 * 60; - var uJ = 60 * 60 * 24; - var uM = 60 * 60 * 24 * 30; - var uN = 60 * 60; - var uO = 1; - var uS = 1; - var uT = 60; - var uU = 60; - var uc = dc; - - function duration(opts) { - return function(evt) { - var str = date_time_join_args(evt, opts.args); - for (var i = 0; i < opts.fmts.length; i++) { - var seconds = duration_try_pattern(opts.fmts[i], str); - if (seconds !== undefined) { - evt.Put(FIELDS_PREFIX + opts.dest, seconds); - return; - } - } - if (debug) console.warn("in duration: id=" + opts.id + " (s) FAILED: " + str); - }; - } - - function duration_try_pattern(fmt, str) { - var secs = 0; - var pos = 0; - for (var i=0; i [ month_id , how many chars to skip if month in long form ] - "Jan": [0, 4], - "Feb": [1, 5], - "Mar": [2, 2], - "Apr": [3, 2], - "May": [4, 0], - "Jun": [5, 1], - "Jul": [6, 1], - "Aug": [7, 3], - "Sep": [8, 6], - "Oct": [9, 4], - "Nov": [10, 5], - "Dec": [11, 4], - "jan": [0, 4], - "feb": [1, 5], - "mar": [2, 2], - "apr": [3, 2], - "may": [4, 0], - "jun": [5, 1], - "jul": [6, 1], - "aug": [7, 3], - "sep": [8, 6], - "oct": [9, 4], - "nov": [10, 5], - "dec": [11, 4], - }; - - // var dC = undefined; - var dR = dateMonthName(true); - var dB = dateMonthName(false); - var dM = dateFixedWidthNumber("M", 2, 1, 12, DateContainer.prototype.setMonth); - var dG = dateVariableWidthNumber("G", 1, 12, DateContainer.prototype.setMonth); - var dD = dateFixedWidthNumber("D", 2, 1, 31, DateContainer.prototype.setDay); - var dF = dateVariableWidthNumber("F", 1, 31, DateContainer.prototype.setDay); - var dH = dateFixedWidthNumber("H", 2, 0, 24, DateContainer.prototype.setHours); - var dI = dateVariableWidthNumber("I", 0, 24, DateContainer.prototype.setHours); // Accept hours >12 - var dN = dateVariableWidthNumber("N", 0, 24, DateContainer.prototype.setHours); - var dT = dateFixedWidthNumber("T", 2, 0, 59, DateContainer.prototype.setMinutes); - var dU = dateVariableWidthNumber("U", 0, 59, DateContainer.prototype.setMinutes); - var dP = parseAMPM; // AM|PM - var dQ = parseAMPM; // A.M.|P.M - var dS = dateFixedWidthNumber("S", 2, 0, 60, DateContainer.prototype.setSeconds); - var dO = dateVariableWidthNumber("O", 0, 60, DateContainer.prototype.setSeconds); - var dY = dateFixedWidthNumber("Y", 2, 0, 99, DateContainer.prototype.set2DigitYear); - var dW = dateFixedWidthNumber("W", 4, 1000, 9999, DateContainer.prototype.setYear); - var dZ = parseHMS; - var dX = dateVariableWidthNumber("X", 0, 0x10000000000, DateContainer.prototype.setUNIX); - - // parseAMPM parses "A.M", "AM", "P.M", "PM" from logs. - // Only works if this modifier appears after the hour has been read from logs - // which is always the case in the 300 devices. - function parseAMPM(str, pos, date) { - var n = str.length; - var start = skipws(str, pos); - if (start + 2 > n) return; - var head = str.substr(start, 2).toUpperCase(); - var isPM = false; - var skip = false; - switch (head) { - case "A.": - skip = true; - /* falls through */ - case "AM": - break; - case "P.": - skip = true; - /* falls through */ - case "PM": - isPM = true; - break; - default: - if (debug) console.warn("can't parse pos " + start + " as AM/PM: " + str + "(head:" + head + ")"); - return; - } - pos = start + 2; - if (skip) { - if (pos+2 > n || str.substr(pos, 2).toUpperCase() !== "M.") { - if (debug) console.warn("can't parse pos " + start + " as AM/PM: " + str + "(tail)"); - return; - } - pos += 2; - } - var hh = date.hours; - if (isPM) { - // Accept existing hour in 24h format. - if (hh < 12) hh += 12; - } else { - if (hh === 12) hh = 0; - } - date.setHours(hh); - return pos; - } - - function parseHMS(str, pos, date) { - return date_time_try_pattern_at_pos([dN, dc(":"), dU, dc(":"), dO], str, pos, date); - } - - function skipws(str, pos) { - for ( var n = str.length; - pos < n && str.charAt(pos) === " "; - pos++) - ; - return pos; - } - - function skipdigits(str, pos) { - var c; - for (var n = str.length; - pos < n && (c = str.charAt(pos)) >= "0" && c <= "9"; - pos++) - ; - return pos; - } - - function dSkip(str, pos, date) { - var chr; - for (;pos < str.length && (chr=str[pos])<'0' || chr>'9'; pos++) {} - return pos < str.length? pos : undefined; - } - - function dateVariableWidthNumber(fmtChar, min, max, setter) { - return function (str, pos, date) { - var start = skipws(str, pos); - pos = skipdigits(str, start); - var s = str.substr(start, pos - start); - var value = parseInt(s, 10); - if (value >= min && value <= max) { - setter.call(date, value); - return pos; - } - return; - }; - } - - function dateFixedWidthNumber(fmtChar, width, min, max, setter) { - return function (str, pos, date) { - pos = skipws(str, pos); - var n = str.length; - if (pos + width > n) return; - var s = str.substr(pos, width); - var value = parseInt(s, 10); - if (value >= min && value <= max) { - setter.call(date, value); - return pos + width; - } - return; - }; - } - - // Short month name (Jan..Dec). - function dateMonthName(long) { - return function (str, pos, date) { - pos = skipws(str, pos); - var n = str.length; - if (pos + 3 > n) return; - var mon = str.substr(pos, 3); - var idx = shortMonths[mon]; - if (idx === undefined) { - idx = shortMonths[mon.toLowerCase()]; - } - if (idx === undefined) { - //console.warn("parsing date_time: '" + mon + "' is not a valid short month (%B)"); - return; - } - date.setMonth(idx[0]+1); - return pos + 3 + (long ? idx[1] : 0); - }; - } - - function url_wrapper(dst, src, fn) { - return function(evt) { - var value = evt.Get(FIELDS_PREFIX + src), result; - if (value != null && (result = fn(value))!== undefined) { - evt.Put(FIELDS_PREFIX + dst, result); - } else { - console.debug(fn.name + " failed for '" + value + "'"); - } - }; - } - - // The following regular expression for parsing URLs from: - // https://github.com/wizard04wsu/URI_Parsing - // - // The MIT License (MIT) - // - // Copyright (c) 2014 Andrew Harrison - // - // Permission is hereby granted, free of charge, to any person obtaining a copy of - // this software and associated documentation files (the "Software"), to deal in - // the Software without restriction, including without limitation the rights to - // use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of - // the Software, and to permit persons to whom the Software is furnished to do so, - // subject to the following conditions: - // - // The above copyright notice and this permission notice shall be included in all - // copies or substantial portions of the Software. - // - // THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - // IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS - // FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR - // COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER - // IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN - // CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. - var uriRegExp = /^([a-z][a-z0-9+.\-]*):(?:\/\/((?:(?=((?:[a-z0-9\-._~!$&'()*+,;=:]|%[0-9A-F]{2})*))(\3)@)?(?=(\[[0-9A-F:.]{2,}\]|(?:[a-z0-9\-._~!$&'()*+,;=]|%[0-9A-F]{2})*))\5(?::(?=(\d*))\6)?)(\/(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/]|%[0-9A-F]{2})*))\8)?|(\/?(?!\/)(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/]|%[0-9A-F]{2})*))\10)?)(?:\?(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/?]|%[0-9A-F]{2})*))\11)?(?:#(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/?]|%[0-9A-F]{2})*))\12)?$/i; - - var uriScheme = 1; - var uriDomain = 5; - var uriPort = 6; - var uriPath = 7; - var uriPathAlt = 9; - var uriQuery = 11; - - function domain(dst, src) { - return url_wrapper(dst, src, extract_domain); - } - - function split_url(value) { - var m = value.match(uriRegExp); - if (m && m[uriDomain]) return m; - // Support input in the form "www.example.net/path", but not "/path". - m = ("null://" + value).match(uriRegExp); - if (m) return m; - } - - function extract_domain(value) { - var m = split_url(value); - if (m && m[uriDomain]) return m[uriDomain]; - } - - var extFromPage = /\.[^.]+$/; - function extract_ext(value) { - var page = extract_page(value); - if (page) { - var m = page.match(extFromPage); - if (m) return m[0]; - } - } - - function ext(dst, src) { - return url_wrapper(dst, src, extract_ext); - } - - function fqdn(dst, src) { - // TODO: fqdn and domain(eTLD+1) are currently the same. - return domain(dst, src); - } - - var pageFromPathRegExp = /\/([^\/]+)$/; - var pageName = 1; - - function extract_page(value) { - value = extract_path(value); - if (!value) return undefined; - var m = value.match(pageFromPathRegExp); - if (m) return m[pageName]; - } - - function page(dst, src) { - return url_wrapper(dst, src, extract_page); - } - - function extract_path(value) { - var m = split_url(value); - return m? m[uriPath] || m[uriPathAlt] : undefined; - } - - function path(dst, src) { - return url_wrapper(dst, src, extract_path); - } - - // Map common schemes to their default port. - // port has to be a string (will be converted at a later stage). - var schemePort = { - "ftp": "21", - "ssh": "22", - "http": "80", - "https": "443", - }; - - function extract_port(value) { - var m = split_url(value); - if (!m) return undefined; - if (m[uriPort]) return m[uriPort]; - if (m[uriScheme]) { - return schemePort[m[uriScheme]]; - } - } - - function port(dst, src) { - return url_wrapper(dst, src, extract_port); - } - - function extract_query(value) { - var m = split_url(value); - if (m && m[uriQuery]) return m[uriQuery]; - } - - function query(dst, src) { - return url_wrapper(dst, src, extract_query); - } - - function extract_root(value) { - var m = split_url(value); - if (m && m[uriDomain] && m[uriDomain]) { - var scheme = m[uriScheme] && m[uriScheme] !== "null"? - m[uriScheme] + "://" : ""; - var port = m[uriPort]? ":" + m[uriPort] : ""; - return scheme + m[uriDomain] + port; - } - } - - function root(dst, src) { - return url_wrapper(dst, src, extract_root); - } - - function tagval(id, src, cfg, keys, on_success) { - var fail = function(evt) { - evt.Put(FLAG_FIELD, "tagval_parsing_error"); - } - if (cfg.kv_separator.length !== 1) { - throw("Invalid TAGVALMAP ValueDelimiter (must have 1 character)"); - } - var quotes_len = cfg.open_quote.length > 0 && cfg.close_quote.length > 0? - cfg.open_quote.length + cfg.close_quote.length : 0; - var kv_regex = new RegExp('^([^' + cfg.kv_separator + ']*)*' + cfg.kv_separator + ' *(.*)*$'); - return function(evt) { - var msg = evt.Get(src); - if (msg === undefined) { - console.warn("tagval: input field is missing"); - return fail(evt); - } - var pairs = msg.split(cfg.pair_separator); - var i; - var success = false; - var prev = ""; - for (i=0; i 0 && - value.length >= cfg.open_quote.length + cfg.close_quote.length && - value.substr(0, cfg.open_quote.length) === cfg.open_quote && - value.substr(value.length - cfg.close_quote.length) === cfg.close_quote) { - value = value.substr(cfg.open_quote.length, value.length - quotes_len); - } - evt.Put(FIELDS_PREFIX + field, value); - success = true; - } - if (!success) { - return fail(evt); - } - if (on_success != null) { - on_success(evt); - } - } - } - - var ecs_mappings = { - "_facility": {convert: to_long, to:[{field: "log.syslog.facility.code", setter: fld_set}]}, - "_pri": {convert: to_long, to:[{field: "log.syslog.priority", setter: fld_set}]}, - "_severity": {convert: to_long, to:[{field: "log.syslog.severity.code", setter: fld_set}]}, - "action": {to:[{field: "event.action", setter: fld_prio, prio: 0}]}, - "administrator": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 4}]}, - "alias.ip": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 3},{field: "related.ip", setter: fld_append}]}, - "alias.ipv6": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 4},{field: "related.ip", setter: fld_append}]}, - "alias.mac": {convert: to_mac, to:[{field: "host.mac", setter: fld_prio, prio: 1}]}, - "application": {to:[{field: "network.application", setter: fld_set}]}, - "bytes": {convert: to_long, to:[{field: "network.bytes", setter: fld_set}]}, - "c_domain": {to:[{field: "source.domain", setter: fld_prio, prio: 1}]}, - "c_logon_id": {to:[{field: "user.id", setter: fld_prio, prio: 2}]}, - "c_user_name": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 8}]}, - "c_username": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 2}]}, - "cctld": {to:[{field: "url.top_level_domain", setter: fld_prio, prio: 1}]}, - "child_pid": {convert: to_long, to:[{field: "process.pid", setter: fld_prio, prio: 1}]}, - "child_pid_val": {to:[{field: "process.title", setter: fld_set}]}, - "child_process": {to:[{field: "process.name", setter: fld_prio, prio: 1}]}, - "city.dst": {to:[{field: "destination.geo.city_name", setter: fld_set}]}, - "city.src": {to:[{field: "source.geo.city_name", setter: fld_set}]}, - "daddr": {convert: to_ip, to:[{field: "destination.ip", setter: fld_set},{field: "related.ip", setter: fld_append}]}, - "daddr_v6": {convert: to_ip, to:[{field: "destination.ip", setter: fld_set},{field: "related.ip", setter: fld_append}]}, - "ddomain": {to:[{field: "destination.domain", setter: fld_prio, prio: 0}]}, - "devicehostip": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 2},{field: "related.ip", setter: fld_append}]}, - "devicehostmac": {convert: to_mac, to:[{field: "host.mac", setter: fld_prio, prio: 0}]}, - "dhost": {to:[{field: "destination.address", setter: fld_set},{field: "related.hosts", setter: fld_append}]}, - "dinterface": {to:[{field: "observer.egress.interface.name", setter: fld_set}]}, - "direction": {to:[{field: "network.direction", setter: fld_set}]}, - "directory": {to:[{field: "file.directory", setter: fld_set}]}, - "dmacaddr": {convert: to_mac, to:[{field: "destination.mac", setter: fld_set}]}, - "dns.responsetype": {to:[{field: "dns.answers.type", setter: fld_set}]}, - "dns.resptext": {to:[{field: "dns.answers.name", setter: fld_set}]}, - "dns_querytype": {to:[{field: "dns.question.type", setter: fld_set}]}, - "domain": {to:[{field: "server.domain", setter: fld_prio, prio: 0},{field: "related.hosts", setter: fld_append}]}, - "domain.dst": {to:[{field: "destination.domain", setter: fld_prio, prio: 1}]}, - "domain.src": {to:[{field: "source.domain", setter: fld_prio, prio: 2}]}, - "domain_id": {to:[{field: "user.domain", setter: fld_set}]}, - "domainname": {to:[{field: "server.domain", setter: fld_prio, prio: 1}]}, - "dport": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 0}]}, - "dtransaddr": {convert: to_ip, to:[{field: "destination.nat.ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, - "dtransport": {convert: to_long, to:[{field: "destination.nat.port", setter: fld_prio, prio: 0}]}, - "ec_outcome": {to:[{field: "event.outcome", setter: fld_ecs_outcome}]}, - "event_description": {to:[{field: "message", setter: fld_prio, prio: 0}]}, - "event_source": {to:[{field: "related.hosts", setter: fld_append}]}, - "event_time": {convert: to_date, to:[{field: "@timestamp", setter: fld_set}]}, - "event_type": {to:[{field: "event.action", setter: fld_prio, prio: 1}]}, - "extension": {to:[{field: "file.extension", setter: fld_prio, prio: 1}]}, - "file.attributes": {to:[{field: "file.attributes", setter: fld_set}]}, - "filename": {to:[{field: "file.name", setter: fld_prio, prio: 0}]}, - "filename_size": {convert: to_long, to:[{field: "file.size", setter: fld_set}]}, - "filepath": {to:[{field: "file.path", setter: fld_set}]}, - "filetype": {to:[{field: "file.type", setter: fld_set}]}, - "fqdn": {to:[{field: "related.hosts", setter: fld_append}]}, - "group": {to:[{field: "group.name", setter: fld_set}]}, - "groupid": {to:[{field: "group.id", setter: fld_set}]}, - "host": {to:[{field: "host.name", setter: fld_prio, prio: 1},{field: "related.hosts", setter: fld_append}]}, - "hostip": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, - "hostip_v6": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, - "hostname": {to:[{field: "host.name", setter: fld_prio, prio: 0}]}, - "id": {to:[{field: "event.code", setter: fld_prio, prio: 0}]}, - "interface": {to:[{field: "network.interface.name", setter: fld_set}]}, - "ip.orig": {convert: to_ip, to:[{field: "network.forwarded_ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, - "ip.trans.dst": {convert: to_ip, to:[{field: "destination.nat.ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, - "ip.trans.src": {convert: to_ip, to:[{field: "source.nat.ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, - "ipv6.orig": {convert: to_ip, to:[{field: "network.forwarded_ip", setter: fld_prio, prio: 2},{field: "related.ip", setter: fld_append}]}, - "latdec_dst": {convert: to_double, to:[{field: "destination.geo.location.lat", setter: fld_set}]}, - "latdec_src": {convert: to_double, to:[{field: "source.geo.location.lat", setter: fld_set}]}, - "location_city": {to:[{field: "geo.city_name", setter: fld_set}]}, - "location_country": {to:[{field: "geo.country_name", setter: fld_set}]}, - "location_desc": {to:[{field: "geo.name", setter: fld_set}]}, - "location_dst": {to:[{field: "destination.geo.country_name", setter: fld_set}]}, - "location_src": {to:[{field: "source.geo.country_name", setter: fld_set}]}, - "location_state": {to:[{field: "geo.region_name", setter: fld_set}]}, - "logon_id": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 5}]}, - "longdec_dst": {convert: to_double, to:[{field: "destination.geo.location.lon", setter: fld_set}]}, - "longdec_src": {convert: to_double, to:[{field: "source.geo.location.lon", setter: fld_set}]}, - "macaddr": {convert: to_mac, to:[{field: "host.mac", setter: fld_prio, prio: 2}]}, - "messageid": {to:[{field: "event.code", setter: fld_prio, prio: 1}]}, - "method": {to:[{field: "http.request.method", setter: fld_set}]}, - "msg": {to:[{field: "message", setter: fld_set}]}, - "orig_ip": {convert: to_ip, to:[{field: "network.forwarded_ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, - "owner": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 6}]}, - "packets": {convert: to_long, to:[{field: "network.packets", setter: fld_set}]}, - "parent_pid": {convert: to_long, to:[{field: "process.parent.pid", setter: fld_prio, prio: 0}]}, - "parent_pid_val": {to:[{field: "process.parent.title", setter: fld_set}]}, - "parent_process": {to:[{field: "process.parent.name", setter: fld_prio, prio: 0}]}, - "patient_fullname": {to:[{field: "user.full_name", setter: fld_prio, prio: 1}]}, - "port.dst": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 1}]}, - "port.src": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 1}]}, - "port.trans.dst": {convert: to_long, to:[{field: "destination.nat.port", setter: fld_prio, prio: 1}]}, - "port.trans.src": {convert: to_long, to:[{field: "source.nat.port", setter: fld_prio, prio: 1}]}, - "process": {to:[{field: "process.name", setter: fld_prio, prio: 0}]}, - "process_id": {convert: to_long, to:[{field: "process.pid", setter: fld_prio, prio: 0}]}, - "process_id_src": {convert: to_long, to:[{field: "process.parent.pid", setter: fld_prio, prio: 1}]}, - "process_src": {to:[{field: "process.parent.name", setter: fld_prio, prio: 1}]}, - "product": {to:[{field: "observer.product", setter: fld_set}]}, - "protocol": {to:[{field: "network.protocol", setter: fld_set}]}, - "query": {to:[{field: "url.query", setter: fld_prio, prio: 2}]}, - "rbytes": {convert: to_long, to:[{field: "destination.bytes", setter: fld_set}]}, - "referer": {to:[{field: "http.request.referrer", setter: fld_prio, prio: 1}]}, - "rulename": {to:[{field: "rule.name", setter: fld_set}]}, - "saddr": {convert: to_ip, to:[{field: "source.ip", setter: fld_set},{field: "related.ip", setter: fld_append}]}, - "saddr_v6": {convert: to_ip, to:[{field: "source.ip", setter: fld_set},{field: "related.ip", setter: fld_append}]}, - "sbytes": {convert: to_long, to:[{field: "source.bytes", setter: fld_set}]}, - "sdomain": {to:[{field: "source.domain", setter: fld_prio, prio: 0}]}, - "service": {to:[{field: "service.name", setter: fld_prio, prio: 1}]}, - "service.name": {to:[{field: "service.name", setter: fld_prio, prio: 0}]}, - "service_account": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 7}]}, - "severity": {to:[{field: "log.level", setter: fld_set}]}, - "shost": {to:[{field: "host.hostname", setter: fld_set},{field: "source.address", setter: fld_set},{field: "related.hosts", setter: fld_append}]}, - "sinterface": {to:[{field: "observer.ingress.interface.name", setter: fld_set}]}, - "sld": {to:[{field: "url.registered_domain", setter: fld_set}]}, - "smacaddr": {convert: to_mac, to:[{field: "source.mac", setter: fld_set}]}, - "sport": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 0}]}, - "stransaddr": {convert: to_ip, to:[{field: "source.nat.ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, - "stransport": {convert: to_long, to:[{field: "source.nat.port", setter: fld_prio, prio: 0}]}, - "tcp.dstport": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 2}]}, - "tcp.srcport": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 2}]}, - "timezone": {to:[{field: "event.timezone", setter: fld_set}]}, - "tld": {to:[{field: "url.top_level_domain", setter: fld_prio, prio: 0}]}, - "udp.dstport": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 3}]}, - "udp.srcport": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 3}]}, - "uid": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 3}]}, - "url": {to:[{field: "url.original", setter: fld_prio, prio: 1}]}, - "url_raw": {to:[{field: "url.original", setter: fld_prio, prio: 0}]}, - "urldomain": {to:[{field: "url.domain", setter: fld_prio, prio: 0}]}, - "urlquery": {to:[{field: "url.query", setter: fld_prio, prio: 0}]}, - "user": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 0}]}, - "user.id": {to:[{field: "user.id", setter: fld_prio, prio: 1}]}, - "user_agent": {to:[{field: "user_agent.original", setter: fld_set}]}, - "user_fullname": {to:[{field: "user.full_name", setter: fld_prio, prio: 0}]}, - "user_id": {to:[{field: "user.id", setter: fld_prio, prio: 0}]}, - "username": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 1}]}, - "version": {to:[{field: "observer.version", setter: fld_set}]}, - "web_domain": {to:[{field: "url.domain", setter: fld_prio, prio: 1},{field: "related.hosts", setter: fld_append}]}, - "web_extension": {to:[{field: "file.extension", setter: fld_prio, prio: 0}]}, - "web_query": {to:[{field: "url.query", setter: fld_prio, prio: 1}]}, - "web_ref_domain": {to:[{field: "related.hosts", setter: fld_append}]}, - "web_referer": {to:[{field: "http.request.referrer", setter: fld_prio, prio: 0}]}, - "web_root": {to:[{field: "url.path", setter: fld_set}]}, - "webpage": {to:[{field: "file.name", setter: fld_prio, prio: 1}]}, - }; - - var rsa_mappings = { - "access_point": {to:[{field: "rsa.wireless.access_point", setter: fld_set}]}, - "accesses": {to:[{field: "rsa.identity.accesses", setter: fld_set}]}, - "acl_id": {to:[{field: "rsa.misc.acl_id", setter: fld_set}]}, - "acl_op": {to:[{field: "rsa.misc.acl_op", setter: fld_set}]}, - "acl_pos": {to:[{field: "rsa.misc.acl_pos", setter: fld_set}]}, - "acl_table": {to:[{field: "rsa.misc.acl_table", setter: fld_set}]}, - "action": {to:[{field: "rsa.misc.action", setter: fld_append}]}, - "ad_computer_dst": {to:[{field: "rsa.network.ad_computer_dst", setter: fld_set}]}, - "addr": {to:[{field: "rsa.network.addr", setter: fld_set}]}, - "admin": {to:[{field: "rsa.misc.admin", setter: fld_set}]}, - "agent": {to:[{field: "rsa.misc.client", setter: fld_prio, prio: 0}]}, - "agent.id": {to:[{field: "rsa.misc.agent_id", setter: fld_set}]}, - "alarm_id": {to:[{field: "rsa.misc.alarm_id", setter: fld_set}]}, - "alarmname": {to:[{field: "rsa.misc.alarmname", setter: fld_set}]}, - "alert": {to:[{field: "rsa.threat.alert", setter: fld_set}]}, - "alert_id": {to:[{field: "rsa.misc.alert_id", setter: fld_set}]}, - "alias.host": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "analysis.file": {to:[{field: "rsa.investigations.analysis_file", setter: fld_set}]}, - "analysis.service": {to:[{field: "rsa.investigations.analysis_service", setter: fld_set}]}, - "analysis.session": {to:[{field: "rsa.investigations.analysis_session", setter: fld_set}]}, - "app_id": {to:[{field: "rsa.misc.app_id", setter: fld_set}]}, - "attachment": {to:[{field: "rsa.file.attachment", setter: fld_set}]}, - "audit": {to:[{field: "rsa.misc.audit", setter: fld_set}]}, - "audit_class": {to:[{field: "rsa.internal.audit_class", setter: fld_set}]}, - "audit_object": {to:[{field: "rsa.misc.audit_object", setter: fld_set}]}, - "auditdata": {to:[{field: "rsa.misc.auditdata", setter: fld_set}]}, - "authmethod": {to:[{field: "rsa.identity.auth_method", setter: fld_set}]}, - "autorun_type": {to:[{field: "rsa.misc.autorun_type", setter: fld_set}]}, - "bcc": {to:[{field: "rsa.email.email", setter: fld_append}]}, - "benchmark": {to:[{field: "rsa.misc.benchmark", setter: fld_set}]}, - "binary": {to:[{field: "rsa.file.binary", setter: fld_set}]}, - "boc": {to:[{field: "rsa.investigations.boc", setter: fld_set}]}, - "bssid": {to:[{field: "rsa.wireless.wlan_ssid", setter: fld_prio, prio: 1}]}, - "bypass": {to:[{field: "rsa.misc.bypass", setter: fld_set}]}, - "c_sid": {to:[{field: "rsa.identity.user_sid_src", setter: fld_set}]}, - "cache": {to:[{field: "rsa.misc.cache", setter: fld_set}]}, - "cache_hit": {to:[{field: "rsa.misc.cache_hit", setter: fld_set}]}, - "calling_from": {to:[{field: "rsa.misc.phone", setter: fld_prio, prio: 1}]}, - "calling_to": {to:[{field: "rsa.misc.phone", setter: fld_prio, prio: 0}]}, - "category": {to:[{field: "rsa.misc.category", setter: fld_set}]}, - "cc": {to:[{field: "rsa.email.email", setter: fld_append}]}, - "cc.number": {convert: to_long, to:[{field: "rsa.misc.cc_number", setter: fld_set}]}, - "cefversion": {to:[{field: "rsa.misc.cefversion", setter: fld_set}]}, - "cert.serial": {to:[{field: "rsa.crypto.cert_serial", setter: fld_set}]}, - "cert_ca": {to:[{field: "rsa.crypto.cert_ca", setter: fld_set}]}, - "cert_checksum": {to:[{field: "rsa.crypto.cert_checksum", setter: fld_set}]}, - "cert_common": {to:[{field: "rsa.crypto.cert_common", setter: fld_set}]}, - "cert_error": {to:[{field: "rsa.crypto.cert_error", setter: fld_set}]}, - "cert_hostname": {to:[{field: "rsa.crypto.cert_host_name", setter: fld_set}]}, - "cert_hostname_cat": {to:[{field: "rsa.crypto.cert_host_cat", setter: fld_set}]}, - "cert_issuer": {to:[{field: "rsa.crypto.cert_issuer", setter: fld_set}]}, - "cert_keysize": {to:[{field: "rsa.crypto.cert_keysize", setter: fld_set}]}, - "cert_status": {to:[{field: "rsa.crypto.cert_status", setter: fld_set}]}, - "cert_subject": {to:[{field: "rsa.crypto.cert_subject", setter: fld_set}]}, - "cert_username": {to:[{field: "rsa.crypto.cert_username", setter: fld_set}]}, - "cfg.attr": {to:[{field: "rsa.misc.cfg_attr", setter: fld_set}]}, - "cfg.obj": {to:[{field: "rsa.misc.cfg_obj", setter: fld_set}]}, - "cfg.path": {to:[{field: "rsa.misc.cfg_path", setter: fld_set}]}, - "change_attribute": {to:[{field: "rsa.misc.change_attrib", setter: fld_set}]}, - "change_new": {to:[{field: "rsa.misc.change_new", setter: fld_set}]}, - "change_old": {to:[{field: "rsa.misc.change_old", setter: fld_set}]}, - "changes": {to:[{field: "rsa.misc.changes", setter: fld_set}]}, - "checksum": {to:[{field: "rsa.misc.checksum", setter: fld_set}]}, - "checksum.dst": {to:[{field: "rsa.misc.checksum_dst", setter: fld_set}]}, - "checksum.src": {to:[{field: "rsa.misc.checksum_src", setter: fld_set}]}, - "cid": {to:[{field: "rsa.internal.cid", setter: fld_set}]}, - "client": {to:[{field: "rsa.misc.client", setter: fld_prio, prio: 1}]}, - "client_ip": {to:[{field: "rsa.misc.client_ip", setter: fld_set}]}, - "clustermembers": {to:[{field: "rsa.misc.clustermembers", setter: fld_set}]}, - "cmd": {to:[{field: "rsa.misc.cmd", setter: fld_set}]}, - "cn_acttimeout": {to:[{field: "rsa.misc.cn_acttimeout", setter: fld_set}]}, - "cn_asn_dst": {to:[{field: "rsa.web.cn_asn_dst", setter: fld_set}]}, - "cn_asn_src": {to:[{field: "rsa.misc.cn_asn_src", setter: fld_set}]}, - "cn_bgpv4nxthop": {to:[{field: "rsa.misc.cn_bgpv4nxthop", setter: fld_set}]}, - "cn_ctr_dst_code": {to:[{field: "rsa.misc.cn_ctr_dst_code", setter: fld_set}]}, - "cn_dst_tos": {to:[{field: "rsa.misc.cn_dst_tos", setter: fld_set}]}, - "cn_dst_vlan": {to:[{field: "rsa.misc.cn_dst_vlan", setter: fld_set}]}, - "cn_engine_id": {to:[{field: "rsa.misc.cn_engine_id", setter: fld_set}]}, - "cn_engine_type": {to:[{field: "rsa.misc.cn_engine_type", setter: fld_set}]}, - "cn_f_switch": {to:[{field: "rsa.misc.cn_f_switch", setter: fld_set}]}, - "cn_flowsampid": {to:[{field: "rsa.misc.cn_flowsampid", setter: fld_set}]}, - "cn_flowsampintv": {to:[{field: "rsa.misc.cn_flowsampintv", setter: fld_set}]}, - "cn_flowsampmode": {to:[{field: "rsa.misc.cn_flowsampmode", setter: fld_set}]}, - "cn_inacttimeout": {to:[{field: "rsa.misc.cn_inacttimeout", setter: fld_set}]}, - "cn_inpermbyts": {to:[{field: "rsa.misc.cn_inpermbyts", setter: fld_set}]}, - "cn_inpermpckts": {to:[{field: "rsa.misc.cn_inpermpckts", setter: fld_set}]}, - "cn_invalid": {to:[{field: "rsa.misc.cn_invalid", setter: fld_set}]}, - "cn_ip_proto_ver": {to:[{field: "rsa.misc.cn_ip_proto_ver", setter: fld_set}]}, - "cn_ipv4_ident": {to:[{field: "rsa.misc.cn_ipv4_ident", setter: fld_set}]}, - "cn_l_switch": {to:[{field: "rsa.misc.cn_l_switch", setter: fld_set}]}, - "cn_log_did": {to:[{field: "rsa.misc.cn_log_did", setter: fld_set}]}, - "cn_log_rid": {to:[{field: "rsa.misc.cn_log_rid", setter: fld_set}]}, - "cn_max_ttl": {to:[{field: "rsa.misc.cn_max_ttl", setter: fld_set}]}, - "cn_maxpcktlen": {to:[{field: "rsa.misc.cn_maxpcktlen", setter: fld_set}]}, - "cn_min_ttl": {to:[{field: "rsa.misc.cn_min_ttl", setter: fld_set}]}, - "cn_minpcktlen": {to:[{field: "rsa.misc.cn_minpcktlen", setter: fld_set}]}, - "cn_mpls_lbl_1": {to:[{field: "rsa.misc.cn_mpls_lbl_1", setter: fld_set}]}, - "cn_mpls_lbl_10": {to:[{field: "rsa.misc.cn_mpls_lbl_10", setter: fld_set}]}, - "cn_mpls_lbl_2": {to:[{field: "rsa.misc.cn_mpls_lbl_2", setter: fld_set}]}, - "cn_mpls_lbl_3": {to:[{field: "rsa.misc.cn_mpls_lbl_3", setter: fld_set}]}, - "cn_mpls_lbl_4": {to:[{field: "rsa.misc.cn_mpls_lbl_4", setter: fld_set}]}, - "cn_mpls_lbl_5": {to:[{field: "rsa.misc.cn_mpls_lbl_5", setter: fld_set}]}, - "cn_mpls_lbl_6": {to:[{field: "rsa.misc.cn_mpls_lbl_6", setter: fld_set}]}, - "cn_mpls_lbl_7": {to:[{field: "rsa.misc.cn_mpls_lbl_7", setter: fld_set}]}, - "cn_mpls_lbl_8": {to:[{field: "rsa.misc.cn_mpls_lbl_8", setter: fld_set}]}, - "cn_mpls_lbl_9": {to:[{field: "rsa.misc.cn_mpls_lbl_9", setter: fld_set}]}, - "cn_mplstoplabel": {to:[{field: "rsa.misc.cn_mplstoplabel", setter: fld_set}]}, - "cn_mplstoplabip": {to:[{field: "rsa.misc.cn_mplstoplabip", setter: fld_set}]}, - "cn_mul_dst_byt": {to:[{field: "rsa.misc.cn_mul_dst_byt", setter: fld_set}]}, - "cn_mul_dst_pks": {to:[{field: "rsa.misc.cn_mul_dst_pks", setter: fld_set}]}, - "cn_muligmptype": {to:[{field: "rsa.misc.cn_muligmptype", setter: fld_set}]}, - "cn_rpackets": {to:[{field: "rsa.web.cn_rpackets", setter: fld_set}]}, - "cn_sampalgo": {to:[{field: "rsa.misc.cn_sampalgo", setter: fld_set}]}, - "cn_sampint": {to:[{field: "rsa.misc.cn_sampint", setter: fld_set}]}, - "cn_seqctr": {to:[{field: "rsa.misc.cn_seqctr", setter: fld_set}]}, - "cn_spackets": {to:[{field: "rsa.misc.cn_spackets", setter: fld_set}]}, - "cn_src_tos": {to:[{field: "rsa.misc.cn_src_tos", setter: fld_set}]}, - "cn_src_vlan": {to:[{field: "rsa.misc.cn_src_vlan", setter: fld_set}]}, - "cn_sysuptime": {to:[{field: "rsa.misc.cn_sysuptime", setter: fld_set}]}, - "cn_template_id": {to:[{field: "rsa.misc.cn_template_id", setter: fld_set}]}, - "cn_totbytsexp": {to:[{field: "rsa.misc.cn_totbytsexp", setter: fld_set}]}, - "cn_totflowexp": {to:[{field: "rsa.misc.cn_totflowexp", setter: fld_set}]}, - "cn_totpcktsexp": {to:[{field: "rsa.misc.cn_totpcktsexp", setter: fld_set}]}, - "cn_unixnanosecs": {to:[{field: "rsa.misc.cn_unixnanosecs", setter: fld_set}]}, - "cn_v6flowlabel": {to:[{field: "rsa.misc.cn_v6flowlabel", setter: fld_set}]}, - "cn_v6optheaders": {to:[{field: "rsa.misc.cn_v6optheaders", setter: fld_set}]}, - "code": {to:[{field: "rsa.misc.code", setter: fld_set}]}, - "command": {to:[{field: "rsa.misc.command", setter: fld_set}]}, - "comments": {to:[{field: "rsa.misc.comments", setter: fld_set}]}, - "comp_class": {to:[{field: "rsa.misc.comp_class", setter: fld_set}]}, - "comp_name": {to:[{field: "rsa.misc.comp_name", setter: fld_set}]}, - "comp_rbytes": {to:[{field: "rsa.misc.comp_rbytes", setter: fld_set}]}, - "comp_sbytes": {to:[{field: "rsa.misc.comp_sbytes", setter: fld_set}]}, - "component_version": {to:[{field: "rsa.misc.comp_version", setter: fld_set}]}, - "connection_id": {to:[{field: "rsa.misc.connection_id", setter: fld_prio, prio: 1}]}, - "connectionid": {to:[{field: "rsa.misc.connection_id", setter: fld_prio, prio: 0}]}, - "content": {to:[{field: "rsa.misc.content", setter: fld_set}]}, - "content_type": {to:[{field: "rsa.misc.content_type", setter: fld_set}]}, - "content_version": {to:[{field: "rsa.misc.content_version", setter: fld_set}]}, - "context": {to:[{field: "rsa.misc.context", setter: fld_set}]}, - "count": {to:[{field: "rsa.misc.count", setter: fld_set}]}, - "cpu": {convert: to_long, to:[{field: "rsa.misc.cpu", setter: fld_set}]}, - "cpu_data": {to:[{field: "rsa.misc.cpu_data", setter: fld_set}]}, - "criticality": {to:[{field: "rsa.misc.criticality", setter: fld_set}]}, - "cs_agency_dst": {to:[{field: "rsa.misc.cs_agency_dst", setter: fld_set}]}, - "cs_analyzedby": {to:[{field: "rsa.misc.cs_analyzedby", setter: fld_set}]}, - "cs_av_other": {to:[{field: "rsa.misc.cs_av_other", setter: fld_set}]}, - "cs_av_primary": {to:[{field: "rsa.misc.cs_av_primary", setter: fld_set}]}, - "cs_av_secondary": {to:[{field: "rsa.misc.cs_av_secondary", setter: fld_set}]}, - "cs_bgpv6nxthop": {to:[{field: "rsa.misc.cs_bgpv6nxthop", setter: fld_set}]}, - "cs_bit9status": {to:[{field: "rsa.misc.cs_bit9status", setter: fld_set}]}, - "cs_context": {to:[{field: "rsa.misc.cs_context", setter: fld_set}]}, - "cs_control": {to:[{field: "rsa.misc.cs_control", setter: fld_set}]}, - "cs_data": {to:[{field: "rsa.misc.cs_data", setter: fld_set}]}, - "cs_datecret": {to:[{field: "rsa.misc.cs_datecret", setter: fld_set}]}, - "cs_dst_tld": {to:[{field: "rsa.misc.cs_dst_tld", setter: fld_set}]}, - "cs_eth_dst_ven": {to:[{field: "rsa.misc.cs_eth_dst_ven", setter: fld_set}]}, - "cs_eth_src_ven": {to:[{field: "rsa.misc.cs_eth_src_ven", setter: fld_set}]}, - "cs_event_uuid": {to:[{field: "rsa.misc.cs_event_uuid", setter: fld_set}]}, - "cs_filetype": {to:[{field: "rsa.misc.cs_filetype", setter: fld_set}]}, - "cs_fld": {to:[{field: "rsa.misc.cs_fld", setter: fld_set}]}, - "cs_if_desc": {to:[{field: "rsa.misc.cs_if_desc", setter: fld_set}]}, - "cs_if_name": {to:[{field: "rsa.misc.cs_if_name", setter: fld_set}]}, - "cs_ip_next_hop": {to:[{field: "rsa.misc.cs_ip_next_hop", setter: fld_set}]}, - "cs_ipv4dstpre": {to:[{field: "rsa.misc.cs_ipv4dstpre", setter: fld_set}]}, - "cs_ipv4srcpre": {to:[{field: "rsa.misc.cs_ipv4srcpre", setter: fld_set}]}, - "cs_lifetime": {to:[{field: "rsa.misc.cs_lifetime", setter: fld_set}]}, - "cs_log_medium": {to:[{field: "rsa.misc.cs_log_medium", setter: fld_set}]}, - "cs_loginname": {to:[{field: "rsa.misc.cs_loginname", setter: fld_set}]}, - "cs_modulescore": {to:[{field: "rsa.misc.cs_modulescore", setter: fld_set}]}, - "cs_modulesign": {to:[{field: "rsa.misc.cs_modulesign", setter: fld_set}]}, - "cs_opswatresult": {to:[{field: "rsa.misc.cs_opswatresult", setter: fld_set}]}, - "cs_payload": {to:[{field: "rsa.misc.cs_payload", setter: fld_set}]}, - "cs_registrant": {to:[{field: "rsa.misc.cs_registrant", setter: fld_set}]}, - "cs_registrar": {to:[{field: "rsa.misc.cs_registrar", setter: fld_set}]}, - "cs_represult": {to:[{field: "rsa.misc.cs_represult", setter: fld_set}]}, - "cs_rpayload": {to:[{field: "rsa.misc.cs_rpayload", setter: fld_set}]}, - "cs_sampler_name": {to:[{field: "rsa.misc.cs_sampler_name", setter: fld_set}]}, - "cs_sourcemodule": {to:[{field: "rsa.misc.cs_sourcemodule", setter: fld_set}]}, - "cs_streams": {to:[{field: "rsa.misc.cs_streams", setter: fld_set}]}, - "cs_targetmodule": {to:[{field: "rsa.misc.cs_targetmodule", setter: fld_set}]}, - "cs_v6nxthop": {to:[{field: "rsa.misc.cs_v6nxthop", setter: fld_set}]}, - "cs_whois_server": {to:[{field: "rsa.misc.cs_whois_server", setter: fld_set}]}, - "cs_yararesult": {to:[{field: "rsa.misc.cs_yararesult", setter: fld_set}]}, - "cve": {to:[{field: "rsa.misc.cve", setter: fld_set}]}, - "d_certauth": {to:[{field: "rsa.crypto.d_certauth", setter: fld_set}]}, - "d_cipher": {to:[{field: "rsa.crypto.cipher_dst", setter: fld_set}]}, - "d_ciphersize": {convert: to_long, to:[{field: "rsa.crypto.cipher_size_dst", setter: fld_set}]}, - "d_sslver": {to:[{field: "rsa.crypto.ssl_ver_dst", setter: fld_set}]}, - "data": {to:[{field: "rsa.internal.data", setter: fld_set}]}, - "data_type": {to:[{field: "rsa.misc.data_type", setter: fld_set}]}, - "date": {to:[{field: "rsa.time.date", setter: fld_set}]}, - "datetime": {to:[{field: "rsa.time.datetime", setter: fld_set}]}, - "day": {to:[{field: "rsa.time.day", setter: fld_set}]}, - "db_id": {to:[{field: "rsa.db.db_id", setter: fld_set}]}, - "db_name": {to:[{field: "rsa.db.database", setter: fld_set}]}, - "db_pid": {convert: to_long, to:[{field: "rsa.db.db_pid", setter: fld_set}]}, - "dclass_counter1": {convert: to_long, to:[{field: "rsa.counters.dclass_c1", setter: fld_set}]}, - "dclass_counter1_string": {to:[{field: "rsa.counters.dclass_c1_str", setter: fld_set}]}, - "dclass_counter2": {convert: to_long, to:[{field: "rsa.counters.dclass_c2", setter: fld_set}]}, - "dclass_counter2_string": {to:[{field: "rsa.counters.dclass_c2_str", setter: fld_set}]}, - "dclass_counter3": {convert: to_long, to:[{field: "rsa.counters.dclass_c3", setter: fld_set}]}, - "dclass_counter3_string": {to:[{field: "rsa.counters.dclass_c3_str", setter: fld_set}]}, - "dclass_ratio1": {to:[{field: "rsa.counters.dclass_r1", setter: fld_set}]}, - "dclass_ratio1_string": {to:[{field: "rsa.counters.dclass_r1_str", setter: fld_set}]}, - "dclass_ratio2": {to:[{field: "rsa.counters.dclass_r2", setter: fld_set}]}, - "dclass_ratio2_string": {to:[{field: "rsa.counters.dclass_r2_str", setter: fld_set}]}, - "dclass_ratio3": {to:[{field: "rsa.counters.dclass_r3", setter: fld_set}]}, - "dclass_ratio3_string": {to:[{field: "rsa.counters.dclass_r3_str", setter: fld_set}]}, - "dead": {convert: to_long, to:[{field: "rsa.internal.dead", setter: fld_set}]}, - "description": {to:[{field: "rsa.misc.description", setter: fld_set}]}, - "detail": {to:[{field: "rsa.misc.event_desc", setter: fld_set}]}, - "device": {to:[{field: "rsa.misc.device_name", setter: fld_set}]}, - "device.class": {to:[{field: "rsa.internal.device_class", setter: fld_set}]}, - "device.group": {to:[{field: "rsa.internal.device_group", setter: fld_set}]}, - "device.host": {to:[{field: "rsa.internal.device_host", setter: fld_set}]}, - "device.ip": {convert: to_ip, to:[{field: "rsa.internal.device_ip", setter: fld_set}]}, - "device.ipv6": {convert: to_ip, to:[{field: "rsa.internal.device_ipv6", setter: fld_set}]}, - "device.type": {to:[{field: "rsa.internal.device_type", setter: fld_set}]}, - "device.type.id": {convert: to_long, to:[{field: "rsa.internal.device_type_id", setter: fld_set}]}, - "devicehostname": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "devvendor": {to:[{field: "rsa.misc.devvendor", setter: fld_set}]}, - "dhost": {to:[{field: "rsa.network.host_dst", setter: fld_set}]}, - "did": {to:[{field: "rsa.internal.did", setter: fld_set}]}, - "dinterface": {to:[{field: "rsa.network.dinterface", setter: fld_set}]}, - "directory.dst": {to:[{field: "rsa.file.directory_dst", setter: fld_set}]}, - "directory.src": {to:[{field: "rsa.file.directory_src", setter: fld_set}]}, - "disk_volume": {to:[{field: "rsa.storage.disk_volume", setter: fld_set}]}, - "disposition": {to:[{field: "rsa.misc.disposition", setter: fld_set}]}, - "distance": {to:[{field: "rsa.misc.distance", setter: fld_set}]}, - "dmask": {to:[{field: "rsa.network.dmask", setter: fld_set}]}, - "dn": {to:[{field: "rsa.identity.dn", setter: fld_set}]}, - "dns_a_record": {to:[{field: "rsa.network.dns_a_record", setter: fld_set}]}, - "dns_cname_record": {to:[{field: "rsa.network.dns_cname_record", setter: fld_set}]}, - "dns_id": {to:[{field: "rsa.network.dns_id", setter: fld_set}]}, - "dns_opcode": {to:[{field: "rsa.network.dns_opcode", setter: fld_set}]}, - "dns_ptr_record": {to:[{field: "rsa.network.dns_ptr_record", setter: fld_set}]}, - "dns_resp": {to:[{field: "rsa.network.dns_resp", setter: fld_set}]}, - "dns_type": {to:[{field: "rsa.network.dns_type", setter: fld_set}]}, - "doc_number": {convert: to_long, to:[{field: "rsa.misc.doc_number", setter: fld_set}]}, - "domain": {to:[{field: "rsa.network.domain", setter: fld_set}]}, - "domain1": {to:[{field: "rsa.network.domain1", setter: fld_set}]}, - "dst_dn": {to:[{field: "rsa.identity.dn_dst", setter: fld_set}]}, - "dst_payload": {to:[{field: "rsa.misc.payload_dst", setter: fld_set}]}, - "dst_spi": {to:[{field: "rsa.misc.spi_dst", setter: fld_set}]}, - "dst_zone": {to:[{field: "rsa.network.zone_dst", setter: fld_set}]}, - "dstburb": {to:[{field: "rsa.misc.dstburb", setter: fld_set}]}, - "duration": {convert: to_double, to:[{field: "rsa.time.duration_time", setter: fld_set}]}, - "duration_string": {to:[{field: "rsa.time.duration_str", setter: fld_set}]}, - "ec_activity": {to:[{field: "rsa.investigations.ec_activity", setter: fld_set}]}, - "ec_outcome": {to:[{field: "rsa.investigations.ec_outcome", setter: fld_set}]}, - "ec_subject": {to:[{field: "rsa.investigations.ec_subject", setter: fld_set}]}, - "ec_theme": {to:[{field: "rsa.investigations.ec_theme", setter: fld_set}]}, - "edomain": {to:[{field: "rsa.misc.edomain", setter: fld_set}]}, - "edomaub": {to:[{field: "rsa.misc.edomaub", setter: fld_set}]}, - "effective_time": {convert: to_date, to:[{field: "rsa.time.effective_time", setter: fld_set}]}, - "ein.number": {convert: to_long, to:[{field: "rsa.misc.ein_number", setter: fld_set}]}, - "email": {to:[{field: "rsa.email.email", setter: fld_append}]}, - "encryption_type": {to:[{field: "rsa.crypto.crypto", setter: fld_set}]}, - "endtime": {convert: to_date, to:[{field: "rsa.time.endtime", setter: fld_set}]}, - "entropy.req": {convert: to_long, to:[{field: "rsa.internal.entropy_req", setter: fld_set}]}, - "entropy.res": {convert: to_long, to:[{field: "rsa.internal.entropy_res", setter: fld_set}]}, - "entry": {to:[{field: "rsa.internal.entry", setter: fld_set}]}, - "eoc": {to:[{field: "rsa.investigations.eoc", setter: fld_set}]}, - "error": {to:[{field: "rsa.misc.error", setter: fld_set}]}, - "eth_type": {convert: to_long, to:[{field: "rsa.network.eth_type", setter: fld_set}]}, - "euid": {to:[{field: "rsa.misc.euid", setter: fld_set}]}, - "event.cat": {convert: to_long, to:[{field: "rsa.investigations.event_cat", setter: fld_prio, prio: 1}]}, - "event.cat.name": {to:[{field: "rsa.investigations.event_cat_name", setter: fld_prio, prio: 1}]}, - "event_cat": {convert: to_long, to:[{field: "rsa.investigations.event_cat", setter: fld_prio, prio: 0}]}, - "event_cat_name": {to:[{field: "rsa.investigations.event_cat_name", setter: fld_prio, prio: 0}]}, - "event_category": {to:[{field: "rsa.misc.event_category", setter: fld_set}]}, - "event_computer": {to:[{field: "rsa.misc.event_computer", setter: fld_set}]}, - "event_counter": {convert: to_long, to:[{field: "rsa.counters.event_counter", setter: fld_set}]}, - "event_description": {to:[{field: "rsa.internal.event_desc", setter: fld_set}]}, - "event_id": {to:[{field: "rsa.misc.event_id", setter: fld_set}]}, - "event_log": {to:[{field: "rsa.misc.event_log", setter: fld_set}]}, - "event_name": {to:[{field: "rsa.internal.event_name", setter: fld_set}]}, - "event_queue_time": {convert: to_date, to:[{field: "rsa.time.event_queue_time", setter: fld_set}]}, - "event_source": {to:[{field: "rsa.misc.event_source", setter: fld_set}]}, - "event_state": {to:[{field: "rsa.misc.event_state", setter: fld_set}]}, - "event_time": {convert: to_date, to:[{field: "rsa.time.event_time", setter: fld_set}]}, - "event_time_str": {to:[{field: "rsa.time.event_time_str", setter: fld_prio, prio: 1}]}, - "event_time_string": {to:[{field: "rsa.time.event_time_str", setter: fld_prio, prio: 0}]}, - "event_type": {to:[{field: "rsa.misc.event_type", setter: fld_set}]}, - "event_user": {to:[{field: "rsa.misc.event_user", setter: fld_set}]}, - "eventtime": {to:[{field: "rsa.time.eventtime", setter: fld_set}]}, - "expected_val": {to:[{field: "rsa.misc.expected_val", setter: fld_set}]}, - "expiration_time": {convert: to_date, to:[{field: "rsa.time.expire_time", setter: fld_set}]}, - "expiration_time_string": {to:[{field: "rsa.time.expire_time_str", setter: fld_set}]}, - "facility": {to:[{field: "rsa.misc.facility", setter: fld_set}]}, - "facilityname": {to:[{field: "rsa.misc.facilityname", setter: fld_set}]}, - "faddr": {to:[{field: "rsa.network.faddr", setter: fld_set}]}, - "fcatnum": {to:[{field: "rsa.misc.fcatnum", setter: fld_set}]}, - "federated_idp": {to:[{field: "rsa.identity.federated_idp", setter: fld_set}]}, - "federated_sp": {to:[{field: "rsa.identity.federated_sp", setter: fld_set}]}, - "feed.category": {to:[{field: "rsa.internal.feed_category", setter: fld_set}]}, - "feed_desc": {to:[{field: "rsa.internal.feed_desc", setter: fld_set}]}, - "feed_name": {to:[{field: "rsa.internal.feed_name", setter: fld_set}]}, - "fhost": {to:[{field: "rsa.network.fhost", setter: fld_set}]}, - "file_entropy": {convert: to_double, to:[{field: "rsa.file.file_entropy", setter: fld_set}]}, - "file_vendor": {to:[{field: "rsa.file.file_vendor", setter: fld_set}]}, - "filename_dst": {to:[{field: "rsa.file.filename_dst", setter: fld_set}]}, - "filename_src": {to:[{field: "rsa.file.filename_src", setter: fld_set}]}, - "filename_tmp": {to:[{field: "rsa.file.filename_tmp", setter: fld_set}]}, - "filesystem": {to:[{field: "rsa.file.filesystem", setter: fld_set}]}, - "filter": {to:[{field: "rsa.misc.filter", setter: fld_set}]}, - "finterface": {to:[{field: "rsa.misc.finterface", setter: fld_set}]}, - "flags": {to:[{field: "rsa.misc.flags", setter: fld_set}]}, - "forensic_info": {to:[{field: "rsa.misc.forensic_info", setter: fld_set}]}, - "forward.ip": {convert: to_ip, to:[{field: "rsa.internal.forward_ip", setter: fld_set}]}, - "forward.ipv6": {convert: to_ip, to:[{field: "rsa.internal.forward_ipv6", setter: fld_set}]}, - "found": {to:[{field: "rsa.misc.found", setter: fld_set}]}, - "fport": {to:[{field: "rsa.network.fport", setter: fld_set}]}, - "fqdn": {to:[{field: "rsa.web.fqdn", setter: fld_set}]}, - "fresult": {convert: to_long, to:[{field: "rsa.misc.fresult", setter: fld_set}]}, - "from": {to:[{field: "rsa.email.email_src", setter: fld_set}]}, - "gaddr": {to:[{field: "rsa.misc.gaddr", setter: fld_set}]}, - "gateway": {to:[{field: "rsa.network.gateway", setter: fld_set}]}, - "gmtdate": {to:[{field: "rsa.time.gmtdate", setter: fld_set}]}, - "gmttime": {to:[{field: "rsa.time.gmttime", setter: fld_set}]}, - "group": {to:[{field: "rsa.misc.group", setter: fld_set}]}, - "group_object": {to:[{field: "rsa.misc.group_object", setter: fld_set}]}, - "groupid": {to:[{field: "rsa.misc.group_id", setter: fld_set}]}, - "h_code": {to:[{field: "rsa.internal.hcode", setter: fld_set}]}, - "hardware_id": {to:[{field: "rsa.misc.hardware_id", setter: fld_set}]}, - "header.id": {to:[{field: "rsa.internal.header_id", setter: fld_set}]}, - "host.orig": {to:[{field: "rsa.network.host_orig", setter: fld_set}]}, - "host.state": {to:[{field: "rsa.endpoint.host_state", setter: fld_set}]}, - "host.type": {to:[{field: "rsa.network.host_type", setter: fld_set}]}, - "host_role": {to:[{field: "rsa.identity.host_role", setter: fld_set}]}, - "hostid": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "hostname": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "hour": {to:[{field: "rsa.time.hour", setter: fld_set}]}, - "https.insact": {to:[{field: "rsa.crypto.https_insact", setter: fld_set}]}, - "https.valid": {to:[{field: "rsa.crypto.https_valid", setter: fld_set}]}, - "icmpcode": {convert: to_long, to:[{field: "rsa.network.icmp_code", setter: fld_set}]}, - "icmptype": {convert: to_long, to:[{field: "rsa.network.icmp_type", setter: fld_set}]}, - "id": {to:[{field: "rsa.misc.reference_id", setter: fld_set}]}, - "id1": {to:[{field: "rsa.misc.reference_id1", setter: fld_set}]}, - "id2": {to:[{field: "rsa.misc.reference_id2", setter: fld_set}]}, - "id3": {to:[{field: "rsa.misc.id3", setter: fld_set}]}, - "ike": {to:[{field: "rsa.crypto.ike", setter: fld_set}]}, - "ike_cookie1": {to:[{field: "rsa.crypto.ike_cookie1", setter: fld_set}]}, - "ike_cookie2": {to:[{field: "rsa.crypto.ike_cookie2", setter: fld_set}]}, - "im_buddyid": {to:[{field: "rsa.misc.im_buddyid", setter: fld_set}]}, - "im_buddyname": {to:[{field: "rsa.misc.im_buddyname", setter: fld_set}]}, - "im_client": {to:[{field: "rsa.misc.im_client", setter: fld_set}]}, - "im_croomid": {to:[{field: "rsa.misc.im_croomid", setter: fld_set}]}, - "im_croomtype": {to:[{field: "rsa.misc.im_croomtype", setter: fld_set}]}, - "im_members": {to:[{field: "rsa.misc.im_members", setter: fld_set}]}, - "im_userid": {to:[{field: "rsa.misc.im_userid", setter: fld_set}]}, - "im_username": {to:[{field: "rsa.misc.im_username", setter: fld_set}]}, - "index": {to:[{field: "rsa.misc.index", setter: fld_set}]}, - "info": {to:[{field: "rsa.db.index", setter: fld_set}]}, - "inode": {convert: to_long, to:[{field: "rsa.internal.inode", setter: fld_set}]}, - "inout": {to:[{field: "rsa.misc.inout", setter: fld_set}]}, - "instance": {to:[{field: "rsa.db.instance", setter: fld_set}]}, - "interface": {to:[{field: "rsa.network.interface", setter: fld_set}]}, - "inv.category": {to:[{field: "rsa.investigations.inv_category", setter: fld_set}]}, - "inv.context": {to:[{field: "rsa.investigations.inv_context", setter: fld_set}]}, - "ioc": {to:[{field: "rsa.investigations.ioc", setter: fld_set}]}, - "ip_proto": {convert: to_long, to:[{field: "rsa.network.ip_proto", setter: fld_set}]}, - "ipkt": {to:[{field: "rsa.misc.ipkt", setter: fld_set}]}, - "ipscat": {to:[{field: "rsa.misc.ipscat", setter: fld_set}]}, - "ipspri": {to:[{field: "rsa.misc.ipspri", setter: fld_set}]}, - "jobname": {to:[{field: "rsa.misc.jobname", setter: fld_set}]}, - "jobnum": {to:[{field: "rsa.misc.job_num", setter: fld_set}]}, - "laddr": {to:[{field: "rsa.network.laddr", setter: fld_set}]}, - "language": {to:[{field: "rsa.misc.language", setter: fld_set}]}, - "latitude": {to:[{field: "rsa.misc.latitude", setter: fld_set}]}, - "lc.cid": {to:[{field: "rsa.internal.lc_cid", setter: fld_set}]}, - "lc.ctime": {convert: to_date, to:[{field: "rsa.internal.lc_ctime", setter: fld_set}]}, - "ldap": {to:[{field: "rsa.identity.ldap", setter: fld_set}]}, - "ldap.query": {to:[{field: "rsa.identity.ldap_query", setter: fld_set}]}, - "ldap.response": {to:[{field: "rsa.identity.ldap_response", setter: fld_set}]}, - "level": {convert: to_long, to:[{field: "rsa.internal.level", setter: fld_set}]}, - "lhost": {to:[{field: "rsa.network.lhost", setter: fld_set}]}, - "library": {to:[{field: "rsa.misc.library", setter: fld_set}]}, - "lifetime": {convert: to_long, to:[{field: "rsa.misc.lifetime", setter: fld_set}]}, - "linenum": {to:[{field: "rsa.misc.linenum", setter: fld_set}]}, - "link": {to:[{field: "rsa.misc.link", setter: fld_set}]}, - "linterface": {to:[{field: "rsa.network.linterface", setter: fld_set}]}, - "list_name": {to:[{field: "rsa.misc.list_name", setter: fld_set}]}, - "listnum": {to:[{field: "rsa.misc.listnum", setter: fld_set}]}, - "load_data": {to:[{field: "rsa.misc.load_data", setter: fld_set}]}, - "location_floor": {to:[{field: "rsa.misc.location_floor", setter: fld_set}]}, - "location_mark": {to:[{field: "rsa.misc.location_mark", setter: fld_set}]}, - "log_id": {to:[{field: "rsa.misc.log_id", setter: fld_set}]}, - "log_type": {to:[{field: "rsa.misc.log_type", setter: fld_set}]}, - "logid": {to:[{field: "rsa.misc.logid", setter: fld_set}]}, - "logip": {to:[{field: "rsa.misc.logip", setter: fld_set}]}, - "logname": {to:[{field: "rsa.misc.logname", setter: fld_set}]}, - "logon_type": {to:[{field: "rsa.identity.logon_type", setter: fld_set}]}, - "logon_type_desc": {to:[{field: "rsa.identity.logon_type_desc", setter: fld_set}]}, - "longitude": {to:[{field: "rsa.misc.longitude", setter: fld_set}]}, - "lport": {to:[{field: "rsa.misc.lport", setter: fld_set}]}, - "lread": {convert: to_long, to:[{field: "rsa.db.lread", setter: fld_set}]}, - "lun": {to:[{field: "rsa.storage.lun", setter: fld_set}]}, - "lwrite": {convert: to_long, to:[{field: "rsa.db.lwrite", setter: fld_set}]}, - "macaddr": {convert: to_mac, to:[{field: "rsa.network.eth_host", setter: fld_set}]}, - "mail_id": {to:[{field: "rsa.misc.mail_id", setter: fld_set}]}, - "mask": {to:[{field: "rsa.network.mask", setter: fld_set}]}, - "match": {to:[{field: "rsa.misc.match", setter: fld_set}]}, - "mbug_data": {to:[{field: "rsa.misc.mbug_data", setter: fld_set}]}, - "mcb.req": {convert: to_long, to:[{field: "rsa.internal.mcb_req", setter: fld_set}]}, - "mcb.res": {convert: to_long, to:[{field: "rsa.internal.mcb_res", setter: fld_set}]}, - "mcbc.req": {convert: to_long, to:[{field: "rsa.internal.mcbc_req", setter: fld_set}]}, - "mcbc.res": {convert: to_long, to:[{field: "rsa.internal.mcbc_res", setter: fld_set}]}, - "medium": {convert: to_long, to:[{field: "rsa.internal.medium", setter: fld_set}]}, - "message": {to:[{field: "rsa.internal.message", setter: fld_set}]}, - "message_body": {to:[{field: "rsa.misc.message_body", setter: fld_set}]}, - "messageid": {to:[{field: "rsa.internal.messageid", setter: fld_set}]}, - "min": {to:[{field: "rsa.time.min", setter: fld_set}]}, - "misc": {to:[{field: "rsa.misc.misc", setter: fld_set}]}, - "misc_name": {to:[{field: "rsa.misc.misc_name", setter: fld_set}]}, - "mode": {to:[{field: "rsa.misc.mode", setter: fld_set}]}, - "month": {to:[{field: "rsa.time.month", setter: fld_set}]}, - "msg": {to:[{field: "rsa.internal.msg", setter: fld_set}]}, - "msgIdPart1": {to:[{field: "rsa.misc.msgIdPart1", setter: fld_set}]}, - "msgIdPart2": {to:[{field: "rsa.misc.msgIdPart2", setter: fld_set}]}, - "msgIdPart3": {to:[{field: "rsa.misc.msgIdPart3", setter: fld_set}]}, - "msgIdPart4": {to:[{field: "rsa.misc.msgIdPart4", setter: fld_set}]}, - "msg_id": {to:[{field: "rsa.internal.msg_id", setter: fld_set}]}, - "msg_type": {to:[{field: "rsa.misc.msg_type", setter: fld_set}]}, - "msgid": {to:[{field: "rsa.misc.msgid", setter: fld_set}]}, - "name": {to:[{field: "rsa.misc.name", setter: fld_set}]}, - "netname": {to:[{field: "rsa.network.netname", setter: fld_set}]}, - "netsessid": {to:[{field: "rsa.misc.netsessid", setter: fld_set}]}, - "network_port": {convert: to_long, to:[{field: "rsa.network.network_port", setter: fld_set}]}, - "network_service": {to:[{field: "rsa.network.network_service", setter: fld_set}]}, - "node": {to:[{field: "rsa.misc.node", setter: fld_set}]}, - "nodename": {to:[{field: "rsa.internal.node_name", setter: fld_set}]}, - "ntype": {to:[{field: "rsa.misc.ntype", setter: fld_set}]}, - "num": {to:[{field: "rsa.misc.num", setter: fld_set}]}, - "number": {to:[{field: "rsa.misc.number", setter: fld_set}]}, - "number1": {to:[{field: "rsa.misc.number1", setter: fld_set}]}, - "number2": {to:[{field: "rsa.misc.number2", setter: fld_set}]}, - "nwe.callback_id": {to:[{field: "rsa.internal.nwe_callback_id", setter: fld_set}]}, - "nwwn": {to:[{field: "rsa.misc.nwwn", setter: fld_set}]}, - "obj_id": {to:[{field: "rsa.internal.obj_id", setter: fld_set}]}, - "obj_name": {to:[{field: "rsa.misc.obj_name", setter: fld_set}]}, - "obj_server": {to:[{field: "rsa.internal.obj_server", setter: fld_set}]}, - "obj_type": {to:[{field: "rsa.misc.obj_type", setter: fld_set}]}, - "obj_value": {to:[{field: "rsa.internal.obj_val", setter: fld_set}]}, - "object": {to:[{field: "rsa.misc.object", setter: fld_set}]}, - "observed_val": {to:[{field: "rsa.misc.observed_val", setter: fld_set}]}, - "operation": {to:[{field: "rsa.misc.operation", setter: fld_set}]}, - "operation_id": {to:[{field: "rsa.misc.operation_id", setter: fld_set}]}, - "opkt": {to:[{field: "rsa.misc.opkt", setter: fld_set}]}, - "org.dst": {to:[{field: "rsa.physical.org_dst", setter: fld_prio, prio: 1}]}, - "org.src": {to:[{field: "rsa.physical.org_src", setter: fld_set}]}, - "org_dst": {to:[{field: "rsa.physical.org_dst", setter: fld_prio, prio: 0}]}, - "orig_from": {to:[{field: "rsa.misc.orig_from", setter: fld_set}]}, - "origin": {to:[{field: "rsa.network.origin", setter: fld_set}]}, - "original_owner": {to:[{field: "rsa.identity.owner", setter: fld_set}]}, - "os": {to:[{field: "rsa.misc.OS", setter: fld_set}]}, - "owner_id": {to:[{field: "rsa.misc.owner_id", setter: fld_set}]}, - "p_action": {to:[{field: "rsa.misc.p_action", setter: fld_set}]}, - "p_date": {to:[{field: "rsa.time.p_date", setter: fld_set}]}, - "p_filter": {to:[{field: "rsa.misc.p_filter", setter: fld_set}]}, - "p_group_object": {to:[{field: "rsa.misc.p_group_object", setter: fld_set}]}, - "p_id": {to:[{field: "rsa.misc.p_id", setter: fld_set}]}, - "p_month": {to:[{field: "rsa.time.p_month", setter: fld_set}]}, - "p_msgid": {to:[{field: "rsa.misc.p_msgid", setter: fld_set}]}, - "p_msgid1": {to:[{field: "rsa.misc.p_msgid1", setter: fld_set}]}, - "p_msgid2": {to:[{field: "rsa.misc.p_msgid2", setter: fld_set}]}, - "p_result1": {to:[{field: "rsa.misc.p_result1", setter: fld_set}]}, - "p_time": {to:[{field: "rsa.time.p_time", setter: fld_set}]}, - "p_time1": {to:[{field: "rsa.time.p_time1", setter: fld_set}]}, - "p_time2": {to:[{field: "rsa.time.p_time2", setter: fld_set}]}, - "p_url": {to:[{field: "rsa.web.p_url", setter: fld_set}]}, - "p_user_agent": {to:[{field: "rsa.web.p_user_agent", setter: fld_set}]}, - "p_web_cookie": {to:[{field: "rsa.web.p_web_cookie", setter: fld_set}]}, - "p_web_method": {to:[{field: "rsa.web.p_web_method", setter: fld_set}]}, - "p_web_referer": {to:[{field: "rsa.web.p_web_referer", setter: fld_set}]}, - "p_year": {to:[{field: "rsa.time.p_year", setter: fld_set}]}, - "packet_length": {to:[{field: "rsa.network.packet_length", setter: fld_set}]}, - "paddr": {convert: to_ip, to:[{field: "rsa.network.paddr", setter: fld_set}]}, - "param": {to:[{field: "rsa.misc.param", setter: fld_set}]}, - "param.dst": {to:[{field: "rsa.misc.param_dst", setter: fld_set}]}, - "param.src": {to:[{field: "rsa.misc.param_src", setter: fld_set}]}, - "parent_node": {to:[{field: "rsa.misc.parent_node", setter: fld_set}]}, - "parse.error": {to:[{field: "rsa.internal.parse_error", setter: fld_set}]}, - "password": {to:[{field: "rsa.identity.password", setter: fld_set}]}, - "password_chg": {to:[{field: "rsa.misc.password_chg", setter: fld_set}]}, - "password_expire": {to:[{field: "rsa.misc.password_expire", setter: fld_set}]}, - "patient_fname": {to:[{field: "rsa.healthcare.patient_fname", setter: fld_set}]}, - "patient_id": {to:[{field: "rsa.healthcare.patient_id", setter: fld_set}]}, - "patient_lname": {to:[{field: "rsa.healthcare.patient_lname", setter: fld_set}]}, - "patient_mname": {to:[{field: "rsa.healthcare.patient_mname", setter: fld_set}]}, - "payload.req": {convert: to_long, to:[{field: "rsa.internal.payload_req", setter: fld_set}]}, - "payload.res": {convert: to_long, to:[{field: "rsa.internal.payload_res", setter: fld_set}]}, - "peer": {to:[{field: "rsa.crypto.peer", setter: fld_set}]}, - "peer_id": {to:[{field: "rsa.crypto.peer_id", setter: fld_set}]}, - "permgranted": {to:[{field: "rsa.misc.permgranted", setter: fld_set}]}, - "permissions": {to:[{field: "rsa.db.permissions", setter: fld_set}]}, - "permwanted": {to:[{field: "rsa.misc.permwanted", setter: fld_set}]}, - "pgid": {to:[{field: "rsa.misc.pgid", setter: fld_set}]}, - "phone_number": {to:[{field: "rsa.misc.phone", setter: fld_prio, prio: 2}]}, - "phost": {to:[{field: "rsa.network.phost", setter: fld_set}]}, - "pid": {to:[{field: "rsa.misc.pid", setter: fld_set}]}, - "policy": {to:[{field: "rsa.misc.policy", setter: fld_set}]}, - "policyUUID": {to:[{field: "rsa.misc.policyUUID", setter: fld_set}]}, - "policy_id": {to:[{field: "rsa.misc.policy_id", setter: fld_set}]}, - "policy_value": {to:[{field: "rsa.misc.policy_value", setter: fld_set}]}, - "policy_waiver": {to:[{field: "rsa.misc.policy_waiver", setter: fld_set}]}, - "policyname": {to:[{field: "rsa.misc.policy_name", setter: fld_prio, prio: 0}]}, - "pool_id": {to:[{field: "rsa.misc.pool_id", setter: fld_set}]}, - "pool_name": {to:[{field: "rsa.misc.pool_name", setter: fld_set}]}, - "port": {convert: to_long, to:[{field: "rsa.network.port", setter: fld_set}]}, - "portname": {to:[{field: "rsa.misc.port_name", setter: fld_set}]}, - "pread": {convert: to_long, to:[{field: "rsa.db.pread", setter: fld_set}]}, - "priority": {to:[{field: "rsa.misc.priority", setter: fld_set}]}, - "privilege": {to:[{field: "rsa.file.privilege", setter: fld_set}]}, - "process.vid.dst": {to:[{field: "rsa.internal.process_vid_dst", setter: fld_set}]}, - "process.vid.src": {to:[{field: "rsa.internal.process_vid_src", setter: fld_set}]}, - "process_id_val": {to:[{field: "rsa.misc.process_id_val", setter: fld_set}]}, - "processing_time": {to:[{field: "rsa.time.process_time", setter: fld_set}]}, - "profile": {to:[{field: "rsa.identity.profile", setter: fld_set}]}, - "prog_asp_num": {to:[{field: "rsa.misc.prog_asp_num", setter: fld_set}]}, - "program": {to:[{field: "rsa.misc.program", setter: fld_set}]}, - "protocol_detail": {to:[{field: "rsa.network.protocol_detail", setter: fld_set}]}, - "pwwn": {to:[{field: "rsa.storage.pwwn", setter: fld_set}]}, - "r_hostid": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "real_data": {to:[{field: "rsa.misc.real_data", setter: fld_set}]}, - "realm": {to:[{field: "rsa.identity.realm", setter: fld_set}]}, - "reason": {to:[{field: "rsa.misc.reason", setter: fld_set}]}, - "rec_asp_device": {to:[{field: "rsa.misc.rec_asp_device", setter: fld_set}]}, - "rec_asp_num": {to:[{field: "rsa.misc.rec_asp_num", setter: fld_set}]}, - "rec_library": {to:[{field: "rsa.misc.rec_library", setter: fld_set}]}, - "recorded_time": {convert: to_date, to:[{field: "rsa.time.recorded_time", setter: fld_set}]}, - "recordnum": {to:[{field: "rsa.misc.recordnum", setter: fld_set}]}, - "registry.key": {to:[{field: "rsa.endpoint.registry_key", setter: fld_set}]}, - "registry.value": {to:[{field: "rsa.endpoint.registry_value", setter: fld_set}]}, - "remote_domain": {to:[{field: "rsa.web.remote_domain", setter: fld_set}]}, - "remote_domain_id": {to:[{field: "rsa.network.remote_domain_id", setter: fld_set}]}, - "reputation_num": {convert: to_double, to:[{field: "rsa.web.reputation_num", setter: fld_set}]}, - "resource": {to:[{field: "rsa.internal.resource", setter: fld_set}]}, - "resource_class": {to:[{field: "rsa.internal.resource_class", setter: fld_set}]}, - "result": {to:[{field: "rsa.misc.result", setter: fld_set}]}, - "result_code": {to:[{field: "rsa.misc.result_code", setter: fld_prio, prio: 1}]}, - "resultcode": {to:[{field: "rsa.misc.result_code", setter: fld_prio, prio: 0}]}, - "rid": {convert: to_long, to:[{field: "rsa.internal.rid", setter: fld_set}]}, - "risk": {to:[{field: "rsa.misc.risk", setter: fld_set}]}, - "risk_info": {to:[{field: "rsa.misc.risk_info", setter: fld_set}]}, - "risk_num": {convert: to_double, to:[{field: "rsa.misc.risk_num", setter: fld_set}]}, - "risk_num_comm": {convert: to_double, to:[{field: "rsa.misc.risk_num_comm", setter: fld_set}]}, - "risk_num_next": {convert: to_double, to:[{field: "rsa.misc.risk_num_next", setter: fld_set}]}, - "risk_num_sand": {convert: to_double, to:[{field: "rsa.misc.risk_num_sand", setter: fld_set}]}, - "risk_num_static": {convert: to_double, to:[{field: "rsa.misc.risk_num_static", setter: fld_set}]}, - "risk_suspicious": {to:[{field: "rsa.misc.risk_suspicious", setter: fld_set}]}, - "risk_warning": {to:[{field: "rsa.misc.risk_warning", setter: fld_set}]}, - "rpayload": {to:[{field: "rsa.network.rpayload", setter: fld_set}]}, - "ruid": {to:[{field: "rsa.misc.ruid", setter: fld_set}]}, - "rule": {to:[{field: "rsa.misc.rule", setter: fld_set}]}, - "rule_group": {to:[{field: "rsa.misc.rule_group", setter: fld_set}]}, - "rule_template": {to:[{field: "rsa.misc.rule_template", setter: fld_set}]}, - "rule_uid": {to:[{field: "rsa.misc.rule_uid", setter: fld_set}]}, - "rulename": {to:[{field: "rsa.misc.rule_name", setter: fld_set}]}, - "s_certauth": {to:[{field: "rsa.crypto.s_certauth", setter: fld_set}]}, - "s_cipher": {to:[{field: "rsa.crypto.cipher_src", setter: fld_set}]}, - "s_ciphersize": {convert: to_long, to:[{field: "rsa.crypto.cipher_size_src", setter: fld_set}]}, - "s_context": {to:[{field: "rsa.misc.context_subject", setter: fld_set}]}, - "s_sslver": {to:[{field: "rsa.crypto.ssl_ver_src", setter: fld_set}]}, - "sburb": {to:[{field: "rsa.misc.sburb", setter: fld_set}]}, - "scheme": {to:[{field: "rsa.crypto.scheme", setter: fld_set}]}, - "sdomain_fld": {to:[{field: "rsa.misc.sdomain_fld", setter: fld_set}]}, - "search.text": {to:[{field: "rsa.misc.search_text", setter: fld_set}]}, - "sec": {to:[{field: "rsa.misc.sec", setter: fld_set}]}, - "second": {to:[{field: "rsa.misc.second", setter: fld_set}]}, - "sensor": {to:[{field: "rsa.misc.sensor", setter: fld_set}]}, - "sensorname": {to:[{field: "rsa.misc.sensorname", setter: fld_set}]}, - "seqnum": {to:[{field: "rsa.misc.seqnum", setter: fld_set}]}, - "serial_number": {to:[{field: "rsa.misc.serial_number", setter: fld_set}]}, - "service.account": {to:[{field: "rsa.identity.service_account", setter: fld_set}]}, - "session": {to:[{field: "rsa.misc.session", setter: fld_set}]}, - "session.split": {to:[{field: "rsa.internal.session_split", setter: fld_set}]}, - "sessionid": {to:[{field: "rsa.misc.log_session_id", setter: fld_set}]}, - "sessionid1": {to:[{field: "rsa.misc.log_session_id1", setter: fld_set}]}, - "sessiontype": {to:[{field: "rsa.misc.sessiontype", setter: fld_set}]}, - "severity": {to:[{field: "rsa.misc.severity", setter: fld_set}]}, - "sid": {to:[{field: "rsa.identity.user_sid_dst", setter: fld_set}]}, - "sig.name": {to:[{field: "rsa.misc.sig_name", setter: fld_set}]}, - "sigUUID": {to:[{field: "rsa.misc.sigUUID", setter: fld_set}]}, - "sigcat": {to:[{field: "rsa.misc.sigcat", setter: fld_set}]}, - "sigid": {convert: to_long, to:[{field: "rsa.misc.sig_id", setter: fld_set}]}, - "sigid1": {convert: to_long, to:[{field: "rsa.misc.sig_id1", setter: fld_set}]}, - "sigid_string": {to:[{field: "rsa.misc.sig_id_str", setter: fld_set}]}, - "signame": {to:[{field: "rsa.misc.policy_name", setter: fld_prio, prio: 1}]}, - "sigtype": {to:[{field: "rsa.crypto.sig_type", setter: fld_set}]}, - "sinterface": {to:[{field: "rsa.network.sinterface", setter: fld_set}]}, - "site": {to:[{field: "rsa.internal.site", setter: fld_set}]}, - "size": {convert: to_long, to:[{field: "rsa.internal.size", setter: fld_set}]}, - "smask": {to:[{field: "rsa.network.smask", setter: fld_set}]}, - "snmp.oid": {to:[{field: "rsa.misc.snmp_oid", setter: fld_set}]}, - "snmp.value": {to:[{field: "rsa.misc.snmp_value", setter: fld_set}]}, - "sourcefile": {to:[{field: "rsa.internal.sourcefile", setter: fld_set}]}, - "space": {to:[{field: "rsa.misc.space", setter: fld_set}]}, - "space1": {to:[{field: "rsa.misc.space1", setter: fld_set}]}, - "spi": {to:[{field: "rsa.misc.spi", setter: fld_set}]}, - "sql": {to:[{field: "rsa.misc.sql", setter: fld_set}]}, - "src_dn": {to:[{field: "rsa.identity.dn_src", setter: fld_set}]}, - "src_payload": {to:[{field: "rsa.misc.payload_src", setter: fld_set}]}, - "src_spi": {to:[{field: "rsa.misc.spi_src", setter: fld_set}]}, - "src_zone": {to:[{field: "rsa.network.zone_src", setter: fld_set}]}, - "srcburb": {to:[{field: "rsa.misc.srcburb", setter: fld_set}]}, - "srcdom": {to:[{field: "rsa.misc.srcdom", setter: fld_set}]}, - "srcservice": {to:[{field: "rsa.misc.srcservice", setter: fld_set}]}, - "ssid": {to:[{field: "rsa.wireless.wlan_ssid", setter: fld_prio, prio: 0}]}, - "stamp": {convert: to_date, to:[{field: "rsa.time.stamp", setter: fld_set}]}, - "starttime": {convert: to_date, to:[{field: "rsa.time.starttime", setter: fld_set}]}, - "state": {to:[{field: "rsa.misc.state", setter: fld_set}]}, - "statement": {to:[{field: "rsa.internal.statement", setter: fld_set}]}, - "status": {to:[{field: "rsa.misc.status", setter: fld_set}]}, - "status1": {to:[{field: "rsa.misc.status1", setter: fld_set}]}, - "streams": {convert: to_long, to:[{field: "rsa.misc.streams", setter: fld_set}]}, - "subcategory": {to:[{field: "rsa.misc.subcategory", setter: fld_set}]}, - "subject": {to:[{field: "rsa.email.subject", setter: fld_set}]}, - "svcno": {to:[{field: "rsa.misc.svcno", setter: fld_set}]}, - "system": {to:[{field: "rsa.misc.system", setter: fld_set}]}, - "t_context": {to:[{field: "rsa.misc.context_target", setter: fld_set}]}, - "task_name": {to:[{field: "rsa.file.task_name", setter: fld_set}]}, - "tbdstr1": {to:[{field: "rsa.misc.tbdstr1", setter: fld_set}]}, - "tbdstr2": {to:[{field: "rsa.misc.tbdstr2", setter: fld_set}]}, - "tbl_name": {to:[{field: "rsa.db.table_name", setter: fld_set}]}, - "tcp_flags": {convert: to_long, to:[{field: "rsa.misc.tcp_flags", setter: fld_set}]}, - "terminal": {to:[{field: "rsa.misc.terminal", setter: fld_set}]}, - "tgtdom": {to:[{field: "rsa.misc.tgtdom", setter: fld_set}]}, - "tgtdomain": {to:[{field: "rsa.misc.tgtdomain", setter: fld_set}]}, - "threat_name": {to:[{field: "rsa.threat.threat_category", setter: fld_set}]}, - "threat_source": {to:[{field: "rsa.threat.threat_source", setter: fld_set}]}, - "threat_val": {to:[{field: "rsa.threat.threat_desc", setter: fld_set}]}, - "threshold": {to:[{field: "rsa.misc.threshold", setter: fld_set}]}, - "time": {convert: to_date, to:[{field: "rsa.internal.time", setter: fld_set}]}, - "timestamp": {to:[{field: "rsa.time.timestamp", setter: fld_set}]}, - "timezone": {to:[{field: "rsa.time.timezone", setter: fld_set}]}, - "to": {to:[{field: "rsa.email.email_dst", setter: fld_set}]}, - "tos": {convert: to_long, to:[{field: "rsa.misc.tos", setter: fld_set}]}, - "trans_from": {to:[{field: "rsa.email.trans_from", setter: fld_set}]}, - "trans_id": {to:[{field: "rsa.db.transact_id", setter: fld_set}]}, - "trans_to": {to:[{field: "rsa.email.trans_to", setter: fld_set}]}, - "trigger_desc": {to:[{field: "rsa.misc.trigger_desc", setter: fld_set}]}, - "trigger_val": {to:[{field: "rsa.misc.trigger_val", setter: fld_set}]}, - "type": {to:[{field: "rsa.misc.type", setter: fld_set}]}, - "type1": {to:[{field: "rsa.misc.type1", setter: fld_set}]}, - "tzone": {to:[{field: "rsa.time.tzone", setter: fld_set}]}, - "ubc.req": {convert: to_long, to:[{field: "rsa.internal.ubc_req", setter: fld_set}]}, - "ubc.res": {convert: to_long, to:[{field: "rsa.internal.ubc_res", setter: fld_set}]}, - "udb_class": {to:[{field: "rsa.misc.udb_class", setter: fld_set}]}, - "url_fld": {to:[{field: "rsa.misc.url_fld", setter: fld_set}]}, - "urlpage": {to:[{field: "rsa.web.urlpage", setter: fld_set}]}, - "urlroot": {to:[{field: "rsa.web.urlroot", setter: fld_set}]}, - "user_address": {to:[{field: "rsa.email.email", setter: fld_append}]}, - "user_dept": {to:[{field: "rsa.identity.user_dept", setter: fld_set}]}, - "user_div": {to:[{field: "rsa.misc.user_div", setter: fld_set}]}, - "user_fname": {to:[{field: "rsa.identity.firstname", setter: fld_set}]}, - "user_lname": {to:[{field: "rsa.identity.lastname", setter: fld_set}]}, - "user_mname": {to:[{field: "rsa.identity.middlename", setter: fld_set}]}, - "user_org": {to:[{field: "rsa.identity.org", setter: fld_set}]}, - "user_role": {to:[{field: "rsa.identity.user_role", setter: fld_set}]}, - "userid": {to:[{field: "rsa.misc.userid", setter: fld_set}]}, - "username_fld": {to:[{field: "rsa.misc.username_fld", setter: fld_set}]}, - "utcstamp": {to:[{field: "rsa.misc.utcstamp", setter: fld_set}]}, - "v_instafname": {to:[{field: "rsa.misc.v_instafname", setter: fld_set}]}, - "vendor_event_cat": {to:[{field: "rsa.investigations.event_vcat", setter: fld_set}]}, - "version": {to:[{field: "rsa.misc.version", setter: fld_set}]}, - "vid": {to:[{field: "rsa.internal.msg_vid", setter: fld_set}]}, - "virt_data": {to:[{field: "rsa.misc.virt_data", setter: fld_set}]}, - "virusname": {to:[{field: "rsa.misc.virusname", setter: fld_set}]}, - "vlan": {convert: to_long, to:[{field: "rsa.network.vlan", setter: fld_set}]}, - "vlan.name": {to:[{field: "rsa.network.vlan_name", setter: fld_set}]}, - "vm_target": {to:[{field: "rsa.misc.vm_target", setter: fld_set}]}, - "vpnid": {to:[{field: "rsa.misc.vpnid", setter: fld_set}]}, - "vsys": {to:[{field: "rsa.misc.vsys", setter: fld_set}]}, - "vuln_ref": {to:[{field: "rsa.misc.vuln_ref", setter: fld_set}]}, - "web_cookie": {to:[{field: "rsa.web.web_cookie", setter: fld_set}]}, - "web_extension_tmp": {to:[{field: "rsa.web.web_extension_tmp", setter: fld_set}]}, - "web_host": {to:[{field: "rsa.web.alias_host", setter: fld_set}]}, - "web_method": {to:[{field: "rsa.misc.action", setter: fld_append}]}, - "web_page": {to:[{field: "rsa.web.web_page", setter: fld_set}]}, - "web_ref_domain": {to:[{field: "rsa.web.web_ref_domain", setter: fld_set}]}, - "web_ref_host": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "web_ref_page": {to:[{field: "rsa.web.web_ref_page", setter: fld_set}]}, - "web_ref_query": {to:[{field: "rsa.web.web_ref_query", setter: fld_set}]}, - "web_ref_root": {to:[{field: "rsa.web.web_ref_root", setter: fld_set}]}, - "wifi_channel": {convert: to_long, to:[{field: "rsa.wireless.wlan_channel", setter: fld_set}]}, - "wlan": {to:[{field: "rsa.wireless.wlan_name", setter: fld_set}]}, - "word": {to:[{field: "rsa.internal.word", setter: fld_set}]}, - "workspace_desc": {to:[{field: "rsa.misc.workspace", setter: fld_set}]}, - "workstation": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "year": {to:[{field: "rsa.time.year", setter: fld_set}]}, - "zone": {to:[{field: "rsa.network.zone", setter: fld_set}]}, - }; - - function to_date(value) { - switch (typeof (value)) { - case "object": - // This is a Date. But as it was obtained from evt.Get(), the VM - // doesn't see it as a JS Date anymore, thus value instanceof Date === false. - // Have to trust that any object here is a valid Date for Go. - return value; - case "string": - var asDate = new Date(value); - if (!isNaN(asDate)) return asDate; - } - } - - // ECMAScript 5.1 doesn't have Object.MAX_SAFE_INTEGER / Object.MIN_SAFE_INTEGER. - var maxSafeInt = Math.pow(2, 53) - 1; - var minSafeInt = -maxSafeInt; - - function to_long(value) { - var num = parseInt(value); - // Better not to index a number if it's not safe (above 53 bits). - return !isNaN(num) && minSafeInt <= num && num <= maxSafeInt ? num : undefined; - } - - function to_ip(value) { - if (value.indexOf(":") === -1) - return to_ipv4(value); - return to_ipv6(value); - } - - var ipv4_regex = /^(\d+)\.(\d+)\.(\d+)\.(\d+)$/; - var ipv6_hex_regex = /^[0-9A-Fa-f]{1,4}$/; - - function to_ipv4(value) { - var result = ipv4_regex.exec(value); - if (result == null || result.length !== 5) return; - for (var i = 1; i < 5; i++) { - var num = strictToInt(result[i]); - if (isNaN(num) || num < 0 || num > 255) return; - } - return value; - } - - function to_ipv6(value) { - var sqEnd = value.indexOf("]"); - if (sqEnd > -1) { - if (value.charAt(0) !== "[") return; - value = value.substr(1, sqEnd - 1); - } - var zoneOffset = value.indexOf("%"); - if (zoneOffset > -1) { - value = value.substr(0, zoneOffset); - } - var parts = value.split(":"); - if (parts == null || parts.length < 3 || parts.length > 8) return; - var numEmpty = 0; - var innerEmpty = 0; - for (var i = 0; i < parts.length; i++) { - if (parts[i].length === 0) { - numEmpty++; - if (i > 0 && i + 1 < parts.length) innerEmpty++; - } else if (!parts[i].match(ipv6_hex_regex) && - // Accept an IPv6 with a valid IPv4 at the end. - ((i + 1 < parts.length) || !to_ipv4(parts[i]))) { - return; - } - } - return innerEmpty === 0 && parts.length === 8 || innerEmpty === 1 ? value : undefined; - } - - function to_double(value) { - return parseFloat(value); - } - - function to_mac(value) { - // ES doesn't have a mac datatype so it's safe to ingest whatever was captured. - return value; - } - - function to_lowercase(value) { - // to_lowercase is used against keyword fields, which can accept - // any other type (numbers, dates). - return typeof(value) === "string"? value.toLowerCase() : value; - } - - function fld_set(dst, value) { - dst[this.field] = { v: value }; - } - - function fld_append(dst, value) { - if (dst[this.field] === undefined) { - dst[this.field] = { v: [value] }; - } else { - var base = dst[this.field]; - if (base.v.indexOf(value)===-1) base.v.push(value); - } - } - - function fld_prio(dst, value) { - if (dst[this.field] === undefined) { - dst[this.field] = { v: value, prio: this.prio}; - } else if(this.prio < dst[this.field].prio) { - dst[this.field].v = value; - dst[this.field].prio = this.prio; - } - } - - var valid_ecs_outcome = { - 'failure': true, - 'success': true, - 'unknown': true - }; - - function fld_ecs_outcome(dst, value) { - value = value.toLowerCase(); - if (valid_ecs_outcome[value] === undefined) { - value = 'unknown'; - } - if (dst[this.field] === undefined) { - dst[this.field] = { v: value }; - } else if (dst[this.field].v === 'unknown') { - dst[this.field] = { v: value }; - } - } - - function map_all(evt, targets, value) { - for (var i = 0; i < targets.length; i++) { - evt.Put(targets[i], value); - } - } - - function populate_fields(evt) { - var base = evt.Get(FIELDS_OBJECT); - if (base === null) return; - alternate_datetime(evt); - if (map_ecs) { - do_populate(evt, base, ecs_mappings); - } - if (map_rsa) { - do_populate(evt, base, rsa_mappings); - } - if (keep_raw) { - evt.Put("rsa.raw", base); - } - evt.Delete(FIELDS_OBJECT); - } - - var datetime_alt_components = [ - {field: "day", fmts: [[dF]]}, - {field: "year", fmts: [[dW]]}, - {field: "month", fmts: [[dB],[dG]]}, - {field: "date", fmts: [[dW,dSkip,dG,dSkip,dF],[dW,dSkip,dB,dSkip,dF],[dW,dSkip,dR,dSkip,dF]]}, - {field: "hour", fmts: [[dN]]}, - {field: "min", fmts: [[dU]]}, - {field: "secs", fmts: [[dO]]}, - {field: "time", fmts: [[dN, dSkip, dU, dSkip, dO]]}, - ]; - - function alternate_datetime(evt) { - if (evt.Get(FIELDS_PREFIX + "event_time") != null) { - return; - } - var tzOffset = tz_offset; - if (tzOffset === "event") { - tzOffset = evt.Get("event.timezone"); - } - var container = new DateContainer(tzOffset); - for (var i=0; i} %{hfld2}.%{hfld3->} %{p0}"); - - var dup2 = call({ - dest: "nwparser.payload", - fn: STRCAT, - args: [ - field("hfld4"), - constant("_appliance "), - field("p0"), - ], - }); - - var dup3 = call({ - dest: "nwparser.payload", - fn: STRCAT, - args: [ - field("hfld4"), - constant(" "), - field("p0"), - ], - }); - - var dup4 = match_copy("MESSAGE#0:flows/2_1", "nwparser.p0", "p0"); - - var dup5 = setc("eventcategory","1605020000"); - - var dup6 = setf("msg","$MSG"); - - var dup7 = setc("event_source","appliance"); - - var dup8 = setf("sensor","node"); - - var dup9 = date_time({ - dest: "event_time", - args: ["hfld2"], - fmts: [ - [dX], - ], - }); - - var dup10 = match_copy("MESSAGE#1:flows:01/1_2", "nwparser.p0", ""); - - var dup11 = match("MESSAGE#10:ids-alerts:01/1_0", "nwparser.p0", "dhost=%{dmacaddr->} direction=%{p0}"); - - var dup12 = match("MESSAGE#10:ids-alerts:01/1_1", "nwparser.p0", "shost=%{smacaddr->} direction=%{p0}"); - - var dup13 = match("MESSAGE#10:ids-alerts:01/2", "nwparser.p0", "%{direction->} protocol=%{protocol->} src=%{p0}"); - - var dup14 = match_copy("MESSAGE#10:ids-alerts:01/4", "nwparser.p0", "signame"); - - var dup15 = setc("eventcategory","1607000000"); - - var dup16 = setc("event_type","ids-alerts"); - - var dup17 = date_time({ - dest: "event_time", - args: ["fld3"], - fmts: [ - [dX], - ], - }); - - var dup18 = setc("event_type","security_event"); - - var dup19 = constant("Allow"); - - var dup20 = match("HEADER#0:0003/1_0", "nwparser.p0", "%{hfld4}_appliance %{p0}", processor_chain([ - dup2, - ])); - - var dup21 = match("HEADER#0:0003/1_1", "nwparser.p0", "%{hfld4->} %{p0}", processor_chain([ - dup3, - ])); - - var dup22 = linear_select([ - dup11, - dup12, - ]); - - var dup23 = linear_select([ - dup20, - dup21, - ]); - - var part1 = match("HEADER#0:0003/2", "nwparser.p0", "urls %{p0}"); - - var all1 = all_match({ - processors: [ - dup1, - dup23, - part1, - ], - on_success: processor_chain([ - setc("header_id","0003"), - setc("messageid","urls"), - ]), - }); - - var part2 = match("HEADER#1:0002/1_0", "nwparser.p0", "%{node}_appliance events %{p0}"); - - var part3 = match("HEADER#1:0002/1_1", "nwparser.p0", "%{node->} events %{p0}"); - - var select1 = linear_select([ - part2, - part3, - ]); - - var part4 = match_copy("HEADER#1:0002/2", "nwparser.p0", "payload"); - - var all2 = all_match({ - processors: [ - dup1, - select1, - part4, - ], - on_success: processor_chain([ - setc("header_id","0002"), - setc("messageid","events"), - ]), - }); - - var part5 = match("HEADER#2:0001/2", "nwparser.p0", "%{messageid->} %{p0}"); - - var all3 = all_match({ - processors: [ - dup1, - dup23, - part5, - ], - on_success: processor_chain([ - setc("header_id","0001"), - ]), - }); - - var part6 = match("HEADER#3:0005/1_0", "nwparser.p0", "%{hfld4}_appliance %{p0}"); - - var part7 = match("HEADER#3:0005/1_1", "nwparser.p0", "%{hfld4->} %{p0}"); - - var select2 = linear_select([ - part6, - part7, - ]); - - var part8 = match("HEADER#3:0005/2", "nwparser.p0", "%{} %{hfld5->} %{hfld6->} %{messageid->} %{p0}", processor_chain([ - call({ - dest: "nwparser.payload", - fn: STRCAT, - args: [ - field("hfld6"), - constant(" "), - field("messageid"), - constant(" "), - field("p0"), - ], - }), - ])); - - var all4 = all_match({ - processors: [ - dup1, - select2, - part8, - ], - on_success: processor_chain([ - setc("header_id","0005"), - ]), - }); - - var hdr1 = match("HEADER#4:0004", "message", "%{hfld1->} %{hfld2}.%{hfld3->} %{hfld4}_%{space->} %{messageid->} %{payload}", processor_chain([ - setc("header_id","0004"), - ])); - - var select3 = linear_select([ - all1, - all2, - all3, - all4, - hdr1, - ]); - - var part9 = match("MESSAGE#0:flows/0_0", "nwparser.payload", "%{node}_appliance %{p0}"); - - var part10 = match("MESSAGE#0:flows/0_1", "nwparser.payload", "%{node->} %{p0}"); - - var select4 = linear_select([ - part9, - part10, - ]); - - var part11 = match("MESSAGE#0:flows/1", "nwparser.p0", "flows src=%{saddr->} dst=%{daddr->} %{p0}"); - - var part12 = match("MESSAGE#0:flows/2_0", "nwparser.p0", "mac=%{dmacaddr->} %{p0}"); - - var select5 = linear_select([ - part12, - dup4, - ]); - - var part13 = match("MESSAGE#0:flows/3", "nwparser.p0", "protocol=%{protocol->} %{p0}"); - - var part14 = match("MESSAGE#0:flows/4_0", "nwparser.p0", "sport=%{sport->} dport=%{dport->} %{p0}"); - - var part15 = match("MESSAGE#0:flows/4_1", "nwparser.p0", "type=%{event_type->} %{p0}"); - - var select6 = linear_select([ - part14, - part15, - dup4, - ]); - - var part16 = match("MESSAGE#0:flows/5", "nwparser.p0", "pattern: %{fld21->} %{info}"); - - var all5 = all_match({ - processors: [ - select4, - part11, - select5, - part13, - select6, - part16, - ], - on_success: processor_chain([ - dup5, - dup6, - lookup({ - dest: "nwparser.action", - map: map_actionType, - key: field("fld21"), - }), - dup7, - dup8, - dup9, - ]), - }); - - var msg1 = msg("flows", all5); - - var part17 = match("MESSAGE#1:flows:01/0", "nwparser.payload", "%{node->} flows %{action->} src=%{saddr->} dst=%{daddr->} mac=%{smacaddr->} protocol=%{protocol->} %{p0}"); - - var part18 = match("MESSAGE#1:flows:01/1_0", "nwparser.p0", "sport=%{sport->} dport=%{dport->} "); - - var part19 = match("MESSAGE#1:flows:01/1_1", "nwparser.p0", "type=%{event_type->} "); - - var select7 = linear_select([ - part18, - part19, - dup10, - ]); - - var all6 = all_match({ - processors: [ - part17, - select7, - ], - on_success: processor_chain([ - dup5, - dup6, - dup7, - dup8, - dup9, - ]), - }); - - var msg2 = msg("flows:01", all6); - - var part20 = match("MESSAGE#2:flows:02", "nwparser.payload", "%{node->} flows %{action}", processor_chain([ - dup5, - dup6, - dup7, - dup8, - dup9, - ])); - - var msg3 = msg("flows:02", part20); - - var select8 = linear_select([ - msg1, - msg2, - msg3, - ]); - - var part21 = match("MESSAGE#3:urls/0_0", "nwparser.payload", "%{node}_appliance urls src=%{p0}"); - - var part22 = match("MESSAGE#3:urls/0_1", "nwparser.payload", "%{node->} urls src=%{p0}"); - - var part23 = match("MESSAGE#3:urls/0_2", "nwparser.payload", "src=%{p0}"); - - var select9 = linear_select([ - part21, - part22, - part23, - ]); - - var part24 = match("MESSAGE#3:urls/1", "nwparser.p0", "%{sport}:%{saddr->} dst=%{daddr}:%{dport->} mac=%{macaddr->} %{p0}"); - - var part25 = match("MESSAGE#3:urls/2_0", "nwparser.p0", "agent='%{user_agent}' request: %{p0}"); - - var part26 = match("MESSAGE#3:urls/2_1", "nwparser.p0", "agent=%{user_agent->} request: %{p0}"); - - var part27 = match("MESSAGE#3:urls/2_2", "nwparser.p0", "request: %{p0}"); - - var select10 = linear_select([ - part25, - part26, - part27, - ]); - - var part28 = match("MESSAGE#3:urls/3", "nwparser.p0", "%{} %{web_method}%{url}"); - - var all7 = all_match({ - processors: [ - select9, - part24, - select10, - part28, - ], - on_success: processor_chain([ - dup5, - dup6, - dup7, - dup8, - dup9, - ]), - }); - - var msg4 = msg("urls", all7); - - var part29 = match("MESSAGE#4:events/0", "nwparser.payload", "dhcp lease of ip %{saddr->} from server mac %{smacaddr->} for client mac %{p0}"); - - var part30 = match("MESSAGE#4:events/1_0", "nwparser.p0", "%{dmacaddr->} with hostname %{hostname->} from router %{p0}"); - - var part31 = match("MESSAGE#4:events/1_1", "nwparser.p0", "%{dmacaddr->} from router %{p0}"); - - var select11 = linear_select([ - part30, - part31, - ]); - - var part32 = match("MESSAGE#4:events/2", "nwparser.p0", "%{hostip->} on subnet %{mask->} with dns %{dns_a_record}"); - - var all8 = all_match({ - processors: [ - part29, - select11, - part32, - ], - on_success: processor_chain([ - dup5, - dup6, - dup7, - dup8, - dup9, - ]), - }); - - var msg5 = msg("events", all8); - - var part33 = match("MESSAGE#5:events:02/0", "nwparser.payload", "content_filtering_block url='%{url}' category0='%{category}' server='%{daddr}:%{dport}'%{p0}"); - - var part34 = match("MESSAGE#5:events:02/1_0", "nwparser.p0", " client_mac='%{dmacaddr}'"); - - var select12 = linear_select([ - part34, - dup10, - ]); - - var all9 = all_match({ - processors: [ - part33, - select12, - ], - on_success: processor_chain([ - dup5, - dup6, - setc("event_description","content_filtering_block"), - dup8, - dup9, - ]), - }); - - var msg6 = msg("events:02", all9); - - var part35 = tagval("MESSAGE#6:events:01", "nwparser.payload", tvm, { - "aid": "fld1", - "arp_resp": "fld2", - "arp_src": "fld3", - "auth_neg_dur": "fld4", - "auth_neg_failed": "fld5", - "category0": "category", - "channel": "fld6", - "client_ip": "daddr", - "client_mac": "dmacaddr", - "connectivity": "fld28", - "dhcp_ip": "fld23", - "dhcp_lease_completed": "fld22", - "dhcp_resp": "fld26", - "dhcp_server": "fld24", - "dhcp_server_mac": "fld25", - "dns_req_rtt": "fld7", - "dns_resp": "fld8", - "dns_server": "fld9", - "duration": "duration", - "full_conn": "fld11", - "http_resp": "fld21", - "identity": "fld12", - "instigator": "fld20", - "ip_resp": "fld13", - "ip_src": "saddr", - "is_8021x": "fld15", - "is_wpa": "fld16", - "last_auth_ago": "fld17", - "radio": "fld18", - "reason": "fld19", - "rssi": "dclass_ratio1", - "server": "daddr", - "type": "event_type", - "url": "url", - "vap": "fld22", - "vpn_type": "fld27", - }, processor_chain([ - dup5, - dup6, - dup7, - dup8, - dup9, - ])); - - var msg7 = msg("events:01", part35); - - var part36 = match("MESSAGE#7:events:03", "nwparser.payload", "IDS: %{info}", processor_chain([ - dup5, - dup6, - setc("event_description","events IDS"), - dup8, - dup9, - ])); - - var msg8 = msg("events:03", part36); - - var part37 = match("MESSAGE#8:events:04/0", "nwparser.payload", "dhcp %{p0}"); - - var part38 = match("MESSAGE#8:events:04/1_0", "nwparser.p0", "no offers%{p0}"); - - var part39 = match("MESSAGE#8:events:04/1_1", "nwparser.p0", "release%{p0}"); - - var select13 = linear_select([ - part38, - part39, - ]); - - var part40 = match("MESSAGE#8:events:04/2", "nwparser.p0", "%{}for mac %{macaddr}"); - - var all10 = all_match({ - processors: [ - part37, - select13, - part40, - ], - on_success: processor_chain([ - dup5, - dup6, - setc("event_description","events DHCP"), - dup8, - dup9, - ]), - }); - - var msg9 = msg("events:04", all10); - - var part41 = match("MESSAGE#9:events:05", "nwparser.payload", "MAC %{macaddr->} and MAC %{macaddr->} both claim IP: %{saddr}", processor_chain([ - dup5, - dup6, - setc("event_description"," events MAC"), - dup8, - dup9, - ])); - - var msg10 = msg("events:05", part41); - - var select14 = linear_select([ - msg5, - msg6, - msg7, - msg8, - msg9, - msg10, - ]); - - var part42 = match("MESSAGE#10:ids-alerts:01/0", "nwparser.payload", "%{node->} ids-alerts signature=%{fld1->} priority=%{fld2->} timestamp=%{fld3}.%{fld4->} %{p0}"); - - var part43 = match("MESSAGE#10:ids-alerts:01/3_0", "nwparser.p0", "%{saddr}:%{sport->} dst=%{daddr}:%{dport->} message: %{p0}"); - - var part44 = match("MESSAGE#10:ids-alerts:01/3_1", "nwparser.p0", "%{saddr->} dst=%{daddr->} message: %{p0}"); - - var select15 = linear_select([ - part43, - part44, - ]); - - var all11 = all_match({ - processors: [ - part42, - dup22, - dup13, - select15, - dup14, - ], - on_success: processor_chain([ - dup15, - dup6, - dup16, - dup8, - dup17, - ]), - }); - - var msg11 = msg("ids-alerts:01", all11); - - var part45 = match("MESSAGE#11:ids-alerts:03", "nwparser.payload", "%{node->} ids-alerts signature=%{fld1->} priority=%{fld2->} timestamp=%{fld3}.%{fld4}direction=%{direction->} protocol=%{protocol->} src=%{saddr}:%{sport}", processor_chain([ - dup15, - dup6, - dup16, - dup8, - dup17, - ])); - - var msg12 = msg("ids-alerts:03", part45); - - var part46 = match("MESSAGE#12:ids-alerts:02", "nwparser.payload", "%{node->} ids-alerts signature=%{fld1->} priority=%{fld2->} timestamp=%{fld3}.%{fld4}protocol=%{protocol->} src=%{saddr->} dst=%{daddr}message: %{signame}", processor_chain([ - dup15, - dup6, - dup16, - dup8, - dup17, - ])); - - var msg13 = msg("ids-alerts:02", part46); - - var select16 = linear_select([ - msg11, - msg12, - msg13, - ]); - - var part47 = match("MESSAGE#13:security_event", "nwparser.payload", "%{node}security_event %{event_description->} url=%{url->} src=%{saddr}:%{sport->} dst=%{daddr}:%{dport->} mac=%{smacaddr->} name=%{fld10->} sha256=%{fld11->} disposition=%{disposition->} action=%{action}", processor_chain([ - dup5, - dup6, - dup18, - dup8, - dup9, - ])); - - var msg14 = msg("security_event", part47); - - var part48 = match("MESSAGE#14:security_event:01/0", "nwparser.payload", "%{node->} security_event %{event_description->} signature=%{fld1->} priority=%{fld2->} timestamp=%{fld3}.%{fld4->} %{p0}"); - - var part49 = match("MESSAGE#14:security_event:01/3_0", "nwparser.p0", "%{saddr}:%{sport->} dst=%{daddr}:%{dport->} message:%{p0}"); - - var part50 = match("MESSAGE#14:security_event:01/3_1", "nwparser.p0", "%{saddr->} dst=%{daddr->} message:%{p0}"); - - var select17 = linear_select([ - part49, - part50, - ]); - - var all12 = all_match({ - processors: [ - part48, - dup22, - dup13, - select17, - dup14, - ], - on_success: processor_chain([ - dup15, - dup6, - dup18, - dup8, - dup17, - ]), - }); - - var msg15 = msg("security_event:01", all12); - - var select18 = linear_select([ - msg14, - msg15, - ]); - - var chain1 = processor_chain([ - select3, - msgid_select({ - "events": select14, - "flows": select8, - "ids-alerts": select16, - "security_event": select18, - "urls": msg4, - }), - ]); - - var hdr2 = match("HEADER#0:0003/0", "message", "%{hfld1->} %{hfld2}.%{hfld3->} %{p0}"); - - var part51 = match_copy("MESSAGE#0:flows/2_1", "nwparser.p0", "p0"); - - var part52 = match_copy("MESSAGE#1:flows:01/1_2", "nwparser.p0", ""); - - var part53 = match("MESSAGE#10:ids-alerts:01/1_0", "nwparser.p0", "dhost=%{dmacaddr->} direction=%{p0}"); - - var part54 = match("MESSAGE#10:ids-alerts:01/1_1", "nwparser.p0", "shost=%{smacaddr->} direction=%{p0}"); - - var part55 = match("MESSAGE#10:ids-alerts:01/2", "nwparser.p0", "%{direction->} protocol=%{protocol->} src=%{p0}"); - - var part56 = match_copy("MESSAGE#10:ids-alerts:01/4", "nwparser.p0", "signame"); - - var part57 = match("HEADER#0:0003/1_0", "nwparser.p0", "%{hfld4}_appliance %{p0}", processor_chain([ - dup2, - ])); - - var part58 = match("HEADER#0:0003/1_1", "nwparser.p0", "%{hfld4->} %{p0}", processor_chain([ - dup3, - ])); - - var select19 = linear_select([ - dup11, - dup12, - ]); - - var select20 = linear_select([ - dup20, - dup21, - ]); - -- community_id: -- registered_domain: - ignore_missing: true - ignore_failure: true - field: dns.question.name - target_field: dns.question.registered_domain - target_subdomain_field: dns.question.subdomain - target_etld_field: dns.question.top_level_domain -- registered_domain: - ignore_missing: true - ignore_failure: true - field: client.domain - target_field: client.registered_domain - target_subdomain_field: client.subdomain - target_etld_field: client.top_level_domain -- registered_domain: - ignore_missing: true - ignore_failure: true - field: server.domain - target_field: server.registered_domain - target_subdomain_field: server.subdomain - target_etld_field: server.top_level_domain -- registered_domain: - ignore_missing: true - ignore_failure: true - field: destination.domain - target_field: destination.registered_domain - target_subdomain_field: destination.subdomain - target_etld_field: destination.top_level_domain -- registered_domain: - ignore_missing: true - ignore_failure: true - field: source.domain - target_field: source.registered_domain - target_subdomain_field: source.subdomain - target_etld_field: source.top_level_domain -- registered_domain: - ignore_missing: true - ignore_failure: true - field: url.domain - target_field: url.registered_domain - target_subdomain_field: url.subdomain - target_etld_field: url.top_level_domain -- add_locale: ~ diff --git a/packages/cisco_meraki/data_stream/log/agent/stream/tcp.yml.hbs b/packages/cisco_meraki/data_stream/log/agent/stream/tcp.yml.hbs index c835db3270bb..993860734ef4 100644 --- a/packages/cisco_meraki/data_stream/log/agent/stream/tcp.yml.hbs +++ b/packages/cisco_meraki/data_stream/log/agent/stream/tcp.yml.hbs @@ -1,5 +1,6 @@ -tcp: -host: "{{tcp_host}}:{{tcp_port}}" +host: "{{listen_address}}:{{listen_port}}" +max_message_size: 1 MiB + tags: {{#if preserve_original_event}} - preserve_original_event @@ -7,3247 +8,17 @@ tags: {{#each tags as |tag i|}} - {{tag}} {{/each}} -fields_under_root: true -fields: - observer: - vendor: "Cisco" - product: "Meraki" - type: "Wireless" + {{#contains "forwarded" tags}} publisher_pipeline.disable_host: true {{/contains}} -processors: + +fields_under_root: true +fields: + _conf: + tz_offset: '{{tz_offset}}' + {{#if processors}} +processors: {{processors}} {{/if}} -- script: - lang: javascript - params: - ecs: true - rsa: {{rsa_fields}} - tz_offset: {{tz_offset}} - keep_raw: {{keep_raw_fields}} - debug: {{debug}} - source: | - // Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one - // or more contributor license agreements. Licensed under the Elastic License; - // you may not use this file except in compliance with the Elastic License. - - /* jshint -W014,-W016,-W097,-W116 */ - - var processor = require("processor"); - var console = require("console"); - - var FLAG_FIELD = "log.flags"; - var FIELDS_OBJECT = "nwparser"; - var FIELDS_PREFIX = FIELDS_OBJECT + "."; - - var defaults = { - debug: false, - ecs: true, - rsa: false, - keep_raw: false, - tz_offset: "local", - strip_priority: true - }; - - var saved_flags = null; - var debug; - var map_ecs; - var map_rsa; - var keep_raw; - var device; - var tz_offset; - var strip_priority; - - // Register params from configuration. - function register(params) { - debug = params.debug !== undefined ? params.debug : defaults.debug; - map_ecs = params.ecs !== undefined ? params.ecs : defaults.ecs; - map_rsa = params.rsa !== undefined ? params.rsa : defaults.rsa; - keep_raw = params.keep_raw !== undefined ? params.keep_raw : defaults.keep_raw; - tz_offset = parse_tz_offset(params.tz_offset !== undefined? params.tz_offset : defaults.tz_offset); - strip_priority = params.strip_priority !== undefined? params.strip_priority : defaults.strip_priority; - device = new DeviceProcessor(); - } - - function parse_tz_offset(offset) { - var date; - var m; - switch(offset) { - // local uses the tz offset from the JS VM. - case "local": - date = new Date(); - // Reversing the sign as we the offset from UTC, not to UTC. - return parse_local_tz_offset(-date.getTimezoneOffset()); - // event uses the tz offset from event.timezone (add_locale processor). - case "event": - return offset; - // Otherwise a tz offset in the form "[+-][0-9]{4}" is required. - default: - m = offset.match(/^([+\-])([0-9]{2}):?([0-9]{2})?$/); - if (m === null || m.length !== 4) { - throw("bad timezone offset: '" + offset + "'. Must have the form +HH:MM"); - } - return m[1] + m[2] + ":" + (m[3]!==undefined? m[3] : "00"); - } - } - - function parse_local_tz_offset(minutes) { - var neg = minutes < 0; - minutes = Math.abs(minutes); - var min = minutes % 60; - var hours = Math.floor(minutes / 60); - var pad2digit = function(n) { - if (n < 10) { return "0" + n;} - return "" + n; - }; - return (neg? "-" : "+") + pad2digit(hours) + ":" + pad2digit(min); - } - - function process(evt) { - // Function register is only called by the processor when `params` are set - // in the processor config. - if (device === undefined) { - register(defaults); - } - return device.process(evt); - } - - function processor_chain(subprocessors) { - var builder = new processor.Chain(); - subprocessors.forEach(builder.Add); - return builder.Build().Run; - } - - function linear_select(subprocessors) { - return function (evt) { - var flags = evt.Get(FLAG_FIELD); - var i; - for (i = 0; i < subprocessors.length; i++) { - evt.Delete(FLAG_FIELD); - if (debug) console.warn("linear_select trying entry " + i); - subprocessors[i](evt); - // Dissect processor succeeded? - if (evt.Get(FLAG_FIELD) == null) break; - if (debug) console.warn("linear_select failed entry " + i); - } - if (flags !== null) { - evt.Put(FLAG_FIELD, flags); - } - if (debug) { - if (i < subprocessors.length) { - console.warn("linear_select matched entry " + i); - } else { - console.warn("linear_select didn't match"); - } - } - }; - } - - function conditional(opt) { - return function(evt) { - if (opt.if(evt)) { - opt.then(evt); - } else if (opt.else) { - opt.else(evt); - } - }; - } - - var strip_syslog_priority = (function() { - var isEnabled = function() { return strip_priority === true; }; - var fetchPRI = field("_pri"); - var fetchPayload = field("payload"); - var removePayload = remove(["payload"]); - var cleanup = remove(["_pri", "payload"]); - var onMatch = function(evt) { - var pri, priStr = fetchPRI(evt); - if (priStr != null - && 0 < priStr.length && priStr.length < 4 - && !isNaN((pri = Number(priStr))) - && 0 <= pri && pri < 192) { - var severity = pri & 7, - facility = pri >> 3; - setc("_severity", "" + severity)(evt); - setc("_facility", "" + facility)(evt); - // Replace message with priority stripped. - evt.Put("message", fetchPayload(evt)); - removePayload(evt); - } else { - // not a valid syslog PRI, cleanup. - cleanup(evt); - } - }; - return conditional({ - if: isEnabled, - then: cleanup_flags(match( - "STRIP_PRI", - "message", - "<%{_pri}>%{payload}", - onMatch - )) - }); - })(); - - function match(id, src, pattern, on_success) { - var dissect = new processor.Dissect({ - field: src, - tokenizer: pattern, - target_prefix: FIELDS_OBJECT, - ignore_failure: true, - overwrite_keys: true, - trim_values: "right" - }); - return function (evt) { - var msg = evt.Get(src); - dissect.Run(evt); - var failed = evt.Get(FLAG_FIELD) != null; - if (debug) { - if (failed) { - console.debug("dissect fail: " + id + " field:" + src); - } else { - console.debug("dissect OK: " + id + " field:" + src); - } - console.debug(" expr: <<" + pattern + ">>"); - console.debug(" input: <<" + msg + ">>"); - } - if (on_success != null && !failed) { - on_success(evt); - } - }; - } - - function match_copy(id, src, dst, on_success) { - dst = FIELDS_PREFIX + dst; - if (dst === FIELDS_PREFIX || dst === src) { - return function (evt) { - if (debug) { - console.debug("noop OK: " + id + " field:" + src); - console.debug(" input: <<" + evt.Get(src) + ">>"); - } - if (on_success != null) on_success(evt); - } - } - return function (evt) { - var msg = evt.Get(src); - evt.Put(dst, msg); - if (debug) { - console.debug("copy OK: " + id + " field:" + src); - console.debug(" target: '" + dst + "'"); - console.debug(" input: <<" + msg + ">>"); - } - if (on_success != null) on_success(evt); - } - } - - function cleanup_flags(processor) { - return function(evt) { - processor(evt); - evt.Delete(FLAG_FIELD); - }; - } - - function all_match(opts) { - return function (evt) { - var i; - for (i = 0; i < opts.processors.length; i++) { - evt.Delete(FLAG_FIELD); - opts.processors[i](evt); - // Dissect processor succeeded? - if (evt.Get(FLAG_FIELD) != null) { - if (debug) console.warn("all_match failure at " + i); - if (opts.on_failure != null) opts.on_failure(evt); - return; - } - if (debug) console.warn("all_match success at " + i); - } - if (opts.on_success != null) opts.on_success(evt); - }; - } - - function msgid_select(mapping) { - return function (evt) { - var msgid = evt.Get(FIELDS_PREFIX + "messageid"); - if (msgid == null) { - if (debug) console.warn("msgid_select: no messageid captured!"); - return; - } - var next = mapping[msgid]; - if (next === undefined) { - if (debug) console.warn("msgid_select: no mapping for messageid:" + msgid); - return; - } - if (debug) console.info("msgid_select: matched key=" + msgid); - return next(evt); - }; - } - - function msg(msg_id, match) { - return function (evt) { - match(evt); - if (evt.Get(FLAG_FIELD) == null) { - evt.Put(FIELDS_PREFIX + "msg_id1", msg_id); - } - }; - } - - var start; - - function save_flags(evt) { - saved_flags = evt.Get(FLAG_FIELD); - evt.Put("event.original", evt.Get("message")); - } - - function restore_flags(evt) { - if (saved_flags !== null) { - evt.Put(FLAG_FIELD, saved_flags); - } - evt.Delete("message"); - } - - function constant(value) { - return function (evt) { - return value; - }; - } - - function field(name) { - var fullname = FIELDS_PREFIX + name; - return function (evt) { - return evt.Get(fullname); - }; - } - - function STRCAT(args) { - var s = ""; - var i; - for (i = 0; i < args.length; i++) { - s += args[i]; - } - return s; - } - - // TODO: Implement - function DIRCHK(args) { - unimplemented("DIRCHK"); - } - - function strictToInt(str) { - return str * 1; - } - - function CALC(args) { - if (args.length !== 3) { - console.warn("skipped call to CALC with " + args.length + " arguments."); - return; - } - var a = strictToInt(args[0]); - var b = strictToInt(args[2]); - if (isNaN(a) || isNaN(b)) { - console.warn("failed evaluating CALC arguments a='" + args[0] + "' b='" + args[2] + "'."); - return; - } - var result; - switch (args[1]) { - case "+": - result = a + b; - break; - case "-": - result = a - b; - break; - case "*": - result = a * b; - break; - default: - // Only * and + seen in the parsers. - console.warn("unknown CALC operation '" + args[1] + "'."); - return; - } - // Always return a string - return result !== undefined ? "" + result : result; - } - - var quoteChars = "\"'`"; - function RMQ(args) { - if(args.length !== 1) { - console.warn("RMQ: only one argument expected"); - return; - } - var value = args[0].trim(); - var n = value.length; - var char; - return n > 1 - && (char=value.charAt(0)) === value.charAt(n-1) - && quoteChars.indexOf(char) !== -1? - value.substr(1, n-2) - : value; - } - - function call(opts) { - var args = new Array(opts.args.length); - return function (evt) { - for (var i = 0; i < opts.args.length; i++) - if ((args[i] = opts.args[i](evt)) == null) return; - var result = opts.fn(args); - if (result != null) { - evt.Put(opts.dest, result); - } - }; - } - - function nop(evt) { - } - - function appendErrorMsg(evt, msg) { - var value = evt.Get("error.message"); - if (value == null) { - value = [msg]; - } else if (msg instanceof Array) { - value.push(msg); - } else { - value = [value, msg]; - } - evt.Put("error.message", value); - } - - function unimplemented(name) { - appendErrorMsg("unimplemented feature: " + name); - } - - function lookup(opts) { - return function (evt) { - var key = opts.key(evt); - if (key == null) return; - var value = opts.map.keyvaluepairs[key]; - if (value === undefined) { - value = opts.map.default; - } - if (value !== undefined) { - evt.Put(opts.dest, value(evt)); - } - }; - } - - function set(fields) { - return new processor.AddFields({ - target: FIELDS_OBJECT, - fields: fields, - }); - } - - function setf(dst, src) { - return function (evt) { - var val = evt.Get(FIELDS_PREFIX + src); - if (val != null) evt.Put(FIELDS_PREFIX + dst, val); - }; - } - - function setc(dst, value) { - return function (evt) { - evt.Put(FIELDS_PREFIX + dst, value); - }; - } - - function set_field(opts) { - return function (evt) { - var val = opts.value(evt); - if (val != null) evt.Put(opts.dest, val); - }; - } - - function dump(label) { - return function (evt) { - console.log("Dump of event at " + label + ": " + JSON.stringify(evt, null, "\t")); - }; - } - - function date_time_join_args(evt, arglist) { - var str = ""; - for (var i = 0; i < arglist.length; i++) { - var fname = FIELDS_PREFIX + arglist[i]; - var val = evt.Get(fname); - if (val != null) { - if (str !== "") str += " "; - str += val; - } else { - if (debug) console.warn("in date_time: input arg " + fname + " is not set"); - } - } - return str; - } - - function to2Digit(num) { - return num? (num < 10? "0" + num : num) : "00"; - } - - // Make two-digit dates 00-69 interpreted as 2000-2069 - // and dates 70-99 translated to 1970-1999. - var twoDigitYearEpoch = 70; - var twoDigitYearCentury = 2000; - - // This is to accept dates up to 2 days in the future, only used when - // no year is specified in a date. 2 days should be enough to account for - // time differences between systems and different tz offsets. - var maxFutureDelta = 2*24*60*60*1000; - - // DateContainer stores date fields and then converts those fields into - // a Date. Necessary because building a Date using its set() methods gives - // different results depending on the order of components. - function DateContainer(tzOffset) { - this.offset = tzOffset === undefined? "Z" : tzOffset; - } - - DateContainer.prototype = { - setYear: function(v) {this.year = v;}, - setMonth: function(v) {this.month = v;}, - setDay: function(v) {this.day = v;}, - setHours: function(v) {this.hours = v;}, - setMinutes: function(v) {this.minutes = v;}, - setSeconds: function(v) {this.seconds = v;}, - - setUNIX: function(v) {this.unix = v;}, - - set2DigitYear: function(v) { - this.year = v < twoDigitYearEpoch? twoDigitYearCentury + v : twoDigitYearCentury + v - 100; - }, - - toDate: function() { - if (this.unix !== undefined) { - return new Date(this.unix * 1000); - } - if (this.day === undefined || this.month === undefined) { - // Can't make a date from this. - return undefined; - } - if (this.year === undefined) { - // A date without a year. Set current year, or previous year - // if date would be in the future. - var now = new Date(); - this.year = now.getFullYear(); - var date = this.toDate(); - if (date.getTime() - now.getTime() > maxFutureDelta) { - date.setFullYear(now.getFullYear() - 1); - } - return date; - } - var MM = to2Digit(this.month); - var DD = to2Digit(this.day); - var hh = to2Digit(this.hours); - var mm = to2Digit(this.minutes); - var ss = to2Digit(this.seconds); - return new Date(this.year + "-" + MM + "-" + DD + "T" + hh + ":" + mm + ":" + ss + this.offset); - } - } - - function date_time_try_pattern(fmt, str, tzOffset) { - var date = new DateContainer(tzOffset); - var pos = date_time_try_pattern_at_pos(fmt, str, 0, date); - return pos !== undefined? date.toDate() : undefined; - } - - function date_time_try_pattern_at_pos(fmt, str, pos, date) { - var len = str.length; - for (var proc = 0; pos !== undefined && pos < len && proc < fmt.length; proc++) { - pos = fmt[proc](str, pos, date); - } - return pos; - } - - function date_time(opts) { - return function (evt) { - var tzOffset = opts.tz || tz_offset; - if (tzOffset === "event") { - tzOffset = evt.Get("event.timezone"); - } - var str = date_time_join_args(evt, opts.args); - for (var i = 0; i < opts.fmts.length; i++) { - var date = date_time_try_pattern(opts.fmts[i], str, tzOffset); - if (date !== undefined) { - evt.Put(FIELDS_PREFIX + opts.dest, date); - return; - } - } - if (debug) console.warn("in date_time: id=" + opts.id + " FAILED: " + str); - }; - } - - var uA = 60 * 60 * 24; - var uD = 60 * 60 * 24; - var uF = 60 * 60; - var uG = 60 * 60 * 24 * 30; - var uH = 60 * 60; - var uI = 60 * 60; - var uJ = 60 * 60 * 24; - var uM = 60 * 60 * 24 * 30; - var uN = 60 * 60; - var uO = 1; - var uS = 1; - var uT = 60; - var uU = 60; - var uc = dc; - - function duration(opts) { - return function(evt) { - var str = date_time_join_args(evt, opts.args); - for (var i = 0; i < opts.fmts.length; i++) { - var seconds = duration_try_pattern(opts.fmts[i], str); - if (seconds !== undefined) { - evt.Put(FIELDS_PREFIX + opts.dest, seconds); - return; - } - } - if (debug) console.warn("in duration: id=" + opts.id + " (s) FAILED: " + str); - }; - } - - function duration_try_pattern(fmt, str) { - var secs = 0; - var pos = 0; - for (var i=0; i [ month_id , how many chars to skip if month in long form ] - "Jan": [0, 4], - "Feb": [1, 5], - "Mar": [2, 2], - "Apr": [3, 2], - "May": [4, 0], - "Jun": [5, 1], - "Jul": [6, 1], - "Aug": [7, 3], - "Sep": [8, 6], - "Oct": [9, 4], - "Nov": [10, 5], - "Dec": [11, 4], - "jan": [0, 4], - "feb": [1, 5], - "mar": [2, 2], - "apr": [3, 2], - "may": [4, 0], - "jun": [5, 1], - "jul": [6, 1], - "aug": [7, 3], - "sep": [8, 6], - "oct": [9, 4], - "nov": [10, 5], - "dec": [11, 4], - }; - - // var dC = undefined; - var dR = dateMonthName(true); - var dB = dateMonthName(false); - var dM = dateFixedWidthNumber("M", 2, 1, 12, DateContainer.prototype.setMonth); - var dG = dateVariableWidthNumber("G", 1, 12, DateContainer.prototype.setMonth); - var dD = dateFixedWidthNumber("D", 2, 1, 31, DateContainer.prototype.setDay); - var dF = dateVariableWidthNumber("F", 1, 31, DateContainer.prototype.setDay); - var dH = dateFixedWidthNumber("H", 2, 0, 24, DateContainer.prototype.setHours); - var dI = dateVariableWidthNumber("I", 0, 24, DateContainer.prototype.setHours); // Accept hours >12 - var dN = dateVariableWidthNumber("N", 0, 24, DateContainer.prototype.setHours); - var dT = dateFixedWidthNumber("T", 2, 0, 59, DateContainer.prototype.setMinutes); - var dU = dateVariableWidthNumber("U", 0, 59, DateContainer.prototype.setMinutes); - var dP = parseAMPM; // AM|PM - var dQ = parseAMPM; // A.M.|P.M - var dS = dateFixedWidthNumber("S", 2, 0, 60, DateContainer.prototype.setSeconds); - var dO = dateVariableWidthNumber("O", 0, 60, DateContainer.prototype.setSeconds); - var dY = dateFixedWidthNumber("Y", 2, 0, 99, DateContainer.prototype.set2DigitYear); - var dW = dateFixedWidthNumber("W", 4, 1000, 9999, DateContainer.prototype.setYear); - var dZ = parseHMS; - var dX = dateVariableWidthNumber("X", 0, 0x10000000000, DateContainer.prototype.setUNIX); - - // parseAMPM parses "A.M", "AM", "P.M", "PM" from logs. - // Only works if this modifier appears after the hour has been read from logs - // which is always the case in the 300 devices. - function parseAMPM(str, pos, date) { - var n = str.length; - var start = skipws(str, pos); - if (start + 2 > n) return; - var head = str.substr(start, 2).toUpperCase(); - var isPM = false; - var skip = false; - switch (head) { - case "A.": - skip = true; - /* falls through */ - case "AM": - break; - case "P.": - skip = true; - /* falls through */ - case "PM": - isPM = true; - break; - default: - if (debug) console.warn("can't parse pos " + start + " as AM/PM: " + str + "(head:" + head + ")"); - return; - } - pos = start + 2; - if (skip) { - if (pos+2 > n || str.substr(pos, 2).toUpperCase() !== "M.") { - if (debug) console.warn("can't parse pos " + start + " as AM/PM: " + str + "(tail)"); - return; - } - pos += 2; - } - var hh = date.hours; - if (isPM) { - // Accept existing hour in 24h format. - if (hh < 12) hh += 12; - } else { - if (hh === 12) hh = 0; - } - date.setHours(hh); - return pos; - } - - function parseHMS(str, pos, date) { - return date_time_try_pattern_at_pos([dN, dc(":"), dU, dc(":"), dO], str, pos, date); - } - - function skipws(str, pos) { - for ( var n = str.length; - pos < n && str.charAt(pos) === " "; - pos++) - ; - return pos; - } - - function skipdigits(str, pos) { - var c; - for (var n = str.length; - pos < n && (c = str.charAt(pos)) >= "0" && c <= "9"; - pos++) - ; - return pos; - } - - function dSkip(str, pos, date) { - var chr; - for (;pos < str.length && (chr=str[pos])<'0' || chr>'9'; pos++) {} - return pos < str.length? pos : undefined; - } - - function dateVariableWidthNumber(fmtChar, min, max, setter) { - return function (str, pos, date) { - var start = skipws(str, pos); - pos = skipdigits(str, start); - var s = str.substr(start, pos - start); - var value = parseInt(s, 10); - if (value >= min && value <= max) { - setter.call(date, value); - return pos; - } - return; - }; - } - - function dateFixedWidthNumber(fmtChar, width, min, max, setter) { - return function (str, pos, date) { - pos = skipws(str, pos); - var n = str.length; - if (pos + width > n) return; - var s = str.substr(pos, width); - var value = parseInt(s, 10); - if (value >= min && value <= max) { - setter.call(date, value); - return pos + width; - } - return; - }; - } - - // Short month name (Jan..Dec). - function dateMonthName(long) { - return function (str, pos, date) { - pos = skipws(str, pos); - var n = str.length; - if (pos + 3 > n) return; - var mon = str.substr(pos, 3); - var idx = shortMonths[mon]; - if (idx === undefined) { - idx = shortMonths[mon.toLowerCase()]; - } - if (idx === undefined) { - //console.warn("parsing date_time: '" + mon + "' is not a valid short month (%B)"); - return; - } - date.setMonth(idx[0]+1); - return pos + 3 + (long ? idx[1] : 0); - }; - } - - function url_wrapper(dst, src, fn) { - return function(evt) { - var value = evt.Get(FIELDS_PREFIX + src), result; - if (value != null && (result = fn(value))!== undefined) { - evt.Put(FIELDS_PREFIX + dst, result); - } else { - console.debug(fn.name + " failed for '" + value + "'"); - } - }; - } - - // The following regular expression for parsing URLs from: - // https://github.com/wizard04wsu/URI_Parsing - // - // The MIT License (MIT) - // - // Copyright (c) 2014 Andrew Harrison - // - // Permission is hereby granted, free of charge, to any person obtaining a copy of - // this software and associated documentation files (the "Software"), to deal in - // the Software without restriction, including without limitation the rights to - // use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of - // the Software, and to permit persons to whom the Software is furnished to do so, - // subject to the following conditions: - // - // The above copyright notice and this permission notice shall be included in all - // copies or substantial portions of the Software. - // - // THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - // IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS - // FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR - // COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER - // IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN - // CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. - var uriRegExp = /^([a-z][a-z0-9+.\-]*):(?:\/\/((?:(?=((?:[a-z0-9\-._~!$&'()*+,;=:]|%[0-9A-F]{2})*))(\3)@)?(?=(\[[0-9A-F:.]{2,}\]|(?:[a-z0-9\-._~!$&'()*+,;=]|%[0-9A-F]{2})*))\5(?::(?=(\d*))\6)?)(\/(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/]|%[0-9A-F]{2})*))\8)?|(\/?(?!\/)(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/]|%[0-9A-F]{2})*))\10)?)(?:\?(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/?]|%[0-9A-F]{2})*))\11)?(?:#(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/?]|%[0-9A-F]{2})*))\12)?$/i; - - var uriScheme = 1; - var uriDomain = 5; - var uriPort = 6; - var uriPath = 7; - var uriPathAlt = 9; - var uriQuery = 11; - - function domain(dst, src) { - return url_wrapper(dst, src, extract_domain); - } - - function split_url(value) { - var m = value.match(uriRegExp); - if (m && m[uriDomain]) return m; - // Support input in the form "www.example.net/path", but not "/path". - m = ("null://" + value).match(uriRegExp); - if (m) return m; - } - - function extract_domain(value) { - var m = split_url(value); - if (m && m[uriDomain]) return m[uriDomain]; - } - - var extFromPage = /\.[^.]+$/; - function extract_ext(value) { - var page = extract_page(value); - if (page) { - var m = page.match(extFromPage); - if (m) return m[0]; - } - } - - function ext(dst, src) { - return url_wrapper(dst, src, extract_ext); - } - - function fqdn(dst, src) { - // TODO: fqdn and domain(eTLD+1) are currently the same. - return domain(dst, src); - } - - var pageFromPathRegExp = /\/([^\/]+)$/; - var pageName = 1; - - function extract_page(value) { - value = extract_path(value); - if (!value) return undefined; - var m = value.match(pageFromPathRegExp); - if (m) return m[pageName]; - } - - function page(dst, src) { - return url_wrapper(dst, src, extract_page); - } - - function extract_path(value) { - var m = split_url(value); - return m? m[uriPath] || m[uriPathAlt] : undefined; - } - - function path(dst, src) { - return url_wrapper(dst, src, extract_path); - } - - // Map common schemes to their default port. - // port has to be a string (will be converted at a later stage). - var schemePort = { - "ftp": "21", - "ssh": "22", - "http": "80", - "https": "443", - }; - - function extract_port(value) { - var m = split_url(value); - if (!m) return undefined; - if (m[uriPort]) return m[uriPort]; - if (m[uriScheme]) { - return schemePort[m[uriScheme]]; - } - } - - function port(dst, src) { - return url_wrapper(dst, src, extract_port); - } - - function extract_query(value) { - var m = split_url(value); - if (m && m[uriQuery]) return m[uriQuery]; - } - - function query(dst, src) { - return url_wrapper(dst, src, extract_query); - } - - function extract_root(value) { - var m = split_url(value); - if (m && m[uriDomain] && m[uriDomain]) { - var scheme = m[uriScheme] && m[uriScheme] !== "null"? - m[uriScheme] + "://" : ""; - var port = m[uriPort]? ":" + m[uriPort] : ""; - return scheme + m[uriDomain] + port; - } - } - - function root(dst, src) { - return url_wrapper(dst, src, extract_root); - } - - function tagval(id, src, cfg, keys, on_success) { - var fail = function(evt) { - evt.Put(FLAG_FIELD, "tagval_parsing_error"); - } - if (cfg.kv_separator.length !== 1) { - throw("Invalid TAGVALMAP ValueDelimiter (must have 1 character)"); - } - var quotes_len = cfg.open_quote.length > 0 && cfg.close_quote.length > 0? - cfg.open_quote.length + cfg.close_quote.length : 0; - var kv_regex = new RegExp('^([^' + cfg.kv_separator + ']*)*' + cfg.kv_separator + ' *(.*)*$'); - return function(evt) { - var msg = evt.Get(src); - if (msg === undefined) { - console.warn("tagval: input field is missing"); - return fail(evt); - } - var pairs = msg.split(cfg.pair_separator); - var i; - var success = false; - var prev = ""; - for (i=0; i 0 && - value.length >= cfg.open_quote.length + cfg.close_quote.length && - value.substr(0, cfg.open_quote.length) === cfg.open_quote && - value.substr(value.length - cfg.close_quote.length) === cfg.close_quote) { - value = value.substr(cfg.open_quote.length, value.length - quotes_len); - } - evt.Put(FIELDS_PREFIX + field, value); - success = true; - } - if (!success) { - return fail(evt); - } - if (on_success != null) { - on_success(evt); - } - } - } - - var ecs_mappings = { - "_facility": {convert: to_long, to:[{field: "log.syslog.facility.code", setter: fld_set}]}, - "_pri": {convert: to_long, to:[{field: "log.syslog.priority", setter: fld_set}]}, - "_severity": {convert: to_long, to:[{field: "log.syslog.severity.code", setter: fld_set}]}, - "action": {to:[{field: "event.action", setter: fld_prio, prio: 0}]}, - "administrator": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 4}]}, - "alias.ip": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 3},{field: "related.ip", setter: fld_append}]}, - "alias.ipv6": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 4},{field: "related.ip", setter: fld_append}]}, - "alias.mac": {convert: to_mac, to:[{field: "host.mac", setter: fld_prio, prio: 1}]}, - "application": {to:[{field: "network.application", setter: fld_set}]}, - "bytes": {convert: to_long, to:[{field: "network.bytes", setter: fld_set}]}, - "c_domain": {to:[{field: "source.domain", setter: fld_prio, prio: 1}]}, - "c_logon_id": {to:[{field: "user.id", setter: fld_prio, prio: 2}]}, - "c_user_name": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 8}]}, - "c_username": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 2}]}, - "cctld": {to:[{field: "url.top_level_domain", setter: fld_prio, prio: 1}]}, - "child_pid": {convert: to_long, to:[{field: "process.pid", setter: fld_prio, prio: 1}]}, - "child_pid_val": {to:[{field: "process.title", setter: fld_set}]}, - "child_process": {to:[{field: "process.name", setter: fld_prio, prio: 1}]}, - "city.dst": {to:[{field: "destination.geo.city_name", setter: fld_set}]}, - "city.src": {to:[{field: "source.geo.city_name", setter: fld_set}]}, - "daddr": {convert: to_ip, to:[{field: "destination.ip", setter: fld_set},{field: "related.ip", setter: fld_append}]}, - "daddr_v6": {convert: to_ip, to:[{field: "destination.ip", setter: fld_set},{field: "related.ip", setter: fld_append}]}, - "ddomain": {to:[{field: "destination.domain", setter: fld_prio, prio: 0}]}, - "devicehostip": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 2},{field: "related.ip", setter: fld_append}]}, - "devicehostmac": {convert: to_mac, to:[{field: "host.mac", setter: fld_prio, prio: 0}]}, - "dhost": {to:[{field: "destination.address", setter: fld_set},{field: "related.hosts", setter: fld_append}]}, - "dinterface": {to:[{field: "observer.egress.interface.name", setter: fld_set}]}, - "direction": {to:[{field: "network.direction", setter: fld_set}]}, - "directory": {to:[{field: "file.directory", setter: fld_set}]}, - "dmacaddr": {convert: to_mac, to:[{field: "destination.mac", setter: fld_set}]}, - "dns.responsetype": {to:[{field: "dns.answers.type", setter: fld_set}]}, - "dns.resptext": {to:[{field: "dns.answers.name", setter: fld_set}]}, - "dns_querytype": {to:[{field: "dns.question.type", setter: fld_set}]}, - "domain": {to:[{field: "server.domain", setter: fld_prio, prio: 0},{field: "related.hosts", setter: fld_append}]}, - "domain.dst": {to:[{field: "destination.domain", setter: fld_prio, prio: 1}]}, - "domain.src": {to:[{field: "source.domain", setter: fld_prio, prio: 2}]}, - "domain_id": {to:[{field: "user.domain", setter: fld_set}]}, - "domainname": {to:[{field: "server.domain", setter: fld_prio, prio: 1}]}, - "dport": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 0}]}, - "dtransaddr": {convert: to_ip, to:[{field: "destination.nat.ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, - "dtransport": {convert: to_long, to:[{field: "destination.nat.port", setter: fld_prio, prio: 0}]}, - "ec_outcome": {to:[{field: "event.outcome", setter: fld_ecs_outcome}]}, - "event_description": {to:[{field: "message", setter: fld_prio, prio: 0}]}, - "event_source": {to:[{field: "related.hosts", setter: fld_append}]}, - "event_time": {convert: to_date, to:[{field: "@timestamp", setter: fld_set}]}, - "event_type": {to:[{field: "event.action", setter: fld_prio, prio: 1}]}, - "extension": {to:[{field: "file.extension", setter: fld_prio, prio: 1}]}, - "file.attributes": {to:[{field: "file.attributes", setter: fld_set}]}, - "filename": {to:[{field: "file.name", setter: fld_prio, prio: 0}]}, - "filename_size": {convert: to_long, to:[{field: "file.size", setter: fld_set}]}, - "filepath": {to:[{field: "file.path", setter: fld_set}]}, - "filetype": {to:[{field: "file.type", setter: fld_set}]}, - "fqdn": {to:[{field: "related.hosts", setter: fld_append}]}, - "group": {to:[{field: "group.name", setter: fld_set}]}, - "groupid": {to:[{field: "group.id", setter: fld_set}]}, - "host": {to:[{field: "host.name", setter: fld_prio, prio: 1},{field: "related.hosts", setter: fld_append}]}, - "hostip": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, - "hostip_v6": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, - "hostname": {to:[{field: "host.name", setter: fld_prio, prio: 0}]}, - "id": {to:[{field: "event.code", setter: fld_prio, prio: 0}]}, - "interface": {to:[{field: "network.interface.name", setter: fld_set}]}, - "ip.orig": {convert: to_ip, to:[{field: "network.forwarded_ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, - "ip.trans.dst": {convert: to_ip, to:[{field: "destination.nat.ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, - "ip.trans.src": {convert: to_ip, to:[{field: "source.nat.ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, - "ipv6.orig": {convert: to_ip, to:[{field: "network.forwarded_ip", setter: fld_prio, prio: 2},{field: "related.ip", setter: fld_append}]}, - "latdec_dst": {convert: to_double, to:[{field: "destination.geo.location.lat", setter: fld_set}]}, - "latdec_src": {convert: to_double, to:[{field: "source.geo.location.lat", setter: fld_set}]}, - "location_city": {to:[{field: "geo.city_name", setter: fld_set}]}, - "location_country": {to:[{field: "geo.country_name", setter: fld_set}]}, - "location_desc": {to:[{field: "geo.name", setter: fld_set}]}, - "location_dst": {to:[{field: "destination.geo.country_name", setter: fld_set}]}, - "location_src": {to:[{field: "source.geo.country_name", setter: fld_set}]}, - "location_state": {to:[{field: "geo.region_name", setter: fld_set}]}, - "logon_id": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 5}]}, - "longdec_dst": {convert: to_double, to:[{field: "destination.geo.location.lon", setter: fld_set}]}, - "longdec_src": {convert: to_double, to:[{field: "source.geo.location.lon", setter: fld_set}]}, - "macaddr": {convert: to_mac, to:[{field: "host.mac", setter: fld_prio, prio: 2}]}, - "messageid": {to:[{field: "event.code", setter: fld_prio, prio: 1}]}, - "method": {to:[{field: "http.request.method", setter: fld_set}]}, - "msg": {to:[{field: "message", setter: fld_set}]}, - "orig_ip": {convert: to_ip, to:[{field: "network.forwarded_ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, - "owner": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 6}]}, - "packets": {convert: to_long, to:[{field: "network.packets", setter: fld_set}]}, - "parent_pid": {convert: to_long, to:[{field: "process.parent.pid", setter: fld_prio, prio: 0}]}, - "parent_pid_val": {to:[{field: "process.parent.title", setter: fld_set}]}, - "parent_process": {to:[{field: "process.parent.name", setter: fld_prio, prio: 0}]}, - "patient_fullname": {to:[{field: "user.full_name", setter: fld_prio, prio: 1}]}, - "port.dst": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 1}]}, - "port.src": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 1}]}, - "port.trans.dst": {convert: to_long, to:[{field: "destination.nat.port", setter: fld_prio, prio: 1}]}, - "port.trans.src": {convert: to_long, to:[{field: "source.nat.port", setter: fld_prio, prio: 1}]}, - "process": {to:[{field: "process.name", setter: fld_prio, prio: 0}]}, - "process_id": {convert: to_long, to:[{field: "process.pid", setter: fld_prio, prio: 0}]}, - "process_id_src": {convert: to_long, to:[{field: "process.parent.pid", setter: fld_prio, prio: 1}]}, - "process_src": {to:[{field: "process.parent.name", setter: fld_prio, prio: 1}]}, - "product": {to:[{field: "observer.product", setter: fld_set}]}, - "protocol": {to:[{field: "network.protocol", setter: fld_set}]}, - "query": {to:[{field: "url.query", setter: fld_prio, prio: 2}]}, - "rbytes": {convert: to_long, to:[{field: "destination.bytes", setter: fld_set}]}, - "referer": {to:[{field: "http.request.referrer", setter: fld_prio, prio: 1}]}, - "rulename": {to:[{field: "rule.name", setter: fld_set}]}, - "saddr": {convert: to_ip, to:[{field: "source.ip", setter: fld_set},{field: "related.ip", setter: fld_append}]}, - "saddr_v6": {convert: to_ip, to:[{field: "source.ip", setter: fld_set},{field: "related.ip", setter: fld_append}]}, - "sbytes": {convert: to_long, to:[{field: "source.bytes", setter: fld_set}]}, - "sdomain": {to:[{field: "source.domain", setter: fld_prio, prio: 0}]}, - "service": {to:[{field: "service.name", setter: fld_prio, prio: 1}]}, - "service.name": {to:[{field: "service.name", setter: fld_prio, prio: 0}]}, - "service_account": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 7}]}, - "severity": {to:[{field: "log.level", setter: fld_set}]}, - "shost": {to:[{field: "host.hostname", setter: fld_set},{field: "source.address", setter: fld_set},{field: "related.hosts", setter: fld_append}]}, - "sinterface": {to:[{field: "observer.ingress.interface.name", setter: fld_set}]}, - "sld": {to:[{field: "url.registered_domain", setter: fld_set}]}, - "smacaddr": {convert: to_mac, to:[{field: "source.mac", setter: fld_set}]}, - "sport": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 0}]}, - "stransaddr": {convert: to_ip, to:[{field: "source.nat.ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, - "stransport": {convert: to_long, to:[{field: "source.nat.port", setter: fld_prio, prio: 0}]}, - "tcp.dstport": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 2}]}, - "tcp.srcport": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 2}]}, - "timezone": {to:[{field: "event.timezone", setter: fld_set}]}, - "tld": {to:[{field: "url.top_level_domain", setter: fld_prio, prio: 0}]}, - "udp.dstport": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 3}]}, - "udp.srcport": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 3}]}, - "uid": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 3}]}, - "url": {to:[{field: "url.original", setter: fld_prio, prio: 1}]}, - "url_raw": {to:[{field: "url.original", setter: fld_prio, prio: 0}]}, - "urldomain": {to:[{field: "url.domain", setter: fld_prio, prio: 0}]}, - "urlquery": {to:[{field: "url.query", setter: fld_prio, prio: 0}]}, - "user": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 0}]}, - "user.id": {to:[{field: "user.id", setter: fld_prio, prio: 1}]}, - "user_agent": {to:[{field: "user_agent.original", setter: fld_set}]}, - "user_fullname": {to:[{field: "user.full_name", setter: fld_prio, prio: 0}]}, - "user_id": {to:[{field: "user.id", setter: fld_prio, prio: 0}]}, - "username": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 1}]}, - "version": {to:[{field: "observer.version", setter: fld_set}]}, - "web_domain": {to:[{field: "url.domain", setter: fld_prio, prio: 1},{field: "related.hosts", setter: fld_append}]}, - "web_extension": {to:[{field: "file.extension", setter: fld_prio, prio: 0}]}, - "web_query": {to:[{field: "url.query", setter: fld_prio, prio: 1}]}, - "web_ref_domain": {to:[{field: "related.hosts", setter: fld_append}]}, - "web_referer": {to:[{field: "http.request.referrer", setter: fld_prio, prio: 0}]}, - "web_root": {to:[{field: "url.path", setter: fld_set}]}, - "webpage": {to:[{field: "file.name", setter: fld_prio, prio: 1}]}, - }; - - var rsa_mappings = { - "access_point": {to:[{field: "rsa.wireless.access_point", setter: fld_set}]}, - "accesses": {to:[{field: "rsa.identity.accesses", setter: fld_set}]}, - "acl_id": {to:[{field: "rsa.misc.acl_id", setter: fld_set}]}, - "acl_op": {to:[{field: "rsa.misc.acl_op", setter: fld_set}]}, - "acl_pos": {to:[{field: "rsa.misc.acl_pos", setter: fld_set}]}, - "acl_table": {to:[{field: "rsa.misc.acl_table", setter: fld_set}]}, - "action": {to:[{field: "rsa.misc.action", setter: fld_append}]}, - "ad_computer_dst": {to:[{field: "rsa.network.ad_computer_dst", setter: fld_set}]}, - "addr": {to:[{field: "rsa.network.addr", setter: fld_set}]}, - "admin": {to:[{field: "rsa.misc.admin", setter: fld_set}]}, - "agent": {to:[{field: "rsa.misc.client", setter: fld_prio, prio: 0}]}, - "agent.id": {to:[{field: "rsa.misc.agent_id", setter: fld_set}]}, - "alarm_id": {to:[{field: "rsa.misc.alarm_id", setter: fld_set}]}, - "alarmname": {to:[{field: "rsa.misc.alarmname", setter: fld_set}]}, - "alert": {to:[{field: "rsa.threat.alert", setter: fld_set}]}, - "alert_id": {to:[{field: "rsa.misc.alert_id", setter: fld_set}]}, - "alias.host": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "analysis.file": {to:[{field: "rsa.investigations.analysis_file", setter: fld_set}]}, - "analysis.service": {to:[{field: "rsa.investigations.analysis_service", setter: fld_set}]}, - "analysis.session": {to:[{field: "rsa.investigations.analysis_session", setter: fld_set}]}, - "app_id": {to:[{field: "rsa.misc.app_id", setter: fld_set}]}, - "attachment": {to:[{field: "rsa.file.attachment", setter: fld_set}]}, - "audit": {to:[{field: "rsa.misc.audit", setter: fld_set}]}, - "audit_class": {to:[{field: "rsa.internal.audit_class", setter: fld_set}]}, - "audit_object": {to:[{field: "rsa.misc.audit_object", setter: fld_set}]}, - "auditdata": {to:[{field: "rsa.misc.auditdata", setter: fld_set}]}, - "authmethod": {to:[{field: "rsa.identity.auth_method", setter: fld_set}]}, - "autorun_type": {to:[{field: "rsa.misc.autorun_type", setter: fld_set}]}, - "bcc": {to:[{field: "rsa.email.email", setter: fld_append}]}, - "benchmark": {to:[{field: "rsa.misc.benchmark", setter: fld_set}]}, - "binary": {to:[{field: "rsa.file.binary", setter: fld_set}]}, - "boc": {to:[{field: "rsa.investigations.boc", setter: fld_set}]}, - "bssid": {to:[{field: "rsa.wireless.wlan_ssid", setter: fld_prio, prio: 1}]}, - "bypass": {to:[{field: "rsa.misc.bypass", setter: fld_set}]}, - "c_sid": {to:[{field: "rsa.identity.user_sid_src", setter: fld_set}]}, - "cache": {to:[{field: "rsa.misc.cache", setter: fld_set}]}, - "cache_hit": {to:[{field: "rsa.misc.cache_hit", setter: fld_set}]}, - "calling_from": {to:[{field: "rsa.misc.phone", setter: fld_prio, prio: 1}]}, - "calling_to": {to:[{field: "rsa.misc.phone", setter: fld_prio, prio: 0}]}, - "category": {to:[{field: "rsa.misc.category", setter: fld_set}]}, - "cc": {to:[{field: "rsa.email.email", setter: fld_append}]}, - "cc.number": {convert: to_long, to:[{field: "rsa.misc.cc_number", setter: fld_set}]}, - "cefversion": {to:[{field: "rsa.misc.cefversion", setter: fld_set}]}, - "cert.serial": {to:[{field: "rsa.crypto.cert_serial", setter: fld_set}]}, - "cert_ca": {to:[{field: "rsa.crypto.cert_ca", setter: fld_set}]}, - "cert_checksum": {to:[{field: "rsa.crypto.cert_checksum", setter: fld_set}]}, - "cert_common": {to:[{field: "rsa.crypto.cert_common", setter: fld_set}]}, - "cert_error": {to:[{field: "rsa.crypto.cert_error", setter: fld_set}]}, - "cert_hostname": {to:[{field: "rsa.crypto.cert_host_name", setter: fld_set}]}, - "cert_hostname_cat": {to:[{field: "rsa.crypto.cert_host_cat", setter: fld_set}]}, - "cert_issuer": {to:[{field: "rsa.crypto.cert_issuer", setter: fld_set}]}, - "cert_keysize": {to:[{field: "rsa.crypto.cert_keysize", setter: fld_set}]}, - "cert_status": {to:[{field: "rsa.crypto.cert_status", setter: fld_set}]}, - "cert_subject": {to:[{field: "rsa.crypto.cert_subject", setter: fld_set}]}, - "cert_username": {to:[{field: "rsa.crypto.cert_username", setter: fld_set}]}, - "cfg.attr": {to:[{field: "rsa.misc.cfg_attr", setter: fld_set}]}, - "cfg.obj": {to:[{field: "rsa.misc.cfg_obj", setter: fld_set}]}, - "cfg.path": {to:[{field: "rsa.misc.cfg_path", setter: fld_set}]}, - "change_attribute": {to:[{field: "rsa.misc.change_attrib", setter: fld_set}]}, - "change_new": {to:[{field: "rsa.misc.change_new", setter: fld_set}]}, - "change_old": {to:[{field: "rsa.misc.change_old", setter: fld_set}]}, - "changes": {to:[{field: "rsa.misc.changes", setter: fld_set}]}, - "checksum": {to:[{field: "rsa.misc.checksum", setter: fld_set}]}, - "checksum.dst": {to:[{field: "rsa.misc.checksum_dst", setter: fld_set}]}, - "checksum.src": {to:[{field: "rsa.misc.checksum_src", setter: fld_set}]}, - "cid": {to:[{field: "rsa.internal.cid", setter: fld_set}]}, - "client": {to:[{field: "rsa.misc.client", setter: fld_prio, prio: 1}]}, - "client_ip": {to:[{field: "rsa.misc.client_ip", setter: fld_set}]}, - "clustermembers": {to:[{field: "rsa.misc.clustermembers", setter: fld_set}]}, - "cmd": {to:[{field: "rsa.misc.cmd", setter: fld_set}]}, - "cn_acttimeout": {to:[{field: "rsa.misc.cn_acttimeout", setter: fld_set}]}, - "cn_asn_dst": {to:[{field: "rsa.web.cn_asn_dst", setter: fld_set}]}, - "cn_asn_src": {to:[{field: "rsa.misc.cn_asn_src", setter: fld_set}]}, - "cn_bgpv4nxthop": {to:[{field: "rsa.misc.cn_bgpv4nxthop", setter: fld_set}]}, - "cn_ctr_dst_code": {to:[{field: "rsa.misc.cn_ctr_dst_code", setter: fld_set}]}, - "cn_dst_tos": {to:[{field: "rsa.misc.cn_dst_tos", setter: fld_set}]}, - "cn_dst_vlan": {to:[{field: "rsa.misc.cn_dst_vlan", setter: fld_set}]}, - "cn_engine_id": {to:[{field: "rsa.misc.cn_engine_id", setter: fld_set}]}, - "cn_engine_type": {to:[{field: "rsa.misc.cn_engine_type", setter: fld_set}]}, - "cn_f_switch": {to:[{field: "rsa.misc.cn_f_switch", setter: fld_set}]}, - "cn_flowsampid": {to:[{field: "rsa.misc.cn_flowsampid", setter: fld_set}]}, - "cn_flowsampintv": {to:[{field: "rsa.misc.cn_flowsampintv", setter: fld_set}]}, - "cn_flowsampmode": {to:[{field: "rsa.misc.cn_flowsampmode", setter: fld_set}]}, - "cn_inacttimeout": {to:[{field: "rsa.misc.cn_inacttimeout", setter: fld_set}]}, - "cn_inpermbyts": {to:[{field: "rsa.misc.cn_inpermbyts", setter: fld_set}]}, - "cn_inpermpckts": {to:[{field: "rsa.misc.cn_inpermpckts", setter: fld_set}]}, - "cn_invalid": {to:[{field: "rsa.misc.cn_invalid", setter: fld_set}]}, - "cn_ip_proto_ver": {to:[{field: "rsa.misc.cn_ip_proto_ver", setter: fld_set}]}, - "cn_ipv4_ident": {to:[{field: "rsa.misc.cn_ipv4_ident", setter: fld_set}]}, - "cn_l_switch": {to:[{field: "rsa.misc.cn_l_switch", setter: fld_set}]}, - "cn_log_did": {to:[{field: "rsa.misc.cn_log_did", setter: fld_set}]}, - "cn_log_rid": {to:[{field: "rsa.misc.cn_log_rid", setter: fld_set}]}, - "cn_max_ttl": {to:[{field: "rsa.misc.cn_max_ttl", setter: fld_set}]}, - "cn_maxpcktlen": {to:[{field: "rsa.misc.cn_maxpcktlen", setter: fld_set}]}, - "cn_min_ttl": {to:[{field: "rsa.misc.cn_min_ttl", setter: fld_set}]}, - "cn_minpcktlen": {to:[{field: "rsa.misc.cn_minpcktlen", setter: fld_set}]}, - "cn_mpls_lbl_1": {to:[{field: "rsa.misc.cn_mpls_lbl_1", setter: fld_set}]}, - "cn_mpls_lbl_10": {to:[{field: "rsa.misc.cn_mpls_lbl_10", setter: fld_set}]}, - "cn_mpls_lbl_2": {to:[{field: "rsa.misc.cn_mpls_lbl_2", setter: fld_set}]}, - "cn_mpls_lbl_3": {to:[{field: "rsa.misc.cn_mpls_lbl_3", setter: fld_set}]}, - "cn_mpls_lbl_4": {to:[{field: "rsa.misc.cn_mpls_lbl_4", setter: fld_set}]}, - "cn_mpls_lbl_5": {to:[{field: "rsa.misc.cn_mpls_lbl_5", setter: fld_set}]}, - "cn_mpls_lbl_6": {to:[{field: "rsa.misc.cn_mpls_lbl_6", setter: fld_set}]}, - "cn_mpls_lbl_7": {to:[{field: "rsa.misc.cn_mpls_lbl_7", setter: fld_set}]}, - "cn_mpls_lbl_8": {to:[{field: "rsa.misc.cn_mpls_lbl_8", setter: fld_set}]}, - "cn_mpls_lbl_9": {to:[{field: "rsa.misc.cn_mpls_lbl_9", setter: fld_set}]}, - "cn_mplstoplabel": {to:[{field: "rsa.misc.cn_mplstoplabel", setter: fld_set}]}, - "cn_mplstoplabip": {to:[{field: "rsa.misc.cn_mplstoplabip", setter: fld_set}]}, - "cn_mul_dst_byt": {to:[{field: "rsa.misc.cn_mul_dst_byt", setter: fld_set}]}, - "cn_mul_dst_pks": {to:[{field: "rsa.misc.cn_mul_dst_pks", setter: fld_set}]}, - "cn_muligmptype": {to:[{field: "rsa.misc.cn_muligmptype", setter: fld_set}]}, - "cn_rpackets": {to:[{field: "rsa.web.cn_rpackets", setter: fld_set}]}, - "cn_sampalgo": {to:[{field: "rsa.misc.cn_sampalgo", setter: fld_set}]}, - "cn_sampint": {to:[{field: "rsa.misc.cn_sampint", setter: fld_set}]}, - "cn_seqctr": {to:[{field: "rsa.misc.cn_seqctr", setter: fld_set}]}, - "cn_spackets": {to:[{field: "rsa.misc.cn_spackets", setter: fld_set}]}, - "cn_src_tos": {to:[{field: "rsa.misc.cn_src_tos", setter: fld_set}]}, - "cn_src_vlan": {to:[{field: "rsa.misc.cn_src_vlan", setter: fld_set}]}, - "cn_sysuptime": {to:[{field: "rsa.misc.cn_sysuptime", setter: fld_set}]}, - "cn_template_id": {to:[{field: "rsa.misc.cn_template_id", setter: fld_set}]}, - "cn_totbytsexp": {to:[{field: "rsa.misc.cn_totbytsexp", setter: fld_set}]}, - "cn_totflowexp": {to:[{field: "rsa.misc.cn_totflowexp", setter: fld_set}]}, - "cn_totpcktsexp": {to:[{field: "rsa.misc.cn_totpcktsexp", setter: fld_set}]}, - "cn_unixnanosecs": {to:[{field: "rsa.misc.cn_unixnanosecs", setter: fld_set}]}, - "cn_v6flowlabel": {to:[{field: "rsa.misc.cn_v6flowlabel", setter: fld_set}]}, - "cn_v6optheaders": {to:[{field: "rsa.misc.cn_v6optheaders", setter: fld_set}]}, - "code": {to:[{field: "rsa.misc.code", setter: fld_set}]}, - "command": {to:[{field: "rsa.misc.command", setter: fld_set}]}, - "comments": {to:[{field: "rsa.misc.comments", setter: fld_set}]}, - "comp_class": {to:[{field: "rsa.misc.comp_class", setter: fld_set}]}, - "comp_name": {to:[{field: "rsa.misc.comp_name", setter: fld_set}]}, - "comp_rbytes": {to:[{field: "rsa.misc.comp_rbytes", setter: fld_set}]}, - "comp_sbytes": {to:[{field: "rsa.misc.comp_sbytes", setter: fld_set}]}, - "component_version": {to:[{field: "rsa.misc.comp_version", setter: fld_set}]}, - "connection_id": {to:[{field: "rsa.misc.connection_id", setter: fld_prio, prio: 1}]}, - "connectionid": {to:[{field: "rsa.misc.connection_id", setter: fld_prio, prio: 0}]}, - "content": {to:[{field: "rsa.misc.content", setter: fld_set}]}, - "content_type": {to:[{field: "rsa.misc.content_type", setter: fld_set}]}, - "content_version": {to:[{field: "rsa.misc.content_version", setter: fld_set}]}, - "context": {to:[{field: "rsa.misc.context", setter: fld_set}]}, - "count": {to:[{field: "rsa.misc.count", setter: fld_set}]}, - "cpu": {convert: to_long, to:[{field: "rsa.misc.cpu", setter: fld_set}]}, - "cpu_data": {to:[{field: "rsa.misc.cpu_data", setter: fld_set}]}, - "criticality": {to:[{field: "rsa.misc.criticality", setter: fld_set}]}, - "cs_agency_dst": {to:[{field: "rsa.misc.cs_agency_dst", setter: fld_set}]}, - "cs_analyzedby": {to:[{field: "rsa.misc.cs_analyzedby", setter: fld_set}]}, - "cs_av_other": {to:[{field: "rsa.misc.cs_av_other", setter: fld_set}]}, - "cs_av_primary": {to:[{field: "rsa.misc.cs_av_primary", setter: fld_set}]}, - "cs_av_secondary": {to:[{field: "rsa.misc.cs_av_secondary", setter: fld_set}]}, - "cs_bgpv6nxthop": {to:[{field: "rsa.misc.cs_bgpv6nxthop", setter: fld_set}]}, - "cs_bit9status": {to:[{field: "rsa.misc.cs_bit9status", setter: fld_set}]}, - "cs_context": {to:[{field: "rsa.misc.cs_context", setter: fld_set}]}, - "cs_control": {to:[{field: "rsa.misc.cs_control", setter: fld_set}]}, - "cs_data": {to:[{field: "rsa.misc.cs_data", setter: fld_set}]}, - "cs_datecret": {to:[{field: "rsa.misc.cs_datecret", setter: fld_set}]}, - "cs_dst_tld": {to:[{field: "rsa.misc.cs_dst_tld", setter: fld_set}]}, - "cs_eth_dst_ven": {to:[{field: "rsa.misc.cs_eth_dst_ven", setter: fld_set}]}, - "cs_eth_src_ven": {to:[{field: "rsa.misc.cs_eth_src_ven", setter: fld_set}]}, - "cs_event_uuid": {to:[{field: "rsa.misc.cs_event_uuid", setter: fld_set}]}, - "cs_filetype": {to:[{field: "rsa.misc.cs_filetype", setter: fld_set}]}, - "cs_fld": {to:[{field: "rsa.misc.cs_fld", setter: fld_set}]}, - "cs_if_desc": {to:[{field: "rsa.misc.cs_if_desc", setter: fld_set}]}, - "cs_if_name": {to:[{field: "rsa.misc.cs_if_name", setter: fld_set}]}, - "cs_ip_next_hop": {to:[{field: "rsa.misc.cs_ip_next_hop", setter: fld_set}]}, - "cs_ipv4dstpre": {to:[{field: "rsa.misc.cs_ipv4dstpre", setter: fld_set}]}, - "cs_ipv4srcpre": {to:[{field: "rsa.misc.cs_ipv4srcpre", setter: fld_set}]}, - "cs_lifetime": {to:[{field: "rsa.misc.cs_lifetime", setter: fld_set}]}, - "cs_log_medium": {to:[{field: "rsa.misc.cs_log_medium", setter: fld_set}]}, - "cs_loginname": {to:[{field: "rsa.misc.cs_loginname", setter: fld_set}]}, - "cs_modulescore": {to:[{field: "rsa.misc.cs_modulescore", setter: fld_set}]}, - "cs_modulesign": {to:[{field: "rsa.misc.cs_modulesign", setter: fld_set}]}, - "cs_opswatresult": {to:[{field: "rsa.misc.cs_opswatresult", setter: fld_set}]}, - "cs_payload": {to:[{field: "rsa.misc.cs_payload", setter: fld_set}]}, - "cs_registrant": {to:[{field: "rsa.misc.cs_registrant", setter: fld_set}]}, - "cs_registrar": {to:[{field: "rsa.misc.cs_registrar", setter: fld_set}]}, - "cs_represult": {to:[{field: "rsa.misc.cs_represult", setter: fld_set}]}, - "cs_rpayload": {to:[{field: "rsa.misc.cs_rpayload", setter: fld_set}]}, - "cs_sampler_name": {to:[{field: "rsa.misc.cs_sampler_name", setter: fld_set}]}, - "cs_sourcemodule": {to:[{field: "rsa.misc.cs_sourcemodule", setter: fld_set}]}, - "cs_streams": {to:[{field: "rsa.misc.cs_streams", setter: fld_set}]}, - "cs_targetmodule": {to:[{field: "rsa.misc.cs_targetmodule", setter: fld_set}]}, - "cs_v6nxthop": {to:[{field: "rsa.misc.cs_v6nxthop", setter: fld_set}]}, - "cs_whois_server": {to:[{field: "rsa.misc.cs_whois_server", setter: fld_set}]}, - "cs_yararesult": {to:[{field: "rsa.misc.cs_yararesult", setter: fld_set}]}, - "cve": {to:[{field: "rsa.misc.cve", setter: fld_set}]}, - "d_certauth": {to:[{field: "rsa.crypto.d_certauth", setter: fld_set}]}, - "d_cipher": {to:[{field: "rsa.crypto.cipher_dst", setter: fld_set}]}, - "d_ciphersize": {convert: to_long, to:[{field: "rsa.crypto.cipher_size_dst", setter: fld_set}]}, - "d_sslver": {to:[{field: "rsa.crypto.ssl_ver_dst", setter: fld_set}]}, - "data": {to:[{field: "rsa.internal.data", setter: fld_set}]}, - "data_type": {to:[{field: "rsa.misc.data_type", setter: fld_set}]}, - "date": {to:[{field: "rsa.time.date", setter: fld_set}]}, - "datetime": {to:[{field: "rsa.time.datetime", setter: fld_set}]}, - "day": {to:[{field: "rsa.time.day", setter: fld_set}]}, - "db_id": {to:[{field: "rsa.db.db_id", setter: fld_set}]}, - "db_name": {to:[{field: "rsa.db.database", setter: fld_set}]}, - "db_pid": {convert: to_long, to:[{field: "rsa.db.db_pid", setter: fld_set}]}, - "dclass_counter1": {convert: to_long, to:[{field: "rsa.counters.dclass_c1", setter: fld_set}]}, - "dclass_counter1_string": {to:[{field: "rsa.counters.dclass_c1_str", setter: fld_set}]}, - "dclass_counter2": {convert: to_long, to:[{field: "rsa.counters.dclass_c2", setter: fld_set}]}, - "dclass_counter2_string": {to:[{field: "rsa.counters.dclass_c2_str", setter: fld_set}]}, - "dclass_counter3": {convert: to_long, to:[{field: "rsa.counters.dclass_c3", setter: fld_set}]}, - "dclass_counter3_string": {to:[{field: "rsa.counters.dclass_c3_str", setter: fld_set}]}, - "dclass_ratio1": {to:[{field: "rsa.counters.dclass_r1", setter: fld_set}]}, - "dclass_ratio1_string": {to:[{field: "rsa.counters.dclass_r1_str", setter: fld_set}]}, - "dclass_ratio2": {to:[{field: "rsa.counters.dclass_r2", setter: fld_set}]}, - "dclass_ratio2_string": {to:[{field: "rsa.counters.dclass_r2_str", setter: fld_set}]}, - "dclass_ratio3": {to:[{field: "rsa.counters.dclass_r3", setter: fld_set}]}, - "dclass_ratio3_string": {to:[{field: "rsa.counters.dclass_r3_str", setter: fld_set}]}, - "dead": {convert: to_long, to:[{field: "rsa.internal.dead", setter: fld_set}]}, - "description": {to:[{field: "rsa.misc.description", setter: fld_set}]}, - "detail": {to:[{field: "rsa.misc.event_desc", setter: fld_set}]}, - "device": {to:[{field: "rsa.misc.device_name", setter: fld_set}]}, - "device.class": {to:[{field: "rsa.internal.device_class", setter: fld_set}]}, - "device.group": {to:[{field: "rsa.internal.device_group", setter: fld_set}]}, - "device.host": {to:[{field: "rsa.internal.device_host", setter: fld_set}]}, - "device.ip": {convert: to_ip, to:[{field: "rsa.internal.device_ip", setter: fld_set}]}, - "device.ipv6": {convert: to_ip, to:[{field: "rsa.internal.device_ipv6", setter: fld_set}]}, - "device.type": {to:[{field: "rsa.internal.device_type", setter: fld_set}]}, - "device.type.id": {convert: to_long, to:[{field: "rsa.internal.device_type_id", setter: fld_set}]}, - "devicehostname": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "devvendor": {to:[{field: "rsa.misc.devvendor", setter: fld_set}]}, - "dhost": {to:[{field: "rsa.network.host_dst", setter: fld_set}]}, - "did": {to:[{field: "rsa.internal.did", setter: fld_set}]}, - "dinterface": {to:[{field: "rsa.network.dinterface", setter: fld_set}]}, - "directory.dst": {to:[{field: "rsa.file.directory_dst", setter: fld_set}]}, - "directory.src": {to:[{field: "rsa.file.directory_src", setter: fld_set}]}, - "disk_volume": {to:[{field: "rsa.storage.disk_volume", setter: fld_set}]}, - "disposition": {to:[{field: "rsa.misc.disposition", setter: fld_set}]}, - "distance": {to:[{field: "rsa.misc.distance", setter: fld_set}]}, - "dmask": {to:[{field: "rsa.network.dmask", setter: fld_set}]}, - "dn": {to:[{field: "rsa.identity.dn", setter: fld_set}]}, - "dns_a_record": {to:[{field: "rsa.network.dns_a_record", setter: fld_set}]}, - "dns_cname_record": {to:[{field: "rsa.network.dns_cname_record", setter: fld_set}]}, - "dns_id": {to:[{field: "rsa.network.dns_id", setter: fld_set}]}, - "dns_opcode": {to:[{field: "rsa.network.dns_opcode", setter: fld_set}]}, - "dns_ptr_record": {to:[{field: "rsa.network.dns_ptr_record", setter: fld_set}]}, - "dns_resp": {to:[{field: "rsa.network.dns_resp", setter: fld_set}]}, - "dns_type": {to:[{field: "rsa.network.dns_type", setter: fld_set}]}, - "doc_number": {convert: to_long, to:[{field: "rsa.misc.doc_number", setter: fld_set}]}, - "domain": {to:[{field: "rsa.network.domain", setter: fld_set}]}, - "domain1": {to:[{field: "rsa.network.domain1", setter: fld_set}]}, - "dst_dn": {to:[{field: "rsa.identity.dn_dst", setter: fld_set}]}, - "dst_payload": {to:[{field: "rsa.misc.payload_dst", setter: fld_set}]}, - "dst_spi": {to:[{field: "rsa.misc.spi_dst", setter: fld_set}]}, - "dst_zone": {to:[{field: "rsa.network.zone_dst", setter: fld_set}]}, - "dstburb": {to:[{field: "rsa.misc.dstburb", setter: fld_set}]}, - "duration": {convert: to_double, to:[{field: "rsa.time.duration_time", setter: fld_set}]}, - "duration_string": {to:[{field: "rsa.time.duration_str", setter: fld_set}]}, - "ec_activity": {to:[{field: "rsa.investigations.ec_activity", setter: fld_set}]}, - "ec_outcome": {to:[{field: "rsa.investigations.ec_outcome", setter: fld_set}]}, - "ec_subject": {to:[{field: "rsa.investigations.ec_subject", setter: fld_set}]}, - "ec_theme": {to:[{field: "rsa.investigations.ec_theme", setter: fld_set}]}, - "edomain": {to:[{field: "rsa.misc.edomain", setter: fld_set}]}, - "edomaub": {to:[{field: "rsa.misc.edomaub", setter: fld_set}]}, - "effective_time": {convert: to_date, to:[{field: "rsa.time.effective_time", setter: fld_set}]}, - "ein.number": {convert: to_long, to:[{field: "rsa.misc.ein_number", setter: fld_set}]}, - "email": {to:[{field: "rsa.email.email", setter: fld_append}]}, - "encryption_type": {to:[{field: "rsa.crypto.crypto", setter: fld_set}]}, - "endtime": {convert: to_date, to:[{field: "rsa.time.endtime", setter: fld_set}]}, - "entropy.req": {convert: to_long, to:[{field: "rsa.internal.entropy_req", setter: fld_set}]}, - "entropy.res": {convert: to_long, to:[{field: "rsa.internal.entropy_res", setter: fld_set}]}, - "entry": {to:[{field: "rsa.internal.entry", setter: fld_set}]}, - "eoc": {to:[{field: "rsa.investigations.eoc", setter: fld_set}]}, - "error": {to:[{field: "rsa.misc.error", setter: fld_set}]}, - "eth_type": {convert: to_long, to:[{field: "rsa.network.eth_type", setter: fld_set}]}, - "euid": {to:[{field: "rsa.misc.euid", setter: fld_set}]}, - "event.cat": {convert: to_long, to:[{field: "rsa.investigations.event_cat", setter: fld_prio, prio: 1}]}, - "event.cat.name": {to:[{field: "rsa.investigations.event_cat_name", setter: fld_prio, prio: 1}]}, - "event_cat": {convert: to_long, to:[{field: "rsa.investigations.event_cat", setter: fld_prio, prio: 0}]}, - "event_cat_name": {to:[{field: "rsa.investigations.event_cat_name", setter: fld_prio, prio: 0}]}, - "event_category": {to:[{field: "rsa.misc.event_category", setter: fld_set}]}, - "event_computer": {to:[{field: "rsa.misc.event_computer", setter: fld_set}]}, - "event_counter": {convert: to_long, to:[{field: "rsa.counters.event_counter", setter: fld_set}]}, - "event_description": {to:[{field: "rsa.internal.event_desc", setter: fld_set}]}, - "event_id": {to:[{field: "rsa.misc.event_id", setter: fld_set}]}, - "event_log": {to:[{field: "rsa.misc.event_log", setter: fld_set}]}, - "event_name": {to:[{field: "rsa.internal.event_name", setter: fld_set}]}, - "event_queue_time": {convert: to_date, to:[{field: "rsa.time.event_queue_time", setter: fld_set}]}, - "event_source": {to:[{field: "rsa.misc.event_source", setter: fld_set}]}, - "event_state": {to:[{field: "rsa.misc.event_state", setter: fld_set}]}, - "event_time": {convert: to_date, to:[{field: "rsa.time.event_time", setter: fld_set}]}, - "event_time_str": {to:[{field: "rsa.time.event_time_str", setter: fld_prio, prio: 1}]}, - "event_time_string": {to:[{field: "rsa.time.event_time_str", setter: fld_prio, prio: 0}]}, - "event_type": {to:[{field: "rsa.misc.event_type", setter: fld_set}]}, - "event_user": {to:[{field: "rsa.misc.event_user", setter: fld_set}]}, - "eventtime": {to:[{field: "rsa.time.eventtime", setter: fld_set}]}, - "expected_val": {to:[{field: "rsa.misc.expected_val", setter: fld_set}]}, - "expiration_time": {convert: to_date, to:[{field: "rsa.time.expire_time", setter: fld_set}]}, - "expiration_time_string": {to:[{field: "rsa.time.expire_time_str", setter: fld_set}]}, - "facility": {to:[{field: "rsa.misc.facility", setter: fld_set}]}, - "facilityname": {to:[{field: "rsa.misc.facilityname", setter: fld_set}]}, - "faddr": {to:[{field: "rsa.network.faddr", setter: fld_set}]}, - "fcatnum": {to:[{field: "rsa.misc.fcatnum", setter: fld_set}]}, - "federated_idp": {to:[{field: "rsa.identity.federated_idp", setter: fld_set}]}, - "federated_sp": {to:[{field: "rsa.identity.federated_sp", setter: fld_set}]}, - "feed.category": {to:[{field: "rsa.internal.feed_category", setter: fld_set}]}, - "feed_desc": {to:[{field: "rsa.internal.feed_desc", setter: fld_set}]}, - "feed_name": {to:[{field: "rsa.internal.feed_name", setter: fld_set}]}, - "fhost": {to:[{field: "rsa.network.fhost", setter: fld_set}]}, - "file_entropy": {convert: to_double, to:[{field: "rsa.file.file_entropy", setter: fld_set}]}, - "file_vendor": {to:[{field: "rsa.file.file_vendor", setter: fld_set}]}, - "filename_dst": {to:[{field: "rsa.file.filename_dst", setter: fld_set}]}, - "filename_src": {to:[{field: "rsa.file.filename_src", setter: fld_set}]}, - "filename_tmp": {to:[{field: "rsa.file.filename_tmp", setter: fld_set}]}, - "filesystem": {to:[{field: "rsa.file.filesystem", setter: fld_set}]}, - "filter": {to:[{field: "rsa.misc.filter", setter: fld_set}]}, - "finterface": {to:[{field: "rsa.misc.finterface", setter: fld_set}]}, - "flags": {to:[{field: "rsa.misc.flags", setter: fld_set}]}, - "forensic_info": {to:[{field: "rsa.misc.forensic_info", setter: fld_set}]}, - "forward.ip": {convert: to_ip, to:[{field: "rsa.internal.forward_ip", setter: fld_set}]}, - "forward.ipv6": {convert: to_ip, to:[{field: "rsa.internal.forward_ipv6", setter: fld_set}]}, - "found": {to:[{field: "rsa.misc.found", setter: fld_set}]}, - "fport": {to:[{field: "rsa.network.fport", setter: fld_set}]}, - "fqdn": {to:[{field: "rsa.web.fqdn", setter: fld_set}]}, - "fresult": {convert: to_long, to:[{field: "rsa.misc.fresult", setter: fld_set}]}, - "from": {to:[{field: "rsa.email.email_src", setter: fld_set}]}, - "gaddr": {to:[{field: "rsa.misc.gaddr", setter: fld_set}]}, - "gateway": {to:[{field: "rsa.network.gateway", setter: fld_set}]}, - "gmtdate": {to:[{field: "rsa.time.gmtdate", setter: fld_set}]}, - "gmttime": {to:[{field: "rsa.time.gmttime", setter: fld_set}]}, - "group": {to:[{field: "rsa.misc.group", setter: fld_set}]}, - "group_object": {to:[{field: "rsa.misc.group_object", setter: fld_set}]}, - "groupid": {to:[{field: "rsa.misc.group_id", setter: fld_set}]}, - "h_code": {to:[{field: "rsa.internal.hcode", setter: fld_set}]}, - "hardware_id": {to:[{field: "rsa.misc.hardware_id", setter: fld_set}]}, - "header.id": {to:[{field: "rsa.internal.header_id", setter: fld_set}]}, - "host.orig": {to:[{field: "rsa.network.host_orig", setter: fld_set}]}, - "host.state": {to:[{field: "rsa.endpoint.host_state", setter: fld_set}]}, - "host.type": {to:[{field: "rsa.network.host_type", setter: fld_set}]}, - "host_role": {to:[{field: "rsa.identity.host_role", setter: fld_set}]}, - "hostid": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "hostname": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "hour": {to:[{field: "rsa.time.hour", setter: fld_set}]}, - "https.insact": {to:[{field: "rsa.crypto.https_insact", setter: fld_set}]}, - "https.valid": {to:[{field: "rsa.crypto.https_valid", setter: fld_set}]}, - "icmpcode": {convert: to_long, to:[{field: "rsa.network.icmp_code", setter: fld_set}]}, - "icmptype": {convert: to_long, to:[{field: "rsa.network.icmp_type", setter: fld_set}]}, - "id": {to:[{field: "rsa.misc.reference_id", setter: fld_set}]}, - "id1": {to:[{field: "rsa.misc.reference_id1", setter: fld_set}]}, - "id2": {to:[{field: "rsa.misc.reference_id2", setter: fld_set}]}, - "id3": {to:[{field: "rsa.misc.id3", setter: fld_set}]}, - "ike": {to:[{field: "rsa.crypto.ike", setter: fld_set}]}, - "ike_cookie1": {to:[{field: "rsa.crypto.ike_cookie1", setter: fld_set}]}, - "ike_cookie2": {to:[{field: "rsa.crypto.ike_cookie2", setter: fld_set}]}, - "im_buddyid": {to:[{field: "rsa.misc.im_buddyid", setter: fld_set}]}, - "im_buddyname": {to:[{field: "rsa.misc.im_buddyname", setter: fld_set}]}, - "im_client": {to:[{field: "rsa.misc.im_client", setter: fld_set}]}, - "im_croomid": {to:[{field: "rsa.misc.im_croomid", setter: fld_set}]}, - "im_croomtype": {to:[{field: "rsa.misc.im_croomtype", setter: fld_set}]}, - "im_members": {to:[{field: "rsa.misc.im_members", setter: fld_set}]}, - "im_userid": {to:[{field: "rsa.misc.im_userid", setter: fld_set}]}, - "im_username": {to:[{field: "rsa.misc.im_username", setter: fld_set}]}, - "index": {to:[{field: "rsa.misc.index", setter: fld_set}]}, - "info": {to:[{field: "rsa.db.index", setter: fld_set}]}, - "inode": {convert: to_long, to:[{field: "rsa.internal.inode", setter: fld_set}]}, - "inout": {to:[{field: "rsa.misc.inout", setter: fld_set}]}, - "instance": {to:[{field: "rsa.db.instance", setter: fld_set}]}, - "interface": {to:[{field: "rsa.network.interface", setter: fld_set}]}, - "inv.category": {to:[{field: "rsa.investigations.inv_category", setter: fld_set}]}, - "inv.context": {to:[{field: "rsa.investigations.inv_context", setter: fld_set}]}, - "ioc": {to:[{field: "rsa.investigations.ioc", setter: fld_set}]}, - "ip_proto": {convert: to_long, to:[{field: "rsa.network.ip_proto", setter: fld_set}]}, - "ipkt": {to:[{field: "rsa.misc.ipkt", setter: fld_set}]}, - "ipscat": {to:[{field: "rsa.misc.ipscat", setter: fld_set}]}, - "ipspri": {to:[{field: "rsa.misc.ipspri", setter: fld_set}]}, - "jobname": {to:[{field: "rsa.misc.jobname", setter: fld_set}]}, - "jobnum": {to:[{field: "rsa.misc.job_num", setter: fld_set}]}, - "laddr": {to:[{field: "rsa.network.laddr", setter: fld_set}]}, - "language": {to:[{field: "rsa.misc.language", setter: fld_set}]}, - "latitude": {to:[{field: "rsa.misc.latitude", setter: fld_set}]}, - "lc.cid": {to:[{field: "rsa.internal.lc_cid", setter: fld_set}]}, - "lc.ctime": {convert: to_date, to:[{field: "rsa.internal.lc_ctime", setter: fld_set}]}, - "ldap": {to:[{field: "rsa.identity.ldap", setter: fld_set}]}, - "ldap.query": {to:[{field: "rsa.identity.ldap_query", setter: fld_set}]}, - "ldap.response": {to:[{field: "rsa.identity.ldap_response", setter: fld_set}]}, - "level": {convert: to_long, to:[{field: "rsa.internal.level", setter: fld_set}]}, - "lhost": {to:[{field: "rsa.network.lhost", setter: fld_set}]}, - "library": {to:[{field: "rsa.misc.library", setter: fld_set}]}, - "lifetime": {convert: to_long, to:[{field: "rsa.misc.lifetime", setter: fld_set}]}, - "linenum": {to:[{field: "rsa.misc.linenum", setter: fld_set}]}, - "link": {to:[{field: "rsa.misc.link", setter: fld_set}]}, - "linterface": {to:[{field: "rsa.network.linterface", setter: fld_set}]}, - "list_name": {to:[{field: "rsa.misc.list_name", setter: fld_set}]}, - "listnum": {to:[{field: "rsa.misc.listnum", setter: fld_set}]}, - "load_data": {to:[{field: "rsa.misc.load_data", setter: fld_set}]}, - "location_floor": {to:[{field: "rsa.misc.location_floor", setter: fld_set}]}, - "location_mark": {to:[{field: "rsa.misc.location_mark", setter: fld_set}]}, - "log_id": {to:[{field: "rsa.misc.log_id", setter: fld_set}]}, - "log_type": {to:[{field: "rsa.misc.log_type", setter: fld_set}]}, - "logid": {to:[{field: "rsa.misc.logid", setter: fld_set}]}, - "logip": {to:[{field: "rsa.misc.logip", setter: fld_set}]}, - "logname": {to:[{field: "rsa.misc.logname", setter: fld_set}]}, - "logon_type": {to:[{field: "rsa.identity.logon_type", setter: fld_set}]}, - "logon_type_desc": {to:[{field: "rsa.identity.logon_type_desc", setter: fld_set}]}, - "longitude": {to:[{field: "rsa.misc.longitude", setter: fld_set}]}, - "lport": {to:[{field: "rsa.misc.lport", setter: fld_set}]}, - "lread": {convert: to_long, to:[{field: "rsa.db.lread", setter: fld_set}]}, - "lun": {to:[{field: "rsa.storage.lun", setter: fld_set}]}, - "lwrite": {convert: to_long, to:[{field: "rsa.db.lwrite", setter: fld_set}]}, - "macaddr": {convert: to_mac, to:[{field: "rsa.network.eth_host", setter: fld_set}]}, - "mail_id": {to:[{field: "rsa.misc.mail_id", setter: fld_set}]}, - "mask": {to:[{field: "rsa.network.mask", setter: fld_set}]}, - "match": {to:[{field: "rsa.misc.match", setter: fld_set}]}, - "mbug_data": {to:[{field: "rsa.misc.mbug_data", setter: fld_set}]}, - "mcb.req": {convert: to_long, to:[{field: "rsa.internal.mcb_req", setter: fld_set}]}, - "mcb.res": {convert: to_long, to:[{field: "rsa.internal.mcb_res", setter: fld_set}]}, - "mcbc.req": {convert: to_long, to:[{field: "rsa.internal.mcbc_req", setter: fld_set}]}, - "mcbc.res": {convert: to_long, to:[{field: "rsa.internal.mcbc_res", setter: fld_set}]}, - "medium": {convert: to_long, to:[{field: "rsa.internal.medium", setter: fld_set}]}, - "message": {to:[{field: "rsa.internal.message", setter: fld_set}]}, - "message_body": {to:[{field: "rsa.misc.message_body", setter: fld_set}]}, - "messageid": {to:[{field: "rsa.internal.messageid", setter: fld_set}]}, - "min": {to:[{field: "rsa.time.min", setter: fld_set}]}, - "misc": {to:[{field: "rsa.misc.misc", setter: fld_set}]}, - "misc_name": {to:[{field: "rsa.misc.misc_name", setter: fld_set}]}, - "mode": {to:[{field: "rsa.misc.mode", setter: fld_set}]}, - "month": {to:[{field: "rsa.time.month", setter: fld_set}]}, - "msg": {to:[{field: "rsa.internal.msg", setter: fld_set}]}, - "msgIdPart1": {to:[{field: "rsa.misc.msgIdPart1", setter: fld_set}]}, - "msgIdPart2": {to:[{field: "rsa.misc.msgIdPart2", setter: fld_set}]}, - "msgIdPart3": {to:[{field: "rsa.misc.msgIdPart3", setter: fld_set}]}, - "msgIdPart4": {to:[{field: "rsa.misc.msgIdPart4", setter: fld_set}]}, - "msg_id": {to:[{field: "rsa.internal.msg_id", setter: fld_set}]}, - "msg_type": {to:[{field: "rsa.misc.msg_type", setter: fld_set}]}, - "msgid": {to:[{field: "rsa.misc.msgid", setter: fld_set}]}, - "name": {to:[{field: "rsa.misc.name", setter: fld_set}]}, - "netname": {to:[{field: "rsa.network.netname", setter: fld_set}]}, - "netsessid": {to:[{field: "rsa.misc.netsessid", setter: fld_set}]}, - "network_port": {convert: to_long, to:[{field: "rsa.network.network_port", setter: fld_set}]}, - "network_service": {to:[{field: "rsa.network.network_service", setter: fld_set}]}, - "node": {to:[{field: "rsa.misc.node", setter: fld_set}]}, - "nodename": {to:[{field: "rsa.internal.node_name", setter: fld_set}]}, - "ntype": {to:[{field: "rsa.misc.ntype", setter: fld_set}]}, - "num": {to:[{field: "rsa.misc.num", setter: fld_set}]}, - "number": {to:[{field: "rsa.misc.number", setter: fld_set}]}, - "number1": {to:[{field: "rsa.misc.number1", setter: fld_set}]}, - "number2": {to:[{field: "rsa.misc.number2", setter: fld_set}]}, - "nwe.callback_id": {to:[{field: "rsa.internal.nwe_callback_id", setter: fld_set}]}, - "nwwn": {to:[{field: "rsa.misc.nwwn", setter: fld_set}]}, - "obj_id": {to:[{field: "rsa.internal.obj_id", setter: fld_set}]}, - "obj_name": {to:[{field: "rsa.misc.obj_name", setter: fld_set}]}, - "obj_server": {to:[{field: "rsa.internal.obj_server", setter: fld_set}]}, - "obj_type": {to:[{field: "rsa.misc.obj_type", setter: fld_set}]}, - "obj_value": {to:[{field: "rsa.internal.obj_val", setter: fld_set}]}, - "object": {to:[{field: "rsa.misc.object", setter: fld_set}]}, - "observed_val": {to:[{field: "rsa.misc.observed_val", setter: fld_set}]}, - "operation": {to:[{field: "rsa.misc.operation", setter: fld_set}]}, - "operation_id": {to:[{field: "rsa.misc.operation_id", setter: fld_set}]}, - "opkt": {to:[{field: "rsa.misc.opkt", setter: fld_set}]}, - "org.dst": {to:[{field: "rsa.physical.org_dst", setter: fld_prio, prio: 1}]}, - "org.src": {to:[{field: "rsa.physical.org_src", setter: fld_set}]}, - "org_dst": {to:[{field: "rsa.physical.org_dst", setter: fld_prio, prio: 0}]}, - "orig_from": {to:[{field: "rsa.misc.orig_from", setter: fld_set}]}, - "origin": {to:[{field: "rsa.network.origin", setter: fld_set}]}, - "original_owner": {to:[{field: "rsa.identity.owner", setter: fld_set}]}, - "os": {to:[{field: "rsa.misc.OS", setter: fld_set}]}, - "owner_id": {to:[{field: "rsa.misc.owner_id", setter: fld_set}]}, - "p_action": {to:[{field: "rsa.misc.p_action", setter: fld_set}]}, - "p_date": {to:[{field: "rsa.time.p_date", setter: fld_set}]}, - "p_filter": {to:[{field: "rsa.misc.p_filter", setter: fld_set}]}, - "p_group_object": {to:[{field: "rsa.misc.p_group_object", setter: fld_set}]}, - "p_id": {to:[{field: "rsa.misc.p_id", setter: fld_set}]}, - "p_month": {to:[{field: "rsa.time.p_month", setter: fld_set}]}, - "p_msgid": {to:[{field: "rsa.misc.p_msgid", setter: fld_set}]}, - "p_msgid1": {to:[{field: "rsa.misc.p_msgid1", setter: fld_set}]}, - "p_msgid2": {to:[{field: "rsa.misc.p_msgid2", setter: fld_set}]}, - "p_result1": {to:[{field: "rsa.misc.p_result1", setter: fld_set}]}, - "p_time": {to:[{field: "rsa.time.p_time", setter: fld_set}]}, - "p_time1": {to:[{field: "rsa.time.p_time1", setter: fld_set}]}, - "p_time2": {to:[{field: "rsa.time.p_time2", setter: fld_set}]}, - "p_url": {to:[{field: "rsa.web.p_url", setter: fld_set}]}, - "p_user_agent": {to:[{field: "rsa.web.p_user_agent", setter: fld_set}]}, - "p_web_cookie": {to:[{field: "rsa.web.p_web_cookie", setter: fld_set}]}, - "p_web_method": {to:[{field: "rsa.web.p_web_method", setter: fld_set}]}, - "p_web_referer": {to:[{field: "rsa.web.p_web_referer", setter: fld_set}]}, - "p_year": {to:[{field: "rsa.time.p_year", setter: fld_set}]}, - "packet_length": {to:[{field: "rsa.network.packet_length", setter: fld_set}]}, - "paddr": {convert: to_ip, to:[{field: "rsa.network.paddr", setter: fld_set}]}, - "param": {to:[{field: "rsa.misc.param", setter: fld_set}]}, - "param.dst": {to:[{field: "rsa.misc.param_dst", setter: fld_set}]}, - "param.src": {to:[{field: "rsa.misc.param_src", setter: fld_set}]}, - "parent_node": {to:[{field: "rsa.misc.parent_node", setter: fld_set}]}, - "parse.error": {to:[{field: "rsa.internal.parse_error", setter: fld_set}]}, - "password": {to:[{field: "rsa.identity.password", setter: fld_set}]}, - "password_chg": {to:[{field: "rsa.misc.password_chg", setter: fld_set}]}, - "password_expire": {to:[{field: "rsa.misc.password_expire", setter: fld_set}]}, - "patient_fname": {to:[{field: "rsa.healthcare.patient_fname", setter: fld_set}]}, - "patient_id": {to:[{field: "rsa.healthcare.patient_id", setter: fld_set}]}, - "patient_lname": {to:[{field: "rsa.healthcare.patient_lname", setter: fld_set}]}, - "patient_mname": {to:[{field: "rsa.healthcare.patient_mname", setter: fld_set}]}, - "payload.req": {convert: to_long, to:[{field: "rsa.internal.payload_req", setter: fld_set}]}, - "payload.res": {convert: to_long, to:[{field: "rsa.internal.payload_res", setter: fld_set}]}, - "peer": {to:[{field: "rsa.crypto.peer", setter: fld_set}]}, - "peer_id": {to:[{field: "rsa.crypto.peer_id", setter: fld_set}]}, - "permgranted": {to:[{field: "rsa.misc.permgranted", setter: fld_set}]}, - "permissions": {to:[{field: "rsa.db.permissions", setter: fld_set}]}, - "permwanted": {to:[{field: "rsa.misc.permwanted", setter: fld_set}]}, - "pgid": {to:[{field: "rsa.misc.pgid", setter: fld_set}]}, - "phone_number": {to:[{field: "rsa.misc.phone", setter: fld_prio, prio: 2}]}, - "phost": {to:[{field: "rsa.network.phost", setter: fld_set}]}, - "pid": {to:[{field: "rsa.misc.pid", setter: fld_set}]}, - "policy": {to:[{field: "rsa.misc.policy", setter: fld_set}]}, - "policyUUID": {to:[{field: "rsa.misc.policyUUID", setter: fld_set}]}, - "policy_id": {to:[{field: "rsa.misc.policy_id", setter: fld_set}]}, - "policy_value": {to:[{field: "rsa.misc.policy_value", setter: fld_set}]}, - "policy_waiver": {to:[{field: "rsa.misc.policy_waiver", setter: fld_set}]}, - "policyname": {to:[{field: "rsa.misc.policy_name", setter: fld_prio, prio: 0}]}, - "pool_id": {to:[{field: "rsa.misc.pool_id", setter: fld_set}]}, - "pool_name": {to:[{field: "rsa.misc.pool_name", setter: fld_set}]}, - "port": {convert: to_long, to:[{field: "rsa.network.port", setter: fld_set}]}, - "portname": {to:[{field: "rsa.misc.port_name", setter: fld_set}]}, - "pread": {convert: to_long, to:[{field: "rsa.db.pread", setter: fld_set}]}, - "priority": {to:[{field: "rsa.misc.priority", setter: fld_set}]}, - "privilege": {to:[{field: "rsa.file.privilege", setter: fld_set}]}, - "process.vid.dst": {to:[{field: "rsa.internal.process_vid_dst", setter: fld_set}]}, - "process.vid.src": {to:[{field: "rsa.internal.process_vid_src", setter: fld_set}]}, - "process_id_val": {to:[{field: "rsa.misc.process_id_val", setter: fld_set}]}, - "processing_time": {to:[{field: "rsa.time.process_time", setter: fld_set}]}, - "profile": {to:[{field: "rsa.identity.profile", setter: fld_set}]}, - "prog_asp_num": {to:[{field: "rsa.misc.prog_asp_num", setter: fld_set}]}, - "program": {to:[{field: "rsa.misc.program", setter: fld_set}]}, - "protocol_detail": {to:[{field: "rsa.network.protocol_detail", setter: fld_set}]}, - "pwwn": {to:[{field: "rsa.storage.pwwn", setter: fld_set}]}, - "r_hostid": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "real_data": {to:[{field: "rsa.misc.real_data", setter: fld_set}]}, - "realm": {to:[{field: "rsa.identity.realm", setter: fld_set}]}, - "reason": {to:[{field: "rsa.misc.reason", setter: fld_set}]}, - "rec_asp_device": {to:[{field: "rsa.misc.rec_asp_device", setter: fld_set}]}, - "rec_asp_num": {to:[{field: "rsa.misc.rec_asp_num", setter: fld_set}]}, - "rec_library": {to:[{field: "rsa.misc.rec_library", setter: fld_set}]}, - "recorded_time": {convert: to_date, to:[{field: "rsa.time.recorded_time", setter: fld_set}]}, - "recordnum": {to:[{field: "rsa.misc.recordnum", setter: fld_set}]}, - "registry.key": {to:[{field: "rsa.endpoint.registry_key", setter: fld_set}]}, - "registry.value": {to:[{field: "rsa.endpoint.registry_value", setter: fld_set}]}, - "remote_domain": {to:[{field: "rsa.web.remote_domain", setter: fld_set}]}, - "remote_domain_id": {to:[{field: "rsa.network.remote_domain_id", setter: fld_set}]}, - "reputation_num": {convert: to_double, to:[{field: "rsa.web.reputation_num", setter: fld_set}]}, - "resource": {to:[{field: "rsa.internal.resource", setter: fld_set}]}, - "resource_class": {to:[{field: "rsa.internal.resource_class", setter: fld_set}]}, - "result": {to:[{field: "rsa.misc.result", setter: fld_set}]}, - "result_code": {to:[{field: "rsa.misc.result_code", setter: fld_prio, prio: 1}]}, - "resultcode": {to:[{field: "rsa.misc.result_code", setter: fld_prio, prio: 0}]}, - "rid": {convert: to_long, to:[{field: "rsa.internal.rid", setter: fld_set}]}, - "risk": {to:[{field: "rsa.misc.risk", setter: fld_set}]}, - "risk_info": {to:[{field: "rsa.misc.risk_info", setter: fld_set}]}, - "risk_num": {convert: to_double, to:[{field: "rsa.misc.risk_num", setter: fld_set}]}, - "risk_num_comm": {convert: to_double, to:[{field: "rsa.misc.risk_num_comm", setter: fld_set}]}, - "risk_num_next": {convert: to_double, to:[{field: "rsa.misc.risk_num_next", setter: fld_set}]}, - "risk_num_sand": {convert: to_double, to:[{field: "rsa.misc.risk_num_sand", setter: fld_set}]}, - "risk_num_static": {convert: to_double, to:[{field: "rsa.misc.risk_num_static", setter: fld_set}]}, - "risk_suspicious": {to:[{field: "rsa.misc.risk_suspicious", setter: fld_set}]}, - "risk_warning": {to:[{field: "rsa.misc.risk_warning", setter: fld_set}]}, - "rpayload": {to:[{field: "rsa.network.rpayload", setter: fld_set}]}, - "ruid": {to:[{field: "rsa.misc.ruid", setter: fld_set}]}, - "rule": {to:[{field: "rsa.misc.rule", setter: fld_set}]}, - "rule_group": {to:[{field: "rsa.misc.rule_group", setter: fld_set}]}, - "rule_template": {to:[{field: "rsa.misc.rule_template", setter: fld_set}]}, - "rule_uid": {to:[{field: "rsa.misc.rule_uid", setter: fld_set}]}, - "rulename": {to:[{field: "rsa.misc.rule_name", setter: fld_set}]}, - "s_certauth": {to:[{field: "rsa.crypto.s_certauth", setter: fld_set}]}, - "s_cipher": {to:[{field: "rsa.crypto.cipher_src", setter: fld_set}]}, - "s_ciphersize": {convert: to_long, to:[{field: "rsa.crypto.cipher_size_src", setter: fld_set}]}, - "s_context": {to:[{field: "rsa.misc.context_subject", setter: fld_set}]}, - "s_sslver": {to:[{field: "rsa.crypto.ssl_ver_src", setter: fld_set}]}, - "sburb": {to:[{field: "rsa.misc.sburb", setter: fld_set}]}, - "scheme": {to:[{field: "rsa.crypto.scheme", setter: fld_set}]}, - "sdomain_fld": {to:[{field: "rsa.misc.sdomain_fld", setter: fld_set}]}, - "search.text": {to:[{field: "rsa.misc.search_text", setter: fld_set}]}, - "sec": {to:[{field: "rsa.misc.sec", setter: fld_set}]}, - "second": {to:[{field: "rsa.misc.second", setter: fld_set}]}, - "sensor": {to:[{field: "rsa.misc.sensor", setter: fld_set}]}, - "sensorname": {to:[{field: "rsa.misc.sensorname", setter: fld_set}]}, - "seqnum": {to:[{field: "rsa.misc.seqnum", setter: fld_set}]}, - "serial_number": {to:[{field: "rsa.misc.serial_number", setter: fld_set}]}, - "service.account": {to:[{field: "rsa.identity.service_account", setter: fld_set}]}, - "session": {to:[{field: "rsa.misc.session", setter: fld_set}]}, - "session.split": {to:[{field: "rsa.internal.session_split", setter: fld_set}]}, - "sessionid": {to:[{field: "rsa.misc.log_session_id", setter: fld_set}]}, - "sessionid1": {to:[{field: "rsa.misc.log_session_id1", setter: fld_set}]}, - "sessiontype": {to:[{field: "rsa.misc.sessiontype", setter: fld_set}]}, - "severity": {to:[{field: "rsa.misc.severity", setter: fld_set}]}, - "sid": {to:[{field: "rsa.identity.user_sid_dst", setter: fld_set}]}, - "sig.name": {to:[{field: "rsa.misc.sig_name", setter: fld_set}]}, - "sigUUID": {to:[{field: "rsa.misc.sigUUID", setter: fld_set}]}, - "sigcat": {to:[{field: "rsa.misc.sigcat", setter: fld_set}]}, - "sigid": {convert: to_long, to:[{field: "rsa.misc.sig_id", setter: fld_set}]}, - "sigid1": {convert: to_long, to:[{field: "rsa.misc.sig_id1", setter: fld_set}]}, - "sigid_string": {to:[{field: "rsa.misc.sig_id_str", setter: fld_set}]}, - "signame": {to:[{field: "rsa.misc.policy_name", setter: fld_prio, prio: 1}]}, - "sigtype": {to:[{field: "rsa.crypto.sig_type", setter: fld_set}]}, - "sinterface": {to:[{field: "rsa.network.sinterface", setter: fld_set}]}, - "site": {to:[{field: "rsa.internal.site", setter: fld_set}]}, - "size": {convert: to_long, to:[{field: "rsa.internal.size", setter: fld_set}]}, - "smask": {to:[{field: "rsa.network.smask", setter: fld_set}]}, - "snmp.oid": {to:[{field: "rsa.misc.snmp_oid", setter: fld_set}]}, - "snmp.value": {to:[{field: "rsa.misc.snmp_value", setter: fld_set}]}, - "sourcefile": {to:[{field: "rsa.internal.sourcefile", setter: fld_set}]}, - "space": {to:[{field: "rsa.misc.space", setter: fld_set}]}, - "space1": {to:[{field: "rsa.misc.space1", setter: fld_set}]}, - "spi": {to:[{field: "rsa.misc.spi", setter: fld_set}]}, - "sql": {to:[{field: "rsa.misc.sql", setter: fld_set}]}, - "src_dn": {to:[{field: "rsa.identity.dn_src", setter: fld_set}]}, - "src_payload": {to:[{field: "rsa.misc.payload_src", setter: fld_set}]}, - "src_spi": {to:[{field: "rsa.misc.spi_src", setter: fld_set}]}, - "src_zone": {to:[{field: "rsa.network.zone_src", setter: fld_set}]}, - "srcburb": {to:[{field: "rsa.misc.srcburb", setter: fld_set}]}, - "srcdom": {to:[{field: "rsa.misc.srcdom", setter: fld_set}]}, - "srcservice": {to:[{field: "rsa.misc.srcservice", setter: fld_set}]}, - "ssid": {to:[{field: "rsa.wireless.wlan_ssid", setter: fld_prio, prio: 0}]}, - "stamp": {convert: to_date, to:[{field: "rsa.time.stamp", setter: fld_set}]}, - "starttime": {convert: to_date, to:[{field: "rsa.time.starttime", setter: fld_set}]}, - "state": {to:[{field: "rsa.misc.state", setter: fld_set}]}, - "statement": {to:[{field: "rsa.internal.statement", setter: fld_set}]}, - "status": {to:[{field: "rsa.misc.status", setter: fld_set}]}, - "status1": {to:[{field: "rsa.misc.status1", setter: fld_set}]}, - "streams": {convert: to_long, to:[{field: "rsa.misc.streams", setter: fld_set}]}, - "subcategory": {to:[{field: "rsa.misc.subcategory", setter: fld_set}]}, - "subject": {to:[{field: "rsa.email.subject", setter: fld_set}]}, - "svcno": {to:[{field: "rsa.misc.svcno", setter: fld_set}]}, - "system": {to:[{field: "rsa.misc.system", setter: fld_set}]}, - "t_context": {to:[{field: "rsa.misc.context_target", setter: fld_set}]}, - "task_name": {to:[{field: "rsa.file.task_name", setter: fld_set}]}, - "tbdstr1": {to:[{field: "rsa.misc.tbdstr1", setter: fld_set}]}, - "tbdstr2": {to:[{field: "rsa.misc.tbdstr2", setter: fld_set}]}, - "tbl_name": {to:[{field: "rsa.db.table_name", setter: fld_set}]}, - "tcp_flags": {convert: to_long, to:[{field: "rsa.misc.tcp_flags", setter: fld_set}]}, - "terminal": {to:[{field: "rsa.misc.terminal", setter: fld_set}]}, - "tgtdom": {to:[{field: "rsa.misc.tgtdom", setter: fld_set}]}, - "tgtdomain": {to:[{field: "rsa.misc.tgtdomain", setter: fld_set}]}, - "threat_name": {to:[{field: "rsa.threat.threat_category", setter: fld_set}]}, - "threat_source": {to:[{field: "rsa.threat.threat_source", setter: fld_set}]}, - "threat_val": {to:[{field: "rsa.threat.threat_desc", setter: fld_set}]}, - "threshold": {to:[{field: "rsa.misc.threshold", setter: fld_set}]}, - "time": {convert: to_date, to:[{field: "rsa.internal.time", setter: fld_set}]}, - "timestamp": {to:[{field: "rsa.time.timestamp", setter: fld_set}]}, - "timezone": {to:[{field: "rsa.time.timezone", setter: fld_set}]}, - "to": {to:[{field: "rsa.email.email_dst", setter: fld_set}]}, - "tos": {convert: to_long, to:[{field: "rsa.misc.tos", setter: fld_set}]}, - "trans_from": {to:[{field: "rsa.email.trans_from", setter: fld_set}]}, - "trans_id": {to:[{field: "rsa.db.transact_id", setter: fld_set}]}, - "trans_to": {to:[{field: "rsa.email.trans_to", setter: fld_set}]}, - "trigger_desc": {to:[{field: "rsa.misc.trigger_desc", setter: fld_set}]}, - "trigger_val": {to:[{field: "rsa.misc.trigger_val", setter: fld_set}]}, - "type": {to:[{field: "rsa.misc.type", setter: fld_set}]}, - "type1": {to:[{field: "rsa.misc.type1", setter: fld_set}]}, - "tzone": {to:[{field: "rsa.time.tzone", setter: fld_set}]}, - "ubc.req": {convert: to_long, to:[{field: "rsa.internal.ubc_req", setter: fld_set}]}, - "ubc.res": {convert: to_long, to:[{field: "rsa.internal.ubc_res", setter: fld_set}]}, - "udb_class": {to:[{field: "rsa.misc.udb_class", setter: fld_set}]}, - "url_fld": {to:[{field: "rsa.misc.url_fld", setter: fld_set}]}, - "urlpage": {to:[{field: "rsa.web.urlpage", setter: fld_set}]}, - "urlroot": {to:[{field: "rsa.web.urlroot", setter: fld_set}]}, - "user_address": {to:[{field: "rsa.email.email", setter: fld_append}]}, - "user_dept": {to:[{field: "rsa.identity.user_dept", setter: fld_set}]}, - "user_div": {to:[{field: "rsa.misc.user_div", setter: fld_set}]}, - "user_fname": {to:[{field: "rsa.identity.firstname", setter: fld_set}]}, - "user_lname": {to:[{field: "rsa.identity.lastname", setter: fld_set}]}, - "user_mname": {to:[{field: "rsa.identity.middlename", setter: fld_set}]}, - "user_org": {to:[{field: "rsa.identity.org", setter: fld_set}]}, - "user_role": {to:[{field: "rsa.identity.user_role", setter: fld_set}]}, - "userid": {to:[{field: "rsa.misc.userid", setter: fld_set}]}, - "username_fld": {to:[{field: "rsa.misc.username_fld", setter: fld_set}]}, - "utcstamp": {to:[{field: "rsa.misc.utcstamp", setter: fld_set}]}, - "v_instafname": {to:[{field: "rsa.misc.v_instafname", setter: fld_set}]}, - "vendor_event_cat": {to:[{field: "rsa.investigations.event_vcat", setter: fld_set}]}, - "version": {to:[{field: "rsa.misc.version", setter: fld_set}]}, - "vid": {to:[{field: "rsa.internal.msg_vid", setter: fld_set}]}, - "virt_data": {to:[{field: "rsa.misc.virt_data", setter: fld_set}]}, - "virusname": {to:[{field: "rsa.misc.virusname", setter: fld_set}]}, - "vlan": {convert: to_long, to:[{field: "rsa.network.vlan", setter: fld_set}]}, - "vlan.name": {to:[{field: "rsa.network.vlan_name", setter: fld_set}]}, - "vm_target": {to:[{field: "rsa.misc.vm_target", setter: fld_set}]}, - "vpnid": {to:[{field: "rsa.misc.vpnid", setter: fld_set}]}, - "vsys": {to:[{field: "rsa.misc.vsys", setter: fld_set}]}, - "vuln_ref": {to:[{field: "rsa.misc.vuln_ref", setter: fld_set}]}, - "web_cookie": {to:[{field: "rsa.web.web_cookie", setter: fld_set}]}, - "web_extension_tmp": {to:[{field: "rsa.web.web_extension_tmp", setter: fld_set}]}, - "web_host": {to:[{field: "rsa.web.alias_host", setter: fld_set}]}, - "web_method": {to:[{field: "rsa.misc.action", setter: fld_append}]}, - "web_page": {to:[{field: "rsa.web.web_page", setter: fld_set}]}, - "web_ref_domain": {to:[{field: "rsa.web.web_ref_domain", setter: fld_set}]}, - "web_ref_host": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "web_ref_page": {to:[{field: "rsa.web.web_ref_page", setter: fld_set}]}, - "web_ref_query": {to:[{field: "rsa.web.web_ref_query", setter: fld_set}]}, - "web_ref_root": {to:[{field: "rsa.web.web_ref_root", setter: fld_set}]}, - "wifi_channel": {convert: to_long, to:[{field: "rsa.wireless.wlan_channel", setter: fld_set}]}, - "wlan": {to:[{field: "rsa.wireless.wlan_name", setter: fld_set}]}, - "word": {to:[{field: "rsa.internal.word", setter: fld_set}]}, - "workspace_desc": {to:[{field: "rsa.misc.workspace", setter: fld_set}]}, - "workstation": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "year": {to:[{field: "rsa.time.year", setter: fld_set}]}, - "zone": {to:[{field: "rsa.network.zone", setter: fld_set}]}, - }; - - function to_date(value) { - switch (typeof (value)) { - case "object": - // This is a Date. But as it was obtained from evt.Get(), the VM - // doesn't see it as a JS Date anymore, thus value instanceof Date === false. - // Have to trust that any object here is a valid Date for Go. - return value; - case "string": - var asDate = new Date(value); - if (!isNaN(asDate)) return asDate; - } - } - - // ECMAScript 5.1 doesn't have Object.MAX_SAFE_INTEGER / Object.MIN_SAFE_INTEGER. - var maxSafeInt = Math.pow(2, 53) - 1; - var minSafeInt = -maxSafeInt; - - function to_long(value) { - var num = parseInt(value); - // Better not to index a number if it's not safe (above 53 bits). - return !isNaN(num) && minSafeInt <= num && num <= maxSafeInt ? num : undefined; - } - - function to_ip(value) { - if (value.indexOf(":") === -1) - return to_ipv4(value); - return to_ipv6(value); - } - - var ipv4_regex = /^(\d+)\.(\d+)\.(\d+)\.(\d+)$/; - var ipv6_hex_regex = /^[0-9A-Fa-f]{1,4}$/; - - function to_ipv4(value) { - var result = ipv4_regex.exec(value); - if (result == null || result.length !== 5) return; - for (var i = 1; i < 5; i++) { - var num = strictToInt(result[i]); - if (isNaN(num) || num < 0 || num > 255) return; - } - return value; - } - - function to_ipv6(value) { - var sqEnd = value.indexOf("]"); - if (sqEnd > -1) { - if (value.charAt(0) !== "[") return; - value = value.substr(1, sqEnd - 1); - } - var zoneOffset = value.indexOf("%"); - if (zoneOffset > -1) { - value = value.substr(0, zoneOffset); - } - var parts = value.split(":"); - if (parts == null || parts.length < 3 || parts.length > 8) return; - var numEmpty = 0; - var innerEmpty = 0; - for (var i = 0; i < parts.length; i++) { - if (parts[i].length === 0) { - numEmpty++; - if (i > 0 && i + 1 < parts.length) innerEmpty++; - } else if (!parts[i].match(ipv6_hex_regex) && - // Accept an IPv6 with a valid IPv4 at the end. - ((i + 1 < parts.length) || !to_ipv4(parts[i]))) { - return; - } - } - return innerEmpty === 0 && parts.length === 8 || innerEmpty === 1 ? value : undefined; - } - - function to_double(value) { - return parseFloat(value); - } - - function to_mac(value) { - // ES doesn't have a mac datatype so it's safe to ingest whatever was captured. - return value; - } - - function to_lowercase(value) { - // to_lowercase is used against keyword fields, which can accept - // any other type (numbers, dates). - return typeof(value) === "string"? value.toLowerCase() : value; - } - - function fld_set(dst, value) { - dst[this.field] = { v: value }; - } - - function fld_append(dst, value) { - if (dst[this.field] === undefined) { - dst[this.field] = { v: [value] }; - } else { - var base = dst[this.field]; - if (base.v.indexOf(value)===-1) base.v.push(value); - } - } - - function fld_prio(dst, value) { - if (dst[this.field] === undefined) { - dst[this.field] = { v: value, prio: this.prio}; - } else if(this.prio < dst[this.field].prio) { - dst[this.field].v = value; - dst[this.field].prio = this.prio; - } - } - - var valid_ecs_outcome = { - 'failure': true, - 'success': true, - 'unknown': true - }; - - function fld_ecs_outcome(dst, value) { - value = value.toLowerCase(); - if (valid_ecs_outcome[value] === undefined) { - value = 'unknown'; - } - if (dst[this.field] === undefined) { - dst[this.field] = { v: value }; - } else if (dst[this.field].v === 'unknown') { - dst[this.field] = { v: value }; - } - } - - function map_all(evt, targets, value) { - for (var i = 0; i < targets.length; i++) { - evt.Put(targets[i], value); - } - } - - function populate_fields(evt) { - var base = evt.Get(FIELDS_OBJECT); - if (base === null) return; - alternate_datetime(evt); - if (map_ecs) { - do_populate(evt, base, ecs_mappings); - } - if (map_rsa) { - do_populate(evt, base, rsa_mappings); - } - if (keep_raw) { - evt.Put("rsa.raw", base); - } - evt.Delete(FIELDS_OBJECT); - } - - var datetime_alt_components = [ - {field: "day", fmts: [[dF]]}, - {field: "year", fmts: [[dW]]}, - {field: "month", fmts: [[dB],[dG]]}, - {field: "date", fmts: [[dW,dSkip,dG,dSkip,dF],[dW,dSkip,dB,dSkip,dF],[dW,dSkip,dR,dSkip,dF]]}, - {field: "hour", fmts: [[dN]]}, - {field: "min", fmts: [[dU]]}, - {field: "secs", fmts: [[dO]]}, - {field: "time", fmts: [[dN, dSkip, dU, dSkip, dO]]}, - ]; - - function alternate_datetime(evt) { - if (evt.Get(FIELDS_PREFIX + "event_time") != null) { - return; - } - var tzOffset = tz_offset; - if (tzOffset === "event") { - tzOffset = evt.Get("event.timezone"); - } - var container = new DateContainer(tzOffset); - for (var i=0; i} %{hfld2}.%{hfld3->} %{p0}"); - - var dup2 = call({ - dest: "nwparser.payload", - fn: STRCAT, - args: [ - field("hfld4"), - constant("_appliance "), - field("p0"), - ], - }); - - var dup3 = call({ - dest: "nwparser.payload", - fn: STRCAT, - args: [ - field("hfld4"), - constant(" "), - field("p0"), - ], - }); - - var dup4 = match_copy("MESSAGE#0:flows/2_1", "nwparser.p0", "p0"); - - var dup5 = setc("eventcategory","1605020000"); - - var dup6 = setf("msg","$MSG"); - - var dup7 = setc("event_source","appliance"); - - var dup8 = setf("sensor","node"); - - var dup9 = date_time({ - dest: "event_time", - args: ["hfld2"], - fmts: [ - [dX], - ], - }); - - var dup10 = match_copy("MESSAGE#1:flows:01/1_2", "nwparser.p0", ""); - - var dup11 = match("MESSAGE#10:ids-alerts:01/1_0", "nwparser.p0", "dhost=%{dmacaddr->} direction=%{p0}"); - - var dup12 = match("MESSAGE#10:ids-alerts:01/1_1", "nwparser.p0", "shost=%{smacaddr->} direction=%{p0}"); - - var dup13 = match("MESSAGE#10:ids-alerts:01/2", "nwparser.p0", "%{direction->} protocol=%{protocol->} src=%{p0}"); - - var dup14 = match_copy("MESSAGE#10:ids-alerts:01/4", "nwparser.p0", "signame"); - - var dup15 = setc("eventcategory","1607000000"); - - var dup16 = setc("event_type","ids-alerts"); - - var dup17 = date_time({ - dest: "event_time", - args: ["fld3"], - fmts: [ - [dX], - ], - }); - - var dup18 = setc("event_type","security_event"); - - var dup19 = constant("Allow"); - - var dup20 = match("HEADER#0:0003/1_0", "nwparser.p0", "%{hfld4}_appliance %{p0}", processor_chain([ - dup2, - ])); - - var dup21 = match("HEADER#0:0003/1_1", "nwparser.p0", "%{hfld4->} %{p0}", processor_chain([ - dup3, - ])); - - var dup22 = linear_select([ - dup11, - dup12, - ]); - - var dup23 = linear_select([ - dup20, - dup21, - ]); - - var part1 = match("HEADER#0:0003/2", "nwparser.p0", "urls %{p0}"); - - var all1 = all_match({ - processors: [ - dup1, - dup23, - part1, - ], - on_success: processor_chain([ - setc("header_id","0003"), - setc("messageid","urls"), - ]), - }); - - var part2 = match("HEADER#1:0002/1_0", "nwparser.p0", "%{node}_appliance events %{p0}"); - - var part3 = match("HEADER#1:0002/1_1", "nwparser.p0", "%{node->} events %{p0}"); - - var select1 = linear_select([ - part2, - part3, - ]); - - var part4 = match_copy("HEADER#1:0002/2", "nwparser.p0", "payload"); - - var all2 = all_match({ - processors: [ - dup1, - select1, - part4, - ], - on_success: processor_chain([ - setc("header_id","0002"), - setc("messageid","events"), - ]), - }); - - var part5 = match("HEADER#2:0001/2", "nwparser.p0", "%{messageid->} %{p0}"); - - var all3 = all_match({ - processors: [ - dup1, - dup23, - part5, - ], - on_success: processor_chain([ - setc("header_id","0001"), - ]), - }); - - var part6 = match("HEADER#3:0005/1_0", "nwparser.p0", "%{hfld4}_appliance %{p0}"); - - var part7 = match("HEADER#3:0005/1_1", "nwparser.p0", "%{hfld4->} %{p0}"); - - var select2 = linear_select([ - part6, - part7, - ]); - - var part8 = match("HEADER#3:0005/2", "nwparser.p0", "%{} %{hfld5->} %{hfld6->} %{messageid->} %{p0}", processor_chain([ - call({ - dest: "nwparser.payload", - fn: STRCAT, - args: [ - field("hfld6"), - constant(" "), - field("messageid"), - constant(" "), - field("p0"), - ], - }), - ])); - - var all4 = all_match({ - processors: [ - dup1, - select2, - part8, - ], - on_success: processor_chain([ - setc("header_id","0005"), - ]), - }); - - var hdr1 = match("HEADER#4:0004", "message", "%{hfld1->} %{hfld2}.%{hfld3->} %{hfld4}_%{space->} %{messageid->} %{payload}", processor_chain([ - setc("header_id","0004"), - ])); - - var select3 = linear_select([ - all1, - all2, - all3, - all4, - hdr1, - ]); - - var part9 = match("MESSAGE#0:flows/0_0", "nwparser.payload", "%{node}_appliance %{p0}"); - - var part10 = match("MESSAGE#0:flows/0_1", "nwparser.payload", "%{node->} %{p0}"); - - var select4 = linear_select([ - part9, - part10, - ]); - - var part11 = match("MESSAGE#0:flows/1", "nwparser.p0", "flows src=%{saddr->} dst=%{daddr->} %{p0}"); - - var part12 = match("MESSAGE#0:flows/2_0", "nwparser.p0", "mac=%{dmacaddr->} %{p0}"); - - var select5 = linear_select([ - part12, - dup4, - ]); - - var part13 = match("MESSAGE#0:flows/3", "nwparser.p0", "protocol=%{protocol->} %{p0}"); - - var part14 = match("MESSAGE#0:flows/4_0", "nwparser.p0", "sport=%{sport->} dport=%{dport->} %{p0}"); - - var part15 = match("MESSAGE#0:flows/4_1", "nwparser.p0", "type=%{event_type->} %{p0}"); - - var select6 = linear_select([ - part14, - part15, - dup4, - ]); - - var part16 = match("MESSAGE#0:flows/5", "nwparser.p0", "pattern: %{fld21->} %{info}"); - - var all5 = all_match({ - processors: [ - select4, - part11, - select5, - part13, - select6, - part16, - ], - on_success: processor_chain([ - dup5, - dup6, - lookup({ - dest: "nwparser.action", - map: map_actionType, - key: field("fld21"), - }), - dup7, - dup8, - dup9, - ]), - }); - - var msg1 = msg("flows", all5); - - var part17 = match("MESSAGE#1:flows:01/0", "nwparser.payload", "%{node->} flows %{action->} src=%{saddr->} dst=%{daddr->} mac=%{smacaddr->} protocol=%{protocol->} %{p0}"); - - var part18 = match("MESSAGE#1:flows:01/1_0", "nwparser.p0", "sport=%{sport->} dport=%{dport->} "); - - var part19 = match("MESSAGE#1:flows:01/1_1", "nwparser.p0", "type=%{event_type->} "); - - var select7 = linear_select([ - part18, - part19, - dup10, - ]); - - var all6 = all_match({ - processors: [ - part17, - select7, - ], - on_success: processor_chain([ - dup5, - dup6, - dup7, - dup8, - dup9, - ]), - }); - - var msg2 = msg("flows:01", all6); - - var part20 = match("MESSAGE#2:flows:02", "nwparser.payload", "%{node->} flows %{action}", processor_chain([ - dup5, - dup6, - dup7, - dup8, - dup9, - ])); - - var msg3 = msg("flows:02", part20); - - var select8 = linear_select([ - msg1, - msg2, - msg3, - ]); - - var part21 = match("MESSAGE#3:urls/0_0", "nwparser.payload", "%{node}_appliance urls src=%{p0}"); - - var part22 = match("MESSAGE#3:urls/0_1", "nwparser.payload", "%{node->} urls src=%{p0}"); - - var part23 = match("MESSAGE#3:urls/0_2", "nwparser.payload", "src=%{p0}"); - - var select9 = linear_select([ - part21, - part22, - part23, - ]); - - var part24 = match("MESSAGE#3:urls/1", "nwparser.p0", "%{sport}:%{saddr->} dst=%{daddr}:%{dport->} mac=%{macaddr->} %{p0}"); - - var part25 = match("MESSAGE#3:urls/2_0", "nwparser.p0", "agent='%{user_agent}' request: %{p0}"); - - var part26 = match("MESSAGE#3:urls/2_1", "nwparser.p0", "agent=%{user_agent->} request: %{p0}"); - - var part27 = match("MESSAGE#3:urls/2_2", "nwparser.p0", "request: %{p0}"); - - var select10 = linear_select([ - part25, - part26, - part27, - ]); - - var part28 = match("MESSAGE#3:urls/3", "nwparser.p0", "%{} %{web_method}%{url}"); - - var all7 = all_match({ - processors: [ - select9, - part24, - select10, - part28, - ], - on_success: processor_chain([ - dup5, - dup6, - dup7, - dup8, - dup9, - ]), - }); - - var msg4 = msg("urls", all7); - - var part29 = match("MESSAGE#4:events/0", "nwparser.payload", "dhcp lease of ip %{saddr->} from server mac %{smacaddr->} for client mac %{p0}"); - - var part30 = match("MESSAGE#4:events/1_0", "nwparser.p0", "%{dmacaddr->} with hostname %{hostname->} from router %{p0}"); - - var part31 = match("MESSAGE#4:events/1_1", "nwparser.p0", "%{dmacaddr->} from router %{p0}"); - - var select11 = linear_select([ - part30, - part31, - ]); - - var part32 = match("MESSAGE#4:events/2", "nwparser.p0", "%{hostip->} on subnet %{mask->} with dns %{dns_a_record}"); - - var all8 = all_match({ - processors: [ - part29, - select11, - part32, - ], - on_success: processor_chain([ - dup5, - dup6, - dup7, - dup8, - dup9, - ]), - }); - - var msg5 = msg("events", all8); - - var part33 = match("MESSAGE#5:events:02/0", "nwparser.payload", "content_filtering_block url='%{url}' category0='%{category}' server='%{daddr}:%{dport}'%{p0}"); - - var part34 = match("MESSAGE#5:events:02/1_0", "nwparser.p0", " client_mac='%{dmacaddr}'"); - - var select12 = linear_select([ - part34, - dup10, - ]); - - var all9 = all_match({ - processors: [ - part33, - select12, - ], - on_success: processor_chain([ - dup5, - dup6, - setc("event_description","content_filtering_block"), - dup8, - dup9, - ]), - }); - - var msg6 = msg("events:02", all9); - - var part35 = tagval("MESSAGE#6:events:01", "nwparser.payload", tvm, { - "aid": "fld1", - "arp_resp": "fld2", - "arp_src": "fld3", - "auth_neg_dur": "fld4", - "auth_neg_failed": "fld5", - "category0": "category", - "channel": "fld6", - "client_ip": "daddr", - "client_mac": "dmacaddr", - "connectivity": "fld28", - "dhcp_ip": "fld23", - "dhcp_lease_completed": "fld22", - "dhcp_resp": "fld26", - "dhcp_server": "fld24", - "dhcp_server_mac": "fld25", - "dns_req_rtt": "fld7", - "dns_resp": "fld8", - "dns_server": "fld9", - "duration": "duration", - "full_conn": "fld11", - "http_resp": "fld21", - "identity": "fld12", - "instigator": "fld20", - "ip_resp": "fld13", - "ip_src": "saddr", - "is_8021x": "fld15", - "is_wpa": "fld16", - "last_auth_ago": "fld17", - "radio": "fld18", - "reason": "fld19", - "rssi": "dclass_ratio1", - "server": "daddr", - "type": "event_type", - "url": "url", - "vap": "fld22", - "vpn_type": "fld27", - }, processor_chain([ - dup5, - dup6, - dup7, - dup8, - dup9, - ])); - - var msg7 = msg("events:01", part35); - - var part36 = match("MESSAGE#7:events:03", "nwparser.payload", "IDS: %{info}", processor_chain([ - dup5, - dup6, - setc("event_description","events IDS"), - dup8, - dup9, - ])); - - var msg8 = msg("events:03", part36); - - var part37 = match("MESSAGE#8:events:04/0", "nwparser.payload", "dhcp %{p0}"); - - var part38 = match("MESSAGE#8:events:04/1_0", "nwparser.p0", "no offers%{p0}"); - - var part39 = match("MESSAGE#8:events:04/1_1", "nwparser.p0", "release%{p0}"); - - var select13 = linear_select([ - part38, - part39, - ]); - - var part40 = match("MESSAGE#8:events:04/2", "nwparser.p0", "%{}for mac %{macaddr}"); - - var all10 = all_match({ - processors: [ - part37, - select13, - part40, - ], - on_success: processor_chain([ - dup5, - dup6, - setc("event_description","events DHCP"), - dup8, - dup9, - ]), - }); - - var msg9 = msg("events:04", all10); - - var part41 = match("MESSAGE#9:events:05", "nwparser.payload", "MAC %{macaddr->} and MAC %{macaddr->} both claim IP: %{saddr}", processor_chain([ - dup5, - dup6, - setc("event_description"," events MAC"), - dup8, - dup9, - ])); - - var msg10 = msg("events:05", part41); - - var select14 = linear_select([ - msg5, - msg6, - msg7, - msg8, - msg9, - msg10, - ]); - - var part42 = match("MESSAGE#10:ids-alerts:01/0", "nwparser.payload", "%{node->} ids-alerts signature=%{fld1->} priority=%{fld2->} timestamp=%{fld3}.%{fld4->} %{p0}"); - - var part43 = match("MESSAGE#10:ids-alerts:01/3_0", "nwparser.p0", "%{saddr}:%{sport->} dst=%{daddr}:%{dport->} message: %{p0}"); - - var part44 = match("MESSAGE#10:ids-alerts:01/3_1", "nwparser.p0", "%{saddr->} dst=%{daddr->} message: %{p0}"); - - var select15 = linear_select([ - part43, - part44, - ]); - - var all11 = all_match({ - processors: [ - part42, - dup22, - dup13, - select15, - dup14, - ], - on_success: processor_chain([ - dup15, - dup6, - dup16, - dup8, - dup17, - ]), - }); - - var msg11 = msg("ids-alerts:01", all11); - - var part45 = match("MESSAGE#11:ids-alerts:03", "nwparser.payload", "%{node->} ids-alerts signature=%{fld1->} priority=%{fld2->} timestamp=%{fld3}.%{fld4}direction=%{direction->} protocol=%{protocol->} src=%{saddr}:%{sport}", processor_chain([ - dup15, - dup6, - dup16, - dup8, - dup17, - ])); - - var msg12 = msg("ids-alerts:03", part45); - - var part46 = match("MESSAGE#12:ids-alerts:02", "nwparser.payload", "%{node->} ids-alerts signature=%{fld1->} priority=%{fld2->} timestamp=%{fld3}.%{fld4}protocol=%{protocol->} src=%{saddr->} dst=%{daddr}message: %{signame}", processor_chain([ - dup15, - dup6, - dup16, - dup8, - dup17, - ])); - - var msg13 = msg("ids-alerts:02", part46); - - var select16 = linear_select([ - msg11, - msg12, - msg13, - ]); - - var part47 = match("MESSAGE#13:security_event", "nwparser.payload", "%{node}security_event %{event_description->} url=%{url->} src=%{saddr}:%{sport->} dst=%{daddr}:%{dport->} mac=%{smacaddr->} name=%{fld10->} sha256=%{fld11->} disposition=%{disposition->} action=%{action}", processor_chain([ - dup5, - dup6, - dup18, - dup8, - dup9, - ])); - - var msg14 = msg("security_event", part47); - - var part48 = match("MESSAGE#14:security_event:01/0", "nwparser.payload", "%{node->} security_event %{event_description->} signature=%{fld1->} priority=%{fld2->} timestamp=%{fld3}.%{fld4->} %{p0}"); - - var part49 = match("MESSAGE#14:security_event:01/3_0", "nwparser.p0", "%{saddr}:%{sport->} dst=%{daddr}:%{dport->} message:%{p0}"); - - var part50 = match("MESSAGE#14:security_event:01/3_1", "nwparser.p0", "%{saddr->} dst=%{daddr->} message:%{p0}"); - - var select17 = linear_select([ - part49, - part50, - ]); - - var all12 = all_match({ - processors: [ - part48, - dup22, - dup13, - select17, - dup14, - ], - on_success: processor_chain([ - dup15, - dup6, - dup18, - dup8, - dup17, - ]), - }); - - var msg15 = msg("security_event:01", all12); - - var select18 = linear_select([ - msg14, - msg15, - ]); - - var chain1 = processor_chain([ - select3, - msgid_select({ - "events": select14, - "flows": select8, - "ids-alerts": select16, - "security_event": select18, - "urls": msg4, - }), - ]); - - var hdr2 = match("HEADER#0:0003/0", "message", "%{hfld1->} %{hfld2}.%{hfld3->} %{p0}"); - - var part51 = match_copy("MESSAGE#0:flows/2_1", "nwparser.p0", "p0"); - - var part52 = match_copy("MESSAGE#1:flows:01/1_2", "nwparser.p0", ""); - - var part53 = match("MESSAGE#10:ids-alerts:01/1_0", "nwparser.p0", "dhost=%{dmacaddr->} direction=%{p0}"); - - var part54 = match("MESSAGE#10:ids-alerts:01/1_1", "nwparser.p0", "shost=%{smacaddr->} direction=%{p0}"); - - var part55 = match("MESSAGE#10:ids-alerts:01/2", "nwparser.p0", "%{direction->} protocol=%{protocol->} src=%{p0}"); - - var part56 = match_copy("MESSAGE#10:ids-alerts:01/4", "nwparser.p0", "signame"); - - var part57 = match("HEADER#0:0003/1_0", "nwparser.p0", "%{hfld4}_appliance %{p0}", processor_chain([ - dup2, - ])); - - var part58 = match("HEADER#0:0003/1_1", "nwparser.p0", "%{hfld4->} %{p0}", processor_chain([ - dup3, - ])); - - var select19 = linear_select([ - dup11, - dup12, - ]); - - var select20 = linear_select([ - dup20, - dup21, - ]); - -- community_id: -- registered_domain: - ignore_missing: true - ignore_failure: true - field: dns.question.name - target_field: dns.question.registered_domain - target_subdomain_field: dns.question.subdomain - target_etld_field: dns.question.top_level_domain -- registered_domain: - ignore_missing: true - ignore_failure: true - field: client.domain - target_field: client.registered_domain - target_subdomain_field: client.subdomain - target_etld_field: client.top_level_domain -- registered_domain: - ignore_missing: true - ignore_failure: true - field: server.domain - target_field: server.registered_domain - target_subdomain_field: server.subdomain - target_etld_field: server.top_level_domain -- registered_domain: - ignore_missing: true - ignore_failure: true - field: destination.domain - target_field: destination.registered_domain - target_subdomain_field: destination.subdomain - target_etld_field: destination.top_level_domain -- registered_domain: - ignore_missing: true - ignore_failure: true - field: source.domain - target_field: source.registered_domain - target_subdomain_field: source.subdomain - target_etld_field: source.top_level_domain -- registered_domain: - ignore_missing: true - ignore_failure: true - field: url.domain - target_field: url.registered_domain - target_subdomain_field: url.subdomain - target_etld_field: url.top_level_domain -- add_locale: ~ diff --git a/packages/cisco_meraki/data_stream/log/agent/stream/udp.yml.hbs b/packages/cisco_meraki/data_stream/log/agent/stream/udp.yml.hbs index d88b14f80237..993860734ef4 100644 --- a/packages/cisco_meraki/data_stream/log/agent/stream/udp.yml.hbs +++ b/packages/cisco_meraki/data_stream/log/agent/stream/udp.yml.hbs @@ -1,5 +1,6 @@ -udp: -host: "{{udp_host}}:{{udp_port}}" +host: "{{listen_address}}:{{listen_port}}" +max_message_size: 1 MiB + tags: {{#if preserve_original_event}} - preserve_original_event @@ -7,3247 +8,17 @@ tags: {{#each tags as |tag i|}} - {{tag}} {{/each}} -fields_under_root: true -fields: - observer: - vendor: "Cisco" - product: "Meraki" - type: "Wireless" + {{#contains "forwarded" tags}} publisher_pipeline.disable_host: true {{/contains}} -processors: + +fields_under_root: true +fields: + _conf: + tz_offset: '{{tz_offset}}' + {{#if processors}} +processors: {{processors}} {{/if}} -- script: - lang: javascript - params: - ecs: true - rsa: {{rsa_fields}} - tz_offset: {{tz_offset}} - keep_raw: {{keep_raw_fields}} - debug: {{debug}} - source: | - // Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one - // or more contributor license agreements. Licensed under the Elastic License; - // you may not use this file except in compliance with the Elastic License. - - /* jshint -W014,-W016,-W097,-W116 */ - - var processor = require("processor"); - var console = require("console"); - - var FLAG_FIELD = "log.flags"; - var FIELDS_OBJECT = "nwparser"; - var FIELDS_PREFIX = FIELDS_OBJECT + "."; - - var defaults = { - debug: false, - ecs: true, - rsa: false, - keep_raw: false, - tz_offset: "local", - strip_priority: true - }; - - var saved_flags = null; - var debug; - var map_ecs; - var map_rsa; - var keep_raw; - var device; - var tz_offset; - var strip_priority; - - // Register params from configuration. - function register(params) { - debug = params.debug !== undefined ? params.debug : defaults.debug; - map_ecs = params.ecs !== undefined ? params.ecs : defaults.ecs; - map_rsa = params.rsa !== undefined ? params.rsa : defaults.rsa; - keep_raw = params.keep_raw !== undefined ? params.keep_raw : defaults.keep_raw; - tz_offset = parse_tz_offset(params.tz_offset !== undefined? params.tz_offset : defaults.tz_offset); - strip_priority = params.strip_priority !== undefined? params.strip_priority : defaults.strip_priority; - device = new DeviceProcessor(); - } - - function parse_tz_offset(offset) { - var date; - var m; - switch(offset) { - // local uses the tz offset from the JS VM. - case "local": - date = new Date(); - // Reversing the sign as we the offset from UTC, not to UTC. - return parse_local_tz_offset(-date.getTimezoneOffset()); - // event uses the tz offset from event.timezone (add_locale processor). - case "event": - return offset; - // Otherwise a tz offset in the form "[+-][0-9]{4}" is required. - default: - m = offset.match(/^([+\-])([0-9]{2}):?([0-9]{2})?$/); - if (m === null || m.length !== 4) { - throw("bad timezone offset: '" + offset + "'. Must have the form +HH:MM"); - } - return m[1] + m[2] + ":" + (m[3]!==undefined? m[3] : "00"); - } - } - - function parse_local_tz_offset(minutes) { - var neg = minutes < 0; - minutes = Math.abs(minutes); - var min = minutes % 60; - var hours = Math.floor(minutes / 60); - var pad2digit = function(n) { - if (n < 10) { return "0" + n;} - return "" + n; - }; - return (neg? "-" : "+") + pad2digit(hours) + ":" + pad2digit(min); - } - - function process(evt) { - // Function register is only called by the processor when `params` are set - // in the processor config. - if (device === undefined) { - register(defaults); - } - return device.process(evt); - } - - function processor_chain(subprocessors) { - var builder = new processor.Chain(); - subprocessors.forEach(builder.Add); - return builder.Build().Run; - } - - function linear_select(subprocessors) { - return function (evt) { - var flags = evt.Get(FLAG_FIELD); - var i; - for (i = 0; i < subprocessors.length; i++) { - evt.Delete(FLAG_FIELD); - if (debug) console.warn("linear_select trying entry " + i); - subprocessors[i](evt); - // Dissect processor succeeded? - if (evt.Get(FLAG_FIELD) == null) break; - if (debug) console.warn("linear_select failed entry " + i); - } - if (flags !== null) { - evt.Put(FLAG_FIELD, flags); - } - if (debug) { - if (i < subprocessors.length) { - console.warn("linear_select matched entry " + i); - } else { - console.warn("linear_select didn't match"); - } - } - }; - } - - function conditional(opt) { - return function(evt) { - if (opt.if(evt)) { - opt.then(evt); - } else if (opt.else) { - opt.else(evt); - } - }; - } - - var strip_syslog_priority = (function() { - var isEnabled = function() { return strip_priority === true; }; - var fetchPRI = field("_pri"); - var fetchPayload = field("payload"); - var removePayload = remove(["payload"]); - var cleanup = remove(["_pri", "payload"]); - var onMatch = function(evt) { - var pri, priStr = fetchPRI(evt); - if (priStr != null - && 0 < priStr.length && priStr.length < 4 - && !isNaN((pri = Number(priStr))) - && 0 <= pri && pri < 192) { - var severity = pri & 7, - facility = pri >> 3; - setc("_severity", "" + severity)(evt); - setc("_facility", "" + facility)(evt); - // Replace message with priority stripped. - evt.Put("message", fetchPayload(evt)); - removePayload(evt); - } else { - // not a valid syslog PRI, cleanup. - cleanup(evt); - } - }; - return conditional({ - if: isEnabled, - then: cleanup_flags(match( - "STRIP_PRI", - "message", - "<%{_pri}>%{payload}", - onMatch - )) - }); - })(); - - function match(id, src, pattern, on_success) { - var dissect = new processor.Dissect({ - field: src, - tokenizer: pattern, - target_prefix: FIELDS_OBJECT, - ignore_failure: true, - overwrite_keys: true, - trim_values: "right" - }); - return function (evt) { - var msg = evt.Get(src); - dissect.Run(evt); - var failed = evt.Get(FLAG_FIELD) != null; - if (debug) { - if (failed) { - console.debug("dissect fail: " + id + " field:" + src); - } else { - console.debug("dissect OK: " + id + " field:" + src); - } - console.debug(" expr: <<" + pattern + ">>"); - console.debug(" input: <<" + msg + ">>"); - } - if (on_success != null && !failed) { - on_success(evt); - } - }; - } - - function match_copy(id, src, dst, on_success) { - dst = FIELDS_PREFIX + dst; - if (dst === FIELDS_PREFIX || dst === src) { - return function (evt) { - if (debug) { - console.debug("noop OK: " + id + " field:" + src); - console.debug(" input: <<" + evt.Get(src) + ">>"); - } - if (on_success != null) on_success(evt); - } - } - return function (evt) { - var msg = evt.Get(src); - evt.Put(dst, msg); - if (debug) { - console.debug("copy OK: " + id + " field:" + src); - console.debug(" target: '" + dst + "'"); - console.debug(" input: <<" + msg + ">>"); - } - if (on_success != null) on_success(evt); - } - } - - function cleanup_flags(processor) { - return function(evt) { - processor(evt); - evt.Delete(FLAG_FIELD); - }; - } - - function all_match(opts) { - return function (evt) { - var i; - for (i = 0; i < opts.processors.length; i++) { - evt.Delete(FLAG_FIELD); - opts.processors[i](evt); - // Dissect processor succeeded? - if (evt.Get(FLAG_FIELD) != null) { - if (debug) console.warn("all_match failure at " + i); - if (opts.on_failure != null) opts.on_failure(evt); - return; - } - if (debug) console.warn("all_match success at " + i); - } - if (opts.on_success != null) opts.on_success(evt); - }; - } - - function msgid_select(mapping) { - return function (evt) { - var msgid = evt.Get(FIELDS_PREFIX + "messageid"); - if (msgid == null) { - if (debug) console.warn("msgid_select: no messageid captured!"); - return; - } - var next = mapping[msgid]; - if (next === undefined) { - if (debug) console.warn("msgid_select: no mapping for messageid:" + msgid); - return; - } - if (debug) console.info("msgid_select: matched key=" + msgid); - return next(evt); - }; - } - - function msg(msg_id, match) { - return function (evt) { - match(evt); - if (evt.Get(FLAG_FIELD) == null) { - evt.Put(FIELDS_PREFIX + "msg_id1", msg_id); - } - }; - } - - var start; - - function save_flags(evt) { - saved_flags = evt.Get(FLAG_FIELD); - evt.Put("event.original", evt.Get("message")); - } - - function restore_flags(evt) { - if (saved_flags !== null) { - evt.Put(FLAG_FIELD, saved_flags); - } - evt.Delete("message"); - } - - function constant(value) { - return function (evt) { - return value; - }; - } - - function field(name) { - var fullname = FIELDS_PREFIX + name; - return function (evt) { - return evt.Get(fullname); - }; - } - - function STRCAT(args) { - var s = ""; - var i; - for (i = 0; i < args.length; i++) { - s += args[i]; - } - return s; - } - - // TODO: Implement - function DIRCHK(args) { - unimplemented("DIRCHK"); - } - - function strictToInt(str) { - return str * 1; - } - - function CALC(args) { - if (args.length !== 3) { - console.warn("skipped call to CALC with " + args.length + " arguments."); - return; - } - var a = strictToInt(args[0]); - var b = strictToInt(args[2]); - if (isNaN(a) || isNaN(b)) { - console.warn("failed evaluating CALC arguments a='" + args[0] + "' b='" + args[2] + "'."); - return; - } - var result; - switch (args[1]) { - case "+": - result = a + b; - break; - case "-": - result = a - b; - break; - case "*": - result = a * b; - break; - default: - // Only * and + seen in the parsers. - console.warn("unknown CALC operation '" + args[1] + "'."); - return; - } - // Always return a string - return result !== undefined ? "" + result : result; - } - - var quoteChars = "\"'`"; - function RMQ(args) { - if(args.length !== 1) { - console.warn("RMQ: only one argument expected"); - return; - } - var value = args[0].trim(); - var n = value.length; - var char; - return n > 1 - && (char=value.charAt(0)) === value.charAt(n-1) - && quoteChars.indexOf(char) !== -1? - value.substr(1, n-2) - : value; - } - - function call(opts) { - var args = new Array(opts.args.length); - return function (evt) { - for (var i = 0; i < opts.args.length; i++) - if ((args[i] = opts.args[i](evt)) == null) return; - var result = opts.fn(args); - if (result != null) { - evt.Put(opts.dest, result); - } - }; - } - - function nop(evt) { - } - - function appendErrorMsg(evt, msg) { - var value = evt.Get("error.message"); - if (value == null) { - value = [msg]; - } else if (msg instanceof Array) { - value.push(msg); - } else { - value = [value, msg]; - } - evt.Put("error.message", value); - } - - function unimplemented(name) { - appendErrorMsg("unimplemented feature: " + name); - } - - function lookup(opts) { - return function (evt) { - var key = opts.key(evt); - if (key == null) return; - var value = opts.map.keyvaluepairs[key]; - if (value === undefined) { - value = opts.map.default; - } - if (value !== undefined) { - evt.Put(opts.dest, value(evt)); - } - }; - } - - function set(fields) { - return new processor.AddFields({ - target: FIELDS_OBJECT, - fields: fields, - }); - } - - function setf(dst, src) { - return function (evt) { - var val = evt.Get(FIELDS_PREFIX + src); - if (val != null) evt.Put(FIELDS_PREFIX + dst, val); - }; - } - - function setc(dst, value) { - return function (evt) { - evt.Put(FIELDS_PREFIX + dst, value); - }; - } - - function set_field(opts) { - return function (evt) { - var val = opts.value(evt); - if (val != null) evt.Put(opts.dest, val); - }; - } - - function dump(label) { - return function (evt) { - console.log("Dump of event at " + label + ": " + JSON.stringify(evt, null, "\t")); - }; - } - - function date_time_join_args(evt, arglist) { - var str = ""; - for (var i = 0; i < arglist.length; i++) { - var fname = FIELDS_PREFIX + arglist[i]; - var val = evt.Get(fname); - if (val != null) { - if (str !== "") str += " "; - str += val; - } else { - if (debug) console.warn("in date_time: input arg " + fname + " is not set"); - } - } - return str; - } - - function to2Digit(num) { - return num? (num < 10? "0" + num : num) : "00"; - } - - // Make two-digit dates 00-69 interpreted as 2000-2069 - // and dates 70-99 translated to 1970-1999. - var twoDigitYearEpoch = 70; - var twoDigitYearCentury = 2000; - - // This is to accept dates up to 2 days in the future, only used when - // no year is specified in a date. 2 days should be enough to account for - // time differences between systems and different tz offsets. - var maxFutureDelta = 2*24*60*60*1000; - - // DateContainer stores date fields and then converts those fields into - // a Date. Necessary because building a Date using its set() methods gives - // different results depending on the order of components. - function DateContainer(tzOffset) { - this.offset = tzOffset === undefined? "Z" : tzOffset; - } - - DateContainer.prototype = { - setYear: function(v) {this.year = v;}, - setMonth: function(v) {this.month = v;}, - setDay: function(v) {this.day = v;}, - setHours: function(v) {this.hours = v;}, - setMinutes: function(v) {this.minutes = v;}, - setSeconds: function(v) {this.seconds = v;}, - - setUNIX: function(v) {this.unix = v;}, - - set2DigitYear: function(v) { - this.year = v < twoDigitYearEpoch? twoDigitYearCentury + v : twoDigitYearCentury + v - 100; - }, - - toDate: function() { - if (this.unix !== undefined) { - return new Date(this.unix * 1000); - } - if (this.day === undefined || this.month === undefined) { - // Can't make a date from this. - return undefined; - } - if (this.year === undefined) { - // A date without a year. Set current year, or previous year - // if date would be in the future. - var now = new Date(); - this.year = now.getFullYear(); - var date = this.toDate(); - if (date.getTime() - now.getTime() > maxFutureDelta) { - date.setFullYear(now.getFullYear() - 1); - } - return date; - } - var MM = to2Digit(this.month); - var DD = to2Digit(this.day); - var hh = to2Digit(this.hours); - var mm = to2Digit(this.minutes); - var ss = to2Digit(this.seconds); - return new Date(this.year + "-" + MM + "-" + DD + "T" + hh + ":" + mm + ":" + ss + this.offset); - } - } - - function date_time_try_pattern(fmt, str, tzOffset) { - var date = new DateContainer(tzOffset); - var pos = date_time_try_pattern_at_pos(fmt, str, 0, date); - return pos !== undefined? date.toDate() : undefined; - } - - function date_time_try_pattern_at_pos(fmt, str, pos, date) { - var len = str.length; - for (var proc = 0; pos !== undefined && pos < len && proc < fmt.length; proc++) { - pos = fmt[proc](str, pos, date); - } - return pos; - } - - function date_time(opts) { - return function (evt) { - var tzOffset = opts.tz || tz_offset; - if (tzOffset === "event") { - tzOffset = evt.Get("event.timezone"); - } - var str = date_time_join_args(evt, opts.args); - for (var i = 0; i < opts.fmts.length; i++) { - var date = date_time_try_pattern(opts.fmts[i], str, tzOffset); - if (date !== undefined) { - evt.Put(FIELDS_PREFIX + opts.dest, date); - return; - } - } - if (debug) console.warn("in date_time: id=" + opts.id + " FAILED: " + str); - }; - } - - var uA = 60 * 60 * 24; - var uD = 60 * 60 * 24; - var uF = 60 * 60; - var uG = 60 * 60 * 24 * 30; - var uH = 60 * 60; - var uI = 60 * 60; - var uJ = 60 * 60 * 24; - var uM = 60 * 60 * 24 * 30; - var uN = 60 * 60; - var uO = 1; - var uS = 1; - var uT = 60; - var uU = 60; - var uc = dc; - - function duration(opts) { - return function(evt) { - var str = date_time_join_args(evt, opts.args); - for (var i = 0; i < opts.fmts.length; i++) { - var seconds = duration_try_pattern(opts.fmts[i], str); - if (seconds !== undefined) { - evt.Put(FIELDS_PREFIX + opts.dest, seconds); - return; - } - } - if (debug) console.warn("in duration: id=" + opts.id + " (s) FAILED: " + str); - }; - } - - function duration_try_pattern(fmt, str) { - var secs = 0; - var pos = 0; - for (var i=0; i [ month_id , how many chars to skip if month in long form ] - "Jan": [0, 4], - "Feb": [1, 5], - "Mar": [2, 2], - "Apr": [3, 2], - "May": [4, 0], - "Jun": [5, 1], - "Jul": [6, 1], - "Aug": [7, 3], - "Sep": [8, 6], - "Oct": [9, 4], - "Nov": [10, 5], - "Dec": [11, 4], - "jan": [0, 4], - "feb": [1, 5], - "mar": [2, 2], - "apr": [3, 2], - "may": [4, 0], - "jun": [5, 1], - "jul": [6, 1], - "aug": [7, 3], - "sep": [8, 6], - "oct": [9, 4], - "nov": [10, 5], - "dec": [11, 4], - }; - - // var dC = undefined; - var dR = dateMonthName(true); - var dB = dateMonthName(false); - var dM = dateFixedWidthNumber("M", 2, 1, 12, DateContainer.prototype.setMonth); - var dG = dateVariableWidthNumber("G", 1, 12, DateContainer.prototype.setMonth); - var dD = dateFixedWidthNumber("D", 2, 1, 31, DateContainer.prototype.setDay); - var dF = dateVariableWidthNumber("F", 1, 31, DateContainer.prototype.setDay); - var dH = dateFixedWidthNumber("H", 2, 0, 24, DateContainer.prototype.setHours); - var dI = dateVariableWidthNumber("I", 0, 24, DateContainer.prototype.setHours); // Accept hours >12 - var dN = dateVariableWidthNumber("N", 0, 24, DateContainer.prototype.setHours); - var dT = dateFixedWidthNumber("T", 2, 0, 59, DateContainer.prototype.setMinutes); - var dU = dateVariableWidthNumber("U", 0, 59, DateContainer.prototype.setMinutes); - var dP = parseAMPM; // AM|PM - var dQ = parseAMPM; // A.M.|P.M - var dS = dateFixedWidthNumber("S", 2, 0, 60, DateContainer.prototype.setSeconds); - var dO = dateVariableWidthNumber("O", 0, 60, DateContainer.prototype.setSeconds); - var dY = dateFixedWidthNumber("Y", 2, 0, 99, DateContainer.prototype.set2DigitYear); - var dW = dateFixedWidthNumber("W", 4, 1000, 9999, DateContainer.prototype.setYear); - var dZ = parseHMS; - var dX = dateVariableWidthNumber("X", 0, 0x10000000000, DateContainer.prototype.setUNIX); - - // parseAMPM parses "A.M", "AM", "P.M", "PM" from logs. - // Only works if this modifier appears after the hour has been read from logs - // which is always the case in the 300 devices. - function parseAMPM(str, pos, date) { - var n = str.length; - var start = skipws(str, pos); - if (start + 2 > n) return; - var head = str.substr(start, 2).toUpperCase(); - var isPM = false; - var skip = false; - switch (head) { - case "A.": - skip = true; - /* falls through */ - case "AM": - break; - case "P.": - skip = true; - /* falls through */ - case "PM": - isPM = true; - break; - default: - if (debug) console.warn("can't parse pos " + start + " as AM/PM: " + str + "(head:" + head + ")"); - return; - } - pos = start + 2; - if (skip) { - if (pos+2 > n || str.substr(pos, 2).toUpperCase() !== "M.") { - if (debug) console.warn("can't parse pos " + start + " as AM/PM: " + str + "(tail)"); - return; - } - pos += 2; - } - var hh = date.hours; - if (isPM) { - // Accept existing hour in 24h format. - if (hh < 12) hh += 12; - } else { - if (hh === 12) hh = 0; - } - date.setHours(hh); - return pos; - } - - function parseHMS(str, pos, date) { - return date_time_try_pattern_at_pos([dN, dc(":"), dU, dc(":"), dO], str, pos, date); - } - - function skipws(str, pos) { - for ( var n = str.length; - pos < n && str.charAt(pos) === " "; - pos++) - ; - return pos; - } - - function skipdigits(str, pos) { - var c; - for (var n = str.length; - pos < n && (c = str.charAt(pos)) >= "0" && c <= "9"; - pos++) - ; - return pos; - } - - function dSkip(str, pos, date) { - var chr; - for (;pos < str.length && (chr=str[pos])<'0' || chr>'9'; pos++) {} - return pos < str.length? pos : undefined; - } - - function dateVariableWidthNumber(fmtChar, min, max, setter) { - return function (str, pos, date) { - var start = skipws(str, pos); - pos = skipdigits(str, start); - var s = str.substr(start, pos - start); - var value = parseInt(s, 10); - if (value >= min && value <= max) { - setter.call(date, value); - return pos; - } - return; - }; - } - - function dateFixedWidthNumber(fmtChar, width, min, max, setter) { - return function (str, pos, date) { - pos = skipws(str, pos); - var n = str.length; - if (pos + width > n) return; - var s = str.substr(pos, width); - var value = parseInt(s, 10); - if (value >= min && value <= max) { - setter.call(date, value); - return pos + width; - } - return; - }; - } - - // Short month name (Jan..Dec). - function dateMonthName(long) { - return function (str, pos, date) { - pos = skipws(str, pos); - var n = str.length; - if (pos + 3 > n) return; - var mon = str.substr(pos, 3); - var idx = shortMonths[mon]; - if (idx === undefined) { - idx = shortMonths[mon.toLowerCase()]; - } - if (idx === undefined) { - //console.warn("parsing date_time: '" + mon + "' is not a valid short month (%B)"); - return; - } - date.setMonth(idx[0]+1); - return pos + 3 + (long ? idx[1] : 0); - }; - } - - function url_wrapper(dst, src, fn) { - return function(evt) { - var value = evt.Get(FIELDS_PREFIX + src), result; - if (value != null && (result = fn(value))!== undefined) { - evt.Put(FIELDS_PREFIX + dst, result); - } else { - console.debug(fn.name + " failed for '" + value + "'"); - } - }; - } - - // The following regular expression for parsing URLs from: - // https://github.com/wizard04wsu/URI_Parsing - // - // The MIT License (MIT) - // - // Copyright (c) 2014 Andrew Harrison - // - // Permission is hereby granted, free of charge, to any person obtaining a copy of - // this software and associated documentation files (the "Software"), to deal in - // the Software without restriction, including without limitation the rights to - // use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of - // the Software, and to permit persons to whom the Software is furnished to do so, - // subject to the following conditions: - // - // The above copyright notice and this permission notice shall be included in all - // copies or substantial portions of the Software. - // - // THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - // IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS - // FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR - // COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER - // IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN - // CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. - var uriRegExp = /^([a-z][a-z0-9+.\-]*):(?:\/\/((?:(?=((?:[a-z0-9\-._~!$&'()*+,;=:]|%[0-9A-F]{2})*))(\3)@)?(?=(\[[0-9A-F:.]{2,}\]|(?:[a-z0-9\-._~!$&'()*+,;=]|%[0-9A-F]{2})*))\5(?::(?=(\d*))\6)?)(\/(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/]|%[0-9A-F]{2})*))\8)?|(\/?(?!\/)(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/]|%[0-9A-F]{2})*))\10)?)(?:\?(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/?]|%[0-9A-F]{2})*))\11)?(?:#(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/?]|%[0-9A-F]{2})*))\12)?$/i; - - var uriScheme = 1; - var uriDomain = 5; - var uriPort = 6; - var uriPath = 7; - var uriPathAlt = 9; - var uriQuery = 11; - - function domain(dst, src) { - return url_wrapper(dst, src, extract_domain); - } - - function split_url(value) { - var m = value.match(uriRegExp); - if (m && m[uriDomain]) return m; - // Support input in the form "www.example.net/path", but not "/path". - m = ("null://" + value).match(uriRegExp); - if (m) return m; - } - - function extract_domain(value) { - var m = split_url(value); - if (m && m[uriDomain]) return m[uriDomain]; - } - - var extFromPage = /\.[^.]+$/; - function extract_ext(value) { - var page = extract_page(value); - if (page) { - var m = page.match(extFromPage); - if (m) return m[0]; - } - } - - function ext(dst, src) { - return url_wrapper(dst, src, extract_ext); - } - - function fqdn(dst, src) { - // TODO: fqdn and domain(eTLD+1) are currently the same. - return domain(dst, src); - } - - var pageFromPathRegExp = /\/([^\/]+)$/; - var pageName = 1; - - function extract_page(value) { - value = extract_path(value); - if (!value) return undefined; - var m = value.match(pageFromPathRegExp); - if (m) return m[pageName]; - } - - function page(dst, src) { - return url_wrapper(dst, src, extract_page); - } - - function extract_path(value) { - var m = split_url(value); - return m? m[uriPath] || m[uriPathAlt] : undefined; - } - - function path(dst, src) { - return url_wrapper(dst, src, extract_path); - } - - // Map common schemes to their default port. - // port has to be a string (will be converted at a later stage). - var schemePort = { - "ftp": "21", - "ssh": "22", - "http": "80", - "https": "443", - }; - - function extract_port(value) { - var m = split_url(value); - if (!m) return undefined; - if (m[uriPort]) return m[uriPort]; - if (m[uriScheme]) { - return schemePort[m[uriScheme]]; - } - } - - function port(dst, src) { - return url_wrapper(dst, src, extract_port); - } - - function extract_query(value) { - var m = split_url(value); - if (m && m[uriQuery]) return m[uriQuery]; - } - - function query(dst, src) { - return url_wrapper(dst, src, extract_query); - } - - function extract_root(value) { - var m = split_url(value); - if (m && m[uriDomain] && m[uriDomain]) { - var scheme = m[uriScheme] && m[uriScheme] !== "null"? - m[uriScheme] + "://" : ""; - var port = m[uriPort]? ":" + m[uriPort] : ""; - return scheme + m[uriDomain] + port; - } - } - - function root(dst, src) { - return url_wrapper(dst, src, extract_root); - } - - function tagval(id, src, cfg, keys, on_success) { - var fail = function(evt) { - evt.Put(FLAG_FIELD, "tagval_parsing_error"); - } - if (cfg.kv_separator.length !== 1) { - throw("Invalid TAGVALMAP ValueDelimiter (must have 1 character)"); - } - var quotes_len = cfg.open_quote.length > 0 && cfg.close_quote.length > 0? - cfg.open_quote.length + cfg.close_quote.length : 0; - var kv_regex = new RegExp('^([^' + cfg.kv_separator + ']*)*' + cfg.kv_separator + ' *(.*)*$'); - return function(evt) { - var msg = evt.Get(src); - if (msg === undefined) { - console.warn("tagval: input field is missing"); - return fail(evt); - } - var pairs = msg.split(cfg.pair_separator); - var i; - var success = false; - var prev = ""; - for (i=0; i 0 && - value.length >= cfg.open_quote.length + cfg.close_quote.length && - value.substr(0, cfg.open_quote.length) === cfg.open_quote && - value.substr(value.length - cfg.close_quote.length) === cfg.close_quote) { - value = value.substr(cfg.open_quote.length, value.length - quotes_len); - } - evt.Put(FIELDS_PREFIX + field, value); - success = true; - } - if (!success) { - return fail(evt); - } - if (on_success != null) { - on_success(evt); - } - } - } - - var ecs_mappings = { - "_facility": {convert: to_long, to:[{field: "log.syslog.facility.code", setter: fld_set}]}, - "_pri": {convert: to_long, to:[{field: "log.syslog.priority", setter: fld_set}]}, - "_severity": {convert: to_long, to:[{field: "log.syslog.severity.code", setter: fld_set}]}, - "action": {to:[{field: "event.action", setter: fld_prio, prio: 0}]}, - "administrator": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 4}]}, - "alias.ip": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 3},{field: "related.ip", setter: fld_append}]}, - "alias.ipv6": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 4},{field: "related.ip", setter: fld_append}]}, - "alias.mac": {convert: to_mac, to:[{field: "host.mac", setter: fld_prio, prio: 1}]}, - "application": {to:[{field: "network.application", setter: fld_set}]}, - "bytes": {convert: to_long, to:[{field: "network.bytes", setter: fld_set}]}, - "c_domain": {to:[{field: "source.domain", setter: fld_prio, prio: 1}]}, - "c_logon_id": {to:[{field: "user.id", setter: fld_prio, prio: 2}]}, - "c_user_name": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 8}]}, - "c_username": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 2}]}, - "cctld": {to:[{field: "url.top_level_domain", setter: fld_prio, prio: 1}]}, - "child_pid": {convert: to_long, to:[{field: "process.pid", setter: fld_prio, prio: 1}]}, - "child_pid_val": {to:[{field: "process.title", setter: fld_set}]}, - "child_process": {to:[{field: "process.name", setter: fld_prio, prio: 1}]}, - "city.dst": {to:[{field: "destination.geo.city_name", setter: fld_set}]}, - "city.src": {to:[{field: "source.geo.city_name", setter: fld_set}]}, - "daddr": {convert: to_ip, to:[{field: "destination.ip", setter: fld_set},{field: "related.ip", setter: fld_append}]}, - "daddr_v6": {convert: to_ip, to:[{field: "destination.ip", setter: fld_set},{field: "related.ip", setter: fld_append}]}, - "ddomain": {to:[{field: "destination.domain", setter: fld_prio, prio: 0}]}, - "devicehostip": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 2},{field: "related.ip", setter: fld_append}]}, - "devicehostmac": {convert: to_mac, to:[{field: "host.mac", setter: fld_prio, prio: 0}]}, - "dhost": {to:[{field: "destination.address", setter: fld_set},{field: "related.hosts", setter: fld_append}]}, - "dinterface": {to:[{field: "observer.egress.interface.name", setter: fld_set}]}, - "direction": {to:[{field: "network.direction", setter: fld_set}]}, - "directory": {to:[{field: "file.directory", setter: fld_set}]}, - "dmacaddr": {convert: to_mac, to:[{field: "destination.mac", setter: fld_set}]}, - "dns.responsetype": {to:[{field: "dns.answers.type", setter: fld_set}]}, - "dns.resptext": {to:[{field: "dns.answers.name", setter: fld_set}]}, - "dns_querytype": {to:[{field: "dns.question.type", setter: fld_set}]}, - "domain": {to:[{field: "server.domain", setter: fld_prio, prio: 0},{field: "related.hosts", setter: fld_append}]}, - "domain.dst": {to:[{field: "destination.domain", setter: fld_prio, prio: 1}]}, - "domain.src": {to:[{field: "source.domain", setter: fld_prio, prio: 2}]}, - "domain_id": {to:[{field: "user.domain", setter: fld_set}]}, - "domainname": {to:[{field: "server.domain", setter: fld_prio, prio: 1}]}, - "dport": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 0}]}, - "dtransaddr": {convert: to_ip, to:[{field: "destination.nat.ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, - "dtransport": {convert: to_long, to:[{field: "destination.nat.port", setter: fld_prio, prio: 0}]}, - "ec_outcome": {to:[{field: "event.outcome", setter: fld_ecs_outcome}]}, - "event_description": {to:[{field: "message", setter: fld_prio, prio: 0}]}, - "event_source": {to:[{field: "related.hosts", setter: fld_append}]}, - "event_time": {convert: to_date, to:[{field: "@timestamp", setter: fld_set}]}, - "event_type": {to:[{field: "event.action", setter: fld_prio, prio: 1}]}, - "extension": {to:[{field: "file.extension", setter: fld_prio, prio: 1}]}, - "file.attributes": {to:[{field: "file.attributes", setter: fld_set}]}, - "filename": {to:[{field: "file.name", setter: fld_prio, prio: 0}]}, - "filename_size": {convert: to_long, to:[{field: "file.size", setter: fld_set}]}, - "filepath": {to:[{field: "file.path", setter: fld_set}]}, - "filetype": {to:[{field: "file.type", setter: fld_set}]}, - "fqdn": {to:[{field: "related.hosts", setter: fld_append}]}, - "group": {to:[{field: "group.name", setter: fld_set}]}, - "groupid": {to:[{field: "group.id", setter: fld_set}]}, - "host": {to:[{field: "host.name", setter: fld_prio, prio: 1},{field: "related.hosts", setter: fld_append}]}, - "hostip": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, - "hostip_v6": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, - "hostname": {to:[{field: "host.name", setter: fld_prio, prio: 0}]}, - "id": {to:[{field: "event.code", setter: fld_prio, prio: 0}]}, - "interface": {to:[{field: "network.interface.name", setter: fld_set}]}, - "ip.orig": {convert: to_ip, to:[{field: "network.forwarded_ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, - "ip.trans.dst": {convert: to_ip, to:[{field: "destination.nat.ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, - "ip.trans.src": {convert: to_ip, to:[{field: "source.nat.ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, - "ipv6.orig": {convert: to_ip, to:[{field: "network.forwarded_ip", setter: fld_prio, prio: 2},{field: "related.ip", setter: fld_append}]}, - "latdec_dst": {convert: to_double, to:[{field: "destination.geo.location.lat", setter: fld_set}]}, - "latdec_src": {convert: to_double, to:[{field: "source.geo.location.lat", setter: fld_set}]}, - "location_city": {to:[{field: "geo.city_name", setter: fld_set}]}, - "location_country": {to:[{field: "geo.country_name", setter: fld_set}]}, - "location_desc": {to:[{field: "geo.name", setter: fld_set}]}, - "location_dst": {to:[{field: "destination.geo.country_name", setter: fld_set}]}, - "location_src": {to:[{field: "source.geo.country_name", setter: fld_set}]}, - "location_state": {to:[{field: "geo.region_name", setter: fld_set}]}, - "logon_id": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 5}]}, - "longdec_dst": {convert: to_double, to:[{field: "destination.geo.location.lon", setter: fld_set}]}, - "longdec_src": {convert: to_double, to:[{field: "source.geo.location.lon", setter: fld_set}]}, - "macaddr": {convert: to_mac, to:[{field: "host.mac", setter: fld_prio, prio: 2}]}, - "messageid": {to:[{field: "event.code", setter: fld_prio, prio: 1}]}, - "method": {to:[{field: "http.request.method", setter: fld_set}]}, - "msg": {to:[{field: "message", setter: fld_set}]}, - "orig_ip": {convert: to_ip, to:[{field: "network.forwarded_ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, - "owner": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 6}]}, - "packets": {convert: to_long, to:[{field: "network.packets", setter: fld_set}]}, - "parent_pid": {convert: to_long, to:[{field: "process.parent.pid", setter: fld_prio, prio: 0}]}, - "parent_pid_val": {to:[{field: "process.parent.title", setter: fld_set}]}, - "parent_process": {to:[{field: "process.parent.name", setter: fld_prio, prio: 0}]}, - "patient_fullname": {to:[{field: "user.full_name", setter: fld_prio, prio: 1}]}, - "port.dst": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 1}]}, - "port.src": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 1}]}, - "port.trans.dst": {convert: to_long, to:[{field: "destination.nat.port", setter: fld_prio, prio: 1}]}, - "port.trans.src": {convert: to_long, to:[{field: "source.nat.port", setter: fld_prio, prio: 1}]}, - "process": {to:[{field: "process.name", setter: fld_prio, prio: 0}]}, - "process_id": {convert: to_long, to:[{field: "process.pid", setter: fld_prio, prio: 0}]}, - "process_id_src": {convert: to_long, to:[{field: "process.parent.pid", setter: fld_prio, prio: 1}]}, - "process_src": {to:[{field: "process.parent.name", setter: fld_prio, prio: 1}]}, - "product": {to:[{field: "observer.product", setter: fld_set}]}, - "protocol": {to:[{field: "network.protocol", setter: fld_set}]}, - "query": {to:[{field: "url.query", setter: fld_prio, prio: 2}]}, - "rbytes": {convert: to_long, to:[{field: "destination.bytes", setter: fld_set}]}, - "referer": {to:[{field: "http.request.referrer", setter: fld_prio, prio: 1}]}, - "rulename": {to:[{field: "rule.name", setter: fld_set}]}, - "saddr": {convert: to_ip, to:[{field: "source.ip", setter: fld_set},{field: "related.ip", setter: fld_append}]}, - "saddr_v6": {convert: to_ip, to:[{field: "source.ip", setter: fld_set},{field: "related.ip", setter: fld_append}]}, - "sbytes": {convert: to_long, to:[{field: "source.bytes", setter: fld_set}]}, - "sdomain": {to:[{field: "source.domain", setter: fld_prio, prio: 0}]}, - "service": {to:[{field: "service.name", setter: fld_prio, prio: 1}]}, - "service.name": {to:[{field: "service.name", setter: fld_prio, prio: 0}]}, - "service_account": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 7}]}, - "severity": {to:[{field: "log.level", setter: fld_set}]}, - "shost": {to:[{field: "host.hostname", setter: fld_set},{field: "source.address", setter: fld_set},{field: "related.hosts", setter: fld_append}]}, - "sinterface": {to:[{field: "observer.ingress.interface.name", setter: fld_set}]}, - "sld": {to:[{field: "url.registered_domain", setter: fld_set}]}, - "smacaddr": {convert: to_mac, to:[{field: "source.mac", setter: fld_set}]}, - "sport": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 0}]}, - "stransaddr": {convert: to_ip, to:[{field: "source.nat.ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, - "stransport": {convert: to_long, to:[{field: "source.nat.port", setter: fld_prio, prio: 0}]}, - "tcp.dstport": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 2}]}, - "tcp.srcport": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 2}]}, - "timezone": {to:[{field: "event.timezone", setter: fld_set}]}, - "tld": {to:[{field: "url.top_level_domain", setter: fld_prio, prio: 0}]}, - "udp.dstport": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 3}]}, - "udp.srcport": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 3}]}, - "uid": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 3}]}, - "url": {to:[{field: "url.original", setter: fld_prio, prio: 1}]}, - "url_raw": {to:[{field: "url.original", setter: fld_prio, prio: 0}]}, - "urldomain": {to:[{field: "url.domain", setter: fld_prio, prio: 0}]}, - "urlquery": {to:[{field: "url.query", setter: fld_prio, prio: 0}]}, - "user": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 0}]}, - "user.id": {to:[{field: "user.id", setter: fld_prio, prio: 1}]}, - "user_agent": {to:[{field: "user_agent.original", setter: fld_set}]}, - "user_fullname": {to:[{field: "user.full_name", setter: fld_prio, prio: 0}]}, - "user_id": {to:[{field: "user.id", setter: fld_prio, prio: 0}]}, - "username": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 1}]}, - "version": {to:[{field: "observer.version", setter: fld_set}]}, - "web_domain": {to:[{field: "url.domain", setter: fld_prio, prio: 1},{field: "related.hosts", setter: fld_append}]}, - "web_extension": {to:[{field: "file.extension", setter: fld_prio, prio: 0}]}, - "web_query": {to:[{field: "url.query", setter: fld_prio, prio: 1}]}, - "web_ref_domain": {to:[{field: "related.hosts", setter: fld_append}]}, - "web_referer": {to:[{field: "http.request.referrer", setter: fld_prio, prio: 0}]}, - "web_root": {to:[{field: "url.path", setter: fld_set}]}, - "webpage": {to:[{field: "file.name", setter: fld_prio, prio: 1}]}, - }; - - var rsa_mappings = { - "access_point": {to:[{field: "rsa.wireless.access_point", setter: fld_set}]}, - "accesses": {to:[{field: "rsa.identity.accesses", setter: fld_set}]}, - "acl_id": {to:[{field: "rsa.misc.acl_id", setter: fld_set}]}, - "acl_op": {to:[{field: "rsa.misc.acl_op", setter: fld_set}]}, - "acl_pos": {to:[{field: "rsa.misc.acl_pos", setter: fld_set}]}, - "acl_table": {to:[{field: "rsa.misc.acl_table", setter: fld_set}]}, - "action": {to:[{field: "rsa.misc.action", setter: fld_append}]}, - "ad_computer_dst": {to:[{field: "rsa.network.ad_computer_dst", setter: fld_set}]}, - "addr": {to:[{field: "rsa.network.addr", setter: fld_set}]}, - "admin": {to:[{field: "rsa.misc.admin", setter: fld_set}]}, - "agent": {to:[{field: "rsa.misc.client", setter: fld_prio, prio: 0}]}, - "agent.id": {to:[{field: "rsa.misc.agent_id", setter: fld_set}]}, - "alarm_id": {to:[{field: "rsa.misc.alarm_id", setter: fld_set}]}, - "alarmname": {to:[{field: "rsa.misc.alarmname", setter: fld_set}]}, - "alert": {to:[{field: "rsa.threat.alert", setter: fld_set}]}, - "alert_id": {to:[{field: "rsa.misc.alert_id", setter: fld_set}]}, - "alias.host": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "analysis.file": {to:[{field: "rsa.investigations.analysis_file", setter: fld_set}]}, - "analysis.service": {to:[{field: "rsa.investigations.analysis_service", setter: fld_set}]}, - "analysis.session": {to:[{field: "rsa.investigations.analysis_session", setter: fld_set}]}, - "app_id": {to:[{field: "rsa.misc.app_id", setter: fld_set}]}, - "attachment": {to:[{field: "rsa.file.attachment", setter: fld_set}]}, - "audit": {to:[{field: "rsa.misc.audit", setter: fld_set}]}, - "audit_class": {to:[{field: "rsa.internal.audit_class", setter: fld_set}]}, - "audit_object": {to:[{field: "rsa.misc.audit_object", setter: fld_set}]}, - "auditdata": {to:[{field: "rsa.misc.auditdata", setter: fld_set}]}, - "authmethod": {to:[{field: "rsa.identity.auth_method", setter: fld_set}]}, - "autorun_type": {to:[{field: "rsa.misc.autorun_type", setter: fld_set}]}, - "bcc": {to:[{field: "rsa.email.email", setter: fld_append}]}, - "benchmark": {to:[{field: "rsa.misc.benchmark", setter: fld_set}]}, - "binary": {to:[{field: "rsa.file.binary", setter: fld_set}]}, - "boc": {to:[{field: "rsa.investigations.boc", setter: fld_set}]}, - "bssid": {to:[{field: "rsa.wireless.wlan_ssid", setter: fld_prio, prio: 1}]}, - "bypass": {to:[{field: "rsa.misc.bypass", setter: fld_set}]}, - "c_sid": {to:[{field: "rsa.identity.user_sid_src", setter: fld_set}]}, - "cache": {to:[{field: "rsa.misc.cache", setter: fld_set}]}, - "cache_hit": {to:[{field: "rsa.misc.cache_hit", setter: fld_set}]}, - "calling_from": {to:[{field: "rsa.misc.phone", setter: fld_prio, prio: 1}]}, - "calling_to": {to:[{field: "rsa.misc.phone", setter: fld_prio, prio: 0}]}, - "category": {to:[{field: "rsa.misc.category", setter: fld_set}]}, - "cc": {to:[{field: "rsa.email.email", setter: fld_append}]}, - "cc.number": {convert: to_long, to:[{field: "rsa.misc.cc_number", setter: fld_set}]}, - "cefversion": {to:[{field: "rsa.misc.cefversion", setter: fld_set}]}, - "cert.serial": {to:[{field: "rsa.crypto.cert_serial", setter: fld_set}]}, - "cert_ca": {to:[{field: "rsa.crypto.cert_ca", setter: fld_set}]}, - "cert_checksum": {to:[{field: "rsa.crypto.cert_checksum", setter: fld_set}]}, - "cert_common": {to:[{field: "rsa.crypto.cert_common", setter: fld_set}]}, - "cert_error": {to:[{field: "rsa.crypto.cert_error", setter: fld_set}]}, - "cert_hostname": {to:[{field: "rsa.crypto.cert_host_name", setter: fld_set}]}, - "cert_hostname_cat": {to:[{field: "rsa.crypto.cert_host_cat", setter: fld_set}]}, - "cert_issuer": {to:[{field: "rsa.crypto.cert_issuer", setter: fld_set}]}, - "cert_keysize": {to:[{field: "rsa.crypto.cert_keysize", setter: fld_set}]}, - "cert_status": {to:[{field: "rsa.crypto.cert_status", setter: fld_set}]}, - "cert_subject": {to:[{field: "rsa.crypto.cert_subject", setter: fld_set}]}, - "cert_username": {to:[{field: "rsa.crypto.cert_username", setter: fld_set}]}, - "cfg.attr": {to:[{field: "rsa.misc.cfg_attr", setter: fld_set}]}, - "cfg.obj": {to:[{field: "rsa.misc.cfg_obj", setter: fld_set}]}, - "cfg.path": {to:[{field: "rsa.misc.cfg_path", setter: fld_set}]}, - "change_attribute": {to:[{field: "rsa.misc.change_attrib", setter: fld_set}]}, - "change_new": {to:[{field: "rsa.misc.change_new", setter: fld_set}]}, - "change_old": {to:[{field: "rsa.misc.change_old", setter: fld_set}]}, - "changes": {to:[{field: "rsa.misc.changes", setter: fld_set}]}, - "checksum": {to:[{field: "rsa.misc.checksum", setter: fld_set}]}, - "checksum.dst": {to:[{field: "rsa.misc.checksum_dst", setter: fld_set}]}, - "checksum.src": {to:[{field: "rsa.misc.checksum_src", setter: fld_set}]}, - "cid": {to:[{field: "rsa.internal.cid", setter: fld_set}]}, - "client": {to:[{field: "rsa.misc.client", setter: fld_prio, prio: 1}]}, - "client_ip": {to:[{field: "rsa.misc.client_ip", setter: fld_set}]}, - "clustermembers": {to:[{field: "rsa.misc.clustermembers", setter: fld_set}]}, - "cmd": {to:[{field: "rsa.misc.cmd", setter: fld_set}]}, - "cn_acttimeout": {to:[{field: "rsa.misc.cn_acttimeout", setter: fld_set}]}, - "cn_asn_dst": {to:[{field: "rsa.web.cn_asn_dst", setter: fld_set}]}, - "cn_asn_src": {to:[{field: "rsa.misc.cn_asn_src", setter: fld_set}]}, - "cn_bgpv4nxthop": {to:[{field: "rsa.misc.cn_bgpv4nxthop", setter: fld_set}]}, - "cn_ctr_dst_code": {to:[{field: "rsa.misc.cn_ctr_dst_code", setter: fld_set}]}, - "cn_dst_tos": {to:[{field: "rsa.misc.cn_dst_tos", setter: fld_set}]}, - "cn_dst_vlan": {to:[{field: "rsa.misc.cn_dst_vlan", setter: fld_set}]}, - "cn_engine_id": {to:[{field: "rsa.misc.cn_engine_id", setter: fld_set}]}, - "cn_engine_type": {to:[{field: "rsa.misc.cn_engine_type", setter: fld_set}]}, - "cn_f_switch": {to:[{field: "rsa.misc.cn_f_switch", setter: fld_set}]}, - "cn_flowsampid": {to:[{field: "rsa.misc.cn_flowsampid", setter: fld_set}]}, - "cn_flowsampintv": {to:[{field: "rsa.misc.cn_flowsampintv", setter: fld_set}]}, - "cn_flowsampmode": {to:[{field: "rsa.misc.cn_flowsampmode", setter: fld_set}]}, - "cn_inacttimeout": {to:[{field: "rsa.misc.cn_inacttimeout", setter: fld_set}]}, - "cn_inpermbyts": {to:[{field: "rsa.misc.cn_inpermbyts", setter: fld_set}]}, - "cn_inpermpckts": {to:[{field: "rsa.misc.cn_inpermpckts", setter: fld_set}]}, - "cn_invalid": {to:[{field: "rsa.misc.cn_invalid", setter: fld_set}]}, - "cn_ip_proto_ver": {to:[{field: "rsa.misc.cn_ip_proto_ver", setter: fld_set}]}, - "cn_ipv4_ident": {to:[{field: "rsa.misc.cn_ipv4_ident", setter: fld_set}]}, - "cn_l_switch": {to:[{field: "rsa.misc.cn_l_switch", setter: fld_set}]}, - "cn_log_did": {to:[{field: "rsa.misc.cn_log_did", setter: fld_set}]}, - "cn_log_rid": {to:[{field: "rsa.misc.cn_log_rid", setter: fld_set}]}, - "cn_max_ttl": {to:[{field: "rsa.misc.cn_max_ttl", setter: fld_set}]}, - "cn_maxpcktlen": {to:[{field: "rsa.misc.cn_maxpcktlen", setter: fld_set}]}, - "cn_min_ttl": {to:[{field: "rsa.misc.cn_min_ttl", setter: fld_set}]}, - "cn_minpcktlen": {to:[{field: "rsa.misc.cn_minpcktlen", setter: fld_set}]}, - "cn_mpls_lbl_1": {to:[{field: "rsa.misc.cn_mpls_lbl_1", setter: fld_set}]}, - "cn_mpls_lbl_10": {to:[{field: "rsa.misc.cn_mpls_lbl_10", setter: fld_set}]}, - "cn_mpls_lbl_2": {to:[{field: "rsa.misc.cn_mpls_lbl_2", setter: fld_set}]}, - "cn_mpls_lbl_3": {to:[{field: "rsa.misc.cn_mpls_lbl_3", setter: fld_set}]}, - "cn_mpls_lbl_4": {to:[{field: "rsa.misc.cn_mpls_lbl_4", setter: fld_set}]}, - "cn_mpls_lbl_5": {to:[{field: "rsa.misc.cn_mpls_lbl_5", setter: fld_set}]}, - "cn_mpls_lbl_6": {to:[{field: "rsa.misc.cn_mpls_lbl_6", setter: fld_set}]}, - "cn_mpls_lbl_7": {to:[{field: "rsa.misc.cn_mpls_lbl_7", setter: fld_set}]}, - "cn_mpls_lbl_8": {to:[{field: "rsa.misc.cn_mpls_lbl_8", setter: fld_set}]}, - "cn_mpls_lbl_9": {to:[{field: "rsa.misc.cn_mpls_lbl_9", setter: fld_set}]}, - "cn_mplstoplabel": {to:[{field: "rsa.misc.cn_mplstoplabel", setter: fld_set}]}, - "cn_mplstoplabip": {to:[{field: "rsa.misc.cn_mplstoplabip", setter: fld_set}]}, - "cn_mul_dst_byt": {to:[{field: "rsa.misc.cn_mul_dst_byt", setter: fld_set}]}, - "cn_mul_dst_pks": {to:[{field: "rsa.misc.cn_mul_dst_pks", setter: fld_set}]}, - "cn_muligmptype": {to:[{field: "rsa.misc.cn_muligmptype", setter: fld_set}]}, - "cn_rpackets": {to:[{field: "rsa.web.cn_rpackets", setter: fld_set}]}, - "cn_sampalgo": {to:[{field: "rsa.misc.cn_sampalgo", setter: fld_set}]}, - "cn_sampint": {to:[{field: "rsa.misc.cn_sampint", setter: fld_set}]}, - "cn_seqctr": {to:[{field: "rsa.misc.cn_seqctr", setter: fld_set}]}, - "cn_spackets": {to:[{field: "rsa.misc.cn_spackets", setter: fld_set}]}, - "cn_src_tos": {to:[{field: "rsa.misc.cn_src_tos", setter: fld_set}]}, - "cn_src_vlan": {to:[{field: "rsa.misc.cn_src_vlan", setter: fld_set}]}, - "cn_sysuptime": {to:[{field: "rsa.misc.cn_sysuptime", setter: fld_set}]}, - "cn_template_id": {to:[{field: "rsa.misc.cn_template_id", setter: fld_set}]}, - "cn_totbytsexp": {to:[{field: "rsa.misc.cn_totbytsexp", setter: fld_set}]}, - "cn_totflowexp": {to:[{field: "rsa.misc.cn_totflowexp", setter: fld_set}]}, - "cn_totpcktsexp": {to:[{field: "rsa.misc.cn_totpcktsexp", setter: fld_set}]}, - "cn_unixnanosecs": {to:[{field: "rsa.misc.cn_unixnanosecs", setter: fld_set}]}, - "cn_v6flowlabel": {to:[{field: "rsa.misc.cn_v6flowlabel", setter: fld_set}]}, - "cn_v6optheaders": {to:[{field: "rsa.misc.cn_v6optheaders", setter: fld_set}]}, - "code": {to:[{field: "rsa.misc.code", setter: fld_set}]}, - "command": {to:[{field: "rsa.misc.command", setter: fld_set}]}, - "comments": {to:[{field: "rsa.misc.comments", setter: fld_set}]}, - "comp_class": {to:[{field: "rsa.misc.comp_class", setter: fld_set}]}, - "comp_name": {to:[{field: "rsa.misc.comp_name", setter: fld_set}]}, - "comp_rbytes": {to:[{field: "rsa.misc.comp_rbytes", setter: fld_set}]}, - "comp_sbytes": {to:[{field: "rsa.misc.comp_sbytes", setter: fld_set}]}, - "component_version": {to:[{field: "rsa.misc.comp_version", setter: fld_set}]}, - "connection_id": {to:[{field: "rsa.misc.connection_id", setter: fld_prio, prio: 1}]}, - "connectionid": {to:[{field: "rsa.misc.connection_id", setter: fld_prio, prio: 0}]}, - "content": {to:[{field: "rsa.misc.content", setter: fld_set}]}, - "content_type": {to:[{field: "rsa.misc.content_type", setter: fld_set}]}, - "content_version": {to:[{field: "rsa.misc.content_version", setter: fld_set}]}, - "context": {to:[{field: "rsa.misc.context", setter: fld_set}]}, - "count": {to:[{field: "rsa.misc.count", setter: fld_set}]}, - "cpu": {convert: to_long, to:[{field: "rsa.misc.cpu", setter: fld_set}]}, - "cpu_data": {to:[{field: "rsa.misc.cpu_data", setter: fld_set}]}, - "criticality": {to:[{field: "rsa.misc.criticality", setter: fld_set}]}, - "cs_agency_dst": {to:[{field: "rsa.misc.cs_agency_dst", setter: fld_set}]}, - "cs_analyzedby": {to:[{field: "rsa.misc.cs_analyzedby", setter: fld_set}]}, - "cs_av_other": {to:[{field: "rsa.misc.cs_av_other", setter: fld_set}]}, - "cs_av_primary": {to:[{field: "rsa.misc.cs_av_primary", setter: fld_set}]}, - "cs_av_secondary": {to:[{field: "rsa.misc.cs_av_secondary", setter: fld_set}]}, - "cs_bgpv6nxthop": {to:[{field: "rsa.misc.cs_bgpv6nxthop", setter: fld_set}]}, - "cs_bit9status": {to:[{field: "rsa.misc.cs_bit9status", setter: fld_set}]}, - "cs_context": {to:[{field: "rsa.misc.cs_context", setter: fld_set}]}, - "cs_control": {to:[{field: "rsa.misc.cs_control", setter: fld_set}]}, - "cs_data": {to:[{field: "rsa.misc.cs_data", setter: fld_set}]}, - "cs_datecret": {to:[{field: "rsa.misc.cs_datecret", setter: fld_set}]}, - "cs_dst_tld": {to:[{field: "rsa.misc.cs_dst_tld", setter: fld_set}]}, - "cs_eth_dst_ven": {to:[{field: "rsa.misc.cs_eth_dst_ven", setter: fld_set}]}, - "cs_eth_src_ven": {to:[{field: "rsa.misc.cs_eth_src_ven", setter: fld_set}]}, - "cs_event_uuid": {to:[{field: "rsa.misc.cs_event_uuid", setter: fld_set}]}, - "cs_filetype": {to:[{field: "rsa.misc.cs_filetype", setter: fld_set}]}, - "cs_fld": {to:[{field: "rsa.misc.cs_fld", setter: fld_set}]}, - "cs_if_desc": {to:[{field: "rsa.misc.cs_if_desc", setter: fld_set}]}, - "cs_if_name": {to:[{field: "rsa.misc.cs_if_name", setter: fld_set}]}, - "cs_ip_next_hop": {to:[{field: "rsa.misc.cs_ip_next_hop", setter: fld_set}]}, - "cs_ipv4dstpre": {to:[{field: "rsa.misc.cs_ipv4dstpre", setter: fld_set}]}, - "cs_ipv4srcpre": {to:[{field: "rsa.misc.cs_ipv4srcpre", setter: fld_set}]}, - "cs_lifetime": {to:[{field: "rsa.misc.cs_lifetime", setter: fld_set}]}, - "cs_log_medium": {to:[{field: "rsa.misc.cs_log_medium", setter: fld_set}]}, - "cs_loginname": {to:[{field: "rsa.misc.cs_loginname", setter: fld_set}]}, - "cs_modulescore": {to:[{field: "rsa.misc.cs_modulescore", setter: fld_set}]}, - "cs_modulesign": {to:[{field: "rsa.misc.cs_modulesign", setter: fld_set}]}, - "cs_opswatresult": {to:[{field: "rsa.misc.cs_opswatresult", setter: fld_set}]}, - "cs_payload": {to:[{field: "rsa.misc.cs_payload", setter: fld_set}]}, - "cs_registrant": {to:[{field: "rsa.misc.cs_registrant", setter: fld_set}]}, - "cs_registrar": {to:[{field: "rsa.misc.cs_registrar", setter: fld_set}]}, - "cs_represult": {to:[{field: "rsa.misc.cs_represult", setter: fld_set}]}, - "cs_rpayload": {to:[{field: "rsa.misc.cs_rpayload", setter: fld_set}]}, - "cs_sampler_name": {to:[{field: "rsa.misc.cs_sampler_name", setter: fld_set}]}, - "cs_sourcemodule": {to:[{field: "rsa.misc.cs_sourcemodule", setter: fld_set}]}, - "cs_streams": {to:[{field: "rsa.misc.cs_streams", setter: fld_set}]}, - "cs_targetmodule": {to:[{field: "rsa.misc.cs_targetmodule", setter: fld_set}]}, - "cs_v6nxthop": {to:[{field: "rsa.misc.cs_v6nxthop", setter: fld_set}]}, - "cs_whois_server": {to:[{field: "rsa.misc.cs_whois_server", setter: fld_set}]}, - "cs_yararesult": {to:[{field: "rsa.misc.cs_yararesult", setter: fld_set}]}, - "cve": {to:[{field: "rsa.misc.cve", setter: fld_set}]}, - "d_certauth": {to:[{field: "rsa.crypto.d_certauth", setter: fld_set}]}, - "d_cipher": {to:[{field: "rsa.crypto.cipher_dst", setter: fld_set}]}, - "d_ciphersize": {convert: to_long, to:[{field: "rsa.crypto.cipher_size_dst", setter: fld_set}]}, - "d_sslver": {to:[{field: "rsa.crypto.ssl_ver_dst", setter: fld_set}]}, - "data": {to:[{field: "rsa.internal.data", setter: fld_set}]}, - "data_type": {to:[{field: "rsa.misc.data_type", setter: fld_set}]}, - "date": {to:[{field: "rsa.time.date", setter: fld_set}]}, - "datetime": {to:[{field: "rsa.time.datetime", setter: fld_set}]}, - "day": {to:[{field: "rsa.time.day", setter: fld_set}]}, - "db_id": {to:[{field: "rsa.db.db_id", setter: fld_set}]}, - "db_name": {to:[{field: "rsa.db.database", setter: fld_set}]}, - "db_pid": {convert: to_long, to:[{field: "rsa.db.db_pid", setter: fld_set}]}, - "dclass_counter1": {convert: to_long, to:[{field: "rsa.counters.dclass_c1", setter: fld_set}]}, - "dclass_counter1_string": {to:[{field: "rsa.counters.dclass_c1_str", setter: fld_set}]}, - "dclass_counter2": {convert: to_long, to:[{field: "rsa.counters.dclass_c2", setter: fld_set}]}, - "dclass_counter2_string": {to:[{field: "rsa.counters.dclass_c2_str", setter: fld_set}]}, - "dclass_counter3": {convert: to_long, to:[{field: "rsa.counters.dclass_c3", setter: fld_set}]}, - "dclass_counter3_string": {to:[{field: "rsa.counters.dclass_c3_str", setter: fld_set}]}, - "dclass_ratio1": {to:[{field: "rsa.counters.dclass_r1", setter: fld_set}]}, - "dclass_ratio1_string": {to:[{field: "rsa.counters.dclass_r1_str", setter: fld_set}]}, - "dclass_ratio2": {to:[{field: "rsa.counters.dclass_r2", setter: fld_set}]}, - "dclass_ratio2_string": {to:[{field: "rsa.counters.dclass_r2_str", setter: fld_set}]}, - "dclass_ratio3": {to:[{field: "rsa.counters.dclass_r3", setter: fld_set}]}, - "dclass_ratio3_string": {to:[{field: "rsa.counters.dclass_r3_str", setter: fld_set}]}, - "dead": {convert: to_long, to:[{field: "rsa.internal.dead", setter: fld_set}]}, - "description": {to:[{field: "rsa.misc.description", setter: fld_set}]}, - "detail": {to:[{field: "rsa.misc.event_desc", setter: fld_set}]}, - "device": {to:[{field: "rsa.misc.device_name", setter: fld_set}]}, - "device.class": {to:[{field: "rsa.internal.device_class", setter: fld_set}]}, - "device.group": {to:[{field: "rsa.internal.device_group", setter: fld_set}]}, - "device.host": {to:[{field: "rsa.internal.device_host", setter: fld_set}]}, - "device.ip": {convert: to_ip, to:[{field: "rsa.internal.device_ip", setter: fld_set}]}, - "device.ipv6": {convert: to_ip, to:[{field: "rsa.internal.device_ipv6", setter: fld_set}]}, - "device.type": {to:[{field: "rsa.internal.device_type", setter: fld_set}]}, - "device.type.id": {convert: to_long, to:[{field: "rsa.internal.device_type_id", setter: fld_set}]}, - "devicehostname": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "devvendor": {to:[{field: "rsa.misc.devvendor", setter: fld_set}]}, - "dhost": {to:[{field: "rsa.network.host_dst", setter: fld_set}]}, - "did": {to:[{field: "rsa.internal.did", setter: fld_set}]}, - "dinterface": {to:[{field: "rsa.network.dinterface", setter: fld_set}]}, - "directory.dst": {to:[{field: "rsa.file.directory_dst", setter: fld_set}]}, - "directory.src": {to:[{field: "rsa.file.directory_src", setter: fld_set}]}, - "disk_volume": {to:[{field: "rsa.storage.disk_volume", setter: fld_set}]}, - "disposition": {to:[{field: "rsa.misc.disposition", setter: fld_set}]}, - "distance": {to:[{field: "rsa.misc.distance", setter: fld_set}]}, - "dmask": {to:[{field: "rsa.network.dmask", setter: fld_set}]}, - "dn": {to:[{field: "rsa.identity.dn", setter: fld_set}]}, - "dns_a_record": {to:[{field: "rsa.network.dns_a_record", setter: fld_set}]}, - "dns_cname_record": {to:[{field: "rsa.network.dns_cname_record", setter: fld_set}]}, - "dns_id": {to:[{field: "rsa.network.dns_id", setter: fld_set}]}, - "dns_opcode": {to:[{field: "rsa.network.dns_opcode", setter: fld_set}]}, - "dns_ptr_record": {to:[{field: "rsa.network.dns_ptr_record", setter: fld_set}]}, - "dns_resp": {to:[{field: "rsa.network.dns_resp", setter: fld_set}]}, - "dns_type": {to:[{field: "rsa.network.dns_type", setter: fld_set}]}, - "doc_number": {convert: to_long, to:[{field: "rsa.misc.doc_number", setter: fld_set}]}, - "domain": {to:[{field: "rsa.network.domain", setter: fld_set}]}, - "domain1": {to:[{field: "rsa.network.domain1", setter: fld_set}]}, - "dst_dn": {to:[{field: "rsa.identity.dn_dst", setter: fld_set}]}, - "dst_payload": {to:[{field: "rsa.misc.payload_dst", setter: fld_set}]}, - "dst_spi": {to:[{field: "rsa.misc.spi_dst", setter: fld_set}]}, - "dst_zone": {to:[{field: "rsa.network.zone_dst", setter: fld_set}]}, - "dstburb": {to:[{field: "rsa.misc.dstburb", setter: fld_set}]}, - "duration": {convert: to_double, to:[{field: "rsa.time.duration_time", setter: fld_set}]}, - "duration_string": {to:[{field: "rsa.time.duration_str", setter: fld_set}]}, - "ec_activity": {to:[{field: "rsa.investigations.ec_activity", setter: fld_set}]}, - "ec_outcome": {to:[{field: "rsa.investigations.ec_outcome", setter: fld_set}]}, - "ec_subject": {to:[{field: "rsa.investigations.ec_subject", setter: fld_set}]}, - "ec_theme": {to:[{field: "rsa.investigations.ec_theme", setter: fld_set}]}, - "edomain": {to:[{field: "rsa.misc.edomain", setter: fld_set}]}, - "edomaub": {to:[{field: "rsa.misc.edomaub", setter: fld_set}]}, - "effective_time": {convert: to_date, to:[{field: "rsa.time.effective_time", setter: fld_set}]}, - "ein.number": {convert: to_long, to:[{field: "rsa.misc.ein_number", setter: fld_set}]}, - "email": {to:[{field: "rsa.email.email", setter: fld_append}]}, - "encryption_type": {to:[{field: "rsa.crypto.crypto", setter: fld_set}]}, - "endtime": {convert: to_date, to:[{field: "rsa.time.endtime", setter: fld_set}]}, - "entropy.req": {convert: to_long, to:[{field: "rsa.internal.entropy_req", setter: fld_set}]}, - "entropy.res": {convert: to_long, to:[{field: "rsa.internal.entropy_res", setter: fld_set}]}, - "entry": {to:[{field: "rsa.internal.entry", setter: fld_set}]}, - "eoc": {to:[{field: "rsa.investigations.eoc", setter: fld_set}]}, - "error": {to:[{field: "rsa.misc.error", setter: fld_set}]}, - "eth_type": {convert: to_long, to:[{field: "rsa.network.eth_type", setter: fld_set}]}, - "euid": {to:[{field: "rsa.misc.euid", setter: fld_set}]}, - "event.cat": {convert: to_long, to:[{field: "rsa.investigations.event_cat", setter: fld_prio, prio: 1}]}, - "event.cat.name": {to:[{field: "rsa.investigations.event_cat_name", setter: fld_prio, prio: 1}]}, - "event_cat": {convert: to_long, to:[{field: "rsa.investigations.event_cat", setter: fld_prio, prio: 0}]}, - "event_cat_name": {to:[{field: "rsa.investigations.event_cat_name", setter: fld_prio, prio: 0}]}, - "event_category": {to:[{field: "rsa.misc.event_category", setter: fld_set}]}, - "event_computer": {to:[{field: "rsa.misc.event_computer", setter: fld_set}]}, - "event_counter": {convert: to_long, to:[{field: "rsa.counters.event_counter", setter: fld_set}]}, - "event_description": {to:[{field: "rsa.internal.event_desc", setter: fld_set}]}, - "event_id": {to:[{field: "rsa.misc.event_id", setter: fld_set}]}, - "event_log": {to:[{field: "rsa.misc.event_log", setter: fld_set}]}, - "event_name": {to:[{field: "rsa.internal.event_name", setter: fld_set}]}, - "event_queue_time": {convert: to_date, to:[{field: "rsa.time.event_queue_time", setter: fld_set}]}, - "event_source": {to:[{field: "rsa.misc.event_source", setter: fld_set}]}, - "event_state": {to:[{field: "rsa.misc.event_state", setter: fld_set}]}, - "event_time": {convert: to_date, to:[{field: "rsa.time.event_time", setter: fld_set}]}, - "event_time_str": {to:[{field: "rsa.time.event_time_str", setter: fld_prio, prio: 1}]}, - "event_time_string": {to:[{field: "rsa.time.event_time_str", setter: fld_prio, prio: 0}]}, - "event_type": {to:[{field: "rsa.misc.event_type", setter: fld_set}]}, - "event_user": {to:[{field: "rsa.misc.event_user", setter: fld_set}]}, - "eventtime": {to:[{field: "rsa.time.eventtime", setter: fld_set}]}, - "expected_val": {to:[{field: "rsa.misc.expected_val", setter: fld_set}]}, - "expiration_time": {convert: to_date, to:[{field: "rsa.time.expire_time", setter: fld_set}]}, - "expiration_time_string": {to:[{field: "rsa.time.expire_time_str", setter: fld_set}]}, - "facility": {to:[{field: "rsa.misc.facility", setter: fld_set}]}, - "facilityname": {to:[{field: "rsa.misc.facilityname", setter: fld_set}]}, - "faddr": {to:[{field: "rsa.network.faddr", setter: fld_set}]}, - "fcatnum": {to:[{field: "rsa.misc.fcatnum", setter: fld_set}]}, - "federated_idp": {to:[{field: "rsa.identity.federated_idp", setter: fld_set}]}, - "federated_sp": {to:[{field: "rsa.identity.federated_sp", setter: fld_set}]}, - "feed.category": {to:[{field: "rsa.internal.feed_category", setter: fld_set}]}, - "feed_desc": {to:[{field: "rsa.internal.feed_desc", setter: fld_set}]}, - "feed_name": {to:[{field: "rsa.internal.feed_name", setter: fld_set}]}, - "fhost": {to:[{field: "rsa.network.fhost", setter: fld_set}]}, - "file_entropy": {convert: to_double, to:[{field: "rsa.file.file_entropy", setter: fld_set}]}, - "file_vendor": {to:[{field: "rsa.file.file_vendor", setter: fld_set}]}, - "filename_dst": {to:[{field: "rsa.file.filename_dst", setter: fld_set}]}, - "filename_src": {to:[{field: "rsa.file.filename_src", setter: fld_set}]}, - "filename_tmp": {to:[{field: "rsa.file.filename_tmp", setter: fld_set}]}, - "filesystem": {to:[{field: "rsa.file.filesystem", setter: fld_set}]}, - "filter": {to:[{field: "rsa.misc.filter", setter: fld_set}]}, - "finterface": {to:[{field: "rsa.misc.finterface", setter: fld_set}]}, - "flags": {to:[{field: "rsa.misc.flags", setter: fld_set}]}, - "forensic_info": {to:[{field: "rsa.misc.forensic_info", setter: fld_set}]}, - "forward.ip": {convert: to_ip, to:[{field: "rsa.internal.forward_ip", setter: fld_set}]}, - "forward.ipv6": {convert: to_ip, to:[{field: "rsa.internal.forward_ipv6", setter: fld_set}]}, - "found": {to:[{field: "rsa.misc.found", setter: fld_set}]}, - "fport": {to:[{field: "rsa.network.fport", setter: fld_set}]}, - "fqdn": {to:[{field: "rsa.web.fqdn", setter: fld_set}]}, - "fresult": {convert: to_long, to:[{field: "rsa.misc.fresult", setter: fld_set}]}, - "from": {to:[{field: "rsa.email.email_src", setter: fld_set}]}, - "gaddr": {to:[{field: "rsa.misc.gaddr", setter: fld_set}]}, - "gateway": {to:[{field: "rsa.network.gateway", setter: fld_set}]}, - "gmtdate": {to:[{field: "rsa.time.gmtdate", setter: fld_set}]}, - "gmttime": {to:[{field: "rsa.time.gmttime", setter: fld_set}]}, - "group": {to:[{field: "rsa.misc.group", setter: fld_set}]}, - "group_object": {to:[{field: "rsa.misc.group_object", setter: fld_set}]}, - "groupid": {to:[{field: "rsa.misc.group_id", setter: fld_set}]}, - "h_code": {to:[{field: "rsa.internal.hcode", setter: fld_set}]}, - "hardware_id": {to:[{field: "rsa.misc.hardware_id", setter: fld_set}]}, - "header.id": {to:[{field: "rsa.internal.header_id", setter: fld_set}]}, - "host.orig": {to:[{field: "rsa.network.host_orig", setter: fld_set}]}, - "host.state": {to:[{field: "rsa.endpoint.host_state", setter: fld_set}]}, - "host.type": {to:[{field: "rsa.network.host_type", setter: fld_set}]}, - "host_role": {to:[{field: "rsa.identity.host_role", setter: fld_set}]}, - "hostid": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "hostname": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "hour": {to:[{field: "rsa.time.hour", setter: fld_set}]}, - "https.insact": {to:[{field: "rsa.crypto.https_insact", setter: fld_set}]}, - "https.valid": {to:[{field: "rsa.crypto.https_valid", setter: fld_set}]}, - "icmpcode": {convert: to_long, to:[{field: "rsa.network.icmp_code", setter: fld_set}]}, - "icmptype": {convert: to_long, to:[{field: "rsa.network.icmp_type", setter: fld_set}]}, - "id": {to:[{field: "rsa.misc.reference_id", setter: fld_set}]}, - "id1": {to:[{field: "rsa.misc.reference_id1", setter: fld_set}]}, - "id2": {to:[{field: "rsa.misc.reference_id2", setter: fld_set}]}, - "id3": {to:[{field: "rsa.misc.id3", setter: fld_set}]}, - "ike": {to:[{field: "rsa.crypto.ike", setter: fld_set}]}, - "ike_cookie1": {to:[{field: "rsa.crypto.ike_cookie1", setter: fld_set}]}, - "ike_cookie2": {to:[{field: "rsa.crypto.ike_cookie2", setter: fld_set}]}, - "im_buddyid": {to:[{field: "rsa.misc.im_buddyid", setter: fld_set}]}, - "im_buddyname": {to:[{field: "rsa.misc.im_buddyname", setter: fld_set}]}, - "im_client": {to:[{field: "rsa.misc.im_client", setter: fld_set}]}, - "im_croomid": {to:[{field: "rsa.misc.im_croomid", setter: fld_set}]}, - "im_croomtype": {to:[{field: "rsa.misc.im_croomtype", setter: fld_set}]}, - "im_members": {to:[{field: "rsa.misc.im_members", setter: fld_set}]}, - "im_userid": {to:[{field: "rsa.misc.im_userid", setter: fld_set}]}, - "im_username": {to:[{field: "rsa.misc.im_username", setter: fld_set}]}, - "index": {to:[{field: "rsa.misc.index", setter: fld_set}]}, - "info": {to:[{field: "rsa.db.index", setter: fld_set}]}, - "inode": {convert: to_long, to:[{field: "rsa.internal.inode", setter: fld_set}]}, - "inout": {to:[{field: "rsa.misc.inout", setter: fld_set}]}, - "instance": {to:[{field: "rsa.db.instance", setter: fld_set}]}, - "interface": {to:[{field: "rsa.network.interface", setter: fld_set}]}, - "inv.category": {to:[{field: "rsa.investigations.inv_category", setter: fld_set}]}, - "inv.context": {to:[{field: "rsa.investigations.inv_context", setter: fld_set}]}, - "ioc": {to:[{field: "rsa.investigations.ioc", setter: fld_set}]}, - "ip_proto": {convert: to_long, to:[{field: "rsa.network.ip_proto", setter: fld_set}]}, - "ipkt": {to:[{field: "rsa.misc.ipkt", setter: fld_set}]}, - "ipscat": {to:[{field: "rsa.misc.ipscat", setter: fld_set}]}, - "ipspri": {to:[{field: "rsa.misc.ipspri", setter: fld_set}]}, - "jobname": {to:[{field: "rsa.misc.jobname", setter: fld_set}]}, - "jobnum": {to:[{field: "rsa.misc.job_num", setter: fld_set}]}, - "laddr": {to:[{field: "rsa.network.laddr", setter: fld_set}]}, - "language": {to:[{field: "rsa.misc.language", setter: fld_set}]}, - "latitude": {to:[{field: "rsa.misc.latitude", setter: fld_set}]}, - "lc.cid": {to:[{field: "rsa.internal.lc_cid", setter: fld_set}]}, - "lc.ctime": {convert: to_date, to:[{field: "rsa.internal.lc_ctime", setter: fld_set}]}, - "ldap": {to:[{field: "rsa.identity.ldap", setter: fld_set}]}, - "ldap.query": {to:[{field: "rsa.identity.ldap_query", setter: fld_set}]}, - "ldap.response": {to:[{field: "rsa.identity.ldap_response", setter: fld_set}]}, - "level": {convert: to_long, to:[{field: "rsa.internal.level", setter: fld_set}]}, - "lhost": {to:[{field: "rsa.network.lhost", setter: fld_set}]}, - "library": {to:[{field: "rsa.misc.library", setter: fld_set}]}, - "lifetime": {convert: to_long, to:[{field: "rsa.misc.lifetime", setter: fld_set}]}, - "linenum": {to:[{field: "rsa.misc.linenum", setter: fld_set}]}, - "link": {to:[{field: "rsa.misc.link", setter: fld_set}]}, - "linterface": {to:[{field: "rsa.network.linterface", setter: fld_set}]}, - "list_name": {to:[{field: "rsa.misc.list_name", setter: fld_set}]}, - "listnum": {to:[{field: "rsa.misc.listnum", setter: fld_set}]}, - "load_data": {to:[{field: "rsa.misc.load_data", setter: fld_set}]}, - "location_floor": {to:[{field: "rsa.misc.location_floor", setter: fld_set}]}, - "location_mark": {to:[{field: "rsa.misc.location_mark", setter: fld_set}]}, - "log_id": {to:[{field: "rsa.misc.log_id", setter: fld_set}]}, - "log_type": {to:[{field: "rsa.misc.log_type", setter: fld_set}]}, - "logid": {to:[{field: "rsa.misc.logid", setter: fld_set}]}, - "logip": {to:[{field: "rsa.misc.logip", setter: fld_set}]}, - "logname": {to:[{field: "rsa.misc.logname", setter: fld_set}]}, - "logon_type": {to:[{field: "rsa.identity.logon_type", setter: fld_set}]}, - "logon_type_desc": {to:[{field: "rsa.identity.logon_type_desc", setter: fld_set}]}, - "longitude": {to:[{field: "rsa.misc.longitude", setter: fld_set}]}, - "lport": {to:[{field: "rsa.misc.lport", setter: fld_set}]}, - "lread": {convert: to_long, to:[{field: "rsa.db.lread", setter: fld_set}]}, - "lun": {to:[{field: "rsa.storage.lun", setter: fld_set}]}, - "lwrite": {convert: to_long, to:[{field: "rsa.db.lwrite", setter: fld_set}]}, - "macaddr": {convert: to_mac, to:[{field: "rsa.network.eth_host", setter: fld_set}]}, - "mail_id": {to:[{field: "rsa.misc.mail_id", setter: fld_set}]}, - "mask": {to:[{field: "rsa.network.mask", setter: fld_set}]}, - "match": {to:[{field: "rsa.misc.match", setter: fld_set}]}, - "mbug_data": {to:[{field: "rsa.misc.mbug_data", setter: fld_set}]}, - "mcb.req": {convert: to_long, to:[{field: "rsa.internal.mcb_req", setter: fld_set}]}, - "mcb.res": {convert: to_long, to:[{field: "rsa.internal.mcb_res", setter: fld_set}]}, - "mcbc.req": {convert: to_long, to:[{field: "rsa.internal.mcbc_req", setter: fld_set}]}, - "mcbc.res": {convert: to_long, to:[{field: "rsa.internal.mcbc_res", setter: fld_set}]}, - "medium": {convert: to_long, to:[{field: "rsa.internal.medium", setter: fld_set}]}, - "message": {to:[{field: "rsa.internal.message", setter: fld_set}]}, - "message_body": {to:[{field: "rsa.misc.message_body", setter: fld_set}]}, - "messageid": {to:[{field: "rsa.internal.messageid", setter: fld_set}]}, - "min": {to:[{field: "rsa.time.min", setter: fld_set}]}, - "misc": {to:[{field: "rsa.misc.misc", setter: fld_set}]}, - "misc_name": {to:[{field: "rsa.misc.misc_name", setter: fld_set}]}, - "mode": {to:[{field: "rsa.misc.mode", setter: fld_set}]}, - "month": {to:[{field: "rsa.time.month", setter: fld_set}]}, - "msg": {to:[{field: "rsa.internal.msg", setter: fld_set}]}, - "msgIdPart1": {to:[{field: "rsa.misc.msgIdPart1", setter: fld_set}]}, - "msgIdPart2": {to:[{field: "rsa.misc.msgIdPart2", setter: fld_set}]}, - "msgIdPart3": {to:[{field: "rsa.misc.msgIdPart3", setter: fld_set}]}, - "msgIdPart4": {to:[{field: "rsa.misc.msgIdPart4", setter: fld_set}]}, - "msg_id": {to:[{field: "rsa.internal.msg_id", setter: fld_set}]}, - "msg_type": {to:[{field: "rsa.misc.msg_type", setter: fld_set}]}, - "msgid": {to:[{field: "rsa.misc.msgid", setter: fld_set}]}, - "name": {to:[{field: "rsa.misc.name", setter: fld_set}]}, - "netname": {to:[{field: "rsa.network.netname", setter: fld_set}]}, - "netsessid": {to:[{field: "rsa.misc.netsessid", setter: fld_set}]}, - "network_port": {convert: to_long, to:[{field: "rsa.network.network_port", setter: fld_set}]}, - "network_service": {to:[{field: "rsa.network.network_service", setter: fld_set}]}, - "node": {to:[{field: "rsa.misc.node", setter: fld_set}]}, - "nodename": {to:[{field: "rsa.internal.node_name", setter: fld_set}]}, - "ntype": {to:[{field: "rsa.misc.ntype", setter: fld_set}]}, - "num": {to:[{field: "rsa.misc.num", setter: fld_set}]}, - "number": {to:[{field: "rsa.misc.number", setter: fld_set}]}, - "number1": {to:[{field: "rsa.misc.number1", setter: fld_set}]}, - "number2": {to:[{field: "rsa.misc.number2", setter: fld_set}]}, - "nwe.callback_id": {to:[{field: "rsa.internal.nwe_callback_id", setter: fld_set}]}, - "nwwn": {to:[{field: "rsa.misc.nwwn", setter: fld_set}]}, - "obj_id": {to:[{field: "rsa.internal.obj_id", setter: fld_set}]}, - "obj_name": {to:[{field: "rsa.misc.obj_name", setter: fld_set}]}, - "obj_server": {to:[{field: "rsa.internal.obj_server", setter: fld_set}]}, - "obj_type": {to:[{field: "rsa.misc.obj_type", setter: fld_set}]}, - "obj_value": {to:[{field: "rsa.internal.obj_val", setter: fld_set}]}, - "object": {to:[{field: "rsa.misc.object", setter: fld_set}]}, - "observed_val": {to:[{field: "rsa.misc.observed_val", setter: fld_set}]}, - "operation": {to:[{field: "rsa.misc.operation", setter: fld_set}]}, - "operation_id": {to:[{field: "rsa.misc.operation_id", setter: fld_set}]}, - "opkt": {to:[{field: "rsa.misc.opkt", setter: fld_set}]}, - "org.dst": {to:[{field: "rsa.physical.org_dst", setter: fld_prio, prio: 1}]}, - "org.src": {to:[{field: "rsa.physical.org_src", setter: fld_set}]}, - "org_dst": {to:[{field: "rsa.physical.org_dst", setter: fld_prio, prio: 0}]}, - "orig_from": {to:[{field: "rsa.misc.orig_from", setter: fld_set}]}, - "origin": {to:[{field: "rsa.network.origin", setter: fld_set}]}, - "original_owner": {to:[{field: "rsa.identity.owner", setter: fld_set}]}, - "os": {to:[{field: "rsa.misc.OS", setter: fld_set}]}, - "owner_id": {to:[{field: "rsa.misc.owner_id", setter: fld_set}]}, - "p_action": {to:[{field: "rsa.misc.p_action", setter: fld_set}]}, - "p_date": {to:[{field: "rsa.time.p_date", setter: fld_set}]}, - "p_filter": {to:[{field: "rsa.misc.p_filter", setter: fld_set}]}, - "p_group_object": {to:[{field: "rsa.misc.p_group_object", setter: fld_set}]}, - "p_id": {to:[{field: "rsa.misc.p_id", setter: fld_set}]}, - "p_month": {to:[{field: "rsa.time.p_month", setter: fld_set}]}, - "p_msgid": {to:[{field: "rsa.misc.p_msgid", setter: fld_set}]}, - "p_msgid1": {to:[{field: "rsa.misc.p_msgid1", setter: fld_set}]}, - "p_msgid2": {to:[{field: "rsa.misc.p_msgid2", setter: fld_set}]}, - "p_result1": {to:[{field: "rsa.misc.p_result1", setter: fld_set}]}, - "p_time": {to:[{field: "rsa.time.p_time", setter: fld_set}]}, - "p_time1": {to:[{field: "rsa.time.p_time1", setter: fld_set}]}, - "p_time2": {to:[{field: "rsa.time.p_time2", setter: fld_set}]}, - "p_url": {to:[{field: "rsa.web.p_url", setter: fld_set}]}, - "p_user_agent": {to:[{field: "rsa.web.p_user_agent", setter: fld_set}]}, - "p_web_cookie": {to:[{field: "rsa.web.p_web_cookie", setter: fld_set}]}, - "p_web_method": {to:[{field: "rsa.web.p_web_method", setter: fld_set}]}, - "p_web_referer": {to:[{field: "rsa.web.p_web_referer", setter: fld_set}]}, - "p_year": {to:[{field: "rsa.time.p_year", setter: fld_set}]}, - "packet_length": {to:[{field: "rsa.network.packet_length", setter: fld_set}]}, - "paddr": {convert: to_ip, to:[{field: "rsa.network.paddr", setter: fld_set}]}, - "param": {to:[{field: "rsa.misc.param", setter: fld_set}]}, - "param.dst": {to:[{field: "rsa.misc.param_dst", setter: fld_set}]}, - "param.src": {to:[{field: "rsa.misc.param_src", setter: fld_set}]}, - "parent_node": {to:[{field: "rsa.misc.parent_node", setter: fld_set}]}, - "parse.error": {to:[{field: "rsa.internal.parse_error", setter: fld_set}]}, - "password": {to:[{field: "rsa.identity.password", setter: fld_set}]}, - "password_chg": {to:[{field: "rsa.misc.password_chg", setter: fld_set}]}, - "password_expire": {to:[{field: "rsa.misc.password_expire", setter: fld_set}]}, - "patient_fname": {to:[{field: "rsa.healthcare.patient_fname", setter: fld_set}]}, - "patient_id": {to:[{field: "rsa.healthcare.patient_id", setter: fld_set}]}, - "patient_lname": {to:[{field: "rsa.healthcare.patient_lname", setter: fld_set}]}, - "patient_mname": {to:[{field: "rsa.healthcare.patient_mname", setter: fld_set}]}, - "payload.req": {convert: to_long, to:[{field: "rsa.internal.payload_req", setter: fld_set}]}, - "payload.res": {convert: to_long, to:[{field: "rsa.internal.payload_res", setter: fld_set}]}, - "peer": {to:[{field: "rsa.crypto.peer", setter: fld_set}]}, - "peer_id": {to:[{field: "rsa.crypto.peer_id", setter: fld_set}]}, - "permgranted": {to:[{field: "rsa.misc.permgranted", setter: fld_set}]}, - "permissions": {to:[{field: "rsa.db.permissions", setter: fld_set}]}, - "permwanted": {to:[{field: "rsa.misc.permwanted", setter: fld_set}]}, - "pgid": {to:[{field: "rsa.misc.pgid", setter: fld_set}]}, - "phone_number": {to:[{field: "rsa.misc.phone", setter: fld_prio, prio: 2}]}, - "phost": {to:[{field: "rsa.network.phost", setter: fld_set}]}, - "pid": {to:[{field: "rsa.misc.pid", setter: fld_set}]}, - "policy": {to:[{field: "rsa.misc.policy", setter: fld_set}]}, - "policyUUID": {to:[{field: "rsa.misc.policyUUID", setter: fld_set}]}, - "policy_id": {to:[{field: "rsa.misc.policy_id", setter: fld_set}]}, - "policy_value": {to:[{field: "rsa.misc.policy_value", setter: fld_set}]}, - "policy_waiver": {to:[{field: "rsa.misc.policy_waiver", setter: fld_set}]}, - "policyname": {to:[{field: "rsa.misc.policy_name", setter: fld_prio, prio: 0}]}, - "pool_id": {to:[{field: "rsa.misc.pool_id", setter: fld_set}]}, - "pool_name": {to:[{field: "rsa.misc.pool_name", setter: fld_set}]}, - "port": {convert: to_long, to:[{field: "rsa.network.port", setter: fld_set}]}, - "portname": {to:[{field: "rsa.misc.port_name", setter: fld_set}]}, - "pread": {convert: to_long, to:[{field: "rsa.db.pread", setter: fld_set}]}, - "priority": {to:[{field: "rsa.misc.priority", setter: fld_set}]}, - "privilege": {to:[{field: "rsa.file.privilege", setter: fld_set}]}, - "process.vid.dst": {to:[{field: "rsa.internal.process_vid_dst", setter: fld_set}]}, - "process.vid.src": {to:[{field: "rsa.internal.process_vid_src", setter: fld_set}]}, - "process_id_val": {to:[{field: "rsa.misc.process_id_val", setter: fld_set}]}, - "processing_time": {to:[{field: "rsa.time.process_time", setter: fld_set}]}, - "profile": {to:[{field: "rsa.identity.profile", setter: fld_set}]}, - "prog_asp_num": {to:[{field: "rsa.misc.prog_asp_num", setter: fld_set}]}, - "program": {to:[{field: "rsa.misc.program", setter: fld_set}]}, - "protocol_detail": {to:[{field: "rsa.network.protocol_detail", setter: fld_set}]}, - "pwwn": {to:[{field: "rsa.storage.pwwn", setter: fld_set}]}, - "r_hostid": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "real_data": {to:[{field: "rsa.misc.real_data", setter: fld_set}]}, - "realm": {to:[{field: "rsa.identity.realm", setter: fld_set}]}, - "reason": {to:[{field: "rsa.misc.reason", setter: fld_set}]}, - "rec_asp_device": {to:[{field: "rsa.misc.rec_asp_device", setter: fld_set}]}, - "rec_asp_num": {to:[{field: "rsa.misc.rec_asp_num", setter: fld_set}]}, - "rec_library": {to:[{field: "rsa.misc.rec_library", setter: fld_set}]}, - "recorded_time": {convert: to_date, to:[{field: "rsa.time.recorded_time", setter: fld_set}]}, - "recordnum": {to:[{field: "rsa.misc.recordnum", setter: fld_set}]}, - "registry.key": {to:[{field: "rsa.endpoint.registry_key", setter: fld_set}]}, - "registry.value": {to:[{field: "rsa.endpoint.registry_value", setter: fld_set}]}, - "remote_domain": {to:[{field: "rsa.web.remote_domain", setter: fld_set}]}, - "remote_domain_id": {to:[{field: "rsa.network.remote_domain_id", setter: fld_set}]}, - "reputation_num": {convert: to_double, to:[{field: "rsa.web.reputation_num", setter: fld_set}]}, - "resource": {to:[{field: "rsa.internal.resource", setter: fld_set}]}, - "resource_class": {to:[{field: "rsa.internal.resource_class", setter: fld_set}]}, - "result": {to:[{field: "rsa.misc.result", setter: fld_set}]}, - "result_code": {to:[{field: "rsa.misc.result_code", setter: fld_prio, prio: 1}]}, - "resultcode": {to:[{field: "rsa.misc.result_code", setter: fld_prio, prio: 0}]}, - "rid": {convert: to_long, to:[{field: "rsa.internal.rid", setter: fld_set}]}, - "risk": {to:[{field: "rsa.misc.risk", setter: fld_set}]}, - "risk_info": {to:[{field: "rsa.misc.risk_info", setter: fld_set}]}, - "risk_num": {convert: to_double, to:[{field: "rsa.misc.risk_num", setter: fld_set}]}, - "risk_num_comm": {convert: to_double, to:[{field: "rsa.misc.risk_num_comm", setter: fld_set}]}, - "risk_num_next": {convert: to_double, to:[{field: "rsa.misc.risk_num_next", setter: fld_set}]}, - "risk_num_sand": {convert: to_double, to:[{field: "rsa.misc.risk_num_sand", setter: fld_set}]}, - "risk_num_static": {convert: to_double, to:[{field: "rsa.misc.risk_num_static", setter: fld_set}]}, - "risk_suspicious": {to:[{field: "rsa.misc.risk_suspicious", setter: fld_set}]}, - "risk_warning": {to:[{field: "rsa.misc.risk_warning", setter: fld_set}]}, - "rpayload": {to:[{field: "rsa.network.rpayload", setter: fld_set}]}, - "ruid": {to:[{field: "rsa.misc.ruid", setter: fld_set}]}, - "rule": {to:[{field: "rsa.misc.rule", setter: fld_set}]}, - "rule_group": {to:[{field: "rsa.misc.rule_group", setter: fld_set}]}, - "rule_template": {to:[{field: "rsa.misc.rule_template", setter: fld_set}]}, - "rule_uid": {to:[{field: "rsa.misc.rule_uid", setter: fld_set}]}, - "rulename": {to:[{field: "rsa.misc.rule_name", setter: fld_set}]}, - "s_certauth": {to:[{field: "rsa.crypto.s_certauth", setter: fld_set}]}, - "s_cipher": {to:[{field: "rsa.crypto.cipher_src", setter: fld_set}]}, - "s_ciphersize": {convert: to_long, to:[{field: "rsa.crypto.cipher_size_src", setter: fld_set}]}, - "s_context": {to:[{field: "rsa.misc.context_subject", setter: fld_set}]}, - "s_sslver": {to:[{field: "rsa.crypto.ssl_ver_src", setter: fld_set}]}, - "sburb": {to:[{field: "rsa.misc.sburb", setter: fld_set}]}, - "scheme": {to:[{field: "rsa.crypto.scheme", setter: fld_set}]}, - "sdomain_fld": {to:[{field: "rsa.misc.sdomain_fld", setter: fld_set}]}, - "search.text": {to:[{field: "rsa.misc.search_text", setter: fld_set}]}, - "sec": {to:[{field: "rsa.misc.sec", setter: fld_set}]}, - "second": {to:[{field: "rsa.misc.second", setter: fld_set}]}, - "sensor": {to:[{field: "rsa.misc.sensor", setter: fld_set}]}, - "sensorname": {to:[{field: "rsa.misc.sensorname", setter: fld_set}]}, - "seqnum": {to:[{field: "rsa.misc.seqnum", setter: fld_set}]}, - "serial_number": {to:[{field: "rsa.misc.serial_number", setter: fld_set}]}, - "service.account": {to:[{field: "rsa.identity.service_account", setter: fld_set}]}, - "session": {to:[{field: "rsa.misc.session", setter: fld_set}]}, - "session.split": {to:[{field: "rsa.internal.session_split", setter: fld_set}]}, - "sessionid": {to:[{field: "rsa.misc.log_session_id", setter: fld_set}]}, - "sessionid1": {to:[{field: "rsa.misc.log_session_id1", setter: fld_set}]}, - "sessiontype": {to:[{field: "rsa.misc.sessiontype", setter: fld_set}]}, - "severity": {to:[{field: "rsa.misc.severity", setter: fld_set}]}, - "sid": {to:[{field: "rsa.identity.user_sid_dst", setter: fld_set}]}, - "sig.name": {to:[{field: "rsa.misc.sig_name", setter: fld_set}]}, - "sigUUID": {to:[{field: "rsa.misc.sigUUID", setter: fld_set}]}, - "sigcat": {to:[{field: "rsa.misc.sigcat", setter: fld_set}]}, - "sigid": {convert: to_long, to:[{field: "rsa.misc.sig_id", setter: fld_set}]}, - "sigid1": {convert: to_long, to:[{field: "rsa.misc.sig_id1", setter: fld_set}]}, - "sigid_string": {to:[{field: "rsa.misc.sig_id_str", setter: fld_set}]}, - "signame": {to:[{field: "rsa.misc.policy_name", setter: fld_prio, prio: 1}]}, - "sigtype": {to:[{field: "rsa.crypto.sig_type", setter: fld_set}]}, - "sinterface": {to:[{field: "rsa.network.sinterface", setter: fld_set}]}, - "site": {to:[{field: "rsa.internal.site", setter: fld_set}]}, - "size": {convert: to_long, to:[{field: "rsa.internal.size", setter: fld_set}]}, - "smask": {to:[{field: "rsa.network.smask", setter: fld_set}]}, - "snmp.oid": {to:[{field: "rsa.misc.snmp_oid", setter: fld_set}]}, - "snmp.value": {to:[{field: "rsa.misc.snmp_value", setter: fld_set}]}, - "sourcefile": {to:[{field: "rsa.internal.sourcefile", setter: fld_set}]}, - "space": {to:[{field: "rsa.misc.space", setter: fld_set}]}, - "space1": {to:[{field: "rsa.misc.space1", setter: fld_set}]}, - "spi": {to:[{field: "rsa.misc.spi", setter: fld_set}]}, - "sql": {to:[{field: "rsa.misc.sql", setter: fld_set}]}, - "src_dn": {to:[{field: "rsa.identity.dn_src", setter: fld_set}]}, - "src_payload": {to:[{field: "rsa.misc.payload_src", setter: fld_set}]}, - "src_spi": {to:[{field: "rsa.misc.spi_src", setter: fld_set}]}, - "src_zone": {to:[{field: "rsa.network.zone_src", setter: fld_set}]}, - "srcburb": {to:[{field: "rsa.misc.srcburb", setter: fld_set}]}, - "srcdom": {to:[{field: "rsa.misc.srcdom", setter: fld_set}]}, - "srcservice": {to:[{field: "rsa.misc.srcservice", setter: fld_set}]}, - "ssid": {to:[{field: "rsa.wireless.wlan_ssid", setter: fld_prio, prio: 0}]}, - "stamp": {convert: to_date, to:[{field: "rsa.time.stamp", setter: fld_set}]}, - "starttime": {convert: to_date, to:[{field: "rsa.time.starttime", setter: fld_set}]}, - "state": {to:[{field: "rsa.misc.state", setter: fld_set}]}, - "statement": {to:[{field: "rsa.internal.statement", setter: fld_set}]}, - "status": {to:[{field: "rsa.misc.status", setter: fld_set}]}, - "status1": {to:[{field: "rsa.misc.status1", setter: fld_set}]}, - "streams": {convert: to_long, to:[{field: "rsa.misc.streams", setter: fld_set}]}, - "subcategory": {to:[{field: "rsa.misc.subcategory", setter: fld_set}]}, - "subject": {to:[{field: "rsa.email.subject", setter: fld_set}]}, - "svcno": {to:[{field: "rsa.misc.svcno", setter: fld_set}]}, - "system": {to:[{field: "rsa.misc.system", setter: fld_set}]}, - "t_context": {to:[{field: "rsa.misc.context_target", setter: fld_set}]}, - "task_name": {to:[{field: "rsa.file.task_name", setter: fld_set}]}, - "tbdstr1": {to:[{field: "rsa.misc.tbdstr1", setter: fld_set}]}, - "tbdstr2": {to:[{field: "rsa.misc.tbdstr2", setter: fld_set}]}, - "tbl_name": {to:[{field: "rsa.db.table_name", setter: fld_set}]}, - "tcp_flags": {convert: to_long, to:[{field: "rsa.misc.tcp_flags", setter: fld_set}]}, - "terminal": {to:[{field: "rsa.misc.terminal", setter: fld_set}]}, - "tgtdom": {to:[{field: "rsa.misc.tgtdom", setter: fld_set}]}, - "tgtdomain": {to:[{field: "rsa.misc.tgtdomain", setter: fld_set}]}, - "threat_name": {to:[{field: "rsa.threat.threat_category", setter: fld_set}]}, - "threat_source": {to:[{field: "rsa.threat.threat_source", setter: fld_set}]}, - "threat_val": {to:[{field: "rsa.threat.threat_desc", setter: fld_set}]}, - "threshold": {to:[{field: "rsa.misc.threshold", setter: fld_set}]}, - "time": {convert: to_date, to:[{field: "rsa.internal.time", setter: fld_set}]}, - "timestamp": {to:[{field: "rsa.time.timestamp", setter: fld_set}]}, - "timezone": {to:[{field: "rsa.time.timezone", setter: fld_set}]}, - "to": {to:[{field: "rsa.email.email_dst", setter: fld_set}]}, - "tos": {convert: to_long, to:[{field: "rsa.misc.tos", setter: fld_set}]}, - "trans_from": {to:[{field: "rsa.email.trans_from", setter: fld_set}]}, - "trans_id": {to:[{field: "rsa.db.transact_id", setter: fld_set}]}, - "trans_to": {to:[{field: "rsa.email.trans_to", setter: fld_set}]}, - "trigger_desc": {to:[{field: "rsa.misc.trigger_desc", setter: fld_set}]}, - "trigger_val": {to:[{field: "rsa.misc.trigger_val", setter: fld_set}]}, - "type": {to:[{field: "rsa.misc.type", setter: fld_set}]}, - "type1": {to:[{field: "rsa.misc.type1", setter: fld_set}]}, - "tzone": {to:[{field: "rsa.time.tzone", setter: fld_set}]}, - "ubc.req": {convert: to_long, to:[{field: "rsa.internal.ubc_req", setter: fld_set}]}, - "ubc.res": {convert: to_long, to:[{field: "rsa.internal.ubc_res", setter: fld_set}]}, - "udb_class": {to:[{field: "rsa.misc.udb_class", setter: fld_set}]}, - "url_fld": {to:[{field: "rsa.misc.url_fld", setter: fld_set}]}, - "urlpage": {to:[{field: "rsa.web.urlpage", setter: fld_set}]}, - "urlroot": {to:[{field: "rsa.web.urlroot", setter: fld_set}]}, - "user_address": {to:[{field: "rsa.email.email", setter: fld_append}]}, - "user_dept": {to:[{field: "rsa.identity.user_dept", setter: fld_set}]}, - "user_div": {to:[{field: "rsa.misc.user_div", setter: fld_set}]}, - "user_fname": {to:[{field: "rsa.identity.firstname", setter: fld_set}]}, - "user_lname": {to:[{field: "rsa.identity.lastname", setter: fld_set}]}, - "user_mname": {to:[{field: "rsa.identity.middlename", setter: fld_set}]}, - "user_org": {to:[{field: "rsa.identity.org", setter: fld_set}]}, - "user_role": {to:[{field: "rsa.identity.user_role", setter: fld_set}]}, - "userid": {to:[{field: "rsa.misc.userid", setter: fld_set}]}, - "username_fld": {to:[{field: "rsa.misc.username_fld", setter: fld_set}]}, - "utcstamp": {to:[{field: "rsa.misc.utcstamp", setter: fld_set}]}, - "v_instafname": {to:[{field: "rsa.misc.v_instafname", setter: fld_set}]}, - "vendor_event_cat": {to:[{field: "rsa.investigations.event_vcat", setter: fld_set}]}, - "version": {to:[{field: "rsa.misc.version", setter: fld_set}]}, - "vid": {to:[{field: "rsa.internal.msg_vid", setter: fld_set}]}, - "virt_data": {to:[{field: "rsa.misc.virt_data", setter: fld_set}]}, - "virusname": {to:[{field: "rsa.misc.virusname", setter: fld_set}]}, - "vlan": {convert: to_long, to:[{field: "rsa.network.vlan", setter: fld_set}]}, - "vlan.name": {to:[{field: "rsa.network.vlan_name", setter: fld_set}]}, - "vm_target": {to:[{field: "rsa.misc.vm_target", setter: fld_set}]}, - "vpnid": {to:[{field: "rsa.misc.vpnid", setter: fld_set}]}, - "vsys": {to:[{field: "rsa.misc.vsys", setter: fld_set}]}, - "vuln_ref": {to:[{field: "rsa.misc.vuln_ref", setter: fld_set}]}, - "web_cookie": {to:[{field: "rsa.web.web_cookie", setter: fld_set}]}, - "web_extension_tmp": {to:[{field: "rsa.web.web_extension_tmp", setter: fld_set}]}, - "web_host": {to:[{field: "rsa.web.alias_host", setter: fld_set}]}, - "web_method": {to:[{field: "rsa.misc.action", setter: fld_append}]}, - "web_page": {to:[{field: "rsa.web.web_page", setter: fld_set}]}, - "web_ref_domain": {to:[{field: "rsa.web.web_ref_domain", setter: fld_set}]}, - "web_ref_host": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "web_ref_page": {to:[{field: "rsa.web.web_ref_page", setter: fld_set}]}, - "web_ref_query": {to:[{field: "rsa.web.web_ref_query", setter: fld_set}]}, - "web_ref_root": {to:[{field: "rsa.web.web_ref_root", setter: fld_set}]}, - "wifi_channel": {convert: to_long, to:[{field: "rsa.wireless.wlan_channel", setter: fld_set}]}, - "wlan": {to:[{field: "rsa.wireless.wlan_name", setter: fld_set}]}, - "word": {to:[{field: "rsa.internal.word", setter: fld_set}]}, - "workspace_desc": {to:[{field: "rsa.misc.workspace", setter: fld_set}]}, - "workstation": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "year": {to:[{field: "rsa.time.year", setter: fld_set}]}, - "zone": {to:[{field: "rsa.network.zone", setter: fld_set}]}, - }; - - function to_date(value) { - switch (typeof (value)) { - case "object": - // This is a Date. But as it was obtained from evt.Get(), the VM - // doesn't see it as a JS Date anymore, thus value instanceof Date === false. - // Have to trust that any object here is a valid Date for Go. - return value; - case "string": - var asDate = new Date(value); - if (!isNaN(asDate)) return asDate; - } - } - - // ECMAScript 5.1 doesn't have Object.MAX_SAFE_INTEGER / Object.MIN_SAFE_INTEGER. - var maxSafeInt = Math.pow(2, 53) - 1; - var minSafeInt = -maxSafeInt; - - function to_long(value) { - var num = parseInt(value); - // Better not to index a number if it's not safe (above 53 bits). - return !isNaN(num) && minSafeInt <= num && num <= maxSafeInt ? num : undefined; - } - - function to_ip(value) { - if (value.indexOf(":") === -1) - return to_ipv4(value); - return to_ipv6(value); - } - - var ipv4_regex = /^(\d+)\.(\d+)\.(\d+)\.(\d+)$/; - var ipv6_hex_regex = /^[0-9A-Fa-f]{1,4}$/; - - function to_ipv4(value) { - var result = ipv4_regex.exec(value); - if (result == null || result.length !== 5) return; - for (var i = 1; i < 5; i++) { - var num = strictToInt(result[i]); - if (isNaN(num) || num < 0 || num > 255) return; - } - return value; - } - - function to_ipv6(value) { - var sqEnd = value.indexOf("]"); - if (sqEnd > -1) { - if (value.charAt(0) !== "[") return; - value = value.substr(1, sqEnd - 1); - } - var zoneOffset = value.indexOf("%"); - if (zoneOffset > -1) { - value = value.substr(0, zoneOffset); - } - var parts = value.split(":"); - if (parts == null || parts.length < 3 || parts.length > 8) return; - var numEmpty = 0; - var innerEmpty = 0; - for (var i = 0; i < parts.length; i++) { - if (parts[i].length === 0) { - numEmpty++; - if (i > 0 && i + 1 < parts.length) innerEmpty++; - } else if (!parts[i].match(ipv6_hex_regex) && - // Accept an IPv6 with a valid IPv4 at the end. - ((i + 1 < parts.length) || !to_ipv4(parts[i]))) { - return; - } - } - return innerEmpty === 0 && parts.length === 8 || innerEmpty === 1 ? value : undefined; - } - - function to_double(value) { - return parseFloat(value); - } - - function to_mac(value) { - // ES doesn't have a mac datatype so it's safe to ingest whatever was captured. - return value; - } - - function to_lowercase(value) { - // to_lowercase is used against keyword fields, which can accept - // any other type (numbers, dates). - return typeof(value) === "string"? value.toLowerCase() : value; - } - - function fld_set(dst, value) { - dst[this.field] = { v: value }; - } - - function fld_append(dst, value) { - if (dst[this.field] === undefined) { - dst[this.field] = { v: [value] }; - } else { - var base = dst[this.field]; - if (base.v.indexOf(value)===-1) base.v.push(value); - } - } - - function fld_prio(dst, value) { - if (dst[this.field] === undefined) { - dst[this.field] = { v: value, prio: this.prio}; - } else if(this.prio < dst[this.field].prio) { - dst[this.field].v = value; - dst[this.field].prio = this.prio; - } - } - - var valid_ecs_outcome = { - 'failure': true, - 'success': true, - 'unknown': true - }; - - function fld_ecs_outcome(dst, value) { - value = value.toLowerCase(); - if (valid_ecs_outcome[value] === undefined) { - value = 'unknown'; - } - if (dst[this.field] === undefined) { - dst[this.field] = { v: value }; - } else if (dst[this.field].v === 'unknown') { - dst[this.field] = { v: value }; - } - } - - function map_all(evt, targets, value) { - for (var i = 0; i < targets.length; i++) { - evt.Put(targets[i], value); - } - } - - function populate_fields(evt) { - var base = evt.Get(FIELDS_OBJECT); - if (base === null) return; - alternate_datetime(evt); - if (map_ecs) { - do_populate(evt, base, ecs_mappings); - } - if (map_rsa) { - do_populate(evt, base, rsa_mappings); - } - if (keep_raw) { - evt.Put("rsa.raw", base); - } - evt.Delete(FIELDS_OBJECT); - } - - var datetime_alt_components = [ - {field: "day", fmts: [[dF]]}, - {field: "year", fmts: [[dW]]}, - {field: "month", fmts: [[dB],[dG]]}, - {field: "date", fmts: [[dW,dSkip,dG,dSkip,dF],[dW,dSkip,dB,dSkip,dF],[dW,dSkip,dR,dSkip,dF]]}, - {field: "hour", fmts: [[dN]]}, - {field: "min", fmts: [[dU]]}, - {field: "secs", fmts: [[dO]]}, - {field: "time", fmts: [[dN, dSkip, dU, dSkip, dO]]}, - ]; - - function alternate_datetime(evt) { - if (evt.Get(FIELDS_PREFIX + "event_time") != null) { - return; - } - var tzOffset = tz_offset; - if (tzOffset === "event") { - tzOffset = evt.Get("event.timezone"); - } - var container = new DateContainer(tzOffset); - for (var i=0; i} %{hfld2}.%{hfld3->} %{p0}"); - - var dup2 = call({ - dest: "nwparser.payload", - fn: STRCAT, - args: [ - field("hfld4"), - constant("_appliance "), - field("p0"), - ], - }); - - var dup3 = call({ - dest: "nwparser.payload", - fn: STRCAT, - args: [ - field("hfld4"), - constant(" "), - field("p0"), - ], - }); - - var dup4 = match_copy("MESSAGE#0:flows/2_1", "nwparser.p0", "p0"); - - var dup5 = setc("eventcategory","1605020000"); - - var dup6 = setf("msg","$MSG"); - - var dup7 = setc("event_source","appliance"); - - var dup8 = setf("sensor","node"); - - var dup9 = date_time({ - dest: "event_time", - args: ["hfld2"], - fmts: [ - [dX], - ], - }); - - var dup10 = match_copy("MESSAGE#1:flows:01/1_2", "nwparser.p0", ""); - - var dup11 = match("MESSAGE#10:ids-alerts:01/1_0", "nwparser.p0", "dhost=%{dmacaddr->} direction=%{p0}"); - - var dup12 = match("MESSAGE#10:ids-alerts:01/1_1", "nwparser.p0", "shost=%{smacaddr->} direction=%{p0}"); - - var dup13 = match("MESSAGE#10:ids-alerts:01/2", "nwparser.p0", "%{direction->} protocol=%{protocol->} src=%{p0}"); - - var dup14 = match_copy("MESSAGE#10:ids-alerts:01/4", "nwparser.p0", "signame"); - - var dup15 = setc("eventcategory","1607000000"); - - var dup16 = setc("event_type","ids-alerts"); - - var dup17 = date_time({ - dest: "event_time", - args: ["fld3"], - fmts: [ - [dX], - ], - }); - - var dup18 = setc("event_type","security_event"); - - var dup19 = constant("Allow"); - - var dup20 = match("HEADER#0:0003/1_0", "nwparser.p0", "%{hfld4}_appliance %{p0}", processor_chain([ - dup2, - ])); - - var dup21 = match("HEADER#0:0003/1_1", "nwparser.p0", "%{hfld4->} %{p0}", processor_chain([ - dup3, - ])); - - var dup22 = linear_select([ - dup11, - dup12, - ]); - - var dup23 = linear_select([ - dup20, - dup21, - ]); - - var part1 = match("HEADER#0:0003/2", "nwparser.p0", "urls %{p0}"); - - var all1 = all_match({ - processors: [ - dup1, - dup23, - part1, - ], - on_success: processor_chain([ - setc("header_id","0003"), - setc("messageid","urls"), - ]), - }); - - var part2 = match("HEADER#1:0002/1_0", "nwparser.p0", "%{node}_appliance events %{p0}"); - - var part3 = match("HEADER#1:0002/1_1", "nwparser.p0", "%{node->} events %{p0}"); - - var select1 = linear_select([ - part2, - part3, - ]); - - var part4 = match_copy("HEADER#1:0002/2", "nwparser.p0", "payload"); - - var all2 = all_match({ - processors: [ - dup1, - select1, - part4, - ], - on_success: processor_chain([ - setc("header_id","0002"), - setc("messageid","events"), - ]), - }); - - var part5 = match("HEADER#2:0001/2", "nwparser.p0", "%{messageid->} %{p0}"); - - var all3 = all_match({ - processors: [ - dup1, - dup23, - part5, - ], - on_success: processor_chain([ - setc("header_id","0001"), - ]), - }); - - var part6 = match("HEADER#3:0005/1_0", "nwparser.p0", "%{hfld4}_appliance %{p0}"); - - var part7 = match("HEADER#3:0005/1_1", "nwparser.p0", "%{hfld4->} %{p0}"); - - var select2 = linear_select([ - part6, - part7, - ]); - - var part8 = match("HEADER#3:0005/2", "nwparser.p0", "%{} %{hfld5->} %{hfld6->} %{messageid->} %{p0}", processor_chain([ - call({ - dest: "nwparser.payload", - fn: STRCAT, - args: [ - field("hfld6"), - constant(" "), - field("messageid"), - constant(" "), - field("p0"), - ], - }), - ])); - - var all4 = all_match({ - processors: [ - dup1, - select2, - part8, - ], - on_success: processor_chain([ - setc("header_id","0005"), - ]), - }); - - var hdr1 = match("HEADER#4:0004", "message", "%{hfld1->} %{hfld2}.%{hfld3->} %{hfld4}_%{space->} %{messageid->} %{payload}", processor_chain([ - setc("header_id","0004"), - ])); - - var select3 = linear_select([ - all1, - all2, - all3, - all4, - hdr1, - ]); - - var part9 = match("MESSAGE#0:flows/0_0", "nwparser.payload", "%{node}_appliance %{p0}"); - - var part10 = match("MESSAGE#0:flows/0_1", "nwparser.payload", "%{node->} %{p0}"); - - var select4 = linear_select([ - part9, - part10, - ]); - - var part11 = match("MESSAGE#0:flows/1", "nwparser.p0", "flows src=%{saddr->} dst=%{daddr->} %{p0}"); - - var part12 = match("MESSAGE#0:flows/2_0", "nwparser.p0", "mac=%{dmacaddr->} %{p0}"); - - var select5 = linear_select([ - part12, - dup4, - ]); - - var part13 = match("MESSAGE#0:flows/3", "nwparser.p0", "protocol=%{protocol->} %{p0}"); - - var part14 = match("MESSAGE#0:flows/4_0", "nwparser.p0", "sport=%{sport->} dport=%{dport->} %{p0}"); - - var part15 = match("MESSAGE#0:flows/4_1", "nwparser.p0", "type=%{event_type->} %{p0}"); - - var select6 = linear_select([ - part14, - part15, - dup4, - ]); - - var part16 = match("MESSAGE#0:flows/5", "nwparser.p0", "pattern: %{fld21->} %{info}"); - - var all5 = all_match({ - processors: [ - select4, - part11, - select5, - part13, - select6, - part16, - ], - on_success: processor_chain([ - dup5, - dup6, - lookup({ - dest: "nwparser.action", - map: map_actionType, - key: field("fld21"), - }), - dup7, - dup8, - dup9, - ]), - }); - - var msg1 = msg("flows", all5); - - var part17 = match("MESSAGE#1:flows:01/0", "nwparser.payload", "%{node->} flows %{action->} src=%{saddr->} dst=%{daddr->} mac=%{smacaddr->} protocol=%{protocol->} %{p0}"); - - var part18 = match("MESSAGE#1:flows:01/1_0", "nwparser.p0", "sport=%{sport->} dport=%{dport->} "); - - var part19 = match("MESSAGE#1:flows:01/1_1", "nwparser.p0", "type=%{event_type->} "); - - var select7 = linear_select([ - part18, - part19, - dup10, - ]); - - var all6 = all_match({ - processors: [ - part17, - select7, - ], - on_success: processor_chain([ - dup5, - dup6, - dup7, - dup8, - dup9, - ]), - }); - - var msg2 = msg("flows:01", all6); - - var part20 = match("MESSAGE#2:flows:02", "nwparser.payload", "%{node->} flows %{action}", processor_chain([ - dup5, - dup6, - dup7, - dup8, - dup9, - ])); - - var msg3 = msg("flows:02", part20); - - var select8 = linear_select([ - msg1, - msg2, - msg3, - ]); - - var part21 = match("MESSAGE#3:urls/0_0", "nwparser.payload", "%{node}_appliance urls src=%{p0}"); - - var part22 = match("MESSAGE#3:urls/0_1", "nwparser.payload", "%{node->} urls src=%{p0}"); - - var part23 = match("MESSAGE#3:urls/0_2", "nwparser.payload", "src=%{p0}"); - - var select9 = linear_select([ - part21, - part22, - part23, - ]); - - var part24 = match("MESSAGE#3:urls/1", "nwparser.p0", "%{sport}:%{saddr->} dst=%{daddr}:%{dport->} mac=%{macaddr->} %{p0}"); - - var part25 = match("MESSAGE#3:urls/2_0", "nwparser.p0", "agent='%{user_agent}' request: %{p0}"); - - var part26 = match("MESSAGE#3:urls/2_1", "nwparser.p0", "agent=%{user_agent->} request: %{p0}"); - - var part27 = match("MESSAGE#3:urls/2_2", "nwparser.p0", "request: %{p0}"); - - var select10 = linear_select([ - part25, - part26, - part27, - ]); - - var part28 = match("MESSAGE#3:urls/3", "nwparser.p0", "%{} %{web_method}%{url}"); - - var all7 = all_match({ - processors: [ - select9, - part24, - select10, - part28, - ], - on_success: processor_chain([ - dup5, - dup6, - dup7, - dup8, - dup9, - ]), - }); - - var msg4 = msg("urls", all7); - - var part29 = match("MESSAGE#4:events/0", "nwparser.payload", "dhcp lease of ip %{saddr->} from server mac %{smacaddr->} for client mac %{p0}"); - - var part30 = match("MESSAGE#4:events/1_0", "nwparser.p0", "%{dmacaddr->} with hostname %{hostname->} from router %{p0}"); - - var part31 = match("MESSAGE#4:events/1_1", "nwparser.p0", "%{dmacaddr->} from router %{p0}"); - - var select11 = linear_select([ - part30, - part31, - ]); - - var part32 = match("MESSAGE#4:events/2", "nwparser.p0", "%{hostip->} on subnet %{mask->} with dns %{dns_a_record}"); - - var all8 = all_match({ - processors: [ - part29, - select11, - part32, - ], - on_success: processor_chain([ - dup5, - dup6, - dup7, - dup8, - dup9, - ]), - }); - - var msg5 = msg("events", all8); - - var part33 = match("MESSAGE#5:events:02/0", "nwparser.payload", "content_filtering_block url='%{url}' category0='%{category}' server='%{daddr}:%{dport}'%{p0}"); - - var part34 = match("MESSAGE#5:events:02/1_0", "nwparser.p0", " client_mac='%{dmacaddr}'"); - - var select12 = linear_select([ - part34, - dup10, - ]); - - var all9 = all_match({ - processors: [ - part33, - select12, - ], - on_success: processor_chain([ - dup5, - dup6, - setc("event_description","content_filtering_block"), - dup8, - dup9, - ]), - }); - - var msg6 = msg("events:02", all9); - - var part35 = tagval("MESSAGE#6:events:01", "nwparser.payload", tvm, { - "aid": "fld1", - "arp_resp": "fld2", - "arp_src": "fld3", - "auth_neg_dur": "fld4", - "auth_neg_failed": "fld5", - "category0": "category", - "channel": "fld6", - "client_ip": "daddr", - "client_mac": "dmacaddr", - "connectivity": "fld28", - "dhcp_ip": "fld23", - "dhcp_lease_completed": "fld22", - "dhcp_resp": "fld26", - "dhcp_server": "fld24", - "dhcp_server_mac": "fld25", - "dns_req_rtt": "fld7", - "dns_resp": "fld8", - "dns_server": "fld9", - "duration": "duration", - "full_conn": "fld11", - "http_resp": "fld21", - "identity": "fld12", - "instigator": "fld20", - "ip_resp": "fld13", - "ip_src": "saddr", - "is_8021x": "fld15", - "is_wpa": "fld16", - "last_auth_ago": "fld17", - "radio": "fld18", - "reason": "fld19", - "rssi": "dclass_ratio1", - "server": "daddr", - "type": "event_type", - "url": "url", - "vap": "fld22", - "vpn_type": "fld27", - }, processor_chain([ - dup5, - dup6, - dup7, - dup8, - dup9, - ])); - - var msg7 = msg("events:01", part35); - - var part36 = match("MESSAGE#7:events:03", "nwparser.payload", "IDS: %{info}", processor_chain([ - dup5, - dup6, - setc("event_description","events IDS"), - dup8, - dup9, - ])); - - var msg8 = msg("events:03", part36); - - var part37 = match("MESSAGE#8:events:04/0", "nwparser.payload", "dhcp %{p0}"); - - var part38 = match("MESSAGE#8:events:04/1_0", "nwparser.p0", "no offers%{p0}"); - - var part39 = match("MESSAGE#8:events:04/1_1", "nwparser.p0", "release%{p0}"); - - var select13 = linear_select([ - part38, - part39, - ]); - - var part40 = match("MESSAGE#8:events:04/2", "nwparser.p0", "%{}for mac %{macaddr}"); - - var all10 = all_match({ - processors: [ - part37, - select13, - part40, - ], - on_success: processor_chain([ - dup5, - dup6, - setc("event_description","events DHCP"), - dup8, - dup9, - ]), - }); - - var msg9 = msg("events:04", all10); - - var part41 = match("MESSAGE#9:events:05", "nwparser.payload", "MAC %{macaddr->} and MAC %{macaddr->} both claim IP: %{saddr}", processor_chain([ - dup5, - dup6, - setc("event_description"," events MAC"), - dup8, - dup9, - ])); - - var msg10 = msg("events:05", part41); - - var select14 = linear_select([ - msg5, - msg6, - msg7, - msg8, - msg9, - msg10, - ]); - - var part42 = match("MESSAGE#10:ids-alerts:01/0", "nwparser.payload", "%{node->} ids-alerts signature=%{fld1->} priority=%{fld2->} timestamp=%{fld3}.%{fld4->} %{p0}"); - - var part43 = match("MESSAGE#10:ids-alerts:01/3_0", "nwparser.p0", "%{saddr}:%{sport->} dst=%{daddr}:%{dport->} message: %{p0}"); - - var part44 = match("MESSAGE#10:ids-alerts:01/3_1", "nwparser.p0", "%{saddr->} dst=%{daddr->} message: %{p0}"); - - var select15 = linear_select([ - part43, - part44, - ]); - - var all11 = all_match({ - processors: [ - part42, - dup22, - dup13, - select15, - dup14, - ], - on_success: processor_chain([ - dup15, - dup6, - dup16, - dup8, - dup17, - ]), - }); - - var msg11 = msg("ids-alerts:01", all11); - - var part45 = match("MESSAGE#11:ids-alerts:03", "nwparser.payload", "%{node->} ids-alerts signature=%{fld1->} priority=%{fld2->} timestamp=%{fld3}.%{fld4}direction=%{direction->} protocol=%{protocol->} src=%{saddr}:%{sport}", processor_chain([ - dup15, - dup6, - dup16, - dup8, - dup17, - ])); - - var msg12 = msg("ids-alerts:03", part45); - - var part46 = match("MESSAGE#12:ids-alerts:02", "nwparser.payload", "%{node->} ids-alerts signature=%{fld1->} priority=%{fld2->} timestamp=%{fld3}.%{fld4}protocol=%{protocol->} src=%{saddr->} dst=%{daddr}message: %{signame}", processor_chain([ - dup15, - dup6, - dup16, - dup8, - dup17, - ])); - - var msg13 = msg("ids-alerts:02", part46); - - var select16 = linear_select([ - msg11, - msg12, - msg13, - ]); - - var part47 = match("MESSAGE#13:security_event", "nwparser.payload", "%{node}security_event %{event_description->} url=%{url->} src=%{saddr}:%{sport->} dst=%{daddr}:%{dport->} mac=%{smacaddr->} name=%{fld10->} sha256=%{fld11->} disposition=%{disposition->} action=%{action}", processor_chain([ - dup5, - dup6, - dup18, - dup8, - dup9, - ])); - - var msg14 = msg("security_event", part47); - - var part48 = match("MESSAGE#14:security_event:01/0", "nwparser.payload", "%{node->} security_event %{event_description->} signature=%{fld1->} priority=%{fld2->} timestamp=%{fld3}.%{fld4->} %{p0}"); - - var part49 = match("MESSAGE#14:security_event:01/3_0", "nwparser.p0", "%{saddr}:%{sport->} dst=%{daddr}:%{dport->} message:%{p0}"); - - var part50 = match("MESSAGE#14:security_event:01/3_1", "nwparser.p0", "%{saddr->} dst=%{daddr->} message:%{p0}"); - - var select17 = linear_select([ - part49, - part50, - ]); - - var all12 = all_match({ - processors: [ - part48, - dup22, - dup13, - select17, - dup14, - ], - on_success: processor_chain([ - dup15, - dup6, - dup18, - dup8, - dup17, - ]), - }); - - var msg15 = msg("security_event:01", all12); - - var select18 = linear_select([ - msg14, - msg15, - ]); - - var chain1 = processor_chain([ - select3, - msgid_select({ - "events": select14, - "flows": select8, - "ids-alerts": select16, - "security_event": select18, - "urls": msg4, - }), - ]); - - var hdr2 = match("HEADER#0:0003/0", "message", "%{hfld1->} %{hfld2}.%{hfld3->} %{p0}"); - - var part51 = match_copy("MESSAGE#0:flows/2_1", "nwparser.p0", "p0"); - - var part52 = match_copy("MESSAGE#1:flows:01/1_2", "nwparser.p0", ""); - - var part53 = match("MESSAGE#10:ids-alerts:01/1_0", "nwparser.p0", "dhost=%{dmacaddr->} direction=%{p0}"); - - var part54 = match("MESSAGE#10:ids-alerts:01/1_1", "nwparser.p0", "shost=%{smacaddr->} direction=%{p0}"); - - var part55 = match("MESSAGE#10:ids-alerts:01/2", "nwparser.p0", "%{direction->} protocol=%{protocol->} src=%{p0}"); - - var part56 = match_copy("MESSAGE#10:ids-alerts:01/4", "nwparser.p0", "signame"); - - var part57 = match("HEADER#0:0003/1_0", "nwparser.p0", "%{hfld4}_appliance %{p0}", processor_chain([ - dup2, - ])); - - var part58 = match("HEADER#0:0003/1_1", "nwparser.p0", "%{hfld4->} %{p0}", processor_chain([ - dup3, - ])); - - var select19 = linear_select([ - dup11, - dup12, - ]); - - var select20 = linear_select([ - dup20, - dup21, - ]); - -- community_id: -- registered_domain: - ignore_missing: true - ignore_failure: true - field: dns.question.name - target_field: dns.question.registered_domain - target_subdomain_field: dns.question.subdomain - target_etld_field: dns.question.top_level_domain -- registered_domain: - ignore_missing: true - ignore_failure: true - field: client.domain - target_field: client.registered_domain - target_subdomain_field: client.subdomain - target_etld_field: client.top_level_domain -- registered_domain: - ignore_missing: true - ignore_failure: true - field: server.domain - target_field: server.registered_domain - target_subdomain_field: server.subdomain - target_etld_field: server.top_level_domain -- registered_domain: - ignore_missing: true - ignore_failure: true - field: destination.domain - target_field: destination.registered_domain - target_subdomain_field: destination.subdomain - target_etld_field: destination.top_level_domain -- registered_domain: - ignore_missing: true - ignore_failure: true - field: source.domain - target_field: source.registered_domain - target_subdomain_field: source.subdomain - target_etld_field: source.top_level_domain -- registered_domain: - ignore_missing: true - ignore_failure: true - field: url.domain - target_field: url.registered_domain - target_subdomain_field: url.subdomain - target_etld_field: url.top_level_domain -- add_locale: ~ diff --git a/packages/cisco_meraki/data_stream/log/elasticsearch/ingest_pipeline/airmarshal.yml b/packages/cisco_meraki/data_stream/log/elasticsearch/ingest_pipeline/airmarshal.yml new file mode 100644 index 000000000000..2a7b399e941f --- /dev/null +++ b/packages/cisco_meraki/data_stream/log/elasticsearch/ingest_pipeline/airmarshal.yml @@ -0,0 +1,63 @@ +--- +description: Pipeline for Cisco Meraki airmarshal_events type +processors: +- dissect: + description: Determine the airmarshal event type + field: event.original + pattern: "%{} airmarshal_events %{*type}=%{&type} %{}" +- rename: + field: type + target_field: cisco_meraki.event_subtype +- grok: + field: event.original + patterns: + - '%{GREEDYDATA} ssid=%{QS:_temp.ssid}%{SPACE}%{GREEDYDATA:_temp.kvline}' +- dissect: + field: _temp.ssid + pattern: "'%{_temp.kv.ssid}'" +- kv: + field: _temp.kvline + field_split: " " + value_split: "=" + target_field: _temp.kv + strip_brackets: true +- rename: + field: _temp.kv.ssid + target_field: network.name + if: ctx?._temp?.kv?.ssid != null +- rename: + field: _temp.kv.bssid + target_field: cisco_meraki.bssid +- rename: + field: _temp.kv.vap + target_field: cisco_meraki.vap + if: ctx?.cisco_meraki?.event_subtype == 'ssid_spoofing_detected' +- gsub: + field: _temp.kv.src + target_field: source.mac + pattern: '[-:.]' + replacement: '-' +- gsub: + field: _temp.kv.dst + target_field: destination.mac + pattern: '[-:.]' + replacement: '-' +- gsub: + field: _temp.kv.wired_mac + target_field: observer.mac + pattern: '[-:.]' + replacement: '-' + if: ctx?.cisco_meraki?.event_subtype == 'rogue_ssid_detected' +- rename: + field: _temp.kv.vlan_id + target_field: network.vlan.id + if: ctx?.cisco_meraki?.event_subtype == 'rogue_ssid_detected' +- rename: + field: _temp.kv.channel + target_field: cisco_meraki.channel +- rename: + field: _temp.kv.fc_type + target_field: cisco_meraki.fc_type +- rename: + field: _temp.kv.fc_subtype + target_field: cisco_meraki.fc_subtype diff --git a/packages/cisco_meraki/data_stream/log/elasticsearch/ingest_pipeline/default.yml b/packages/cisco_meraki/data_stream/log/elasticsearch/ingest_pipeline/default.yml index b18eacfd43bb..8f1d8a55b10a 100644 --- a/packages/cisco_meraki/data_stream/log/elasticsearch/ingest_pipeline/default.yml +++ b/packages/cisco_meraki/data_stream/log/elasticsearch/ingest_pipeline/default.yml @@ -1,68 +1,356 @@ --- -description: Pipeline for Cisco Meraki - +description: Pipeline for Cisco Meraki syslog processors: - - set: - field: ecs.version - value: '8.2.0' - # User agent - - user_agent: - field: user_agent.original - ignore_missing: true - # IP Geolocation Lookup - - geoip: - field: source.ip - target_field: source.geo - ignore_missing: true - - geoip: - field: destination.ip - target_field: destination.geo - ignore_missing: true +- set: + field: ecs.version + value: 8.2.0 +- rename: + field: message + target_field: event.original +- dissect: + description: Extract syslog words + field: event.original + pattern: "%{} %{_temp.ts_nano} %{observer.hostname} %{cisco_meraki.event_type} %{}" +- date: + field: _temp.ts_nano + formats: + - UNIX + timezone: '{{{_conf.tz_offset}}}' +- pipeline: + name: '{{ IngestPipeline "flows" }}' + if: ctx.cisco_meraki.event_type == 'flows' +- pipeline: + name: '{{ IngestPipeline "ipflows" }}' + if: ctx.cisco_meraki.event_type == 'ip_flow_start' || ctx.cisco_meraki.event_type == 'ip_flow_end' +- pipeline: + name: '{{ IngestPipeline "airmarshal" }}' + if: ctx.cisco_meraki.event_type == 'airmarshal_events' +- pipeline: + name: '{{ IngestPipeline "security" }}' + if: ctx.cisco_meraki.event_type == 'security_event' +- pipeline: + name: '{{ IngestPipeline "idsalerts" }}' + if: ctx.cisco_meraki.event_type == 'ids-alerts' +- pipeline: + name: '{{ IngestPipeline "events" }}' + if: ctx.cisco_meraki.event_type == 'events' +- pipeline: + name: '{{ IngestPipeline "urls" }}' + if: ctx.cisco_meraki.event_type == 'urls' +- append: + field: event.category + value: ["network"] +- append: + field: event.type + value: ["info"] +- script: + lang: painless + description: The script sets event type, action and category based on type and sub-type fields + tag: set-event-type-for-meraki-events + params: + eventmap: + "vpn_connectivity_change": + category: + - session + type: + - connection + action: vpn-connectivity-change + "dhcp_offer": + type: + - access + - allowed + action: dhcp-offer + "dhcp_no_offer": + type: + - access + - denied + action: dhcp-no-offer + "Site-to-Site VPN": + type: + - access + action: site-to-site-vpn + "client_vpn_connect": + category: + - session + type: + - access + - allowed + - start + action: site-to-site-vpn + "ip_session_initiated": + type: + - access + - start + action: ip-session-initiated + "flow_allowed": + type: + - connection + - start + action: layer3-firewall-allowed-flow + "flow_denied": + type: + - access + - denied + action: layer3-firewall-denied-flow + "http_access": + category: + - web + type: + - access + action: http-access + "http_access_error": + category: + - web + type: + - error + action: http-access-error + "ids_alerted": + category: + - threat + type: + - indicator + action: ids-signature-matched + "security_filtering_file_scanned": + category: + - threat + - malware + type: + - indicator + - info + action: malicious-file-actioned + "security_filtering_disposition_change": + category: + - threat + - malware + type: + - indicator + - info + action: issued-retrospective-malicious-disposition + "association": + type: + - access + - connection + action: wifi-association-request + "disassociation": + category: + - session + type: + - access + - end + action: wifi-disassociation-request + "wpa_auth": + category: + - authentication + type: + - start + - access + action: wifi-wpa-authentication + "wpa_deauth": + category: + - authentication + type: + - end + - denied + action: wifi-wpa-failed-auth-or-deauth + "8021x_eap_failure": + category: + - authentication + type: + - end + - denied + action: wifi-8021x-failed-authentication-attempt + "8021x_deauth": + category: + - authentication + type: + - end + - denied + action: wifi-8021x-failed-auth-or-deauth + "8021x_eap_success": + category: + - authentication + type: + - start + action: wifi-8021x-auth + "splash_auth": + category: + - authentication + type: + - start + action: splash-authentication + "device_packet_flood": + category: + - threat + type: + - indicator + action: wireless-packet-flood-detected + "rogue_ssid_detected": + category: + - threat + type: + - indicator + action: rogue-ssid-detected + "ssid_spoofing_detected": + category: + - threat + type: + - indicator + action: ssid-spoofing-detected + "multiple_dhcp_servers_detected": + type: + - protocol + "dfs_event": + action: dynamic-frequency-selection-detected + "aps_association_reject": + action: association-rejected-for-load-balancing + if: ctx?.cisco_meraki?.event_subtype != null + source: |- + def eventMap = params.get('eventmap'); + def eventData = eventMap.get(ctx.cisco_meraki.event_subtype); + if (eventData == null) { + ctx.event.action = ctx.cisco_meraki.event_subtype; + return; + } + def eventCategory = eventData.get('category'); + def eventType = eventData.get('type'); + def eventAction = eventData.get('action'); + if (eventType != null) { + for (def t : eventType) { + ctx.event.type.add(t); + } + } + if (eventCategory != null) { + for (def c : eventCategory) { + ctx.event.category.add(c); + } + } + if (eventAction != null) { + ctx.event.action = eventAction; + } - # IP Autonomous System (AS) Lookup - - geoip: - database_file: GeoLite2-ASN.mmdb - field: source.ip - target_field: source.as - properties: - - asn - - organization_name - ignore_missing: true - - geoip: - database_file: GeoLite2-ASN.mmdb - field: destination.ip - target_field: destination.as - properties: - - asn - - organization_name - ignore_missing: true - - rename: - field: source.as.asn - target_field: source.as.number - ignore_missing: true - - rename: - field: source.as.organization_name - target_field: source.as.organization.name - ignore_missing: true - - rename: - field: destination.as.asn - target_field: destination.as.number - ignore_missing: true - - rename: - field: destination.as.organization_name - target_field: destination.as.organization.name - ignore_missing: true - - append: - field: related.hosts - value: '{{host.name}}' - allow_duplicates: false - if: ctx.host?.name != null && ctx.host?.name != '' - - remove: - field: event.original - if: "ctx?.tags == null || !(ctx.tags.contains('preserve_original_event'))" - ignore_failure: true - ignore_missing: true +# IP Geolocation Lookup (source) +- geoip: + field: source.ip + target_field: source.geo + ignore_missing: true + if: ctx.source?.geo == null && ctx?.source?.ip != null +# IP Autonomous System (AS) Lookup +- geoip: + database_file: GeoLite2-ASN.mmdb + field: source.ip + target_field: source.as + properties: + - asn + - organization_name + ignore_missing: true + if: ctx?.source?.ip != null +- rename: + field: source.as.asn + target_field: source.as.number + ignore_missing: true +- rename: + field: source.as.organization_name + target_field: source.as.organization.name + ignore_missing: true +# IP Geolocation Lookup (destination) +- geoip: + field: destination.ip + target_field: destination.geo + ignore_missing: true + if: ctx.destination?.geo == null && ctx?.destination?.ip != null +# IP Autonomous System (AS) Lookup +- geoip: + database_file: GeoLite2-ASN.mmdb + field: destination.ip + target_field: destination.as + properties: + - asn + - organization_name + ignore_missing: true + if: ctx?.destination?.ip != null +- rename: + field: destination.as.asn + target_field: destination.as.number + ignore_missing: true +- rename: + field: destination.as.organization_name + target_field: destination.as.organization.name + ignore_missing: true +# IP Geolocation Lookup (client) +- geoip: + field: client.ip + target_field: client.geo + ignore_missing: true + if: ctx.client?.geo == null && ctx?.client?.ip != null +# IP Autonomous System (AS) Lookup +- geoip: + database_file: GeoLite2-ASN.mmdb + field: client.ip + target_field: client.as + properties: + - asn + - organization_name + ignore_missing: true + if: ctx?.client?.ip != null +- rename: + field: client.as.asn + target_field: client.as.number + ignore_missing: true +- rename: + field: client.as.organization_name + target_field: client.as.organization.name + ignore_missing: true +## +# Clean up +## +- remove: + field: + - _temp + - _conf + - sport + - dport + - mac + - src + - dst + - translated_src_ip + - translated_dst_ip + - translated_port + - wired_mac + - rssi + - protocol + - dhost + - client_mac + - radio + - sts + - msgtype + - timestamp + ignore_missing: true +- script: + lang: painless + description: This script processor iterates over the whole document to remove fields with null values. + source: | + void handleMap(Map map) { + for (def x : map.values()) { + if (x instanceof Map) { + handleMap(x); + } else if (x instanceof List) { + handleList(x); + } + } + map.values().removeIf(v -> v == null || v == '' || (v instanceof Map && v.size() == 0) || (v instanceof List && v.size() == 0)); + } + void handleList(List list) { + for (def x : list) { + if (x instanceof Map) { + handleMap(x); + } else if (x instanceof List) { + handleList(x); + } + } + list.removeIf(v -> v == null || v == '' || (v instanceof Map && v.size() == 0) || (v instanceof List && v.size() == 0)); + } + handleMap(ctx); on_failure: - - append: - field: error.message - value: "{{ _ingest.on_failure_message }}" +- set: + field: error.message + value: '{{ _ingest.on_failure_message }}' diff --git a/packages/cisco_meraki/data_stream/log/elasticsearch/ingest_pipeline/events.yml b/packages/cisco_meraki/data_stream/log/elasticsearch/ingest_pipeline/events.yml new file mode 100644 index 000000000000..8f778d2d3441 --- /dev/null +++ b/packages/cisco_meraki/data_stream/log/elasticsearch/ingest_pipeline/events.yml @@ -0,0 +1,202 @@ +--- +description: Pipeline for Cisco Meraki events type +processors: +#################################################### +# set event_subtype based on type/format +#################################################### +- dissect: + description: Determine event type/format + field: event.original + pattern: "%{} events %{msgtype} %{}" +- set: + field: cisco_meraki.event_subtype + value: 'Site-to-Site VPN' + if: ctx?.msgtype.toLowerCase() == "site-to-site" +- set: + field: cisco_meraki.event_subtype + value: client_vpn_connect + if: ctx?.msgtype.toLowerCase() == "client_vpn_connect" +#################################################### +# log event with type= format +# these are dfs_event, association, disassocation, +# vpn_connectivity_change, wpa_auth, wpa_deauth +#################################################### +- dissect: + description: Get the event subtype + field: event.original + pattern: "%{} events type=%{type} %{}" + if: ctx?.msgtype.startsWith("type=") +- rename: + field: type + target_field: cisco_meraki.event_subtype + if: ctx?.type != null + +#################################################### +# Handle DHCP log events +#################################################### +- dissect: + field: event.original + pattern: "%{} events dhcp %{_temp.dhcp_op} %{_temp.dhcp_op2} %{}" + if: ctx?.msgtype.toLowerCase() == "dhcp" +- set: + field: network.protocol + value: dhcp + if: ctx?.msgtype.toLowerCase() == "dhcp" +- dissect: + field: event.original + pattern: "%{} events dhcp lease of ip %{_temp.client_ip} from %{} mac %{server.mac} for client mac %{client.mac} %{}" + if: ctx?.msgtype.toLowerCase() == "dhcp" && ctx?._temp?.dhcp_op.toLowerCase() == 'lease' +- dissect: + field: event.original + pattern: "%{} events dhcp no offers for mac %{client.mac} %{}" + if: ctx?.msgtype.toLowerCase() == "dhcp" && ctx?._temp?.dhcp_op.toLowerCase() == 'no' && ctx?._temp?.dhcp_op2.toLowerCase() == 'offers' +- set: + field: cisco_meraki.event_subtype + value: dhcp_offer + if: ctx?.msgtype.toLowerCase() == "dhcp" && ctx?._temp?.dhcp_op == 'lease' +- set: + field: cisco_meraki.event_subtype + value: dhcp_no_offer + if: ctx?.msgtype.toLowerCase() == "dhcp" && ctx?._temp?.dhcp_op.toLowerCase() == 'no' && ctx?._temp?.dhcp_op2.toLowerCase() == 'offers' +- gsub: + field: client.mac + pattern: '[-:.]' + replacement: '-' + if: ctx?.msgtype.toLowerCase() == "dhcp" +- gsub: + field: server.mac + pattern: '[-:.]' + replacement: '-' + if: ctx?.msgtype.toLowerCase() == "dhcp" && ctx?._temp.dhcp_op == 'lease' +#################################################### +# Handle Site-to-Site VPN message +#################################################### +- grok: + description: Process Site-to-Site VPN messages + field: event.original + patterns: + - '%{SYSLOGHDR}%{SPACE}%{NUMBER}%{SPACE}%{WORDORHOST}%{SPACE}events%{SPACE}(?i)Site-to-Site VPN:%{GREEDYDATA:cisco_meraki.site_to_site_vpn.raw}' + pattern_definitions: + SYSLOGPRI: '<%{NONNEGINT:log.syslog.priority:long}>' + SYSLOGVER: '\b(?:\d{1,2})\b' + SYSLOGHDR: '%{SYSLOGPRI}%{SYSLOGVER}' + WORDORHOST: '(?:%{WORD}|%{HOSTNAME})' + if: ctx.event.original.startsWith('<') && ctx?.cisco_meraki?.event_subtype == "Site-to-Site VPN" + +#################################################### +# Handle dfs_event, wpa_auth, wpa_deauth, +# association or disassociation +#################################################### +- grok: + field: event.original + patterns: + - '%{SYSLOGHDR}%{SPACE}%{NUMBER}%{SPACE}%{WORDORHOST}%{SPACE}events%{SPACE}%{GREEDYDATA:_temp.rest}' + pattern_definitions: + SYSLOGPRI: '<%{NONNEGINT:log.syslog.priority:long}>' + SYSLOGVER: '\b(?:\d{1,2})\b' + SYSLOGHDR: '%{SYSLOGPRI}%{SYSLOGVER}' + WORDORHOST: '(?:%{WORD}|%{HOSTNAME})' + if: ctx.event.original.startsWith('<') && ['dfs_event', 'association', 'disassociation', 'aps_association_reject', 'multiple_dhcp_servers_detected', 'wpa_deauth', 'wpa_auth', 'vpn_connectivity_change', '8021x_eap_failure', '8021x_auth', '8021x_deauth', '8021x_eap_success', 'splash_auth', 'device_packet_flood'].contains(ctx.cisco_meraki.event_subtype) +- kv: + field: _temp.rest + field_split: "[ \t]{1,}" + value_split: "=" + target_field: cisco_meraki.{{{cisco_meraki.event_subtype}}} + strip_brackets: true + if: ctx?._temp?.rest != null && ['dfs_event', 'association', 'disassociation', 'aps_association_reject', 'multiple_dhcp_servers_detected', 'wpa_deauth', 'wpa_auth', '8021x_eap_failure', '8021x_auth', '8021x_deauth', '8021x_eap_success', 'splash_auth', 'device_packet_flood'].contains(ctx.cisco_meraki.event_subtype) +# special case for site-to-site vpn +- kv: + field: _temp.rest + field_split: "[ \t]{1,}" + value_split: "=" + target_field: cisco_meraki.site_to_site_vpn.connectivity_change + strip_brackets: true + if: ctx?._temp?.rest != null && ctx?.cisco_meraki?.event_subtype == 'vpn_connectivity_change' + +#################################################### +# Move values from event subtypes to ECS fields +# multiple_dhcp_servers_detected +#################################################### +- set: + field: network.protocol + value: dhcp + if: ctx?.cisco_meraki?.event_subtype == 'multiple_dhcp_servers_detected' +- rename: + field: cisco_meraki.multiple_dhcp_servers_detected.original_server_mac + target_field: server.mac + if: ctx?.cisco_meraki?.event_subtype == 'multiple_dhcp_servers_detected' +- gsub: + field: server.mac + pattern: '[-:.]' + replacement: '-' + if: ctx?.cisco_meraki?.event_subtype == 'multiple_dhcp_servers_detected' +# process original_server_ip +- grok: + field: cisco_meraki.multiple_dhcp_servers_detected.original_server_ip + patterns: + - "^%{IPV4:cisco_meraki.multiple_dhcp_servers_detected.original_server_ip}$" + - "^%{IPV6:cisco_meraki.multiple_dhcp_servers_detected.original_server_ip}$" + if: ctx?.cisco_meraki?.event_subtype == 'multiple_dhcp_servers_detected' + ignore_failure: true +- convert: + type: ip + field: cisco_meraki.multiple_dhcp_servers_detected.original_server_ip + target_field: server.ip + if: ctx?.cisco_meraki?.event_subtype == 'multiple_dhcp_servers_detected' + ignore_failure: true +# cleanup only if the conversion was successful +- remove: + field: cisco_meraki.multiple_dhcp_servers_detected.original_server_ip + if: ctx?.server?.ip != null +- append: + field: related.ip + value: "{{{server.ip}}}" + if: ctx?.cisco_meraki?.event_subtype == 'multiple_dhcp_servers_detected' +# process server_ip (the other dhcp server ip) +- grok: + field: cisco_meraki.multiple_dhcp_servers_detected.server_ip + patterns: + - "^%{IPV4:cisco_meraki.multiple_dhcp_servers_detected.server_ip}$" + - "^%{IPV6:cisco_meraki.multiple_dhcp_servers_detected.server_ip}$" + if: ctx?.cisco_meraki?.event_subtype == 'multiple_dhcp_servers_detected' +- convert: + type: ip + field: cisco_meraki.multiple_dhcp_servers_detected.server_ip + if: ctx?.cisco_meraki?.event_subtype == 'multiple_dhcp_servers_detected' +- append: + field: related.ip + value: "{{{cisco_meraki.multiple_dhcp_servers_detected.server_ip}}}" + if: ctx?.cisco_meraki?.event_subtype == 'multiple_dhcp_servers_detected' +#################################################### +# wpa_deauth +#################################################### +- rename: + field: cisco_meraki.wpa_deauth.client_mac + target_field: client.mac + if: ctx?.cisco_meraki?.event_subtype == 'wpa_deauth' + +#################################################### +# Handle client_vpn_connect +#################################################### +- dissect: + field: event.original + pattern: "%{} events client_vpn_connect user id '%{user.name}' local ip %{network.forwarded_ip} connected from %{_temp.client_ip}" + if: ctx?.cisco_meraki?.event_subtype == "client_vpn_connect" + +#################################################### +# parse dissected IP values and convert to IP type +# common case for DHCP lease and client_vpn_connect +#################################################### +- grok: + field: _temp.client_ip + patterns: + - "^%{IPV4:_temp.client_ip}$" + - "^%{IPV6:_temp.client_ip}$" + if: ctx?._temp?.client_ip != null + ignore_failure: true +- convert: + type: ip + field: _temp.client_ip + target_field: client.ip + if: ctx?._temp?.client_ip != null + ignore_failure: true diff --git a/packages/cisco_meraki/data_stream/log/elasticsearch/ingest_pipeline/flows.yml b/packages/cisco_meraki/data_stream/log/elasticsearch/ingest_pipeline/flows.yml new file mode 100644 index 000000000000..7f47b9f6cc74 --- /dev/null +++ b/packages/cisco_meraki/data_stream/log/elasticsearch/ingest_pipeline/flows.yml @@ -0,0 +1,72 @@ +--- +description: Pipeline for Cisco Meraki flows message type +processors: +- dissect: + description: Determine if the token is src= or operation + field: event.original + pattern: "%{} %{} %{} %{} %{_temp.token} %{}" +- dissect: + description: Case for src= follows flows keyword + field: event.original + pattern: "%{} flows %{*src}=%{&src} %{*dst}=%{&dst} %{*prot}=%{&prot} %{*sport}=%{&sport} %{*dport}=%{&dport} %{}" + if: ctx._temp.token.startsWith("src=") == true +- dissect: + description: Case for firewall action prepends src= + field: event.original + pattern: "%{} flows %{cisco_meraki.flows.op} %{*src}=%{&src} %{*dst}=%{&dst} %{*mac}=%{&mac} %{*prot}=%{&prot} %{*sport}=%{&sport} %{*dport}=%{&dport}" + if: ctx._temp.token.startsWith("src=") == false +- grok: + field: src + patterns: + - "^%{IPV4:src}$" + - "^%{IPV6:src}$" + if: ctx?.src != null +- convert: + type: ip + field: src + target_field: source.ip + ignore_failure: true +- grok: + field: dst + patterns: + - "^%{IPV4:dst}$" + - "^%{IPV6:dst}$" + if: ctx?.dst != null +- convert: + type: ip + field: dst + target_field: destination.ip + ignore_failure: true +- rename: + field: protocol + target_field: network.protocol +- convert: + field: sport + target_field: source.port + type: long + if: ctx?.sport != "0" + ignore_failure: true +- convert: + field: dport + target_field: destination.port + type: long + if: ctx?.dport != "0" + ignore_failure: true +- gsub: + field: mac + target_field: source.mac + pattern: '[-:.]' + replacement: '-' + if: ctx._temp.token.startsWith("src=") == false +- set: + field: cisco_meraki.event_subtype + value: "ip_session_initiated" + if: ctx._temp.token.startsWith("src=") == true +- set: + field: cisco_meraki.event_subtype + value: "flow_allowed" + if: ctx._temp.token.startsWith("src=") == false && ctx?.cisco_meraki?.flows?.op == 'allow' +- set: + field: cisco_meraki.event_subtype + value: "flow_denied" + if: ctx._temp.token.startsWith("src=") == false && ctx?.cisco_meraki?.flows?.op == 'deny' diff --git a/packages/cisco_meraki/data_stream/log/elasticsearch/ingest_pipeline/idsalerts.yml b/packages/cisco_meraki/data_stream/log/elasticsearch/ingest_pipeline/idsalerts.yml new file mode 100644 index 000000000000..a1684a5e3064 --- /dev/null +++ b/packages/cisco_meraki/data_stream/log/elasticsearch/ingest_pipeline/idsalerts.yml @@ -0,0 +1,48 @@ +--- +description: Pipeline for Cisco Meraki ids-alerts type +processors: +- dissect: + description: Determine the ids-alerts security event type + field: event.original + pattern: "%{} ids-alerts %{*sig}=%{&sig} %{*pri}=%{&pri} %{*ts}=%{&ts} %{*dir}=%{&dir} %{*prot}=%{&prot} %{*src}=%{&src}" +- set: + field: cisco_meraki.event_subtype + value: ids_alerted +- rename: + field: priority + target_field: cisco_meraki.security.priority +- rename: + field: signature + target_field: cisco_meraki.security.signature +- date: + field: timestamp + target_field: threat.indicator.last_seen + formats: ['UNIX'] +- rename: + field: direction + target_field: network.direction +- lowercase: + field: protocol + target_field: network.protocol +- grok: + field: src + patterns: + - "^%{IPV4:_temp.src_ip}:%{PORT:sport}$" + - "^\\[%{IPV6:_temp.src_ip}\\]:%{PORT:sport}$" + - "^%{IPV6NOCOMPRESS:_temp.src_ip}:%{PORT:sport}$" + - "^%{IPV6:_temp.src_ip}%{IPV6PORTSEP}%{PORT:sport}$" + pattern_definitions: + IPV6NOCOMPRESS: '([0-9A-Fa-f]{1,4}:){7}[0-9A-Fa-f]{1,4}' + IPV6PORTSEP: '(?: port |[p#.])' + PORT: '[0-9]+' + if: ctx?.src != null +- convert: + type: ip + field: _temp.src_ip + target_field: source.ip + ignore_failure: true +- convert: + field: sport + target_field: source.port + type: long + ignore_failure: true diff --git a/packages/cisco_meraki/data_stream/log/elasticsearch/ingest_pipeline/ipflows.yml b/packages/cisco_meraki/data_stream/log/elasticsearch/ingest_pipeline/ipflows.yml new file mode 100644 index 000000000000..eb6667d991b6 --- /dev/null +++ b/packages/cisco_meraki/data_stream/log/elasticsearch/ingest_pipeline/ipflows.yml @@ -0,0 +1,62 @@ +--- +description: Pipeline for Cisco Meraki ip_flow_start and ip_flow_end message type +processors: +- dissect: + description: Determine if the token is src= or operation + field: event.original + pattern: "%{} %{} %{} %{_temp.event_type} %{_temp.token} %{}" +- dissect: + description: Case for src= follows ip_flow_start + field: event.original + pattern: "%{} ip_flow_start %{*src}=%{&src} %{*dst}=%{&dst} %{*prot}=%{&prot} %{*sport}=%{&sport} %{*dport}=%{&dport} %{*tsi}=%{&tsi} %{*tp}=%{&tp}" + if: ctx._temp.event_type == 'ip_flow_start' && ctx._temp.token.startsWith("src=") == true +- dissect: + description: Case for src= follows ip_flow_end + field: event.original + pattern: "%{} ip_flow_end %{*src}=%{&src} %{*dst}=%{&dst} %{*prot}=%{&prot} %{*sport}=%{&sport} %{*dport}=%{&dport} %{*tsi_or_tdi}=%{&tsi_or_tdi} %{*tp}=%{&tp}" + if: ctx._temp.event_type == 'ip_flow_end' && ctx._temp.token.startsWith("src=") == true +# source field IP:port handling +- convert: + type: ip + field: translated_src_ip + target_field: source.ip + if: ctx?.translated_src_ip != null +- convert: + type: ip + field: src + target_field: source.ip + if: ctx?.translated_src_ip == null && ctx?.src != null +- convert: + field: translated_port + target_field: source.port + type: long + if: ctx?.translated_src_ip != null && ctx?.translated_port != null +- convert: + field: sport + target_field: source.port + type: long + if: ctx?.translated_src_ip == null && ctx?.sport != null +# destination field IP:port handling +- convert: + type: ip + field: translated_dst_ip + target_field: destination.ip + if: ctx?.translated_dst_ip != null +- convert: + type: ip + field: dst + target_field: destination.ip + if: ctx?.translated_dst_ip == null && ctx?.dst != null +- convert: + field: translated_port + target_field: destination.port + type: long + if: ctx?.translated_dst_ip != null && ctx?.translated_port != null +- convert: + field: dport + target_field: destination.port + type: long + if: ctx?.translated_dst_ip == null && ctx?.dport != null +- rename: + field: protocol + target_field: network.protocol diff --git a/packages/cisco_meraki/data_stream/log/elasticsearch/ingest_pipeline/security.yml b/packages/cisco_meraki/data_stream/log/elasticsearch/ingest_pipeline/security.yml new file mode 100644 index 000000000000..38cd9373523e --- /dev/null +++ b/packages/cisco_meraki/data_stream/log/elasticsearch/ingest_pipeline/security.yml @@ -0,0 +1,151 @@ +--- +description: Pipeline for Cisco Meraki security_event type +processors: +- dissect: + description: Determine the security event type + field: event.original + pattern: "%{} security_event %{type} %{}" +- rename: + field: type + target_field: cisco_meraki.event_subtype + +# scan event based on event type +- dissect: + field: event.original + pattern: "%{} ids_alerted %{*sig}=%{&sig} %{*pri}=%{&pri} %{*ts}=%{&ts} %{*dhost}=%{&dhost} %{*dir}=%{&dir} %{*prot}=%{&prot} %{*src}=%{&src} %{*dst}=%{&dst} %{}" + if: ctx?.cisco_meraki?.event_subtype == 'ids_alerted' +- dissect: + field: event.original + pattern: "%{} security_filtering_file_scanned %{*url}=%{&url} %{*src}=%{&src} %{*dst}=%{&dst} %{*mac}=%{&mac} %{*name}='%{&name}' %{*sha256}=%{&sha256} %{*disp}=%{&disp} %{*action}=%{&action}" + if: ctx?.cisco_meraki?.event_subtype == 'security_filtering_file_scanned' +- dissect: + field: event.original + pattern: "%{} security_filtering_disposition_change %{*name}=%{&name} %{*sha256}=%{&sha256} %{*disp}=%{&disp} %{*action}=%{&action}" + if: ctx?.cisco_meraki?.event_subtype == 'security_filtering_disposition_change' + +# handle fields of ids_alerted type +- rename: + field: priority + target_field: cisco_meraki.security.priority + if: ctx?.cisco_meraki?.event_subtype == 'ids_alerted' +- rename: + field: signature + target_field: cisco_meraki.security.signature + if: ctx?.cisco_meraki?.event_subtype == 'ids_alerted' +- date: + field: timestamp + target_field: threat.indicator.last_seen + formats: ['UNIX'] + if: ctx?.cisco_meraki?.event_subtype == 'ids_alerted' +- gsub: + field: dhost + target_field: cisco_meraki.security.dhost + pattern: '[-:.]' + replacement: '-' + if: ctx?.cisco_meraki?.event_subtype == 'ids_alerted' +- rename: + field: direction + target_field: network.direction + if: ctx?.cisco_meraki?.event_subtype == 'ids_alerted' +- lowercase: + field: protocol + target_field: network.protocol + if: ctx?.cisco_meraki?.event_subtype == 'ids_alerted' +# Process the remaining after dst=. It can have "decision= message: *" or just "message: *" +- dissect: + field: event.original + pattern: "%{} dst=%{?ignore} %{*decision}=%{&decision} %{*message}:%{&message}" + if: ctx?.cisco_meraki?.event_subtype == 'ids_alerted' + ignore_failure: true +- dissect: + field: event.original + pattern: "%{} dst=%{?ignore} %{*message}:%{&message}" + if: ctx?.decision == null && ctx?.cisco_meraki?.event_subtype == 'ids_alerted' +- rename: + field: message + target_field: threat.indicator.description + ignore_missing: true + if: ctx?.cisco_meraki?.event_subtype == 'ids_alerted' +- rename: + field: decision + target_field: cisco_meraki.security.decision + ignore_missing: true + if: ctx?.cisco_meraki?.event_subtype == 'ids_alerted' + +# handle fields of security_filtering_file_scanned or security_filtering_disposition_change type +- rename: + field: url + target_field: threat.indicator.reference + if: ctx?.cisco_meraki?.event_subtype == 'security_filtering_file_scanned' +- gsub: + field: mac + target_field: cisco_meraki.security.mac + pattern: '[-:.]' + replacement: '-' + if: ctx?.cisco_meraki?.event_subtype == 'security_filtering_file_scanned' +- rename: + field: name + target_field: threat.indicator.file.name + if: ctx?.cisco_meraki?.event_subtype == 'security_filtering_file_scanned' || ctx?.cisco_meraki?.event_subtype == 'security_filtering_disposition_change' +- rename: + field: sha256 + target_field: threat.indicator.file.hash.sha256 + if: ctx?.cisco_meraki?.event_subtype == 'security_filtering_file_scanned' || ctx?.cisco_meraki?.event_subtype == 'security_filtering_disposition_change' +- rename: + field: disposition + target_field: threat.software.type + if: ctx?.cisco_meraki?.event_subtype == 'security_filtering_file_scanned' || ctx?.cisco_meraki?.event_subtype == 'security_filtering_disposition_change' +- rename: + field: action + target_field: cisco_meraki.security.action + if: ctx?.cisco_meraki?.event_subtype == 'security_filtering_file_scanned' || ctx?.cisco_meraki?.event_subtype == 'security_filtering_disposition_change' +# fields common to more than one event type +# src processing +- grok: + field: src + patterns: + - "^%{IPV4:_temp.src_ip}:%{PORT:sport}$" + - "^\\[%{IPV6:_temp.src_ip}\\]:%{PORT:sport}$" + - "^%{IPV6NOCOMPRESS:_temp.src_ip}:%{PORT:sport}$" + - "^%{IPV6:_temp.src_ip}%{IPV6PORTSEP}%{PORT:sport}$" + pattern_definitions: + IPV6NOCOMPRESS: '([0-9A-Fa-f]{1,4}:){7}[0-9A-Fa-f]{1,4}' + IPV6PORTSEP: '(?: port |[p#.])' + PORT: '[0-9]+' + if: ctx?.cisco_meraki?.event_subtype != 'security_filtering_disposition_change' && ctx?.src != null +- convert: + type: ip + field: _temp.src_ip + target_field: source.ip + if: ctx?.cisco_meraki?.event_subtype != 'security_filtering_disposition_change' +- convert: + field: sport + target_field: source.port + type: long + if: ctx?.sport != "0" && ctx?.cisco_meraki?.event_subtype != 'security_filtering_disposition_change' + ignore_failure: true +# dst processing +- grok: + field: dst + patterns: + - "^%{IPV4:_temp.dst_ip}:%{PORT:dport}$" + - "^\\[%{IPV6:_temp.dst_ip}\\]:%{PORT:dport}$" + - "^%{IPV6NOCOMPRESS:_temp.dst_ip}:%{PORT:dport}$" + - "^%{IPV6:_temp.dst_ip}%{IPV6PORTSEP}%{PORT:dport}$" + pattern_definitions: + IPV6NOCOMPRESS: '([0-9A-Fa-f]{1,4}:){7}[0-9A-Fa-f]{1,4}' + IPV6PORTSEP: '(?: port |[p#.])' + PORT: '[0-9]+' + if: ctx?.cisco_meraki?.event_subtype != 'security_filtering_disposition_change' && ctx?.dst != null +- convert: + type: ip + field: _temp.dst_ip + target_field: destination.ip + ignore_failure: true + if: ctx?.cisco_meraki?.event_subtype != 'security_filtering_disposition_change' +- convert: + field: dport + target_field: destination.port + type: long + if: ctx?.dport != "0" && ctx?.cisco_meraki?.event_subtype != 'security_filtering_disposition_change' + ignore_failure: true diff --git a/packages/cisco_meraki/data_stream/log/elasticsearch/ingest_pipeline/urls.yml b/packages/cisco_meraki/data_stream/log/elasticsearch/ingest_pipeline/urls.yml new file mode 100644 index 000000000000..68bcddb288ab --- /dev/null +++ b/packages/cisco_meraki/data_stream/log/elasticsearch/ingest_pipeline/urls.yml @@ -0,0 +1,64 @@ +--- +description: Pipeline for Cisco Meraki urls type +processors: +- dissect: + description: Determine the security event type + field: event.original + pattern: "%{} urls %{*src}=%{&src} %{*dst}=%{&dst} %{*mac}=%{&mac} request: %{http.request.method} %{url.original}" +# src processing +- grok: + field: src + patterns: + - "^%{IPV4:_temp.src_ip}:%{PORT:sport}$" + - "^\\[%{IPV6:_temp.src_ip}\\]:%{PORT:sport}$" + - "^%{IPV6NOCOMPRESS:_temp.src_ip}:%{PORT:sport}$" + - "^%{IPV6:_temp.src_ip}%{IPV6PORTSEP}%{PORT:sport}$" + pattern_definitions: + IPV6NOCOMPRESS: '([0-9A-Fa-f]{1,4}:){7}[0-9A-Fa-f]{1,4}' + IPV6PORTSEP: '(?: port |[p#.])' + PORT: '[0-9]+' +- convert: + type: ip + field: _temp.src_ip + target_field: source.ip +- convert: + type: long + field: sport + target_field: source.port + ignore_failure: true +# dst processing +- grok: + field: dst + patterns: + - "^%{IPV4:_temp.dst_ip}:%{PORT:dport}$" + - "^\\[%{IPV6:_temp.dst_ip}\\]:%{PORT:dport}$" + - "^%{IPV6NOCOMPRESS:_temp.dst_ip}:%{PORT:dport}$" + - "^%{IPV6:_temp.dst_ip}%{IPV6PORTSEP}%{PORT:dport}$" + pattern_definitions: + IPV6NOCOMPRESS: '([0-9A-Fa-f]{1,4}:){7}[0-9A-Fa-f]{1,4}' + IPV6PORTSEP: '(?: port |[p#.])' + PORT: '[0-9]+' +- convert: + type: ip + field: _temp.dst_ip + target_field: destination.ip + ignore_failure: true +- convert: + type: long + field: dport + target_field: destination.port + if: ctx?.dport != "0" && ctx?.cisco_meraki?.event_subtype != 'security_filtering_disposition_change' + ignore_failure: true +- gsub: + field: mac + target_field: cisco_meraki.urls.mac + pattern: '[-:.]' + replacement: '-' +- set: + field: cisco_meraki.event_subtype + value: 'http_access' + if: ctx?.http?.request?.method.toLowerCase() != 'unknown' +- set: + field: cisco_meraki.event_subtype + value: 'http_access_error' + if: ctx?.http?.request?.method.toLowerCase() == 'unknown' diff --git a/packages/cisco_meraki/data_stream/log/fields/agent.yml b/packages/cisco_meraki/data_stream/log/fields/agent.yml index da4e652c53b8..162c9f3aa38e 100644 --- a/packages/cisco_meraki/data_stream/log/fields/agent.yml +++ b/packages/cisco_meraki/data_stream/log/fields/agent.yml @@ -196,3 +196,12 @@ description: > OS codename, if any. +- name: input.type + type: keyword + description: Input type. +- name: log.source.address + type: keyword + description: Source address from which the log event was read / sent from. +- name: log.offset + type: long + description: Offset of the entry in the log file. diff --git a/packages/cisco_meraki/data_stream/log/fields/base-fields.yml b/packages/cisco_meraki/data_stream/log/fields/base-fields.yml index b1447bb9e3cc..7691cacc73ec 100644 --- a/packages/cisco_meraki/data_stream/log/fields/base-fields.yml +++ b/packages/cisco_meraki/data_stream/log/fields/base-fields.yml @@ -25,22 +25,3 @@ - name: input.type description: Type of Filebeat input. type: keyword -- name: log.file.path - description: Full path to the log file this event came from. - example: /var/log/fun-times.log - ignore_above: 1024 - type: keyword -- name: log.source.address - description: Source address from which the log event was read / sent from. - type: keyword -- name: log.flags - description: Flags for the log file. - type: keyword -- name: log.offset - description: Offset of the entry in the log file. - type: long -- name: tags - description: List of keywords used to tag each event. - example: '["production", "env2"]' - ignore_above: 1024 - type: keyword diff --git a/packages/cisco_meraki/data_stream/log/fields/ecs.yml b/packages/cisco_meraki/data_stream/log/fields/ecs.yml index 1da8c39a3414..d0f1e65d677d 100644 --- a/packages/cisco_meraki/data_stream/log/fields/ecs.yml +++ b/packages/cisco_meraki/data_stream/log/fields/ecs.yml @@ -1,5 +1,9 @@ - external: ecs name: '@timestamp' +- external: ecs + name: client.ip +- external: ecs + name: client.mac - external: ecs name: client.domain - external: ecs @@ -70,6 +74,10 @@ name: event.outcome - external: ecs name: event.timezone +- external: ecs + name: event.category +- external: ecs + name: event.type - external: ecs name: file.attributes - external: ecs @@ -116,6 +124,10 @@ name: log.syslog.priority - external: ecs name: log.syslog.severity.code +- external: ecs + name: log.file.path +- external: ecs + name: tags - external: ecs name: message - external: ecs @@ -126,6 +138,8 @@ name: network.direction - external: ecs name: network.forwarded_ip +- external: ecs + name: network.name - external: ecs name: network.packets - external: ecs @@ -142,6 +156,8 @@ name: observer.vendor - external: ecs name: observer.version +- external: ecs + name: observer.mac - external: ecs name: process.name - external: ecs @@ -162,6 +178,10 @@ name: related.user - external: ecs name: rule.name +- external: ecs + name: server.mac +- external: ecs + name: server.ip - external: ecs name: server.domain - external: ecs @@ -206,8 +226,6 @@ name: source.subdomain - external: ecs name: source.top_level_domain -- external: ecs - name: tags - external: ecs name: url.domain - external: ecs @@ -230,3 +248,55 @@ name: user.name - external: ecs name: user_agent.original +- external: ecs + name: observer.hostname +- external: ecs + name: destination.geo.continent_name +- external: ecs + name: destination.geo.country_iso_code +- external: ecs + name: destination.geo.region_iso_code +- external: ecs + name: destination.geo.region_name +- external: ecs + name: source.geo.continent_name +- external: ecs + name: source.geo.country_iso_code +- external: ecs + name: source.geo.region_iso_code +- external: ecs + name: source.geo.region_name +- external: ecs + name: network.vlan.id +- external: ecs + name: threat.software.type +- external: ecs + name: threat.indicator.last_seen +- external: ecs + name: threat.indicator.description +- external: ecs + name: threat.indicator.reference +- external: ecs + name: threat.indicator.file.name +- external: ecs + name: threat.indicator.file.hash.sha256 +- external: ecs + name: network.direction +- external: ecs + name: network.protocol +- external: ecs + name: client.geo.city_name +- external: ecs + name: client.geo.continent_name +- external: ecs + name: client.geo.country_iso_code +- external: ecs + name: client.geo.country_name +- external: ecs + name: client.geo.location.lat +- external: ecs + name: client.geo.location.lon +- external: ecs + name: client.geo.region_iso_code +- external: ecs + name: client.geo.region_name diff --git a/packages/cisco_meraki/data_stream/log/fields/fields.yml b/packages/cisco_meraki/data_stream/log/fields/fields.yml index f59640c27542..373013e01f44 100644 --- a/packages/cisco_meraki/data_stream/log/fields/fields.yml +++ b/packages/cisco_meraki/data_stream/log/fields/fields.yml @@ -1,1753 +1,72 @@ -- name: rsa +- name: cisco_meraki type: group fields: - - name: internal + - name: event_type + type: keyword + - name: event_subtype + type: keyword + - name: bssid + type: keyword + - name: vap + type: keyword + - name: channel + type: keyword + - name: fc_type + type: keyword + - name: fc_subtype + type: keyword + - name: flows + type: flattened + - name: dfs_event + type: flattened + - name: wpa_auth + type: flattened + - name: wpa_deauth + type: flattened + - name: association + type: flattened + - name: disassociation + type: flattened + - name: 8021x_eap_failure + type: flattened + - name: 8021x_deauth + type: flattened + - name: 8021x_auth + type: flattened + - name: 8021x_eap_success + type: flattened + - name: splash_auth + type: flattened + - name: device_packet_flood + type: flattened + - name: multiple_dhcp_servers_detected + type: flattened + - name: aps_association_reject + type: flattened + - name: urls + type: group + fields: + - name: mac + type: keyword + - name: security type: group fields: - - name: msg - type: keyword - description: This key is used to capture the raw message that comes into the Log Decoder - - name: messageid - type: keyword - - name: event_desc - type: keyword - - name: message - type: keyword - description: This key captures the contents of instant messages - - name: time - type: date - description: This is the time at which a session hits a NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness. - - name: level - type: long - description: Deprecated key defined only in table map. - - name: msg_id - type: keyword - description: This is the Message ID1 value that identifies the exact log parser definition which parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: msg_vid - type: keyword - description: This is the Message ID2 value that identifies the exact log parser definition which parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: data - type: keyword - description: Deprecated key defined only in table map. - - name: obj_server - type: keyword - description: Deprecated key defined only in table map. - - name: obj_val - type: keyword - description: Deprecated key defined only in table map. - - name: resource - type: keyword - description: Deprecated key defined only in table map. - - name: obj_id - type: keyword - description: Deprecated key defined only in table map. - - name: statement - type: keyword - description: Deprecated key defined only in table map. - - name: audit_class - type: keyword - description: Deprecated key defined only in table map. - - name: entry - type: keyword - description: Deprecated key defined only in table map. - - name: hcode - type: keyword - description: Deprecated key defined only in table map. - - name: inode - type: long - description: Deprecated key defined only in table map. - - name: resource_class - type: keyword - description: Deprecated key defined only in table map. - - name: dead - type: long - description: Deprecated key defined only in table map. - - name: feed_desc - type: keyword - description: This is used to capture the description of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: feed_name - type: keyword - description: This is used to capture the name of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: cid - type: keyword - description: This is the unique identifier used to identify a NetWitness Concentrator. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: device_class - type: keyword - description: This is the Classification of the Log Event Source under a predefined fixed set of Event Source Classifications. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: device_group - type: keyword - description: This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: device_host - type: keyword - description: This is the Hostname of the log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: device_ip - type: ip - description: This is the IPv4 address of the Log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: device_ipv6 - type: ip - description: This is the IPv6 address of the Log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: device_type - type: keyword - description: This is the name of the log parser which parsed a given session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: device_type_id - type: long - description: Deprecated key defined only in table map. - - name: did - type: keyword - description: This is the unique identifier used to identify a NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: entropy_req - type: long - description: This key is only used by the Entropy Parser, the Meta Type can be either UInt16 or Float32 based on the configuration - - name: entropy_res - type: long - description: This key is only used by the Entropy Parser, the Meta Type can be either UInt16 or Float32 based on the configuration - - name: event_name - type: keyword - description: Deprecated key defined only in table map. - - name: feed_category - type: keyword - description: This is used to capture the category of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: forward_ip - type: ip - description: This key should be used to capture the IPV4 address of a relay system which forwarded the events from the original system to NetWitness. - - name: forward_ipv6 - type: ip - description: This key is used to capture the IPV6 address of a relay system which forwarded the events from the original system to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: header_id - type: keyword - description: This is the Header ID value that identifies the exact log parser header definition that parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: lc_cid - type: keyword - description: This is a unique Identifier of a Log Collector. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: lc_ctime - type: date - description: This is the time at which a log is collected in a NetWitness Log Collector. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: mcb_req - type: long - description: This key is only used by the Entropy Parser, the most common byte request is simply which byte for each side (0 thru 255) was seen the most - - name: mcb_res - type: long - description: This key is only used by the Entropy Parser, the most common byte response is simply which byte for each side (0 thru 255) was seen the most - - name: mcbc_req - type: long - description: This key is only used by the Entropy Parser, the most common byte count is the number of times the most common byte (above) was seen in the session streams - - name: mcbc_res - type: long - description: This key is only used by the Entropy Parser, the most common byte count is the number of times the most common byte (above) was seen in the session streams - - name: medium - type: long - description: "This key is used to identify if it’s a log/packet session or Layer 2 Encapsulation Type. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness. 32 = log, 33 = correlation session, < 32 is packet session" - - name: node_name - type: keyword - description: Deprecated key defined only in table map. - - name: nwe_callback_id - type: keyword - description: This key denotes that event is endpoint related - - name: parse_error - type: keyword - description: This is a special key that stores any Meta key validation error found while parsing a log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: payload_req - type: long - description: This key is only used by the Entropy Parser, the payload size metrics are the payload sizes of each session side at the time of parsing. However, in order to keep - - name: payload_res - type: long - description: This key is only used by the Entropy Parser, the payload size metrics are the payload sizes of each session side at the time of parsing. However, in order to keep - - name: process_vid_dst - type: keyword - description: Endpoint generates and uses a unique virtual ID to identify any similar group of process. This ID represents the target process. - - name: process_vid_src - type: keyword - description: Endpoint generates and uses a unique virtual ID to identify any similar group of process. This ID represents the source process. - - name: rid - type: long - description: This is a special ID of the Remote Session created by NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: session_split - type: keyword - description: This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: site - type: keyword - description: Deprecated key defined only in table map. - - name: size - type: long - description: This is the size of the session as seen by the NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: sourcefile - type: keyword - description: This is the name of the log file or PCAPs that can be imported into NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: ubc_req - type: long - description: This key is only used by the Entropy Parser, Unique byte count is the number of unique bytes seen in each stream. 256 would mean all byte values of 0 thru 255 were seen at least once - - name: ubc_res - type: long - description: This key is only used by the Entropy Parser, Unique byte count is the number of unique bytes seen in each stream. 256 would mean all byte values of 0 thru 255 were seen at least once - - name: word - type: keyword - description: This is used by the Word Parsing technology to capture the first 5 character of every word in an unparsed log - - name: time - type: group - fields: - - name: event_time - type: date - description: This key is used to capture the time mentioned in a raw session that represents the actual time an event occured in a standard normalized form - - name: duration_time - type: double - description: This key is used to capture the normalized duration/lifetime in seconds. - - name: event_time_str - type: keyword - description: This key is used to capture the incomplete time mentioned in a session as a string - - name: starttime - type: date - description: This key is used to capture the Start time mentioned in a session in a standard form - - name: month - type: keyword - - name: day - type: keyword - - name: endtime - type: date - description: This key is used to capture the End time mentioned in a session in a standard form - - name: timezone - type: keyword - description: This key is used to capture the timezone of the Event Time - - name: duration_str - type: keyword - description: A text string version of the duration - - name: date - type: keyword - - name: year - type: keyword - - name: recorded_time - type: date - description: The event time as recorded by the system the event is collected from. The usage scenario is a multi-tier application where the management layer of the system records it's own timestamp at the time of collection from its child nodes. Must be in timestamp format. - - name: datetime - type: keyword - - name: effective_time - type: date - description: This key is the effective time referenced by an individual event in a Standard Timestamp format - - name: expire_time - type: date - description: This key is the timestamp that explicitly refers to an expiration. - - name: process_time - type: keyword - description: Deprecated, use duration.time - - name: hour - type: keyword - - name: min - type: keyword - - name: timestamp - type: keyword - - name: event_queue_time - type: date - description: This key is the Time that the event was queued. - - name: p_time1 - type: keyword - - name: tzone - type: keyword - - name: eventtime - type: keyword - - name: gmtdate - type: keyword - - name: gmttime - type: keyword - - name: p_date - type: keyword - - name: p_month - type: keyword - - name: p_time - type: keyword - - name: p_time2 - type: keyword - - name: p_year - type: keyword - - name: expire_time_str - type: keyword - description: This key is used to capture incomplete timestamp that explicitly refers to an expiration. - - name: stamp - type: date - description: Deprecated key defined only in table map. - - name: misc - type: group - fields: - - name: action - type: keyword - - name: result - type: keyword - description: This key is used to capture the outcome/result string value of an action in a session. - - name: severity - type: keyword - description: This key is used to capture the severity given the session - - name: event_type - type: keyword - description: This key captures the event category type as specified by the event source. - - name: reference_id - type: keyword - description: This key is used to capture an event id from the session directly - - name: version - type: keyword - description: This key captures Version of the application or OS which is generating the event. - - name: disposition - type: keyword - description: This key captures the The end state of an action. - - name: result_code - type: keyword - description: This key is used to capture the outcome/result numeric value of an action in a session - - name: category - type: keyword - description: This key is used to capture the category of an event given by the vendor in the session - - name: obj_name - type: keyword - description: This is used to capture name of object - - name: obj_type - type: keyword - description: This is used to capture type of object - - name: event_source - type: keyword - description: "This key captures Source of the event that’s not a hostname" - - name: log_session_id - type: keyword - description: This key is used to capture a sessionid from the session directly - - name: group - type: keyword - description: This key captures the Group Name value - - name: policy_name - type: keyword - description: This key is used to capture the Policy Name only. - - name: rule_name - type: keyword - description: This key captures the Rule Name - - name: context - type: keyword - description: This key captures Information which adds additional context to the event. - - name: change_new - type: keyword - description: "This key is used to capture the new values of the attribute that’s changing in a session" - - name: space - type: keyword - - name: client - type: keyword - description: This key is used to capture only the name of the client application requesting resources of the server. See the user.agent meta key for capture of the specific user agent identifier or browser identification string. - - name: msgIdPart1 - type: keyword - - name: msgIdPart2 - type: keyword - - name: change_old - type: keyword - description: "This key is used to capture the old value of the attribute that’s changing in a session" - - name: operation_id - type: keyword - description: An alert number or operation number. The values should be unique and non-repeating. - - name: event_state - type: keyword - description: This key captures the current state of the object/item referenced within the event. Describing an on-going event. - - name: group_object - type: keyword - description: This key captures a collection/grouping of entities. Specific usage - - name: node - type: keyword - description: Common use case is the node name within a cluster. The cluster name is reflected by the host name. - - name: rule - type: keyword - description: This key captures the Rule number - - name: device_name - type: keyword - description: 'This is used to capture name of the Device associated with the node Like: a physical disk, printer, etc' - - name: param - type: keyword - description: This key is the parameters passed as part of a command or application, etc. - - name: change_attrib - type: keyword - description: "This key is used to capture the name of the attribute that’s changing in a session" - - name: event_computer - type: keyword - description: This key is a windows only concept, where this key is used to capture fully qualified domain name in a windows log. - - name: reference_id1 - type: keyword - description: This key is for Linked ID to be used as an addition to "reference.id" - - name: event_log - type: keyword - description: This key captures the Name of the event log - - name: OS - type: keyword - description: This key captures the Name of the Operating System - - name: terminal - type: keyword - description: This key captures the Terminal Names only - - name: msgIdPart3 - type: keyword - - name: filter - type: keyword - description: This key captures Filter used to reduce result set - - name: serial_number - type: keyword - description: This key is the Serial number associated with a physical asset. - - name: checksum - type: keyword - description: This key is used to capture the checksum or hash of the entity such as a file or process. Checksum should be used over checksum.src or checksum.dst when it is unclear whether the entity is a source or target of an action. - - name: event_user - type: keyword - description: This key is a windows only concept, where this key is used to capture combination of domain name and username in a windows log. - - name: virusname - type: keyword - description: This key captures the name of the virus - - name: content_type - type: keyword - description: This key is used to capture Content Type only. - - name: group_id - type: keyword - description: This key captures Group ID Number (related to the group name) - - name: policy_id - type: keyword - description: This key is used to capture the Policy ID only, this should be a numeric value, use policy.name otherwise - - name: vsys - type: keyword - description: This key captures Virtual System Name - - name: connection_id - type: keyword - description: This key captures the Connection ID - - name: reference_id2 - type: keyword - description: This key is for the 2nd Linked ID. Can be either linked to "reference.id" or "reference.id1" value but should not be used unless the other two variables are in play. - - name: sensor - type: keyword - description: This key captures Name of the sensor. Typically used in IDS/IPS based devices - - name: sig_id - type: long - description: This key captures IDS/IPS Int Signature ID - - name: port_name - type: keyword - description: 'This key is used for Physical or logical port connection but does NOT include a network port. (Example: Printer port name).' - - name: rule_group - type: keyword - description: This key captures the Rule group name - - name: risk_num - type: double - description: This key captures a Numeric Risk value - - name: trigger_val - type: keyword - description: This key captures the Value of the trigger or threshold condition. - - name: log_session_id1 - type: keyword - description: This key is used to capture a Linked (Related) Session ID from the session directly - - name: comp_version - type: keyword - description: This key captures the Version level of a sub-component of a product. - - name: content_version - type: keyword - description: This key captures Version level of a signature or database content. - - name: hardware_id - type: keyword - description: This key is used to capture unique identifier for a device or system (NOT a Mac address) - - name: risk - type: keyword - description: This key captures the non-numeric risk value - - name: event_id - type: keyword - - name: reason - type: keyword - - name: status - type: keyword - - name: mail_id - type: keyword - description: This key is used to capture the mailbox id/name - - name: rule_uid - type: keyword - description: This key is the Unique Identifier for a rule. - - name: trigger_desc - type: keyword - description: This key captures the Description of the trigger or threshold condition. - - name: inout - type: keyword - - name: p_msgid - type: keyword - - name: data_type - type: keyword - - name: msgIdPart4 - type: keyword - - name: error - type: keyword - description: This key captures All non successful Error codes or responses - - name: index - type: keyword - - name: listnum - type: keyword - description: This key is used to capture listname or listnumber, primarily for collecting access-list - - name: ntype - type: keyword - - name: observed_val - type: keyword - description: This key captures the Value observed (from the perspective of the device generating the log). - - name: policy_value - type: keyword - description: This key captures the contents of the policy. This contains details about the policy - - name: pool_name - type: keyword - description: This key captures the name of a resource pool - - name: rule_template - type: keyword - description: A default set of parameters which are overlayed onto a rule (or rulename) which efffectively constitutes a template - - name: count - type: keyword - - name: number - type: keyword - - name: sigcat - type: keyword - - name: type - type: keyword - - name: comments - type: keyword - description: Comment information provided in the log message - - name: doc_number - type: long - description: This key captures File Identification number - - name: expected_val - type: keyword - description: This key captures the Value expected (from the perspective of the device generating the log). - - name: job_num - type: keyword - description: This key captures the Job Number - - name: spi_dst - type: keyword - description: Destination SPI Index - - name: spi_src - type: keyword - description: Source SPI Index - - name: code - type: keyword - - name: agent_id - type: keyword - description: This key is used to capture agent id - - name: message_body - type: keyword - description: This key captures the The contents of the message body. - - name: phone - type: keyword - - name: sig_id_str - type: keyword - description: This key captures a string object of the sigid variable. - - name: cmd - type: keyword - - name: misc - type: keyword - - name: name - type: keyword - - name: cpu - type: long - description: This key is the CPU time used in the execution of the event being recorded. - - name: event_desc - type: keyword - description: This key is used to capture a description of an event available directly or inferred - - name: sig_id1 - type: long - description: This key captures IDS/IPS Int Signature ID. This must be linked to the sig.id - - name: im_buddyid - type: keyword - - name: im_client - type: keyword - - name: im_userid - type: keyword - - name: pid - type: keyword - - name: priority - type: keyword - - name: context_subject - type: keyword - description: This key is to be used in an audit context where the subject is the object being identified - - name: context_target - type: keyword - - name: cve - type: keyword - description: This key captures CVE (Common Vulnerabilities and Exposures) - an identifier for known information security vulnerabilities. - - name: fcatnum - type: keyword - description: This key captures Filter Category Number. Legacy Usage - - name: library - type: keyword - description: This key is used to capture library information in mainframe devices - - name: parent_node - type: keyword - description: This key captures the Parent Node Name. Must be related to node variable. - - name: risk_info - type: keyword - description: Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) - - name: tcp_flags - type: long - description: This key is captures the TCP flags set in any packet of session - - name: tos - type: long - description: This key describes the type of service - - name: vm_target - type: keyword - description: VMWare Target **VMWARE** only varaible. - - name: workspace - type: keyword - description: This key captures Workspace Description - - name: command - type: keyword - - name: event_category - type: keyword - - name: facilityname - type: keyword - - name: forensic_info - type: keyword - - name: jobname - type: keyword - - name: mode - type: keyword - - name: policy - type: keyword - - name: policy_waiver - type: keyword - - name: second - type: keyword - - name: space1 - type: keyword - - name: subcategory - type: keyword - - name: tbdstr2 - type: keyword - - name: alert_id - type: keyword - description: Deprecated, New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) - - name: checksum_dst - type: keyword - description: This key is used to capture the checksum or hash of the the target entity such as a process or file. - - name: checksum_src - type: keyword - description: This key is used to capture the checksum or hash of the source entity such as a file or process. - - name: fresult - type: long - description: This key captures the Filter Result - - name: payload_dst - type: keyword - description: This key is used to capture destination payload - - name: payload_src - type: keyword - description: This key is used to capture source payload - - name: pool_id - type: keyword - description: This key captures the identifier (typically numeric field) of a resource pool - - name: process_id_val - type: keyword - description: This key is a failure key for Process ID when it is not an integer value - - name: risk_num_comm - type: double - description: This key captures Risk Number Community - - name: risk_num_next - type: double - description: This key captures Risk Number NextGen - - name: risk_num_sand - type: double - description: This key captures Risk Number SandBox - - name: risk_num_static - type: double - description: This key captures Risk Number Static - - name: risk_suspicious - type: keyword - description: Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) - - name: risk_warning - type: keyword - description: Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) - - name: snmp_oid - type: keyword - description: SNMP Object Identifier - - name: sql - type: keyword - description: This key captures the SQL query - - name: vuln_ref - type: keyword - description: This key captures the Vulnerability Reference details - - name: acl_id - type: keyword - - name: acl_op - type: keyword - - name: acl_pos - type: keyword - - name: acl_table - type: keyword - - name: admin - type: keyword - - name: alarm_id - type: keyword - - name: alarmname - type: keyword - - name: app_id - type: keyword - - name: audit - type: keyword - - name: audit_object - type: keyword - - name: auditdata - type: keyword - - name: benchmark - type: keyword - - name: bypass - type: keyword - - name: cache - type: keyword - - name: cache_hit - type: keyword - - name: cefversion - type: keyword - - name: cfg_attr - type: keyword - - name: cfg_obj - type: keyword - - name: cfg_path - type: keyword - - name: changes - type: keyword - - name: client_ip - type: keyword - - name: clustermembers - type: keyword - - name: cn_acttimeout - type: keyword - - name: cn_asn_src - type: keyword - - name: cn_bgpv4nxthop - type: keyword - - name: cn_ctr_dst_code - type: keyword - - name: cn_dst_tos - type: keyword - - name: cn_dst_vlan - type: keyword - - name: cn_engine_id - type: keyword - - name: cn_engine_type - type: keyword - - name: cn_f_switch - type: keyword - - name: cn_flowsampid - type: keyword - - name: cn_flowsampintv - type: keyword - - name: cn_flowsampmode - type: keyword - - name: cn_inacttimeout - type: keyword - - name: cn_inpermbyts - type: keyword - - name: cn_inpermpckts - type: keyword - - name: cn_invalid - type: keyword - - name: cn_ip_proto_ver - type: keyword - - name: cn_ipv4_ident - type: keyword - - name: cn_l_switch - type: keyword - - name: cn_log_did - type: keyword - - name: cn_log_rid - type: keyword - - name: cn_max_ttl - type: keyword - - name: cn_maxpcktlen - type: keyword - - name: cn_min_ttl - type: keyword - - name: cn_minpcktlen - type: keyword - - name: cn_mpls_lbl_1 - type: keyword - - name: cn_mpls_lbl_10 - type: keyword - - name: cn_mpls_lbl_2 - type: keyword - - name: cn_mpls_lbl_3 - type: keyword - - name: cn_mpls_lbl_4 - type: keyword - - name: cn_mpls_lbl_5 - type: keyword - - name: cn_mpls_lbl_6 - type: keyword - - name: cn_mpls_lbl_7 - type: keyword - - name: cn_mpls_lbl_8 - type: keyword - - name: cn_mpls_lbl_9 - type: keyword - - name: cn_mplstoplabel - type: keyword - - name: cn_mplstoplabip - type: keyword - - name: cn_mul_dst_byt - type: keyword - - name: cn_mul_dst_pks - type: keyword - - name: cn_muligmptype - type: keyword - - name: cn_sampalgo - type: keyword - - name: cn_sampint - type: keyword - - name: cn_seqctr - type: keyword - - name: cn_spackets - type: keyword - - name: cn_src_tos - type: keyword - - name: cn_src_vlan - type: keyword - - name: cn_sysuptime - type: keyword - - name: cn_template_id - type: keyword - - name: cn_totbytsexp - type: keyword - - name: cn_totflowexp - type: keyword - - name: cn_totpcktsexp - type: keyword - - name: cn_unixnanosecs - type: keyword - - name: cn_v6flowlabel - type: keyword - - name: cn_v6optheaders - type: keyword - - name: comp_class - type: keyword - - name: comp_name - type: keyword - - name: comp_rbytes - type: keyword - - name: comp_sbytes - type: keyword - - name: cpu_data - type: keyword - - name: criticality - type: keyword - - name: cs_agency_dst - type: keyword - - name: cs_analyzedby - type: keyword - - name: cs_av_other - type: keyword - - name: cs_av_primary - type: keyword - - name: cs_av_secondary - type: keyword - - name: cs_bgpv6nxthop - type: keyword - - name: cs_bit9status - type: keyword - - name: cs_context - type: keyword - - name: cs_control - type: keyword - - name: cs_data - type: keyword - - name: cs_datecret - type: keyword - - name: cs_dst_tld - type: keyword - - name: cs_eth_dst_ven - type: keyword - - name: cs_eth_src_ven - type: keyword - - name: cs_event_uuid - type: keyword - - name: cs_filetype - type: keyword - - name: cs_fld - type: keyword - - name: cs_if_desc - type: keyword - - name: cs_if_name - type: keyword - - name: cs_ip_next_hop - type: keyword - - name: cs_ipv4dstpre - type: keyword - - name: cs_ipv4srcpre - type: keyword - - name: cs_lifetime - type: keyword - - name: cs_log_medium - type: keyword - - name: cs_loginname - type: keyword - - name: cs_modulescore - type: keyword - - name: cs_modulesign - type: keyword - - name: cs_opswatresult - type: keyword - - name: cs_payload - type: keyword - - name: cs_registrant - type: keyword - - name: cs_registrar - type: keyword - - name: cs_represult - type: keyword - - name: cs_rpayload - type: keyword - - name: cs_sampler_name - type: keyword - - name: cs_sourcemodule - type: keyword - - name: cs_streams - type: keyword - - name: cs_targetmodule - type: keyword - - name: cs_v6nxthop - type: keyword - - name: cs_whois_server - type: keyword - - name: cs_yararesult - type: keyword - - name: description - type: keyword - - name: devvendor - type: keyword - - name: distance - type: keyword - - name: dstburb - type: keyword - - name: edomain - type: keyword - - name: edomaub - type: keyword - - name: euid - type: keyword - - name: facility - type: keyword - - name: finterface - type: keyword - - name: flags - type: keyword - - name: gaddr - type: keyword - - name: id3 - type: keyword - - name: im_buddyname - type: keyword - - name: im_croomid - type: keyword - - name: im_croomtype - type: keyword - - name: im_members - type: keyword - - name: im_username - type: keyword - - name: ipkt - type: keyword - - name: ipscat - type: keyword - - name: ipspri - type: keyword - - name: latitude - type: keyword - - name: linenum - type: keyword - - name: list_name - type: keyword - - name: load_data - type: keyword - - name: location_floor - type: keyword - - name: location_mark - type: keyword - - name: log_id - type: keyword - - name: log_type - type: keyword - - name: logid - type: keyword - - name: logip - type: keyword - - name: logname - type: keyword - - name: longitude - type: keyword - - name: lport - type: keyword - - name: mbug_data - type: keyword - - name: misc_name - type: keyword - - name: msg_type - type: keyword - - name: msgid - type: keyword - - name: netsessid - type: keyword - - name: num - type: keyword - - name: number1 - type: keyword - - name: number2 - type: keyword - - name: nwwn - type: keyword - - name: object - type: keyword - - name: operation - type: keyword - - name: opkt - type: keyword - - name: orig_from - type: keyword - - name: owner_id - type: keyword - - name: p_action - type: keyword - - name: p_filter - type: keyword - - name: p_group_object - type: keyword - - name: p_id - type: keyword - - name: p_msgid1 - type: keyword - - name: p_msgid2 - type: keyword - - name: p_result1 - type: keyword - - name: password_chg - type: keyword - - name: password_expire - type: keyword - - name: permgranted - type: keyword - - name: permwanted - type: keyword - - name: pgid - type: keyword - - name: policyUUID - type: keyword - - name: prog_asp_num - type: keyword - - name: program - type: keyword - - name: real_data - type: keyword - - name: rec_asp_device - type: keyword - - name: rec_asp_num - type: keyword - - name: rec_library - type: keyword - - name: recordnum - type: keyword - - name: ruid - type: keyword - - name: sburb - type: keyword - - name: sdomain_fld - type: keyword - - name: sec - type: keyword - - name: sensorname - type: keyword - - name: seqnum - type: keyword - - name: session - type: keyword - - name: sessiontype - type: keyword - - name: sigUUID - type: keyword - - name: spi - type: keyword - - name: srcburb - type: keyword - - name: srcdom - type: keyword - - name: srcservice - type: keyword - - name: state - type: keyword - - name: status1 - type: keyword - - name: svcno - type: keyword - - name: system - type: keyword - - name: tbdstr1 - type: keyword - - name: tgtdom - type: keyword - - name: tgtdomain - type: keyword - - name: threshold - type: keyword - - name: type1 - type: keyword - - name: udb_class - type: keyword - - name: url_fld - type: keyword - - name: user_div - type: keyword - - name: userid - type: keyword - - name: username_fld - type: keyword - - name: utcstamp - type: keyword - - name: v_instafname - type: keyword - - name: virt_data - type: keyword - - name: vpnid - type: keyword - - name: autorun_type - type: keyword - description: This is used to capture Auto Run type - - name: cc_number - type: long - description: Valid Credit Card Numbers only - - name: content - type: keyword - description: This key captures the content type from protocol headers - - name: ein_number - type: long - description: Employee Identification Numbers only - - name: found - type: keyword - description: This is used to capture the results of regex match - - name: language - type: keyword - description: This is used to capture list of languages the client support and what it prefers - - name: lifetime - type: long - description: This key is used to capture the session lifetime in seconds. - - name: link - type: keyword - description: This key is used to link the sessions together. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: match - type: keyword - description: This key is for regex match name from search.ini - - name: param_dst - type: keyword - description: This key captures the command line/launch argument of the target process or file - - name: param_src - type: keyword - description: This key captures source parameter - - name: search_text - type: keyword - description: This key captures the Search Text used - - name: sig_name - type: keyword - description: This key is used to capture the Signature Name only. - - name: snmp_value - type: keyword - description: SNMP set request value - - name: streams - type: long - description: This key captures number of streams in session - - name: db - type: group - fields: - - name: index - type: keyword - description: This key captures IndexID of the index. - - name: instance - type: keyword - description: This key is used to capture the database server instance name - - name: database - type: keyword - description: This key is used to capture the name of a database or an instance as seen in a session - - name: transact_id - type: keyword - description: This key captures the SQL transantion ID of the current session - - name: permissions - type: keyword - description: This key captures permission or privilege level assigned to a resource. - - name: table_name - type: keyword - description: This key is used to capture the table name - - name: db_id - type: keyword - description: This key is used to capture the unique identifier for a database - - name: db_pid - type: long - description: This key captures the process id of a connection with database server - - name: lread - type: long - description: This key is used for the number of logical reads - - name: lwrite - type: long - description: This key is used for the number of logical writes - - name: pread - type: long - description: This key is used for the number of physical writes - - name: network - type: group - fields: - - name: alias_host - type: keyword - description: This key should be used when the source or destination context of a hostname is not clear.Also it captures the Device Hostname. Any Hostname that isnt ad.computer. - - name: domain - type: keyword - - name: host_dst - type: keyword - description: "This key should only be used when it’s a Destination Hostname" - - name: network_service - type: keyword - description: This is used to capture layer 7 protocols/service names - - name: interface - type: keyword - description: This key should be used when the source or destination context of an interface is not clear - - name: network_port - type: long - description: 'Deprecated, use port. NOTE: There is a type discrepancy as currently used, TM: Int32, INDEX: UInt64 (why neither chose the correct UInt16?!)' - - name: eth_host - type: keyword - description: Deprecated, use alias.mac - - name: sinterface - type: keyword - description: "This key should only be used when it’s a Source Interface" - - name: dinterface - type: keyword - description: "This key should only be used when it’s a Destination Interface" - - name: vlan - type: long - description: This key should only be used to capture the ID of the Virtual LAN - - name: zone_src - type: keyword - description: "This key should only be used when it’s a Source Zone." - - name: zone - type: keyword - description: This key should be used when the source or destination context of a Zone is not clear - - name: zone_dst - type: keyword - description: "This key should only be used when it’s a Destination Zone." - - name: gateway - type: keyword - description: This key is used to capture the IP Address of the gateway - - name: icmp_type - type: long - description: This key is used to capture the ICMP type only - - name: mask - type: keyword - description: This key is used to capture the device network IPmask. - - name: icmp_code - type: long - description: This key is used to capture the ICMP code only - - name: protocol_detail - type: keyword - description: This key should be used to capture additional protocol information - - name: dmask - type: keyword - description: This key is used for Destionation Device network mask - - name: port - type: long - description: This key should only be used to capture a Network Port when the directionality is not clear - - name: smask - type: keyword - description: This key is used for capturing source Network Mask - - name: netname - type: keyword - description: This key is used to capture the network name associated with an IP range. This is configured by the end user. - - name: paddr - type: ip - description: Deprecated - - name: faddr - type: keyword - - name: lhost - type: keyword - - name: origin - type: keyword - - name: remote_domain_id - type: keyword - - name: addr - type: keyword - - name: dns_a_record - type: keyword - - name: dns_ptr_record - type: keyword - - name: fhost - type: keyword - - name: fport - type: keyword - - name: laddr - type: keyword - - name: linterface - type: keyword - - name: phost - type: keyword - - name: ad_computer_dst - type: keyword - description: Deprecated, use host.dst - - name: eth_type - type: long - description: This key is used to capture Ethernet Type, Used for Layer 3 Protocols Only - - name: ip_proto - type: long - description: This key should be used to capture the Protocol number, all the protocol nubers are converted into string in UI - - name: dns_cname_record - type: keyword - - name: dns_id - type: keyword - - name: dns_opcode - type: keyword - - name: dns_resp - type: keyword - - name: dns_type - type: keyword - - name: domain1 - type: keyword - - name: host_type - type: keyword - - name: packet_length - type: keyword - - name: host_orig - type: keyword - description: This is used to capture the original hostname in case of a Forwarding Agent or a Proxy in between. - - name: rpayload - type: keyword - description: This key is used to capture the total number of payload bytes seen in the retransmitted packets. - - name: vlan_name - type: keyword - description: This key should only be used to capture the name of the Virtual LAN - - name: investigations - type: group - fields: - - name: ec_activity - type: keyword - description: This key captures the particular event activity(Ex:Logoff) - - name: ec_theme - type: keyword - description: This key captures the Theme of a particular Event(Ex:Authentication) - - name: ec_subject - type: keyword - description: This key captures the Subject of a particular Event(Ex:User) - - name: ec_outcome - type: keyword - description: This key captures the outcome of a particular Event(Ex:Success) - - name: event_cat - type: long - description: This key captures the Event category number - - name: event_cat_name - type: keyword - description: This key captures the event category name corresponding to the event cat code - - name: event_vcat - type: keyword - description: This is a vendor supplied category. This should be used in situations where the vendor has adopted their own event_category taxonomy. - - name: analysis_file - type: keyword - description: This is used to capture all indicators used in a File Analysis. This key should be used to capture an analysis of a file - - name: analysis_service - type: keyword - description: This is used to capture all indicators used in a Service Analysis. This key should be used to capture an analysis of a service - - name: analysis_session - type: keyword - description: This is used to capture all indicators used for a Session Analysis. This key should be used to capture an analysis of a session - - name: boc - type: keyword - description: This is used to capture behaviour of compromise - - name: eoc - type: keyword - description: This is used to capture Enablers of Compromise - - name: inv_category - type: keyword - description: This used to capture investigation category - - name: inv_context - type: keyword - description: This used to capture investigation context - - name: ioc - type: keyword - description: This is key capture indicator of compromise - - name: counters - type: group - fields: - - name: dclass_c1 - type: long - description: This is a generic counter key that should be used with the label dclass.c1.str only - - name: dclass_c2 - type: long - description: This is a generic counter key that should be used with the label dclass.c2.str only - - name: event_counter - type: long - description: This is used to capture the number of times an event repeated - - name: dclass_r1 - type: keyword - description: This is a generic ratio key that should be used with the label dclass.r1.str only - - name: dclass_c3 - type: long - description: This is a generic counter key that should be used with the label dclass.c3.str only - - name: dclass_c1_str - type: keyword - description: This is a generic counter string key that should be used with the label dclass.c1 only - - name: dclass_c2_str - type: keyword - description: This is a generic counter string key that should be used with the label dclass.c2 only - - name: dclass_r1_str - type: keyword - description: This is a generic ratio string key that should be used with the label dclass.r1 only - - name: dclass_r2 - type: keyword - description: This is a generic ratio key that should be used with the label dclass.r2.str only - - name: dclass_c3_str - type: keyword - description: This is a generic counter string key that should be used with the label dclass.c3 only - - name: dclass_r3 - type: keyword - description: This is a generic ratio key that should be used with the label dclass.r3.str only - - name: dclass_r2_str - type: keyword - description: This is a generic ratio string key that should be used with the label dclass.r2 only - - name: dclass_r3_str - type: keyword - description: This is a generic ratio string key that should be used with the label dclass.r3 only - - name: identity - type: group - fields: - - name: auth_method - type: keyword - description: This key is used to capture authentication methods used only - - name: user_role - type: keyword - description: This key is used to capture the Role of a user only - - name: dn - type: keyword - description: X.500 (LDAP) Distinguished Name - - name: logon_type - type: keyword - description: This key is used to capture the type of logon method used. - - name: profile - type: keyword - description: This key is used to capture the user profile - - name: accesses - type: keyword - description: This key is used to capture actual privileges used in accessing an object - - name: realm - type: keyword - description: Radius realm or similar grouping of accounts - - name: user_sid_dst - type: keyword - description: This key captures Destination User Session ID - - name: dn_src - type: keyword - description: An X.500 (LDAP) Distinguished name that is used in a context that indicates a Source dn - - name: org - type: keyword - description: This key captures the User organization - - name: dn_dst - type: keyword - description: An X.500 (LDAP) Distinguished name that used in a context that indicates a Destination dn - - name: firstname - type: keyword - description: This key is for First Names only, this is used for Healthcare predominantly to capture Patients information - - name: lastname - type: keyword - description: This key is for Last Names only, this is used for Healthcare predominantly to capture Patients information - - name: user_dept - type: keyword - description: User's Department Names only - - name: user_sid_src - type: keyword - description: This key captures Source User Session ID - - name: federated_sp - type: keyword - description: This key is the Federated Service Provider. This is the application requesting authentication. - - name: federated_idp - type: keyword - description: This key is the federated Identity Provider. This is the server providing the authentication. - - name: logon_type_desc - type: keyword - description: This key is used to capture the textual description of an integer logon type as stored in the meta key 'logon.type'. - - name: middlename - type: keyword - description: This key is for Middle Names only, this is used for Healthcare predominantly to capture Patients information - - name: password - type: keyword - description: This key is for Passwords seen in any session, plain text or encrypted - - name: host_role - type: keyword - description: This key should only be used to capture the role of a Host Machine - - name: ldap - type: keyword - description: "This key is for Uninterpreted LDAP values. Ldap Values that don’t have a clear query or response context" - - name: ldap_query - type: keyword - description: This key is the Search criteria from an LDAP search - - name: ldap_response - type: keyword - description: This key is to capture Results from an LDAP search - - name: owner - type: keyword - description: This is used to capture username the process or service is running as, the author of the task - - name: service_account - type: keyword - description: This key is a windows specific key, used for capturing name of the account a service (referenced in the event) is running under. Legacy Usage - - name: email - type: group - fields: - - name: email_dst - type: keyword - description: This key is used to capture the Destination email address only, when the destination context is not clear use email - - name: email_src - type: keyword - description: This key is used to capture the source email address only, when the source context is not clear use email - - name: subject - type: keyword - description: This key is used to capture the subject string from an Email only. - - name: email - type: keyword - description: This key is used to capture a generic email address where the source or destination context is not clear - - name: trans_from - type: keyword - description: Deprecated key defined only in table map. - - name: trans_to - type: keyword - description: Deprecated key defined only in table map. - - name: file - type: group - fields: - - name: privilege - type: keyword - description: Deprecated, use permissions - - name: attachment - type: keyword - description: This key captures the attachment file name - - name: filesystem - type: keyword - - name: binary - type: keyword - description: Deprecated key defined only in table map. - - name: filename_dst - type: keyword - description: This is used to capture name of the file targeted by the action - - name: filename_src - type: keyword - description: This is used to capture name of the parent filename, the file which performed the action - - name: filename_tmp - type: keyword - - name: directory_dst - type: keyword - description: This key is used to capture the directory of the target process or file - - name: directory_src - type: keyword - description: This key is used to capture the directory of the source process or file - - name: file_entropy - type: double - description: This is used to capture entropy vale of a file - - name: file_vendor - type: keyword - description: This is used to capture Company name of file located in version_info - - name: task_name - type: keyword - description: This is used to capture name of the task - - name: web - type: group - fields: - - name: fqdn - type: keyword - description: Fully Qualified Domain Names - - name: web_cookie - type: keyword - description: This key is used to capture the Web cookies specifically. - - name: alias_host - type: keyword - - name: reputation_num - type: double - description: Reputation Number of an entity. Typically used for Web Domains - - name: web_ref_domain - type: keyword - description: Web referer's domain - - name: web_ref_query - type: keyword - description: This key captures Web referer's query portion of the URL - - name: remote_domain - type: keyword - - name: web_ref_page - type: keyword - description: This key captures Web referer's page information - - name: web_ref_root - type: keyword - description: Web referer's root URL path - - name: cn_asn_dst - type: keyword - - name: cn_rpackets - type: keyword - - name: urlpage - type: keyword - - name: urlroot - type: keyword - - name: p_url - type: keyword - - name: p_user_agent - type: keyword - - name: p_web_cookie - type: keyword - - name: p_web_method - type: keyword - - name: p_web_referer - type: keyword - - name: web_extension_tmp - type: keyword - - name: web_page - type: keyword - - name: threat - type: group - fields: - - name: threat_category - type: keyword - description: This key captures Threat Name/Threat Category/Categorization of alert - - name: threat_desc - type: keyword - description: This key is used to capture the threat description from the session directly or inferred - - name: alert - type: keyword - description: This key is used to capture name of the alert - - name: threat_source - type: keyword - description: This key is used to capture source of the threat - - name: crypto - type: group - fields: - - name: crypto - type: keyword - description: This key is used to capture the Encryption Type or Encryption Key only - - name: cipher_src - type: keyword - description: This key is for Source (Client) Cipher - - name: cert_subject - type: keyword - description: This key is used to capture the Certificate organization only - - name: peer - type: keyword - description: This key is for Encryption peer's IP Address - - name: cipher_size_src - type: long - description: This key captures Source (Client) Cipher Size - - name: ike - type: keyword - description: IKE negotiation phase. - - name: scheme - type: keyword - description: This key captures the Encryption scheme used - - name: peer_id - type: keyword - description: "This key is for Encryption peer’s identity" - - name: sig_type - type: keyword - description: This key captures the Signature Type - - name: cert_issuer - type: keyword - - name: cert_host_name - type: keyword - description: Deprecated key defined only in table map. - - name: cert_error - type: keyword - description: This key captures the Certificate Error String - - name: cipher_dst - type: keyword - description: This key is for Destination (Server) Cipher - - name: cipher_size_dst - type: long - description: This key captures Destination (Server) Cipher Size - - name: ssl_ver_src - type: keyword - description: Deprecated, use version - - name: d_certauth - type: keyword - - name: s_certauth - type: keyword - - name: ike_cookie1 - type: keyword - description: "ID of the negotiation — sent for ISAKMP Phase One" - - name: ike_cookie2 - type: keyword - description: "ID of the negotiation — sent for ISAKMP Phase Two" - - name: cert_checksum - type: keyword - - name: cert_host_cat - type: keyword - description: This key is used for the hostname category value of a certificate - - name: cert_serial - type: keyword - description: This key is used to capture the Certificate serial number only - - name: cert_status - type: keyword - description: This key captures Certificate validation status - - name: ssl_ver_dst - type: keyword - description: Deprecated, use version - - name: cert_keysize - type: keyword - - name: cert_username - type: keyword - - name: https_insact - type: keyword - - name: https_valid - type: keyword - - name: cert_ca - type: keyword - description: This key is used to capture the Certificate signing authority only - - name: cert_common - type: keyword - description: This key is used to capture the Certificate common name only - - name: wireless - type: group - fields: - - name: wlan_ssid - type: keyword - description: This key is used to capture the ssid of a Wireless Session - - name: access_point - type: keyword - description: This key is used to capture the access point name. - - name: wlan_channel - type: long - description: This is used to capture the channel names - - name: wlan_name - type: keyword - description: This key captures either WLAN number/name - - name: storage - type: group - fields: - - name: disk_volume - type: keyword - description: A unique name assigned to logical units (volumes) within a physical disk - - name: lun - type: keyword - description: Logical Unit Number.This key is a very useful concept in Storage. - - name: pwwn - type: keyword - description: This uniquely identifies a port on a HBA. - - name: physical - type: group - fields: - - name: org_dst + - name: priority type: keyword - description: This is used to capture the destination organization based on the GEOPIP Maxmind database. - - name: org_src + - name: signature type: keyword - description: This is used to capture the source organization based on the GEOPIP Maxmind database. - - name: healthcare - type: group - fields: - - name: patient_fname + - name: dhost type: keyword - description: This key is for First Names only, this is used for Healthcare predominantly to capture Patients information - - name: patient_id + - name: decision type: keyword - description: This key captures the unique ID for a patient - - name: patient_lname + - name: mac type: keyword - description: This key is for Last Names only, this is used for Healthcare predominantly to capture Patients information - - name: patient_mname + - name: action type: keyword - description: This key is for Middle Names only, this is used for Healthcare predominantly to capture Patients information - - name: endpoint + - name: site_to_site_vpn type: group fields: - - name: host_state - type: keyword - description: This key is used to capture the current state of the machine, such as blacklisted, infected, firewall disabled and so on - - name: registry_key - type: keyword - description: This key captures the path to the registry key - - name: registry_value - type: keyword - description: This key captures values or decorators used within a registry entry -- name: network.interface.name - type: keyword -- name: dns.question.domain - type: keyword - description: Server domain. + - name: raw + type: text + - name: connectivity_change + type: flattened diff --git a/packages/cisco_meraki/data_stream/log/manifest.yml b/packages/cisco_meraki/data_stream/log/manifest.yml index 1e6886498d38..bf78f78a8096 100644 --- a/packages/cisco_meraki/data_stream/log/manifest.yml +++ b/packages/cisco_meraki/data_stream/log/manifest.yml @@ -1,67 +1,54 @@ -title: Cisco Meraki logs +title: Cisco Meraki logs (via Syslog) release: experimental type: logs streams: - input: udp - title: Cisco Meraki logs - description: Collect Cisco Meraki logs template_path: udp.yml.hbs + title: Cisco Meraki logs + description: Collect Cisco Meraki logs (via Syslog) + enabled: true vars: - - name: tags + - name: listen_address type: text - title: Tags - multi: true - required: true - show_user: false - default: - - cisco-meraki - - forwarded - - name: udp_host - type: text - title: UDP host to listen on + title: Listen Address + description: The bind address to listen for UDP connections. Set to `0.0.0.0` to bind to all available interfaces. multi: false required: true show_user: true default: localhost - - name: udp_port + - name: listen_port type: integer - title: UDP port to listen on + title: Listen Port + description: The UDP port number to listen on. multi: false required: true show_user: true - default: 9525 - - name: tz_offset - type: text - title: Timezone offset (+HH:mm format) - required: false - show_user: true - default: "local" - - name: rsa_fields - type: bool - title: Add non-ECS fields - required: false - show_user: true - default: true - - name: keep_raw_fields - type: bool - title: Keep raw parser fields - required: false - show_user: false - default: false - - name: debug - type: bool - title: Enable debug logging - required: false - show_user: false - default: false + default: 8685 - name: preserve_original_event required: true show_user: true title: Preserve original event - description: Preserves a raw copy of the original event, added to the field `event.original` + description: Preserves a raw copy of the original event, added to the field `event.original`. type: bool multi: false default: false + - name: tags + type: text + title: Tags + multi: true + required: true + show_user: false + default: + - cisco-meraki + - forwarded + - name: tz_offset + type: text + title: Timezone + multi: false + required: false + show_user: false + default: UTC + description: IANA time zone or time offset (e.g. `+0200`) to use when interpreting syslog timestamps without a time zone. - name: processors type: yaml title: Processors @@ -69,68 +56,66 @@ streams: required: false show_user: false description: > - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. - input: tcp - title: Cisco Meraki logs - description: Collect Cisco Meraki logs template_path: tcp.yml.hbs + title: Cisco Meraki logs + description: Collect Cisco Meraki logs (via Syslog) + enabled: false vars: - - name: tags - type: text - title: Tags - multi: true - required: true - show_user: false - default: - - cisco-meraki - - forwarded - - name: tcp_host + - name: listen_address type: text - title: TCP host to listen on + title: Listen Address + description: The bind address to listen for TCP connections. Set to `0.0.0.0` to bind to all available interfaces. multi: false required: true show_user: true default: localhost - - name: tcp_port + - name: listen_port type: integer - title: TCP port to listen on + title: Listen Port + description: The TCP port number to listen on. multi: false required: true show_user: true - default: 9525 - - name: tz_offset - type: text - title: Timezone offset (+HH:mm format) - required: false - show_user: true - default: "local" - - name: rsa_fields - type: bool - title: Add non-ECS fields - required: false - show_user: true - default: true - - name: keep_raw_fields - type: bool - title: Keep raw parser fields - required: false - show_user: false - default: false - - name: debug - type: bool - title: Enable debug logging - required: false - show_user: false - default: false + default: 8685 - name: preserve_original_event required: true show_user: true title: Preserve original event - description: Preserves a raw copy of the original event, added to the field `event.original` + description: Preserves a raw copy of the original event, added to the field `event.original`. type: bool multi: false default: false + - name: ssl + type: yaml + title: TLS + description: Options for enabling TLS for the listening TCP socket. See the [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html) for a list of all options. + multi: false + required: false + show_user: false + default: | + enabled: false + certificate: "/etc/pki/client/cert.pem" + key: "/etc/pki/client/cert.key" + - name: tags + type: text + title: Tags + multi: true + required: true + show_user: false + default: + - cisco-meraki + - forwarded + - name: tz_offset + type: text + title: Timezone + multi: false + required: false + show_user: false + default: UTC + description: IANA time zone or time offset (e.g. `+0200`) to use when interpreting syslog timestamps without a time zone. - name: processors type: yaml title: Processors @@ -138,67 +123,53 @@ streams: required: false show_user: false description: > - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. - input: logfile - enabled: false + template_path: logfile.yml.hbs title: Cisco Meraki logs - description: Collect Cisco Meraki logs from file + description: Collect Cisco Meraki logs (via Syslog) + enabled: false vars: - name: paths type: text title: Paths multi: true - required: true + required: false show_user: true default: - /var/log/cisco-meraki.log + - name: preserve_original_event + required: true + show_user: true + title: Preserve original event + description: Preserves a raw copy of the original event, added to the field `event.original`. + type: bool + multi: false + default: false - name: tags type: text title: Tags multi: true required: true - show_user: false + show_user: true default: - cisco-meraki - forwarded - name: tz_offset type: text - title: Timezone offset (+HH:mm format) - required: false - show_user: true - default: "local" - - name: rsa_fields - type: bool - title: Add non-ECS fields - required: false - show_user: true - default: true - - name: keep_raw_fields - type: bool - title: Keep raw parser fields - required: false - show_user: false - default: false - - name: debug - type: bool - title: Enable debug logging + title: Timezone + multi: false required: false show_user: false - default: false - - name: preserve_original_event - required: true - show_user: true - title: Preserve original event - description: Preserves a raw copy of the original event, added to the field `event.original` - type: bool - multi: false - default: false + default: UTC + description: IANA time zone or time offset (e.g. `+0200`) to use when interpreting syslog timestamps without a time zone. - name: processors type: yaml title: Processors multi: false required: false show_user: false - description: >- - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + description: > + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + diff --git a/packages/cisco_meraki/data_stream/log/sample_event.json b/packages/cisco_meraki/data_stream/log/sample_event.json index e3cebb197bf3..28606304bee9 100644 --- a/packages/cisco_meraki/data_stream/log/sample_event.json +++ b/packages/cisco_meraki/data_stream/log/sample_event.json @@ -1,11 +1,22 @@ { - "@timestamp": "2016-01-29T06:09:59.000Z", + "@timestamp": "2021-11-23T18:13:18.348Z", "agent": { - "ephemeral_id": "32decd4f-7a04-474b-8958-de335bfff10f", - "id": "4e3f135a-d5f9-40b6-ae01-2c834ecbead0", + "ephemeral_id": "b81987d6-cf2e-4101-af0b-0415b1576f88", + "hostname": "docker-fleet-agent", + "id": "9e1c0aac-8d48-4c33-a9f5-98e770f2028e", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.0.0" + "version": "7.17.0" + }, + "cisco_meraki": { + "event_subtype": "ids_alerted", + "event_type": "security_event", + "security": { + "decision": "allowed", + "dhost": "D0-AB-D5-7B-43-73", + "priority": "1", + "signature": "1:29708:4" + } }, "data_stream": { "dataset": "cisco_meraki.log", @@ -13,78 +24,72 @@ "type": "logs" }, "destination": { - "ip": [ - "10.193.124.51" - ], - "port": 5293 + "ip": "10.0.3.162", + "port": 56391 }, "ecs": { "version": "8.2.0" }, "elastic_agent": { - "id": "4e3f135a-d5f9-40b6-ae01-2c834ecbead0", - "snapshot": true, - "version": "8.0.0" + "id": "9e1c0aac-8d48-4c33-a9f5-98e770f2028e", + "snapshot": false, + "version": "7.17.0" }, "event": { - "action": "deny\n", + "action": "ids-signature-matched", "agent_id_status": "verified", - "code": "security_event", + "category": [ + "network", + "threat" + ], "dataset": "cisco_meraki.log", - "ingested": "2022-01-25T12:08:12Z", - "original": "modtempo 1454047799.olab nto_ security_event olaborissecurity_event tur url=https://example.org/odoco/ria.jpg?ritin=uredolor#tatemac src=10.15.44.253:5078 dst=10.193.124.51:5293 mac=01:00:5e:28:ae:7d name=psa sha256=umq disposition=ntium action=deny\n", - "timezone": "+00:00" + "ingested": "2022-04-26T04:02:28Z", + "original": "\u003c134\u003e1 1637691198.348361125 MX84 security_event ids_alerted signature=1:29708:4 priority=1 timestamp=1637691198.330873 dhost=D0:AB:D5:7B:43:73 direction=ingress protocol=tcp/ip src=67.43.156.12:80 dst=10.0.3.162:56391 decision=allowed message: BROWSER-IE Microsoft Internet Explorer CSS uninitialized object access attempt detected", + "type": [ + "info", + "indicator" + ] }, "input": { "type": "udp" }, "log": { "source": { - "address": "172.30.0.4:37331" + "address": "192.168.208.4:40317" } }, - "observer": { - "product": "Meraki", - "type": "Wireless", - "vendor": "Cisco" + "network": { + "direction": "ingress", + "protocol": "tcp/ip" }, - "related": { - "ip": [ - "10.193.124.51", - "10.15.44.253" - ] + "observer": { + "hostname": "MX84" }, - "rsa": { - "internal": { - "event_desc": "olaborissecurity_event tur", - "messageid": "security_event" + "source": { + "as": { + "number": 35908 }, - "misc": { - "action": [ - "deny\n" - ], - "disposition": "ntium", - "event_type": "security_event", - "node": "nto_", - "sensor": "nto_" + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } }, - "time": { - "event_time": "2016-01-29T06:09:59.000Z" - } - }, - "source": { - "ip": [ - "10.15.44.253" - ], - "mac": "01:00:5e:28:ae:7d", - "port": 5078 + "ip": "67.43.156.12", + "port": 80 }, "tags": [ "preserve_original_event", "cisco-meraki", "forwarded" ], - "url": { - "original": "https://example.org/odoco/ria.jpg?ritin=uredolor#tatemac" + "threat": { + "indicator": { + "description": " BROWSER-IE Microsoft Internet Explorer CSS uninitialized object access attempt detected", + "last_seen": "2021-11-23T18:13:18.330Z" + } } } \ No newline at end of file diff --git a/packages/cisco_meraki/docs/README.md b/packages/cisco_meraki/docs/README.md index 8a8350ccbf56..baea4f77535b 100644 --- a/packages/cisco_meraki/docs/README.md +++ b/packages/cisco_meraki/docs/README.md @@ -1,27 +1,308 @@ # Cisco Meraki Integration -This integration is for Cisco Meraki device's logs. It includes the following -datasets for receiving logs over syslog or read from a file: +Cisco Meraki offers a centralized cloud management platform for all Meraki devices such as MX Security Appliances, MR Access Points and so on. Its out-of-band cloud architecture creates secure, scalable and easy-to-deploy networks that can be managed from anywhere. This can be done from almost any device using web-based Meraki Dashboard and Meraki Mobile App. Each Meraki network generates its own events. -- `log` dataset: supports Cisco Meraki logs. +Cisco Meraki offers [several methods for device reporting](https://documentation.meraki.com/General_Administration/Monitoring_and_Reporting/Meraki_Device_Reporting_-_Syslog%2C_SNMP%2C_and_API). This integration supports gathering events via the Cisco Meraki syslog and via API reporting webhooks. The integration package allows you to search, observe, and visualize the events through Elasticsearch. + +## Compatibility + +A syslog server can be configured to store messages for reporting purposes from MX Security Appliances, MR Access Points, and MS switches. This package collects events from the configured syslog server. The integration supports collection of events from "MX Security Appliances" and "MR Access Points". The "MS Switch" events are not recognized. + +## Configuration + +### Enabling the integration in Elastic + +1. In Kibana go to **Management > Integrations** +2. In "Search for integrations" search bar type **Meraki** +3. Click on "Cisco Meraki" integration from the search results. +4. Click on **Add Cisco Meraki Integration** button to add the integration. + +### Cisco Meraki Dashboard Configuration + +#### Syslog + +Cisco Meraki dashboard can be used to configure one or more syslog servers and Meraki message types to be sent to the syslog servers. Refer to [Syslog Server Overview and Configuration](https://documentation.meraki.com/General_Administration/Monitoring_and_Reporting/Syslog_Server_Overview_and_Configuration#Configuring_a_Syslog_Server) page for more information on how to configure syslog server on Cisco Meraki. + +#### API Endpoint (Webhooks) + +Cisco Meraki dashboard can be used to configure Meraki webhooks. Refer to the [Webhooks Dashboard Setup](https://documentation.meraki.com/General_Administration/Monitoring_and_Reporting/Meraki_Device_Reporting_-_Syslog%2C_SNMP%2C_and_API#Webhooks_Dashboard_Setup) section. + +### Configure the Cisco Meraki integration + +#### Syslog + +Depending on the syslog server setup in your environment check one/more of the following options "Collect syslog from Cisco Meraki via UDP", "Collect syslog from Cisco Meraki via TCP", "Collect syslog from Cisco Meraki via file". + +Enter the values for syslog host and port OR file path based on the chosen configuration options. + +### API Endpoint (Webhooks) + +Check the option "Collect events from Cisco Meraki via Webhooks" option. + +1. Enter values for "Listen Address", "Listen Port" and "Webhook path" to form the endpoint URL. Make note of the **Endpoint URL** https://{AGENT_ADDRESS}:8686/meraki/events. +2. Enter value for "Secret value". This must match the "Shared Secret" value entered when configuring the webhook from Meraki cloud. +3. Enter values for "TLS". Cisco Meraki requires that the webhook accept requests over HTTPS. So you must either configure the integration with a valid TLS certificate or use a reverse proxy in front of the integration. + +### Log Events + +Enable to collect Cisco Meraki log events for all the applications configured for the chosen log stream. ## Logs -### Meraki +### Syslog + +The `cisco_meraki.log` dataset provides events from the configured syslog server. All Cisco Meraki syslog specific fields are available in the `cisco_meraki.log` field group. + +**Exported fields** + +| Field | Description | Type | +|---|---|---| +| @timestamp | Event timestamp. | date | +| cisco_meraki.8021x_auth | | flattened | +| cisco_meraki.8021x_deauth | | flattened | +| cisco_meraki.8021x_eap_failure | | flattened | +| cisco_meraki.8021x_eap_success | | flattened | +| cisco_meraki.aps_association_reject | | flattened | +| cisco_meraki.association | | flattened | +| cisco_meraki.bssid | | keyword | +| cisco_meraki.channel | | keyword | +| cisco_meraki.device_packet_flood | | flattened | +| cisco_meraki.dfs_event | | flattened | +| cisco_meraki.disassociation | | flattened | +| cisco_meraki.event_subtype | | keyword | +| cisco_meraki.event_type | | keyword | +| cisco_meraki.fc_subtype | | keyword | +| cisco_meraki.fc_type | | keyword | +| cisco_meraki.flows | | flattened | +| cisco_meraki.multiple_dhcp_servers_detected | | flattened | +| cisco_meraki.security.action | | keyword | +| cisco_meraki.security.decision | | keyword | +| cisco_meraki.security.dhost | | keyword | +| cisco_meraki.security.mac | | keyword | +| cisco_meraki.security.priority | | keyword | +| cisco_meraki.security.signature | | keyword | +| cisco_meraki.site_to_site_vpn.connectivity_change | | flattened | +| cisco_meraki.site_to_site_vpn.raw | | text | +| cisco_meraki.splash_auth | | flattened | +| cisco_meraki.urls.mac | | keyword | +| cisco_meraki.vap | | keyword | +| cisco_meraki.wpa_auth | | flattened | +| cisco_meraki.wpa_deauth | | flattened | +| client.domain | The domain name of the client system. This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. | keyword | +| client.geo.city_name | City name. | keyword | +| client.geo.continent_name | Name of the continent. | keyword | +| client.geo.country_iso_code | Country ISO code. | keyword | +| client.geo.country_name | Country name. | keyword | +| client.geo.location.lat | Longitude and latitude. | geo_point | +| client.geo.location.lon | Longitude and latitude. | geo_point | +| client.geo.region_iso_code | Region ISO code. | keyword | +| client.geo.region_name | Region name. | keyword | +| client.ip | IP address of the client (IPv4 or IPv6). | ip | +| client.mac | MAC address of the client. The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | keyword | +| client.registered_domain | The highest registered client domain, stripped of the subdomain. For example, the registered domain for "foo.example.com" is "example.com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". | keyword | +| client.subdomain | The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain. In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain. For example the subdomain portion of "www.east.mydomain.co.uk" is "east". If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period. | keyword | +| client.top_level_domain | The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". | keyword | +| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | +| cloud.availability_zone | Availability zone in which this host is running. | keyword | +| cloud.image.id | Image ID for the cloud instance. | keyword | +| cloud.instance.id | Instance ID of the host machine. | keyword | +| cloud.instance.name | Instance name of the host machine. | keyword | +| cloud.machine.type | Machine type of the host machine. | keyword | +| cloud.project.id | Name of the project in Google Cloud. | keyword | +| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | +| cloud.region | Region in which this host is running. | keyword | +| container.id | Unique container id. | keyword | +| container.image.name | Name of the image the container was built on. | keyword | +| container.labels | Image labels. | object | +| container.name | Container name. | keyword | +| data_stream.dataset | Data stream dataset. | constant_keyword | +| data_stream.namespace | Data stream namespace. | constant_keyword | +| data_stream.type | Data stream type. | constant_keyword | +| destination.address | Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. | keyword | +| destination.as.number | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | long | +| destination.as.organization.name | Organization name. | keyword | +| destination.as.organization.name.text | Multi-field of `destination.as.organization.name`. | match_only_text | +| destination.bytes | Bytes sent from the destination to the source. | long | +| destination.domain | The domain name of the destination system. This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. | keyword | +| destination.geo.city_name | City name. | keyword | +| destination.geo.continent_name | Name of the continent. | keyword | +| destination.geo.country_iso_code | Country ISO code. | keyword | +| destination.geo.country_name | Country name. | keyword | +| destination.geo.location | Longitude and latitude. | geo_point | +| destination.geo.region_iso_code | Region ISO code. | keyword | +| destination.geo.region_name | Region name. | keyword | +| destination.ip | IP address of the destination (IPv4 or IPv6). | ip | +| destination.mac | MAC address of the destination. The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | keyword | +| destination.nat.ip | Translated ip of destination based NAT sessions (e.g. internet to private DMZ) Typically used with load balancers, firewalls, or routers. | ip | +| destination.nat.port | Port the source session is translated to by NAT Device. Typically used with load balancers, firewalls, or routers. | long | +| destination.port | Port of the destination. | long | +| destination.registered_domain | The highest registered destination domain, stripped of the subdomain. For example, the registered domain for "foo.example.com" is "example.com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". | keyword | +| destination.subdomain | The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain. In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain. For example the subdomain portion of "www.east.mydomain.co.uk" is "east". If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period. | keyword | +| destination.top_level_domain | The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". | keyword | +| dns.answers.name | The domain name to which this resource record pertains. If a chain of CNAME is being resolved, each answer's `name` should be the one that corresponds with the answer's `data`. It should not simply be the original `question.name` repeated. | keyword | +| dns.answers.type | The type of data contained in this resource record. | keyword | +| dns.question.registered_domain | The highest registered domain, stripped of the subdomain. For example, the registered domain for "foo.example.com" is "example.com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". | keyword | +| dns.question.subdomain | The subdomain is all of the labels under the registered_domain. If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period. | keyword | +| dns.question.top_level_domain | The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". | keyword | +| dns.question.type | The type of record being queried. | keyword | +| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | +| error.message | Error message. | match_only_text | +| event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | +| event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | +| event.code | Identification code for this event, if one exists. Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. | keyword | +| event.dataset | Event dataset | constant_keyword | +| event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | +| event.module | Event module | constant_keyword | +| event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | +| event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | +| event.timezone | This field should be populated when the event's timestamp does not include timezone information already (e.g. default Syslog timestamps). It's optional otherwise. Acceptable timezone formats are: a canonical ID (e.g. "Europe/Amsterdam"), abbreviated (e.g. "EST") or an HH:mm differential (e.g. "-05:00"). | keyword | +| event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | +| file.attributes | Array of file attributes. Attributes names will vary by platform. Here's a non-exhaustive list of values that are expected in this field: archive, compressed, directory, encrypted, execute, hidden, read, readonly, system, write. | keyword | +| file.directory | Directory where the file is located. It should include the drive letter, when appropriate. | keyword | +| file.extension | File extension, excluding the leading dot. Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz"). | keyword | +| file.name | Name of the file including the extension, without the directory. | keyword | +| file.path | Full path to the file, including the file name. It should include the drive letter, when appropriate. | keyword | +| file.path.text | Multi-field of `file.path`. | match_only_text | +| file.size | File size in bytes. Only relevant when `file.type` is "file". | long | +| file.type | File type (file, dir, or symlink). | keyword | +| geo.city_name | City name. | keyword | +| geo.country_name | Country name. | keyword | +| geo.name | User-defined description of a location, at the level of granularity they care about. Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. Not typically used in automated geolocation. | keyword | +| geo.region_name | Region name. | keyword | +| group.id | Unique identifier for the group on the system/platform. | keyword | +| group.name | Name of the group. | keyword | +| host.architecture | Operating system architecture. | keyword | +| host.containerized | If the host is a container. | boolean | +| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | +| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | +| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | +| host.ip | Host ip addresses. | ip | +| host.mac | Host MAC addresses. The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | keyword | +| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | +| host.os.build | OS build information. | keyword | +| host.os.codename | OS codename, if any. | keyword | +| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | +| host.os.kernel | Operating system kernel version as a raw string. | keyword | +| host.os.name | Operating system name, without the version. | keyword | +| host.os.name.text | Multi-field of `host.os.name`. | text | +| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | +| host.os.version | Operating system version as a raw string. | keyword | +| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | +| http.request.method | HTTP request method. The value should retain its casing from the original event. For example, `GET`, `get`, and `GeT` are all considered valid values for this field. | keyword | +| http.request.referrer | Referrer for this HTTP request. | keyword | +| input.type | Type of Filebeat input. | keyword | +| log.file.path | Full path to the log file this event came from, including the file name. It should include the drive letter, when appropriate. If the event wasn't read from a log file, do not populate this field. | keyword | +| log.level | Original log level of the log event. If the source of the event provides a log level or textual severity, this is the one that goes in `log.level`. If your source doesn't specify one, you may put your event transport's severity here (e.g. Syslog severity). Some examples are `warn`, `err`, `i`, `informational`. | keyword | +| log.offset | Offset of the entry in the log file. | long | +| log.source.address | Source address from which the log event was read / sent from. | keyword | +| log.syslog.facility.code | The Syslog numeric facility of the log event, if available. According to RFCs 5424 and 3164, this value should be an integer between 0 and 23. | long | +| log.syslog.priority | Syslog numeric priority of the event, if available. According to RFCs 5424 and 3164, the priority is 8 \* facility + severity. This number is therefore expected to contain a value between 0 and 191. | long | +| log.syslog.severity.code | The Syslog numeric severity of the log event, if available. If the event source publishing via Syslog provides a different numeric severity value (e.g. firewall, IDS), your source's numeric severity should go to `event.severity`. If the event source does not specify a distinct severity, you can optionally copy the Syslog severity to `event.severity`. | long | +| message | For log events the message field contains the log message, optimized for viewing in a log viewer. For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. If multiple messages exist, they can be combined into one message. | match_only_text | +| network.application | When a specific application or service is identified from network connection details (source/dest IPs, ports, certificates, or wire format), this field captures the application's or service's name. For example, the original event identifies the network connection being from a specific web service in a `https` network connection, like `facebook` or `twitter`. The field value must be normalized to lowercase for querying. | keyword | +| network.bytes | Total bytes transferred in both directions. If `source.bytes` and `destination.bytes` are known, `network.bytes` is their sum. | long | +| network.direction | Direction of the network traffic. Recommended values are: \* ingress \* egress \* inbound \* outbound \* internal \* external \* unknown When mapping events from a host-based monitoring context, populate this field from the host's point of view, using the values "ingress" or "egress". When mapping events from a network or perimeter-based monitoring context, populate this field from the point of view of the network perimeter, using the values "inbound", "outbound", "internal" or "external". Note that "internal" is not crossing perimeter boundaries, and is meant to describe communication between two hosts within the perimeter. Note also that "external" is meant to describe traffic between two hosts that are external to the perimeter. This could for example be useful for ISPs or VPN service providers. | keyword | +| network.forwarded_ip | Host IP address when the source IP address is the proxy. | ip | +| network.name | Name given by operators to sections of their network. | keyword | +| network.packets | Total packets transferred in both directions. If `source.packets` and `destination.packets` are known, `network.packets` is their sum. | long | +| network.protocol | In the OSI Model this would be the Application Layer protocol. For example, `http`, `dns`, or `ssh`. The field value must be normalized to lowercase for querying. | keyword | +| network.vlan.id | VLAN ID as reported by the observer. | keyword | +| observer.egress.interface.name | Interface name as reported by the system. | keyword | +| observer.hostname | Hostname of the observer. | keyword | +| observer.ingress.interface.name | Interface name as reported by the system. | keyword | +| observer.mac | MAC addresses of the observer. The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | keyword | +| observer.product | The product name of the observer. | keyword | +| observer.type | The type of the observer the data is coming from. There is no predefined list of observer types. Some examples are `forwarder`, `firewall`, `ids`, `ips`, `proxy`, `poller`, `sensor`, `APM server`. | keyword | +| observer.vendor | Vendor name of the observer. | keyword | +| observer.version | Observer version. | keyword | +| process.name | Process name. Sometimes called program name or similar. | keyword | +| process.name.text | Multi-field of `process.name`. | match_only_text | +| process.parent.name | Process name. Sometimes called program name or similar. | keyword | +| process.parent.name.text | Multi-field of `process.parent.name`. | match_only_text | +| process.parent.pid | Process id. | long | +| process.parent.title | Process title. The proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened. | keyword | +| process.parent.title.text | Multi-field of `process.parent.title`. | match_only_text | +| process.pid | Process id. | long | +| process.title | Process title. The proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened. | keyword | +| process.title.text | Multi-field of `process.title`. | match_only_text | +| related.hosts | All hostnames or other host identifiers seen on your event. Example identifiers include FQDNs, domain names, workstation names, or aliases. | keyword | +| related.ip | All of the IPs seen on your event. | ip | +| related.user | All the user names or other user identifiers seen on the event. | keyword | +| rule.name | The name of the rule or signature generating the event. | keyword | +| server.domain | The domain name of the server system. This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. | keyword | +| server.ip | IP address of the server (IPv4 or IPv6). | ip | +| server.mac | MAC address of the server. The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | keyword | +| server.registered_domain | The highest registered server domain, stripped of the subdomain. For example, the registered domain for "foo.example.com" is "example.com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". | keyword | +| server.subdomain | The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain. In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain. For example the subdomain portion of "www.east.mydomain.co.uk" is "east". If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period. | keyword | +| server.top_level_domain | The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". | keyword | +| service.name | Name of the service data is collected from. The name of the service is normally user given. This allows for distributed services that run on multiple hosts to correlate the related instances based on the name. In the case of Elasticsearch the `service.name` could contain the cluster name. For Beats the `service.name` is by default a copy of the `service.type` field if no name is specified. | keyword | +| source.address | Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. | keyword | +| source.as.number | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | long | +| source.as.organization.name | Organization name. | keyword | +| source.as.organization.name.text | Multi-field of `source.as.organization.name`. | match_only_text | +| source.bytes | Bytes sent from the source to the destination. | long | +| source.domain | The domain name of the source system. This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. | keyword | +| source.geo.city_name | City name. | keyword | +| source.geo.continent_name | Name of the continent. | keyword | +| source.geo.country_iso_code | Country ISO code. | keyword | +| source.geo.country_name | Country name. | keyword | +| source.geo.location | Longitude and latitude. | geo_point | +| source.geo.region_iso_code | Region ISO code. | keyword | +| source.geo.region_name | Region name. | keyword | +| source.ip | IP address of the source (IPv4 or IPv6). | ip | +| source.mac | MAC address of the source. The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | keyword | +| source.nat.ip | Translated ip of source based NAT sessions (e.g. internal client to internet) Typically connections traversing load balancers, firewalls, or routers. | ip | +| source.nat.port | Translated port of source based NAT sessions. (e.g. internal client to internet) Typically used with load balancers, firewalls, or routers. | long | +| source.port | Port of the source. | long | +| source.registered_domain | The highest registered source domain, stripped of the subdomain. For example, the registered domain for "foo.example.com" is "example.com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". | keyword | +| source.subdomain | The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain. In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain. For example the subdomain portion of "www.east.mydomain.co.uk" is "east". If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period. | keyword | +| source.top_level_domain | The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". | keyword | +| tags | List of keywords used to tag each event. | keyword | +| threat.indicator.description | Describes the type of action conducted by the threat. | keyword | +| threat.indicator.file.hash.sha256 | SHA256 hash. | keyword | +| threat.indicator.file.name | Name of the file including the extension, without the directory. | keyword | +| threat.indicator.last_seen | The date and time when intelligence source last reported sighting this indicator. | date | +| threat.indicator.reference | Reference URL linking to additional information about this indicator. | keyword | +| threat.software.type | The type of software used by this threat to conduct behavior commonly modeled using MITRE ATT&CK®. Recommended values \* Malware \* Tool While not required, you can use a MITRE ATT&CK® software type. | keyword | +| url.domain | Domain of the url, such as "www.elastic.co". In some cases a URL may refer to an IP and/or port directly, without a domain name. In this case, the IP address would go to the `domain` field. If the URL contains a literal IPv6 address enclosed by `[` and `]` (IETF RFC 2732), the `[` and `]` characters should also be captured in the `domain` field. | keyword | +| url.original | Unmodified original url as seen in the event source. Note that in network monitoring, the observed URL may be a full URL, whereas in access logs, the URL is often just represented as a path. This field is meant to represent the URL as it was observed, complete or not. | wildcard | +| url.original.text | Multi-field of `url.original`. | match_only_text | +| url.path | Path of the request, such as "/search". | wildcard | +| url.query | The query field describes the query string of the request, such as "q=elasticsearch". The `?` is excluded from the query string. If a URL contains no `?`, there is no query field. If there is a `?` but no query, the query field exists with an empty string. The `exists` query can be used to differentiate between the two cases. | keyword | +| url.registered_domain | The highest registered url domain, stripped of the subdomain. For example, the registered domain for "foo.example.com" is "example.com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". | keyword | +| url.top_level_domain | The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". | keyword | +| user.domain | Name of the directory the user is a member of. For example, an LDAP or Active Directory domain name. | keyword | +| user.full_name | User's full name, if available. | keyword | +| user.full_name.text | Multi-field of `user.full_name`. | match_only_text | +| user.id | Unique identifier of the user. | keyword | +| user.name | Short name or login of the user. | keyword | +| user.name.text | Multi-field of `user.name`. | match_only_text | +| user_agent.original | Unparsed user_agent string. | keyword | +| user_agent.original.text | Multi-field of `user_agent.original`. | match_only_text | -The `log` dataset collects Cisco Meraki logs. An example event for `log` looks as following: ```json { - "@timestamp": "2016-01-29T06:09:59.000Z", + "@timestamp": "2021-11-23T18:13:18.348Z", "agent": { - "ephemeral_id": "32decd4f-7a04-474b-8958-de335bfff10f", - "id": "4e3f135a-d5f9-40b6-ae01-2c834ecbead0", + "ephemeral_id": "b81987d6-cf2e-4101-af0b-0415b1576f88", + "hostname": "docker-fleet-agent", + "id": "9e1c0aac-8d48-4c33-a9f5-98e770f2028e", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.0.0" + "version": "7.17.0" + }, + "cisco_meraki": { + "event_subtype": "ids_alerted", + "event_type": "security_event", + "security": { + "decision": "allowed", + "dhost": "D0-AB-D5-7B-43-73", + "priority": "1", + "signature": "1:29708:4" + } }, "data_stream": { "dataset": "cisco_meraki.log", @@ -29,89 +310,117 @@ An example event for `log` looks as following: "type": "logs" }, "destination": { - "ip": [ - "10.193.124.51" - ], - "port": 5293 + "ip": "10.0.3.162", + "port": 56391 }, "ecs": { "version": "8.2.0" }, "elastic_agent": { - "id": "4e3f135a-d5f9-40b6-ae01-2c834ecbead0", - "snapshot": true, - "version": "8.0.0" + "id": "9e1c0aac-8d48-4c33-a9f5-98e770f2028e", + "snapshot": false, + "version": "7.17.0" }, "event": { - "action": "deny\n", + "action": "ids-signature-matched", "agent_id_status": "verified", - "code": "security_event", + "category": [ + "network", + "threat" + ], "dataset": "cisco_meraki.log", - "ingested": "2022-01-25T12:08:12Z", - "original": "modtempo 1454047799.olab nto_ security_event olaborissecurity_event tur url=https://example.org/odoco/ria.jpg?ritin=uredolor#tatemac src=10.15.44.253:5078 dst=10.193.124.51:5293 mac=01:00:5e:28:ae:7d name=psa sha256=umq disposition=ntium action=deny\n", - "timezone": "+00:00" + "ingested": "2022-04-26T04:02:28Z", + "original": "\u003c134\u003e1 1637691198.348361125 MX84 security_event ids_alerted signature=1:29708:4 priority=1 timestamp=1637691198.330873 dhost=D0:AB:D5:7B:43:73 direction=ingress protocol=tcp/ip src=67.43.156.12:80 dst=10.0.3.162:56391 decision=allowed message: BROWSER-IE Microsoft Internet Explorer CSS uninitialized object access attempt detected", + "type": [ + "info", + "indicator" + ] }, "input": { "type": "udp" }, "log": { "source": { - "address": "172.30.0.4:37331" + "address": "192.168.208.4:40317" } }, - "observer": { - "product": "Meraki", - "type": "Wireless", - "vendor": "Cisco" + "network": { + "direction": "ingress", + "protocol": "tcp/ip" }, - "related": { - "ip": [ - "10.193.124.51", - "10.15.44.253" - ] + "observer": { + "hostname": "MX84" }, - "rsa": { - "internal": { - "event_desc": "olaborissecurity_event tur", - "messageid": "security_event" + "source": { + "as": { + "number": 35908 }, - "misc": { - "action": [ - "deny\n" - ], - "disposition": "ntium", - "event_type": "security_event", - "node": "nto_", - "sensor": "nto_" + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } }, - "time": { - "event_time": "2016-01-29T06:09:59.000Z" - } - }, - "source": { - "ip": [ - "10.15.44.253" - ], - "mac": "01:00:5e:28:ae:7d", - "port": 5078 + "ip": "67.43.156.12", + "port": 80 }, "tags": [ "preserve_original_event", "cisco-meraki", "forwarded" ], - "url": { - "original": "https://example.org/odoco/ria.jpg?ritin=uredolor#tatemac" + "threat": { + "indicator": { + "description": " BROWSER-IE Microsoft Internet Explorer CSS uninitialized object access attempt detected", + "last_seen": "2021-11-23T18:13:18.330Z" + } } } ``` +### API Endpoint (Webhooks) + **Exported fields** | Field | Description | Type | |---|---|---| | @timestamp | Event timestamp. | date | +| cisco_meraki.event.alertData | Additional alert data (differs based on alert type) | flattened | +| cisco_meraki.event.alertId | ID for this alert message | keyword | +| cisco_meraki.event.alertLevel | Alert level (informational, critical etc.) | keyword | +| cisco_meraki.event.alertType | Type of alert (“Network usage alert”, “Settings changed”, etc.) | keyword | +| cisco_meraki.event.alertTypeId | Unique ID for the type of alert | keyword | +| cisco_meraki.event.deviceMac | MAC address of the Meraki device | keyword | +| cisco_meraki.event.deviceModel | Meraki device model | keyword | +| cisco_meraki.event.deviceName | Name assigned to the Meraki device | keyword | +| cisco_meraki.event.deviceSerial | Serial number of the Meraki device | keyword | +| cisco_meraki.event.deviceTags | Tags assigned to the Meraki device | keyword | +| cisco_meraki.event.deviceUrl | URL of the Meraki device | keyword | +| cisco_meraki.event.networkId | ID for the Meraki network | keyword | +| cisco_meraki.event.networkName | Name for the Meraki network | keyword | +| cisco_meraki.event.networkTags | Tags assigned to the Meraki network | keyword | +| cisco_meraki.event.networkUrl | URL of the Meraki Dashboard network | keyword | +| cisco_meraki.event.occurredAt | Timestamp of the alert (UTC) | date | +| cisco_meraki.event.organizationId | ID of the Meraki organization | keyword | +| cisco_meraki.event.organizationName | Name of the Meraki organization | keyword | +| cisco_meraki.event.organizationUrl | URL of the Meraki Dashboard organization | keyword | +| cisco_meraki.event.sentAt | Timestamp of the sent message (UTC) | date | +| cisco_meraki.event.sharedSecret | User defined secret to be validated by the webhook receiver (optional) | keyword | +| cisco_meraki.event.version | Current version of webhook format | keyword | | client.domain | The domain name of the client system. This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. | keyword | +| client.geo.city_name | City name. | keyword | +| client.geo.continent_name | Name of the continent. | keyword | +| client.geo.country_iso_code | Country ISO code. | keyword | +| client.geo.country_name | Country name. | keyword | +| client.geo.location.lat | Longitude and latitude. | geo_point | +| client.geo.location.lon | Longitude and latitude. | geo_point | +| client.geo.region_iso_code | Region ISO code. | keyword | +| client.geo.region_name | Region name. | keyword | +| client.ip | IP address of the client (IPv4 or IPv6). | ip | +| client.mac | MAC address of the client. The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | keyword | | client.registered_domain | The highest registered client domain, stripped of the subdomain. For example, the registered domain for "foo.example.com" is "example.com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". | keyword | | client.subdomain | The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain. In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain. For example the subdomain portion of "www.east.mydomain.co.uk" is "east". If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period. | keyword | | client.top_level_domain | The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". | keyword | @@ -138,8 +447,12 @@ An example event for `log` looks as following: | destination.bytes | Bytes sent from the destination to the source. | long | | destination.domain | The domain name of the destination system. This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. | keyword | | destination.geo.city_name | City name. | keyword | +| destination.geo.continent_name | Name of the continent. | keyword | +| destination.geo.country_iso_code | Country ISO code. | keyword | | destination.geo.country_name | Country name. | keyword | | destination.geo.location | Longitude and latitude. | geo_point | +| destination.geo.region_iso_code | Region ISO code. | keyword | +| destination.geo.region_name | Region name. | keyword | | destination.ip | IP address of the destination (IPv4 or IPv6). | ip | | destination.mac | MAC address of the destination. The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | keyword | | destination.nat.ip | Translated ip of destination based NAT sessions (e.g. internet to private DMZ) Typically used with load balancers, firewalls, or routers. | ip | @@ -150,7 +463,6 @@ An example event for `log` looks as following: | destination.top_level_domain | The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". | keyword | | dns.answers.name | The domain name to which this resource record pertains. If a chain of CNAME is being resolved, each answer's `name` should be the one that corresponds with the answer's `data`. It should not simply be the original `question.name` repeated. | keyword | | dns.answers.type | The type of data contained in this resource record. | keyword | -| dns.question.domain | Server domain. | keyword | | dns.question.registered_domain | The highest registered domain, stripped of the subdomain. For example, the registered domain for "foo.example.com" is "example.com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". | keyword | | dns.question.subdomain | The subdomain is all of the labels under the registered_domain. If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period. | keyword | | dns.question.top_level_domain | The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". | keyword | @@ -158,6 +470,7 @@ An example event for `log` looks as following: | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | error.message | Error message. | match_only_text | | event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | +| event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | | event.code | Identification code for this event, if one exists. Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. | keyword | | event.dataset | Event dataset | constant_keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | @@ -165,6 +478,7 @@ An example event for `log` looks as following: | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | | event.timezone | This field should be populated when the event's timestamp does not include timezone information already (e.g. default Syslog timestamps). It's optional otherwise. Acceptable timezone formats are: a canonical ID (e.g. "Europe/Amsterdam"), abbreviated (e.g. "EST") or an HH:mm differential (e.g. "-05:00"). | keyword | +| event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | file.attributes | Array of file attributes. Attributes names will vary by platform. Here's a non-exhaustive list of values that are expected in this field: archive, compressed, directory, encrypted, execute, hidden, read, readonly, system, write. | keyword | | file.directory | Directory where the file is located. It should include the drive letter, when appropriate. | keyword | | file.extension | File extension, excluding the leading dot. Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz"). | keyword | @@ -199,8 +513,7 @@ An example event for `log` looks as following: | http.request.method | HTTP request method. The value should retain its casing from the original event. For example, `GET`, `get`, and `GeT` are all considered valid values for this field. | keyword | | http.request.referrer | Referrer for this HTTP request. | keyword | | input.type | Type of Filebeat input. | keyword | -| log.file.path | Full path to the log file this event came from. | keyword | -| log.flags | Flags for the log file. | keyword | +| log.file.path | Full path to the log file this event came from, including the file name. It should include the drive letter, when appropriate. If the event wasn't read from a log file, do not populate this field. | keyword | | log.level | Original log level of the log event. If the source of the event provides a log level or textual severity, this is the one that goes in `log.level`. If your source doesn't specify one, you may put your event transport's severity here (e.g. Syslog severity). Some examples are `warn`, `err`, `i`, `informational`. | keyword | | log.offset | Offset of the entry in the log file. | long | | log.source.address | Source address from which the log event was read / sent from. | keyword | @@ -212,15 +525,23 @@ An example event for `log` looks as following: | network.bytes | Total bytes transferred in both directions. If `source.bytes` and `destination.bytes` are known, `network.bytes` is their sum. | long | | network.direction | Direction of the network traffic. Recommended values are: \* ingress \* egress \* inbound \* outbound \* internal \* external \* unknown When mapping events from a host-based monitoring context, populate this field from the host's point of view, using the values "ingress" or "egress". When mapping events from a network or perimeter-based monitoring context, populate this field from the point of view of the network perimeter, using the values "inbound", "outbound", "internal" or "external". Note that "internal" is not crossing perimeter boundaries, and is meant to describe communication between two hosts within the perimeter. Note also that "external" is meant to describe traffic between two hosts that are external to the perimeter. This could for example be useful for ISPs or VPN service providers. | keyword | | network.forwarded_ip | Host IP address when the source IP address is the proxy. | ip | -| network.interface.name | | keyword | +| network.name | Name given by operators to sections of their network. | keyword | | network.packets | Total packets transferred in both directions. If `source.packets` and `destination.packets` are known, `network.packets` is their sum. | long | | network.protocol | In the OSI Model this would be the Application Layer protocol. For example, `http`, `dns`, or `ssh`. The field value must be normalized to lowercase for querying. | keyword | +| network.vlan.id | VLAN ID as reported by the observer. | keyword | | observer.egress.interface.name | Interface name as reported by the system. | keyword | +| observer.hostname | Hostname of the observer. | keyword | | observer.ingress.interface.name | Interface name as reported by the system. | keyword | +| observer.mac | MAC addresses of the observer. The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | keyword | +| observer.name | Custom name of the observer. This is a name that can be given to an observer. This can be helpful for example if multiple firewalls of the same model are used in an organization. If no custom name is needed, the field can be left empty. | keyword | | observer.product | The product name of the observer. | keyword | +| observer.serial_number | Observer serial number. | keyword | | observer.type | The type of the observer the data is coming from. There is no predefined list of observer types. Some examples are `forwarder`, `firewall`, `ids`, `ips`, `proxy`, `poller`, `sensor`, `APM server`. | keyword | | observer.vendor | Vendor name of the observer. | keyword | | observer.version | Observer version. | keyword | +| organization.id | Unique identifier for the organization. | keyword | +| organization.name | Organization name. | keyword | +| organization.name.text | Multi-field of `organization.name`. | match_only_text | | process.name | Process name. Sometimes called program name or similar. | keyword | | process.name.text | Multi-field of `process.name`. | match_only_text | | process.parent.name | Process name. Sometimes called program name or similar. | keyword | @@ -234,680 +555,9 @@ An example event for `log` looks as following: | related.hosts | All hostnames or other host identifiers seen on your event. Example identifiers include FQDNs, domain names, workstation names, or aliases. | keyword | | related.ip | All of the IPs seen on your event. | ip | | related.user | All the user names or other user identifiers seen on the event. | keyword | -| rsa.counters.dclass_c1 | This is a generic counter key that should be used with the label dclass.c1.str only | long | -| rsa.counters.dclass_c1_str | This is a generic counter string key that should be used with the label dclass.c1 only | keyword | -| rsa.counters.dclass_c2 | This is a generic counter key that should be used with the label dclass.c2.str only | long | -| rsa.counters.dclass_c2_str | This is a generic counter string key that should be used with the label dclass.c2 only | keyword | -| rsa.counters.dclass_c3 | This is a generic counter key that should be used with the label dclass.c3.str only | long | -| rsa.counters.dclass_c3_str | This is a generic counter string key that should be used with the label dclass.c3 only | keyword | -| rsa.counters.dclass_r1 | This is a generic ratio key that should be used with the label dclass.r1.str only | keyword | -| rsa.counters.dclass_r1_str | This is a generic ratio string key that should be used with the label dclass.r1 only | keyword | -| rsa.counters.dclass_r2 | This is a generic ratio key that should be used with the label dclass.r2.str only | keyword | -| rsa.counters.dclass_r2_str | This is a generic ratio string key that should be used with the label dclass.r2 only | keyword | -| rsa.counters.dclass_r3 | This is a generic ratio key that should be used with the label dclass.r3.str only | keyword | -| rsa.counters.dclass_r3_str | This is a generic ratio string key that should be used with the label dclass.r3 only | keyword | -| rsa.counters.event_counter | This is used to capture the number of times an event repeated | long | -| rsa.crypto.cert_ca | This key is used to capture the Certificate signing authority only | keyword | -| rsa.crypto.cert_checksum | | keyword | -| rsa.crypto.cert_common | This key is used to capture the Certificate common name only | keyword | -| rsa.crypto.cert_error | This key captures the Certificate Error String | keyword | -| rsa.crypto.cert_host_cat | This key is used for the hostname category value of a certificate | keyword | -| rsa.crypto.cert_host_name | Deprecated key defined only in table map. | keyword | -| rsa.crypto.cert_issuer | | keyword | -| rsa.crypto.cert_keysize | | keyword | -| rsa.crypto.cert_serial | This key is used to capture the Certificate serial number only | keyword | -| rsa.crypto.cert_status | This key captures Certificate validation status | keyword | -| rsa.crypto.cert_subject | This key is used to capture the Certificate organization only | keyword | -| rsa.crypto.cert_username | | keyword | -| rsa.crypto.cipher_dst | This key is for Destination (Server) Cipher | keyword | -| rsa.crypto.cipher_size_dst | This key captures Destination (Server) Cipher Size | long | -| rsa.crypto.cipher_size_src | This key captures Source (Client) Cipher Size | long | -| rsa.crypto.cipher_src | This key is for Source (Client) Cipher | keyword | -| rsa.crypto.crypto | This key is used to capture the Encryption Type or Encryption Key only | keyword | -| rsa.crypto.d_certauth | | keyword | -| rsa.crypto.https_insact | | keyword | -| rsa.crypto.https_valid | | keyword | -| rsa.crypto.ike | IKE negotiation phase. | keyword | -| rsa.crypto.ike_cookie1 | ID of the negotiation — sent for ISAKMP Phase One | keyword | -| rsa.crypto.ike_cookie2 | ID of the negotiation — sent for ISAKMP Phase Two | keyword | -| rsa.crypto.peer | This key is for Encryption peer's IP Address | keyword | -| rsa.crypto.peer_id | This key is for Encryption peer’s identity | keyword | -| rsa.crypto.s_certauth | | keyword | -| rsa.crypto.scheme | This key captures the Encryption scheme used | keyword | -| rsa.crypto.sig_type | This key captures the Signature Type | keyword | -| rsa.crypto.ssl_ver_dst | Deprecated, use version | keyword | -| rsa.crypto.ssl_ver_src | Deprecated, use version | keyword | -| rsa.db.database | This key is used to capture the name of a database or an instance as seen in a session | keyword | -| rsa.db.db_id | This key is used to capture the unique identifier for a database | keyword | -| rsa.db.db_pid | This key captures the process id of a connection with database server | long | -| rsa.db.index | This key captures IndexID of the index. | keyword | -| rsa.db.instance | This key is used to capture the database server instance name | keyword | -| rsa.db.lread | This key is used for the number of logical reads | long | -| rsa.db.lwrite | This key is used for the number of logical writes | long | -| rsa.db.permissions | This key captures permission or privilege level assigned to a resource. | keyword | -| rsa.db.pread | This key is used for the number of physical writes | long | -| rsa.db.table_name | This key is used to capture the table name | keyword | -| rsa.db.transact_id | This key captures the SQL transantion ID of the current session | keyword | -| rsa.email.email | This key is used to capture a generic email address where the source or destination context is not clear | keyword | -| rsa.email.email_dst | This key is used to capture the Destination email address only, when the destination context is not clear use email | keyword | -| rsa.email.email_src | This key is used to capture the source email address only, when the source context is not clear use email | keyword | -| rsa.email.subject | This key is used to capture the subject string from an Email only. | keyword | -| rsa.email.trans_from | Deprecated key defined only in table map. | keyword | -| rsa.email.trans_to | Deprecated key defined only in table map. | keyword | -| rsa.endpoint.host_state | This key is used to capture the current state of the machine, such as \blacklisted\, \infected\, \firewall disabled\ and so on | keyword | -| rsa.endpoint.registry_key | This key captures the path to the registry key | keyword | -| rsa.endpoint.registry_value | This key captures values or decorators used within a registry entry | keyword | -| rsa.file.attachment | This key captures the attachment file name | keyword | -| rsa.file.binary | Deprecated key defined only in table map. | keyword | -| rsa.file.directory_dst | \This key is used to capture the directory of the target process or file\ | keyword | -| rsa.file.directory_src | This key is used to capture the directory of the source process or file | keyword | -| rsa.file.file_entropy | This is used to capture entropy vale of a file | double | -| rsa.file.file_vendor | This is used to capture Company name of file located in version_info | keyword | -| rsa.file.filename_dst | This is used to capture name of the file targeted by the action | keyword | -| rsa.file.filename_src | This is used to capture name of the parent filename, the file which performed the action | keyword | -| rsa.file.filename_tmp | | keyword | -| rsa.file.filesystem | | keyword | -| rsa.file.privilege | Deprecated, use permissions | keyword | -| rsa.file.task_name | This is used to capture name of the task | keyword | -| rsa.healthcare.patient_fname | This key is for First Names only, this is used for Healthcare predominantly to capture Patients information | keyword | -| rsa.healthcare.patient_id | This key captures the unique ID for a patient | keyword | -| rsa.healthcare.patient_lname | This key is for Last Names only, this is used for Healthcare predominantly to capture Patients information | keyword | -| rsa.healthcare.patient_mname | This key is for Middle Names only, this is used for Healthcare predominantly to capture Patients information | keyword | -| rsa.identity.accesses | This key is used to capture actual privileges used in accessing an object | keyword | -| rsa.identity.auth_method | This key is used to capture authentication methods used only | keyword | -| rsa.identity.dn | X.500 (LDAP) Distinguished Name | keyword | -| rsa.identity.dn_dst | An X.500 (LDAP) Distinguished name that used in a context that indicates a Destination dn | keyword | -| rsa.identity.dn_src | An X.500 (LDAP) Distinguished name that is used in a context that indicates a Source dn | keyword | -| rsa.identity.federated_idp | This key is the federated Identity Provider. This is the server providing the authentication. | keyword | -| rsa.identity.federated_sp | This key is the Federated Service Provider. This is the application requesting authentication. | keyword | -| rsa.identity.firstname | This key is for First Names only, this is used for Healthcare predominantly to capture Patients information | keyword | -| rsa.identity.host_role | This key should only be used to capture the role of a Host Machine | keyword | -| rsa.identity.lastname | This key is for Last Names only, this is used for Healthcare predominantly to capture Patients information | keyword | -| rsa.identity.ldap | This key is for Uninterpreted LDAP values. Ldap Values that don’t have a clear query or response context | keyword | -| rsa.identity.ldap_query | This key is the Search criteria from an LDAP search | keyword | -| rsa.identity.ldap_response | This key is to capture Results from an LDAP search | keyword | -| rsa.identity.logon_type | This key is used to capture the type of logon method used. | keyword | -| rsa.identity.logon_type_desc | This key is used to capture the textual description of an integer logon type as stored in the meta key 'logon.type'. | keyword | -| rsa.identity.middlename | This key is for Middle Names only, this is used for Healthcare predominantly to capture Patients information | keyword | -| rsa.identity.org | This key captures the User organization | keyword | -| rsa.identity.owner | This is used to capture username the process or service is running as, the author of the task | keyword | -| rsa.identity.password | This key is for Passwords seen in any session, plain text or encrypted | keyword | -| rsa.identity.profile | This key is used to capture the user profile | keyword | -| rsa.identity.realm | Radius realm or similar grouping of accounts | keyword | -| rsa.identity.service_account | This key is a windows specific key, used for capturing name of the account a service (referenced in the event) is running under. Legacy Usage | keyword | -| rsa.identity.user_dept | User's Department Names only | keyword | -| rsa.identity.user_role | This key is used to capture the Role of a user only | keyword | -| rsa.identity.user_sid_dst | This key captures Destination User Session ID | keyword | -| rsa.identity.user_sid_src | This key captures Source User Session ID | keyword | -| rsa.internal.audit_class | Deprecated key defined only in table map. | keyword | -| rsa.internal.cid | This is the unique identifier used to identify a NetWitness Concentrator. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | keyword | -| rsa.internal.data | Deprecated key defined only in table map. | keyword | -| rsa.internal.dead | Deprecated key defined only in table map. | long | -| rsa.internal.device_class | This is the Classification of the Log Event Source under a predefined fixed set of Event Source Classifications. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | keyword | -| rsa.internal.device_group | This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | keyword | -| rsa.internal.device_host | This is the Hostname of the log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | keyword | -| rsa.internal.device_ip | This is the IPv4 address of the Log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | ip | -| rsa.internal.device_ipv6 | This is the IPv6 address of the Log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | ip | -| rsa.internal.device_type | This is the name of the log parser which parsed a given session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | keyword | -| rsa.internal.device_type_id | Deprecated key defined only in table map. | long | -| rsa.internal.did | This is the unique identifier used to identify a NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | keyword | -| rsa.internal.entropy_req | This key is only used by the Entropy Parser, the Meta Type can be either UInt16 or Float32 based on the configuration | long | -| rsa.internal.entropy_res | This key is only used by the Entropy Parser, the Meta Type can be either UInt16 or Float32 based on the configuration | long | -| rsa.internal.entry | Deprecated key defined only in table map. | keyword | -| rsa.internal.event_desc | | keyword | -| rsa.internal.event_name | Deprecated key defined only in table map. | keyword | -| rsa.internal.feed_category | This is used to capture the category of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | keyword | -| rsa.internal.feed_desc | This is used to capture the description of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | keyword | -| rsa.internal.feed_name | This is used to capture the name of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | keyword | -| rsa.internal.forward_ip | This key should be used to capture the IPV4 address of a relay system which forwarded the events from the original system to NetWitness. | ip | -| rsa.internal.forward_ipv6 | This key is used to capture the IPV6 address of a relay system which forwarded the events from the original system to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | ip | -| rsa.internal.hcode | Deprecated key defined only in table map. | keyword | -| rsa.internal.header_id | This is the Header ID value that identifies the exact log parser header definition that parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | keyword | -| rsa.internal.inode | Deprecated key defined only in table map. | long | -| rsa.internal.lc_cid | This is a unique Identifier of a Log Collector. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | keyword | -| rsa.internal.lc_ctime | This is the time at which a log is collected in a NetWitness Log Collector. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | date | -| rsa.internal.level | Deprecated key defined only in table map. | long | -| rsa.internal.mcb_req | This key is only used by the Entropy Parser, the most common byte request is simply which byte for each side (0 thru 255) was seen the most | long | -| rsa.internal.mcb_res | This key is only used by the Entropy Parser, the most common byte response is simply which byte for each side (0 thru 255) was seen the most | long | -| rsa.internal.mcbc_req | This key is only used by the Entropy Parser, the most common byte count is the number of times the most common byte (above) was seen in the session streams | long | -| rsa.internal.mcbc_res | This key is only used by the Entropy Parser, the most common byte count is the number of times the most common byte (above) was seen in the session streams | long | -| rsa.internal.medium | This key is used to identify if it’s a log/packet session or Layer 2 Encapsulation Type. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness. 32 = log, 33 = correlation session, < 32 is packet session | long | -| rsa.internal.message | This key captures the contents of instant messages | keyword | -| rsa.internal.messageid | | keyword | -| rsa.internal.msg | This key is used to capture the raw message that comes into the Log Decoder | keyword | -| rsa.internal.msg_id | This is the Message ID1 value that identifies the exact log parser definition which parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | keyword | -| rsa.internal.msg_vid | This is the Message ID2 value that identifies the exact log parser definition which parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | keyword | -| rsa.internal.node_name | Deprecated key defined only in table map. | keyword | -| rsa.internal.nwe_callback_id | This key denotes that event is endpoint related | keyword | -| rsa.internal.obj_id | Deprecated key defined only in table map. | keyword | -| rsa.internal.obj_server | Deprecated key defined only in table map. | keyword | -| rsa.internal.obj_val | Deprecated key defined only in table map. | keyword | -| rsa.internal.parse_error | This is a special key that stores any Meta key validation error found while parsing a log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | keyword | -| rsa.internal.payload_req | This key is only used by the Entropy Parser, the payload size metrics are the payload sizes of each session side at the time of parsing. However, in order to keep | long | -| rsa.internal.payload_res | This key is only used by the Entropy Parser, the payload size metrics are the payload sizes of each session side at the time of parsing. However, in order to keep | long | -| rsa.internal.process_vid_dst | Endpoint generates and uses a unique virtual ID to identify any similar group of process. This ID represents the target process. | keyword | -| rsa.internal.process_vid_src | Endpoint generates and uses a unique virtual ID to identify any similar group of process. This ID represents the source process. | keyword | -| rsa.internal.resource | Deprecated key defined only in table map. | keyword | -| rsa.internal.resource_class | Deprecated key defined only in table map. | keyword | -| rsa.internal.rid | This is a special ID of the Remote Session created by NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | long | -| rsa.internal.session_split | This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | keyword | -| rsa.internal.site | Deprecated key defined only in table map. | keyword | -| rsa.internal.size | This is the size of the session as seen by the NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | long | -| rsa.internal.sourcefile | This is the name of the log file or PCAPs that can be imported into NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | keyword | -| rsa.internal.statement | Deprecated key defined only in table map. | keyword | -| rsa.internal.time | This is the time at which a session hits a NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness. | date | -| rsa.internal.ubc_req | This key is only used by the Entropy Parser, Unique byte count is the number of unique bytes seen in each stream. 256 would mean all byte values of 0 thru 255 were seen at least once | long | -| rsa.internal.ubc_res | This key is only used by the Entropy Parser, Unique byte count is the number of unique bytes seen in each stream. 256 would mean all byte values of 0 thru 255 were seen at least once | long | -| rsa.internal.word | This is used by the Word Parsing technology to capture the first 5 character of every word in an unparsed log | keyword | -| rsa.investigations.analysis_file | This is used to capture all indicators used in a File Analysis. This key should be used to capture an analysis of a file | keyword | -| rsa.investigations.analysis_service | This is used to capture all indicators used in a Service Analysis. This key should be used to capture an analysis of a service | keyword | -| rsa.investigations.analysis_session | This is used to capture all indicators used for a Session Analysis. This key should be used to capture an analysis of a session | keyword | -| rsa.investigations.boc | This is used to capture behaviour of compromise | keyword | -| rsa.investigations.ec_activity | This key captures the particular event activity(Ex:Logoff) | keyword | -| rsa.investigations.ec_outcome | This key captures the outcome of a particular Event(Ex:Success) | keyword | -| rsa.investigations.ec_subject | This key captures the Subject of a particular Event(Ex:User) | keyword | -| rsa.investigations.ec_theme | This key captures the Theme of a particular Event(Ex:Authentication) | keyword | -| rsa.investigations.eoc | This is used to capture Enablers of Compromise | keyword | -| rsa.investigations.event_cat | This key captures the Event category number | long | -| rsa.investigations.event_cat_name | This key captures the event category name corresponding to the event cat code | keyword | -| rsa.investigations.event_vcat | This is a vendor supplied category. This should be used in situations where the vendor has adopted their own event_category taxonomy. | keyword | -| rsa.investigations.inv_category | This used to capture investigation category | keyword | -| rsa.investigations.inv_context | This used to capture investigation context | keyword | -| rsa.investigations.ioc | This is key capture indicator of compromise | keyword | -| rsa.misc.OS | This key captures the Name of the Operating System | keyword | -| rsa.misc.acl_id | | keyword | -| rsa.misc.acl_op | | keyword | -| rsa.misc.acl_pos | | keyword | -| rsa.misc.acl_table | | keyword | -| rsa.misc.action | | keyword | -| rsa.misc.admin | | keyword | -| rsa.misc.agent_id | This key is used to capture agent id | keyword | -| rsa.misc.alarm_id | | keyword | -| rsa.misc.alarmname | | keyword | -| rsa.misc.alert_id | Deprecated, New Hunting Model (inv.\*, ioc, boc, eoc, analysis.\*) | keyword | -| rsa.misc.app_id | | keyword | -| rsa.misc.audit | | keyword | -| rsa.misc.audit_object | | keyword | -| rsa.misc.auditdata | | keyword | -| rsa.misc.autorun_type | This is used to capture Auto Run type | keyword | -| rsa.misc.benchmark | | keyword | -| rsa.misc.bypass | | keyword | -| rsa.misc.cache | | keyword | -| rsa.misc.cache_hit | | keyword | -| rsa.misc.category | This key is used to capture the category of an event given by the vendor in the session | keyword | -| rsa.misc.cc_number | Valid Credit Card Numbers only | long | -| rsa.misc.cefversion | | keyword | -| rsa.misc.cfg_attr | | keyword | -| rsa.misc.cfg_obj | | keyword | -| rsa.misc.cfg_path | | keyword | -| rsa.misc.change_attrib | This key is used to capture the name of the attribute that’s changing in a session | keyword | -| rsa.misc.change_new | This key is used to capture the new values of the attribute that’s changing in a session | keyword | -| rsa.misc.change_old | This key is used to capture the old value of the attribute that’s changing in a session | keyword | -| rsa.misc.changes | | keyword | -| rsa.misc.checksum | This key is used to capture the checksum or hash of the entity such as a file or process. Checksum should be used over checksum.src or checksum.dst when it is unclear whether the entity is a source or target of an action. | keyword | -| rsa.misc.checksum_dst | This key is used to capture the checksum or hash of the the target entity such as a process or file. | keyword | -| rsa.misc.checksum_src | This key is used to capture the checksum or hash of the source entity such as a file or process. | keyword | -| rsa.misc.client | This key is used to capture only the name of the client application requesting resources of the server. See the user.agent meta key for capture of the specific user agent identifier or browser identification string. | keyword | -| rsa.misc.client_ip | | keyword | -| rsa.misc.clustermembers | | keyword | -| rsa.misc.cmd | | keyword | -| rsa.misc.cn_acttimeout | | keyword | -| rsa.misc.cn_asn_src | | keyword | -| rsa.misc.cn_bgpv4nxthop | | keyword | -| rsa.misc.cn_ctr_dst_code | | keyword | -| rsa.misc.cn_dst_tos | | keyword | -| rsa.misc.cn_dst_vlan | | keyword | -| rsa.misc.cn_engine_id | | keyword | -| rsa.misc.cn_engine_type | | keyword | -| rsa.misc.cn_f_switch | | keyword | -| rsa.misc.cn_flowsampid | | keyword | -| rsa.misc.cn_flowsampintv | | keyword | -| rsa.misc.cn_flowsampmode | | keyword | -| rsa.misc.cn_inacttimeout | | keyword | -| rsa.misc.cn_inpermbyts | | keyword | -| rsa.misc.cn_inpermpckts | | keyword | -| rsa.misc.cn_invalid | | keyword | -| rsa.misc.cn_ip_proto_ver | | keyword | -| rsa.misc.cn_ipv4_ident | | keyword | -| rsa.misc.cn_l_switch | | keyword | -| rsa.misc.cn_log_did | | keyword | -| rsa.misc.cn_log_rid | | keyword | -| rsa.misc.cn_max_ttl | | keyword | -| rsa.misc.cn_maxpcktlen | | keyword | -| rsa.misc.cn_min_ttl | | keyword | -| rsa.misc.cn_minpcktlen | | keyword | -| rsa.misc.cn_mpls_lbl_1 | | keyword | -| rsa.misc.cn_mpls_lbl_10 | | keyword | -| rsa.misc.cn_mpls_lbl_2 | | keyword | -| rsa.misc.cn_mpls_lbl_3 | | keyword | -| rsa.misc.cn_mpls_lbl_4 | | keyword | -| rsa.misc.cn_mpls_lbl_5 | | keyword | -| rsa.misc.cn_mpls_lbl_6 | | keyword | -| rsa.misc.cn_mpls_lbl_7 | | keyword | -| rsa.misc.cn_mpls_lbl_8 | | keyword | -| rsa.misc.cn_mpls_lbl_9 | | keyword | -| rsa.misc.cn_mplstoplabel | | keyword | -| rsa.misc.cn_mplstoplabip | | keyword | -| rsa.misc.cn_mul_dst_byt | | keyword | -| rsa.misc.cn_mul_dst_pks | | keyword | -| rsa.misc.cn_muligmptype | | keyword | -| rsa.misc.cn_sampalgo | | keyword | -| rsa.misc.cn_sampint | | keyword | -| rsa.misc.cn_seqctr | | keyword | -| rsa.misc.cn_spackets | | keyword | -| rsa.misc.cn_src_tos | | keyword | -| rsa.misc.cn_src_vlan | | keyword | -| rsa.misc.cn_sysuptime | | keyword | -| rsa.misc.cn_template_id | | keyword | -| rsa.misc.cn_totbytsexp | | keyword | -| rsa.misc.cn_totflowexp | | keyword | -| rsa.misc.cn_totpcktsexp | | keyword | -| rsa.misc.cn_unixnanosecs | | keyword | -| rsa.misc.cn_v6flowlabel | | keyword | -| rsa.misc.cn_v6optheaders | | keyword | -| rsa.misc.code | | keyword | -| rsa.misc.command | | keyword | -| rsa.misc.comments | Comment information provided in the log message | keyword | -| rsa.misc.comp_class | | keyword | -| rsa.misc.comp_name | | keyword | -| rsa.misc.comp_rbytes | | keyword | -| rsa.misc.comp_sbytes | | keyword | -| rsa.misc.comp_version | This key captures the Version level of a sub-component of a product. | keyword | -| rsa.misc.connection_id | This key captures the Connection ID | keyword | -| rsa.misc.content | This key captures the content type from protocol headers | keyword | -| rsa.misc.content_type | This key is used to capture Content Type only. | keyword | -| rsa.misc.content_version | This key captures Version level of a signature or database content. | keyword | -| rsa.misc.context | This key captures Information which adds additional context to the event. | keyword | -| rsa.misc.context_subject | This key is to be used in an audit context where the subject is the object being identified | keyword | -| rsa.misc.context_target | | keyword | -| rsa.misc.count | | keyword | -| rsa.misc.cpu | This key is the CPU time used in the execution of the event being recorded. | long | -| rsa.misc.cpu_data | | keyword | -| rsa.misc.criticality | | keyword | -| rsa.misc.cs_agency_dst | | keyword | -| rsa.misc.cs_analyzedby | | keyword | -| rsa.misc.cs_av_other | | keyword | -| rsa.misc.cs_av_primary | | keyword | -| rsa.misc.cs_av_secondary | | keyword | -| rsa.misc.cs_bgpv6nxthop | | keyword | -| rsa.misc.cs_bit9status | | keyword | -| rsa.misc.cs_context | | keyword | -| rsa.misc.cs_control | | keyword | -| rsa.misc.cs_data | | keyword | -| rsa.misc.cs_datecret | | keyword | -| rsa.misc.cs_dst_tld | | keyword | -| rsa.misc.cs_eth_dst_ven | | keyword | -| rsa.misc.cs_eth_src_ven | | keyword | -| rsa.misc.cs_event_uuid | | keyword | -| rsa.misc.cs_filetype | | keyword | -| rsa.misc.cs_fld | | keyword | -| rsa.misc.cs_if_desc | | keyword | -| rsa.misc.cs_if_name | | keyword | -| rsa.misc.cs_ip_next_hop | | keyword | -| rsa.misc.cs_ipv4dstpre | | keyword | -| rsa.misc.cs_ipv4srcpre | | keyword | -| rsa.misc.cs_lifetime | | keyword | -| rsa.misc.cs_log_medium | | keyword | -| rsa.misc.cs_loginname | | keyword | -| rsa.misc.cs_modulescore | | keyword | -| rsa.misc.cs_modulesign | | keyword | -| rsa.misc.cs_opswatresult | | keyword | -| rsa.misc.cs_payload | | keyword | -| rsa.misc.cs_registrant | | keyword | -| rsa.misc.cs_registrar | | keyword | -| rsa.misc.cs_represult | | keyword | -| rsa.misc.cs_rpayload | | keyword | -| rsa.misc.cs_sampler_name | | keyword | -| rsa.misc.cs_sourcemodule | | keyword | -| rsa.misc.cs_streams | | keyword | -| rsa.misc.cs_targetmodule | | keyword | -| rsa.misc.cs_v6nxthop | | keyword | -| rsa.misc.cs_whois_server | | keyword | -| rsa.misc.cs_yararesult | | keyword | -| rsa.misc.cve | This key captures CVE (Common Vulnerabilities and Exposures) - an identifier for known information security vulnerabilities. | keyword | -| rsa.misc.data_type | | keyword | -| rsa.misc.description | | keyword | -| rsa.misc.device_name | This is used to capture name of the Device associated with the node Like: a physical disk, printer, etc | keyword | -| rsa.misc.devvendor | | keyword | -| rsa.misc.disposition | This key captures the The end state of an action. | keyword | -| rsa.misc.distance | | keyword | -| rsa.misc.doc_number | This key captures File Identification number | long | -| rsa.misc.dstburb | | keyword | -| rsa.misc.edomain | | keyword | -| rsa.misc.edomaub | | keyword | -| rsa.misc.ein_number | Employee Identification Numbers only | long | -| rsa.misc.error | This key captures All non successful Error codes or responses | keyword | -| rsa.misc.euid | | keyword | -| rsa.misc.event_category | | keyword | -| rsa.misc.event_computer | This key is a windows only concept, where this key is used to capture fully qualified domain name in a windows log. | keyword | -| rsa.misc.event_desc | This key is used to capture a description of an event available directly or inferred | keyword | -| rsa.misc.event_id | | keyword | -| rsa.misc.event_log | This key captures the Name of the event log | keyword | -| rsa.misc.event_source | This key captures Source of the event that’s not a hostname | keyword | -| rsa.misc.event_state | This key captures the current state of the object/item referenced within the event. Describing an on-going event. | keyword | -| rsa.misc.event_type | This key captures the event category type as specified by the event source. | keyword | -| rsa.misc.event_user | This key is a windows only concept, where this key is used to capture combination of domain name and username in a windows log. | keyword | -| rsa.misc.expected_val | This key captures the Value expected (from the perspective of the device generating the log). | keyword | -| rsa.misc.facility | | keyword | -| rsa.misc.facilityname | | keyword | -| rsa.misc.fcatnum | This key captures Filter Category Number. Legacy Usage | keyword | -| rsa.misc.filter | This key captures Filter used to reduce result set | keyword | -| rsa.misc.finterface | | keyword | -| rsa.misc.flags | | keyword | -| rsa.misc.forensic_info | | keyword | -| rsa.misc.found | This is used to capture the results of regex match | keyword | -| rsa.misc.fresult | This key captures the Filter Result | long | -| rsa.misc.gaddr | | keyword | -| rsa.misc.group | This key captures the Group Name value | keyword | -| rsa.misc.group_id | This key captures Group ID Number (related to the group name) | keyword | -| rsa.misc.group_object | This key captures a collection/grouping of entities. Specific usage | keyword | -| rsa.misc.hardware_id | This key is used to capture unique identifier for a device or system (NOT a Mac address) | keyword | -| rsa.misc.id3 | | keyword | -| rsa.misc.im_buddyid | | keyword | -| rsa.misc.im_buddyname | | keyword | -| rsa.misc.im_client | | keyword | -| rsa.misc.im_croomid | | keyword | -| rsa.misc.im_croomtype | | keyword | -| rsa.misc.im_members | | keyword | -| rsa.misc.im_userid | | keyword | -| rsa.misc.im_username | | keyword | -| rsa.misc.index | | keyword | -| rsa.misc.inout | | keyword | -| rsa.misc.ipkt | | keyword | -| rsa.misc.ipscat | | keyword | -| rsa.misc.ipspri | | keyword | -| rsa.misc.job_num | This key captures the Job Number | keyword | -| rsa.misc.jobname | | keyword | -| rsa.misc.language | This is used to capture list of languages the client support and what it prefers | keyword | -| rsa.misc.latitude | | keyword | -| rsa.misc.library | This key is used to capture library information in mainframe devices | keyword | -| rsa.misc.lifetime | This key is used to capture the session lifetime in seconds. | long | -| rsa.misc.linenum | | keyword | -| rsa.misc.link | This key is used to link the sessions together. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | keyword | -| rsa.misc.list_name | | keyword | -| rsa.misc.listnum | This key is used to capture listname or listnumber, primarily for collecting access-list | keyword | -| rsa.misc.load_data | | keyword | -| rsa.misc.location_floor | | keyword | -| rsa.misc.location_mark | | keyword | -| rsa.misc.log_id | | keyword | -| rsa.misc.log_session_id | This key is used to capture a sessionid from the session directly | keyword | -| rsa.misc.log_session_id1 | This key is used to capture a Linked (Related) Session ID from the session directly | keyword | -| rsa.misc.log_type | | keyword | -| rsa.misc.logid | | keyword | -| rsa.misc.logip | | keyword | -| rsa.misc.logname | | keyword | -| rsa.misc.longitude | | keyword | -| rsa.misc.lport | | keyword | -| rsa.misc.mail_id | This key is used to capture the mailbox id/name | keyword | -| rsa.misc.match | This key is for regex match name from search.ini | keyword | -| rsa.misc.mbug_data | | keyword | -| rsa.misc.message_body | This key captures the The contents of the message body. | keyword | -| rsa.misc.misc | | keyword | -| rsa.misc.misc_name | | keyword | -| rsa.misc.mode | | keyword | -| rsa.misc.msgIdPart1 | | keyword | -| rsa.misc.msgIdPart2 | | keyword | -| rsa.misc.msgIdPart3 | | keyword | -| rsa.misc.msgIdPart4 | | keyword | -| rsa.misc.msg_type | | keyword | -| rsa.misc.msgid | | keyword | -| rsa.misc.name | | keyword | -| rsa.misc.netsessid | | keyword | -| rsa.misc.node | Common use case is the node name within a cluster. The cluster name is reflected by the host name. | keyword | -| rsa.misc.ntype | | keyword | -| rsa.misc.num | | keyword | -| rsa.misc.number | | keyword | -| rsa.misc.number1 | | keyword | -| rsa.misc.number2 | | keyword | -| rsa.misc.nwwn | | keyword | -| rsa.misc.obj_name | This is used to capture name of object | keyword | -| rsa.misc.obj_type | This is used to capture type of object | keyword | -| rsa.misc.object | | keyword | -| rsa.misc.observed_val | This key captures the Value observed (from the perspective of the device generating the log). | keyword | -| rsa.misc.operation | | keyword | -| rsa.misc.operation_id | An alert number or operation number. The values should be unique and non-repeating. | keyword | -| rsa.misc.opkt | | keyword | -| rsa.misc.orig_from | | keyword | -| rsa.misc.owner_id | | keyword | -| rsa.misc.p_action | | keyword | -| rsa.misc.p_filter | | keyword | -| rsa.misc.p_group_object | | keyword | -| rsa.misc.p_id | | keyword | -| rsa.misc.p_msgid | | keyword | -| rsa.misc.p_msgid1 | | keyword | -| rsa.misc.p_msgid2 | | keyword | -| rsa.misc.p_result1 | | keyword | -| rsa.misc.param | This key is the parameters passed as part of a command or application, etc. | keyword | -| rsa.misc.param_dst | This key captures the command line/launch argument of the target process or file | keyword | -| rsa.misc.param_src | This key captures source parameter | keyword | -| rsa.misc.parent_node | This key captures the Parent Node Name. Must be related to node variable. | keyword | -| rsa.misc.password_chg | | keyword | -| rsa.misc.password_expire | | keyword | -| rsa.misc.payload_dst | This key is used to capture destination payload | keyword | -| rsa.misc.payload_src | This key is used to capture source payload | keyword | -| rsa.misc.permgranted | | keyword | -| rsa.misc.permwanted | | keyword | -| rsa.misc.pgid | | keyword | -| rsa.misc.phone | | keyword | -| rsa.misc.pid | | keyword | -| rsa.misc.policy | | keyword | -| rsa.misc.policyUUID | | keyword | -| rsa.misc.policy_id | This key is used to capture the Policy ID only, this should be a numeric value, use policy.name otherwise | keyword | -| rsa.misc.policy_name | This key is used to capture the Policy Name only. | keyword | -| rsa.misc.policy_value | This key captures the contents of the policy. This contains details about the policy | keyword | -| rsa.misc.policy_waiver | | keyword | -| rsa.misc.pool_id | This key captures the identifier (typically numeric field) of a resource pool | keyword | -| rsa.misc.pool_name | This key captures the name of a resource pool | keyword | -| rsa.misc.port_name | This key is used for Physical or logical port connection but does NOT include a network port. (Example: Printer port name). | keyword | -| rsa.misc.priority | | keyword | -| rsa.misc.process_id_val | This key is a failure key for Process ID when it is not an integer value | keyword | -| rsa.misc.prog_asp_num | | keyword | -| rsa.misc.program | | keyword | -| rsa.misc.real_data | | keyword | -| rsa.misc.reason | | keyword | -| rsa.misc.rec_asp_device | | keyword | -| rsa.misc.rec_asp_num | | keyword | -| rsa.misc.rec_library | | keyword | -| rsa.misc.recordnum | | keyword | -| rsa.misc.reference_id | This key is used to capture an event id from the session directly | keyword | -| rsa.misc.reference_id1 | This key is for Linked ID to be used as an addition to "reference.id" | keyword | -| rsa.misc.reference_id2 | This key is for the 2nd Linked ID. Can be either linked to "reference.id" or "reference.id1" value but should not be used unless the other two variables are in play. | keyword | -| rsa.misc.result | This key is used to capture the outcome/result string value of an action in a session. | keyword | -| rsa.misc.result_code | This key is used to capture the outcome/result numeric value of an action in a session | keyword | -| rsa.misc.risk | This key captures the non-numeric risk value | keyword | -| rsa.misc.risk_info | Deprecated, use New Hunting Model (inv.\*, ioc, boc, eoc, analysis.\*) | keyword | -| rsa.misc.risk_num | This key captures a Numeric Risk value | double | -| rsa.misc.risk_num_comm | This key captures Risk Number Community | double | -| rsa.misc.risk_num_next | This key captures Risk Number NextGen | double | -| rsa.misc.risk_num_sand | This key captures Risk Number SandBox | double | -| rsa.misc.risk_num_static | This key captures Risk Number Static | double | -| rsa.misc.risk_suspicious | Deprecated, use New Hunting Model (inv.\*, ioc, boc, eoc, analysis.\*) | keyword | -| rsa.misc.risk_warning | Deprecated, use New Hunting Model (inv.\*, ioc, boc, eoc, analysis.\*) | keyword | -| rsa.misc.ruid | | keyword | -| rsa.misc.rule | This key captures the Rule number | keyword | -| rsa.misc.rule_group | This key captures the Rule group name | keyword | -| rsa.misc.rule_name | This key captures the Rule Name | keyword | -| rsa.misc.rule_template | A default set of parameters which are overlayed onto a rule (or rulename) which efffectively constitutes a template | keyword | -| rsa.misc.rule_uid | This key is the Unique Identifier for a rule. | keyword | -| rsa.misc.sburb | | keyword | -| rsa.misc.sdomain_fld | | keyword | -| rsa.misc.search_text | This key captures the Search Text used | keyword | -| rsa.misc.sec | | keyword | -| rsa.misc.second | | keyword | -| rsa.misc.sensor | This key captures Name of the sensor. Typically used in IDS/IPS based devices | keyword | -| rsa.misc.sensorname | | keyword | -| rsa.misc.seqnum | | keyword | -| rsa.misc.serial_number | This key is the Serial number associated with a physical asset. | keyword | -| rsa.misc.session | | keyword | -| rsa.misc.sessiontype | | keyword | -| rsa.misc.severity | This key is used to capture the severity given the session | keyword | -| rsa.misc.sigUUID | | keyword | -| rsa.misc.sig_id | This key captures IDS/IPS Int Signature ID | long | -| rsa.misc.sig_id1 | This key captures IDS/IPS Int Signature ID. This must be linked to the sig.id | long | -| rsa.misc.sig_id_str | This key captures a string object of the sigid variable. | keyword | -| rsa.misc.sig_name | This key is used to capture the Signature Name only. | keyword | -| rsa.misc.sigcat | | keyword | -| rsa.misc.snmp_oid | SNMP Object Identifier | keyword | -| rsa.misc.snmp_value | SNMP set request value | keyword | -| rsa.misc.space | | keyword | -| rsa.misc.space1 | | keyword | -| rsa.misc.spi | | keyword | -| rsa.misc.spi_dst | Destination SPI Index | keyword | -| rsa.misc.spi_src | Source SPI Index | keyword | -| rsa.misc.sql | This key captures the SQL query | keyword | -| rsa.misc.srcburb | | keyword | -| rsa.misc.srcdom | | keyword | -| rsa.misc.srcservice | | keyword | -| rsa.misc.state | | keyword | -| rsa.misc.status | | keyword | -| rsa.misc.status1 | | keyword | -| rsa.misc.streams | This key captures number of streams in session | long | -| rsa.misc.subcategory | | keyword | -| rsa.misc.svcno | | keyword | -| rsa.misc.system | | keyword | -| rsa.misc.tbdstr1 | | keyword | -| rsa.misc.tbdstr2 | | keyword | -| rsa.misc.tcp_flags | This key is captures the TCP flags set in any packet of session | long | -| rsa.misc.terminal | This key captures the Terminal Names only | keyword | -| rsa.misc.tgtdom | | keyword | -| rsa.misc.tgtdomain | | keyword | -| rsa.misc.threshold | | keyword | -| rsa.misc.tos | This key describes the type of service | long | -| rsa.misc.trigger_desc | This key captures the Description of the trigger or threshold condition. | keyword | -| rsa.misc.trigger_val | This key captures the Value of the trigger or threshold condition. | keyword | -| rsa.misc.type | | keyword | -| rsa.misc.type1 | | keyword | -| rsa.misc.udb_class | | keyword | -| rsa.misc.url_fld | | keyword | -| rsa.misc.user_div | | keyword | -| rsa.misc.userid | | keyword | -| rsa.misc.username_fld | | keyword | -| rsa.misc.utcstamp | | keyword | -| rsa.misc.v_instafname | | keyword | -| rsa.misc.version | This key captures Version of the application or OS which is generating the event. | keyword | -| rsa.misc.virt_data | | keyword | -| rsa.misc.virusname | This key captures the name of the virus | keyword | -| rsa.misc.vm_target | VMWare Target \*\*VMWARE\*\* only varaible. | keyword | -| rsa.misc.vpnid | | keyword | -| rsa.misc.vsys | This key captures Virtual System Name | keyword | -| rsa.misc.vuln_ref | This key captures the Vulnerability Reference details | keyword | -| rsa.misc.workspace | This key captures Workspace Description | keyword | -| rsa.network.ad_computer_dst | Deprecated, use host.dst | keyword | -| rsa.network.addr | | keyword | -| rsa.network.alias_host | This key should be used when the source or destination context of a hostname is not clear.Also it captures the Device Hostname. Any Hostname that isnt ad.computer. | keyword | -| rsa.network.dinterface | This key should only be used when it’s a Destination Interface | keyword | -| rsa.network.dmask | This key is used for Destionation Device network mask | keyword | -| rsa.network.dns_a_record | | keyword | -| rsa.network.dns_cname_record | | keyword | -| rsa.network.dns_id | | keyword | -| rsa.network.dns_opcode | | keyword | -| rsa.network.dns_ptr_record | | keyword | -| rsa.network.dns_resp | | keyword | -| rsa.network.dns_type | | keyword | -| rsa.network.domain | | keyword | -| rsa.network.domain1 | | keyword | -| rsa.network.eth_host | Deprecated, use alias.mac | keyword | -| rsa.network.eth_type | This key is used to capture Ethernet Type, Used for Layer 3 Protocols Only | long | -| rsa.network.faddr | | keyword | -| rsa.network.fhost | | keyword | -| rsa.network.fport | | keyword | -| rsa.network.gateway | This key is used to capture the IP Address of the gateway | keyword | -| rsa.network.host_dst | This key should only be used when it’s a Destination Hostname | keyword | -| rsa.network.host_orig | This is used to capture the original hostname in case of a Forwarding Agent or a Proxy in between. | keyword | -| rsa.network.host_type | | keyword | -| rsa.network.icmp_code | This key is used to capture the ICMP code only | long | -| rsa.network.icmp_type | This key is used to capture the ICMP type only | long | -| rsa.network.interface | This key should be used when the source or destination context of an interface is not clear | keyword | -| rsa.network.ip_proto | This key should be used to capture the Protocol number, all the protocol nubers are converted into string in UI | long | -| rsa.network.laddr | | keyword | -| rsa.network.lhost | | keyword | -| rsa.network.linterface | | keyword | -| rsa.network.mask | This key is used to capture the device network IPmask. | keyword | -| rsa.network.netname | This key is used to capture the network name associated with an IP range. This is configured by the end user. | keyword | -| rsa.network.network_port | Deprecated, use port. NOTE: There is a type discrepancy as currently used, TM: Int32, INDEX: UInt64 (why neither chose the correct UInt16?!) | long | -| rsa.network.network_service | This is used to capture layer 7 protocols/service names | keyword | -| rsa.network.origin | | keyword | -| rsa.network.packet_length | | keyword | -| rsa.network.paddr | Deprecated | ip | -| rsa.network.phost | | keyword | -| rsa.network.port | This key should only be used to capture a Network Port when the directionality is not clear | long | -| rsa.network.protocol_detail | This key should be used to capture additional protocol information | keyword | -| rsa.network.remote_domain_id | | keyword | -| rsa.network.rpayload | This key is used to capture the total number of payload bytes seen in the retransmitted packets. | keyword | -| rsa.network.sinterface | This key should only be used when it’s a Source Interface | keyword | -| rsa.network.smask | This key is used for capturing source Network Mask | keyword | -| rsa.network.vlan | This key should only be used to capture the ID of the Virtual LAN | long | -| rsa.network.vlan_name | This key should only be used to capture the name of the Virtual LAN | keyword | -| rsa.network.zone | This key should be used when the source or destination context of a Zone is not clear | keyword | -| rsa.network.zone_dst | This key should only be used when it’s a Destination Zone. | keyword | -| rsa.network.zone_src | This key should only be used when it’s a Source Zone. | keyword | -| rsa.physical.org_dst | This is used to capture the destination organization based on the GEOPIP Maxmind database. | keyword | -| rsa.physical.org_src | This is used to capture the source organization based on the GEOPIP Maxmind database. | keyword | -| rsa.storage.disk_volume | A unique name assigned to logical units (volumes) within a physical disk | keyword | -| rsa.storage.lun | Logical Unit Number.This key is a very useful concept in Storage. | keyword | -| rsa.storage.pwwn | This uniquely identifies a port on a HBA. | keyword | -| rsa.threat.alert | This key is used to capture name of the alert | keyword | -| rsa.threat.threat_category | This key captures Threat Name/Threat Category/Categorization of alert | keyword | -| rsa.threat.threat_desc | This key is used to capture the threat description from the session directly or inferred | keyword | -| rsa.threat.threat_source | This key is used to capture source of the threat | keyword | -| rsa.time.date | | keyword | -| rsa.time.datetime | | keyword | -| rsa.time.day | | keyword | -| rsa.time.duration_str | A text string version of the duration | keyword | -| rsa.time.duration_time | This key is used to capture the normalized duration/lifetime in seconds. | double | -| rsa.time.effective_time | This key is the effective time referenced by an individual event in a Standard Timestamp format | date | -| rsa.time.endtime | This key is used to capture the End time mentioned in a session in a standard form | date | -| rsa.time.event_queue_time | This key is the Time that the event was queued. | date | -| rsa.time.event_time | This key is used to capture the time mentioned in a raw session that represents the actual time an event occured in a standard normalized form | date | -| rsa.time.event_time_str | This key is used to capture the incomplete time mentioned in a session as a string | keyword | -| rsa.time.eventtime | | keyword | -| rsa.time.expire_time | This key is the timestamp that explicitly refers to an expiration. | date | -| rsa.time.expire_time_str | This key is used to capture incomplete timestamp that explicitly refers to an expiration. | keyword | -| rsa.time.gmtdate | | keyword | -| rsa.time.gmttime | | keyword | -| rsa.time.hour | | keyword | -| rsa.time.min | | keyword | -| rsa.time.month | | keyword | -| rsa.time.p_date | | keyword | -| rsa.time.p_month | | keyword | -| rsa.time.p_time | | keyword | -| rsa.time.p_time1 | | keyword | -| rsa.time.p_time2 | | keyword | -| rsa.time.p_year | | keyword | -| rsa.time.process_time | Deprecated, use duration.time | keyword | -| rsa.time.recorded_time | The event time as recorded by the system the event is collected from. The usage scenario is a multi-tier application where the management layer of the system records it's own timestamp at the time of collection from its child nodes. Must be in timestamp format. | date | -| rsa.time.stamp | Deprecated key defined only in table map. | date | -| rsa.time.starttime | This key is used to capture the Start time mentioned in a session in a standard form | date | -| rsa.time.timestamp | | keyword | -| rsa.time.timezone | This key is used to capture the timezone of the Event Time | keyword | -| rsa.time.tzone | | keyword | -| rsa.time.year | | keyword | -| rsa.web.alias_host | | keyword | -| rsa.web.cn_asn_dst | | keyword | -| rsa.web.cn_rpackets | | keyword | -| rsa.web.fqdn | Fully Qualified Domain Names | keyword | -| rsa.web.p_url | | keyword | -| rsa.web.p_user_agent | | keyword | -| rsa.web.p_web_cookie | | keyword | -| rsa.web.p_web_method | | keyword | -| rsa.web.p_web_referer | | keyword | -| rsa.web.remote_domain | | keyword | -| rsa.web.reputation_num | Reputation Number of an entity. Typically used for Web Domains | double | -| rsa.web.urlpage | | keyword | -| rsa.web.urlroot | | keyword | -| rsa.web.web_cookie | This key is used to capture the Web cookies specifically. | keyword | -| rsa.web.web_extension_tmp | | keyword | -| rsa.web.web_page | | keyword | -| rsa.web.web_ref_domain | Web referer's domain | keyword | -| rsa.web.web_ref_page | This key captures Web referer's page information | keyword | -| rsa.web.web_ref_query | This key captures Web referer's query portion of the URL | keyword | -| rsa.web.web_ref_root | Web referer's root URL path | keyword | -| rsa.wireless.access_point | This key is used to capture the access point name. | keyword | -| rsa.wireless.wlan_channel | This is used to capture the channel names | long | -| rsa.wireless.wlan_name | This key captures either WLAN number/name | keyword | -| rsa.wireless.wlan_ssid | This key is used to capture the ssid of a Wireless Session | keyword | | rule.name | The name of the rule or signature generating the event. | keyword | | server.domain | The domain name of the server system. This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. | keyword | +| server.mac | MAC address of the server. The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | keyword | | server.registered_domain | The highest registered server domain, stripped of the subdomain. For example, the registered domain for "foo.example.com" is "example.com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". | keyword | | server.subdomain | The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain. In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain. For example the subdomain portion of "www.east.mydomain.co.uk" is "east". If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period. | keyword | | server.top_level_domain | The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". | keyword | @@ -919,8 +569,12 @@ An example event for `log` looks as following: | source.bytes | Bytes sent from the source to the destination. | long | | source.domain | The domain name of the source system. This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. | keyword | | source.geo.city_name | City name. | keyword | +| source.geo.continent_name | Name of the continent. | keyword | +| source.geo.country_iso_code | Country ISO code. | keyword | | source.geo.country_name | Country name. | keyword | | source.geo.location | Longitude and latitude. | geo_point | +| source.geo.region_iso_code | Region ISO code. | keyword | +| source.geo.region_name | Region name. | keyword | | source.ip | IP address of the source (IPv4 or IPv6). | ip | | source.mac | MAC address of the source. The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | keyword | | source.nat.ip | Translated ip of source based NAT sessions (e.g. internal client to internet) Typically connections traversing load balancers, firewalls, or routers. | ip | @@ -930,6 +584,12 @@ An example event for `log` looks as following: | source.subdomain | The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain. In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain. For example the subdomain portion of "www.east.mydomain.co.uk" is "east". If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period. | keyword | | source.top_level_domain | The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". | keyword | | tags | List of keywords used to tag each event. | keyword | +| threat.indicator.description | Describes the type of action conducted by the threat. | keyword | +| threat.indicator.file.hash.sha256 | SHA256 hash. | keyword | +| threat.indicator.file.name | Name of the file including the extension, without the directory. | keyword | +| threat.indicator.last_seen | The date and time when intelligence source last reported sighting this indicator. | date | +| threat.indicator.reference | Reference URL linking to additional information about this indicator. | keyword | +| threat.software.type | The type of software used by this threat to conduct behavior commonly modeled using MITRE ATT&CK®. Recommended values \* Malware \* Tool While not required, you can use a MITRE ATT&CK® software type. | keyword | | url.domain | Domain of the url, such as "www.elastic.co". In some cases a URL may refer to an IP and/or port directly, without a domain name. In this case, the IP address would go to the `domain` field. If the URL contains a literal IPv6 address enclosed by `[` and `]` (IETF RFC 2732), the `[` and `]` characters should also be captured in the `domain` field. | keyword | | url.original | Unmodified original url as seen in the event source. Note that in network monitoring, the observed URL may be a full URL, whereas in access logs, the URL is often just represented as a path. This field is meant to represent the URL as it was observed, complete or not. | wildcard | | url.original.text | Multi-field of `url.original`. | match_only_text | @@ -946,3 +606,95 @@ An example event for `log` looks as following: | user_agent.original | Unparsed user_agent string. | keyword | | user_agent.original.text | Multi-field of `user_agent.original`. | match_only_text | + +An example event for `events` looks as following: + +```json +{ + "@timestamp": "2018-02-11T00:00:00.123Z", + "agent": { + "ephemeral_id": "4dfea986-5bfd-4b6a-a1b0-00b3043870bd", + "hostname": "docker-fleet-agent", + "id": "9e1c0aac-8d48-4c33-a9f5-98e770f2028e", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "7.17.0" + }, + "cisco_meraki": { + "event": { + "alertData": { + "connection": "LTE", + "local": "192.168.1.2", + "model": "UML290VW", + "provider": "Purview Wireless", + "remote": "1.2.3.5" + }, + "alertId": "0000000000000000", + "alertTypeId": "cellular_up", + "deviceTags": [ + "tag1", + "tag2" + ], + "deviceUrl": "https://n1.meraki.com//n//manage/nodes/new_list/000000000000", + "networkId": "N_24329156", + "networkUrl": "https://n1.meraki.com//n//manage/nodes/list", + "organizationUrl": "https://dashboard.meraki.com/o/VjjsAd/manage/organization/overview", + "sentAt": "2021-10-07T08:42:00.926325Z", + "sharedSecret": "secret", + "version": "0.1" + } + }, + "data_stream": { + "dataset": "cisco_meraki.events", + "namespace": "ep", + "type": "logs" + }, + "ecs": { + "version": "8.0.0" + }, + "elastic_agent": { + "id": "9e1c0aac-8d48-4c33-a9f5-98e770f2028e", + "snapshot": false, + "version": "7.17.0" + }, + "event": { + "action": "Cellular came up", + "agent_id_status": "verified", + "category": [ + "network" + ], + "dataset": "cisco_meraki.events", + "ingested": "2022-04-26T04:00:40Z", + "original": "{\"alertData\":{\"connection\":\"LTE\",\"local\":\"192.168.1.2\",\"model\":\"UML290VW\",\"provider\":\"Purview Wireless\",\"remote\":\"1.2.3.5\"},\"alertId\":\"0000000000000000\",\"alertLevel\":\"informational\",\"alertType\":\"Cellular came up\",\"alertTypeId\":\"cellular_up\",\"deviceMac\":\"00:11:22:33:44:55\",\"deviceModel\":\"MX\",\"deviceName\":\"My appliance\",\"deviceSerial\":\"Q234-ABCD-5678\",\"deviceTags\":[\"tag1\",\"tag2\"],\"deviceUrl\":\"https://n1.meraki.com//n//manage/nodes/new_list/000000000000\",\"networkId\":\"N_24329156\",\"networkName\":\"Main Office\",\"networkTags\":[],\"networkUrl\":\"https://n1.meraki.com//n//manage/nodes/list\",\"occurredAt\":\"2018-02-11T00:00:00.123450Z\",\"organizationId\":\"2930418\",\"organizationName\":\"My organization\",\"organizationUrl\":\"https://dashboard.meraki.com/o/VjjsAd/manage/organization/overview\",\"sentAt\":\"2021-10-07T08:42:00.926325Z\",\"sharedSecret\":\"secret\",\"version\":\"0.1\"}", + "type": [ + "info", + "start" + ] + }, + "input": { + "type": "http_endpoint" + }, + "log": { + "level": "informational" + }, + "network": { + "name": "Main Office" + }, + "observer": { + "mac": "00-11-22-33-44-55", + "name": "My appliance", + "product": "MX", + "serial_number": "Q234-ABCD-5678", + "vendor": "Cisco" + }, + "organization": { + "id": "2930418", + "name": "My organization" + }, + "tags": [ + "preserve_original_event", + "forwarded", + "meraki-events" + ] +} +``` diff --git a/packages/cisco_meraki/img/cisco.svg b/packages/cisco_meraki/img/cisco-logo.svg similarity index 98% rename from packages/cisco_meraki/img/cisco.svg rename to packages/cisco_meraki/img/cisco-logo.svg index 20ebebf19741..a174ad4488f7 100644 --- a/packages/cisco_meraki/img/cisco.svg +++ b/packages/cisco_meraki/img/cisco-logo.svg @@ -1 +1 @@ - \ No newline at end of file + diff --git a/packages/cisco_meraki/img/cisco-meraki-dashboard-1.png b/packages/cisco_meraki/img/cisco-meraki-dashboard-1.png new file mode 100644 index 000000000000..7f6816cf7318 Binary files /dev/null and b/packages/cisco_meraki/img/cisco-meraki-dashboard-1.png differ diff --git a/packages/cisco_meraki/img/cisco-meraki-dashboard-2.png b/packages/cisco_meraki/img/cisco-meraki-dashboard-2.png new file mode 100644 index 000000000000..810b80d4ad9e Binary files /dev/null and b/packages/cisco_meraki/img/cisco-meraki-dashboard-2.png differ diff --git a/packages/cisco_meraki/img/cisco-meraki-dashboard-3.png b/packages/cisco_meraki/img/cisco-meraki-dashboard-3.png new file mode 100644 index 000000000000..1cfa3ccb7d54 Binary files /dev/null and b/packages/cisco_meraki/img/cisco-meraki-dashboard-3.png differ diff --git a/packages/cisco_meraki/kibana/dashboard/cisco_meraki-4832a430-af22-11ec-a899-6f7e676e0fb4.json b/packages/cisco_meraki/kibana/dashboard/cisco_meraki-4832a430-af22-11ec-a899-6f7e676e0fb4.json new file mode 100644 index 000000000000..041776b83e39 --- /dev/null +++ b/packages/cisco_meraki/kibana/dashboard/cisco_meraki-4832a430-af22-11ec-a899-6f7e676e0fb4.json @@ -0,0 +1,1272 @@ +{ + "attributes": { + "description": "", + "hits": 0, + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "cisco_meraki.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "cisco_meraki.log" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "useMargins": true + }, + "panelsJSON": [ + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-9f3c668f-fec6-4125-ae7b-fcb073df79c1", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "filter-index-pattern-0", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "9f3c668f-fec6-4125-ae7b-fcb073df79c1": { + "columnOrder": [ + "c379da24-eba4-47a5-b9aa-213324504619" + ], + "columns": { + "c379da24-eba4-47a5-b9aa-213324504619": { + "dataType": "number", + "isBucketed": false, + "label": "Unique count of source.mac", + "operationType": "unique_count", + "scale": "ratio", + "sourceField": "source.mac" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "filter-index-pattern-0", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "cisco_meraki.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "cisco_meraki.log" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "accessor": "c379da24-eba4-47a5-b9aa-213324504619", + "layerId": "9f3c668f-fec6-4125-ae7b-fcb073df79c1", + "layerType": "data" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 5, + "i": "372a6801-2e52-4c4c-a674-746eec7f7e09", + "w": 9, + "x": 0, + "y": 0 + }, + "panelIndex": "372a6801-2e52-4c4c-a674-746eec7f7e09", + "title": "Count of source MAC address", + "type": "lens", + "version": "7.17.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-511effff-5682-4cfa-a2de-739bbefa93ea", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "filter-index-pattern-0", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "511effff-5682-4cfa-a2de-739bbefa93ea": { + "columnOrder": [ + "b6287f3a-b96b-4973-b2d2-1e4f7830f9e5", + "0929169c-0ee9-4eb6-93b6-effcb648c779", + "c66ed022-eab0-4834-8a01-f508aa4b32b3" + ], + "columns": { + "0929169c-0ee9-4eb6-93b6-effcb648c779": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "b6287f3a-b96b-4973-b2d2-1e4f7830f9e5": { + "dataType": "string", + "isBucketed": true, + "label": "Top values of cisco_meraki.event_type", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "c66ed022-eab0-4834-8a01-f508aa4b32b3", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "cisco_meraki.event_type" + }, + "c66ed022-eab0-4834-8a01-f508aa4b32b3": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "scale": "ratio", + "sourceField": "Records" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "filter-index-pattern-0", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "cisco_meraki.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "cisco_meraki.log" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "c66ed022-eab0-4834-8a01-f508aa4b32b3" + ], + "layerId": "511effff-5682-4cfa-a2de-739bbefa93ea", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "splitAccessor": "b6287f3a-b96b-4973-b2d2-1e4f7830f9e5", + "xAccessor": "0929169c-0ee9-4eb6-93b6-effcb648c779" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "line", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "yLeftExtent": { + "mode": "full" + }, + "yRightExtent": { + "mode": "full" + } + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "03bf41fe-673d-4f95-9d6e-510d8dc46ba6", + "w": 13, + "x": 9, + "y": 0 + }, + "panelIndex": "03bf41fe-673d-4f95-9d6e-510d8dc46ba6", + "title": "Rate of events by type", + "type": "lens", + "version": "7.17.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-abda3ec0-db97-4e02-a42e-45e716110de2", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "filter-index-pattern-0", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "abda3ec0-db97-4e02-a42e-45e716110de2": { + "columnOrder": [ + "c59ef8c2-80ea-4386-834f-378f4a76b87c", + "c1fce02c-25a5-4a5c-a3a3-9412786a5520" + ], + "columns": { + "c1fce02c-25a5-4a5c-a3a3-9412786a5520": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": {}, + "scale": "ratio", + "sourceField": "Records" + }, + "c59ef8c2-80ea-4386-834f-378f4a76b87c": { + "dataType": "string", + "isBucketed": true, + "label": "Top values of cisco_meraki.event_type", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "c1fce02c-25a5-4a5c-a3a3-9412786a5520", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "cisco_meraki.event_type" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "filter-index-pattern-0", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "cisco_meraki.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "cisco_meraki.log" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "groups": [ + "c59ef8c2-80ea-4386-834f-378f4a76b87c" + ], + "layerId": "abda3ec0-db97-4e02-a42e-45e716110de2", + "layerType": "data", + "legendDisplay": "default", + "metric": "c1fce02c-25a5-4a5c-a3a3-9412786a5520", + "nestedLegend": false, + "numberDisplay": "percent" + } + ], + "shape": "donut" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "475cb47c-34d7-4c56-b57d-e27d25678fc8", + "w": 13, + "x": 22, + "y": 0 + }, + "panelIndex": "475cb47c-34d7-4c56-b57d-e27d25678fc8", + "title": "Event distribution by type", + "type": "lens", + "version": "7.17.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-d8f74b4f-a83b-47bc-b862-2bc47ee790eb", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "d8f74b4f-a83b-47bc-b862-2bc47ee790eb": { + "columnOrder": [ + "d1a56033-ffe5-44ed-a05f-ab79d5db90aa", + "a6d64dae-3a8d-49c1-8e4d-b08758c35a09" + ], + "columns": { + "a6d64dae-3a8d-49c1-8e4d-b08758c35a09": { + "dataType": "number", + "isBucketed": false, + "label": "Unique count of cisco_meraki.event_type", + "operationType": "unique_count", + "scale": "ratio", + "sourceField": "cisco_meraki.event_type" + }, + "d1a56033-ffe5-44ed-a05f-ab79d5db90aa": { + "dataType": "string", + "isBucketed": true, + "label": "Top values of cisco_meraki.event_subtype", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "a6d64dae-3a8d-49c1-8e4d-b08758c35a09", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "cisco_meraki.event_subtype" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "groups": [ + "d1a56033-ffe5-44ed-a05f-ab79d5db90aa" + ], + "layerId": "d8f74b4f-a83b-47bc-b862-2bc47ee790eb", + "layerType": "data", + "legendDisplay": "default", + "metric": "a6d64dae-3a8d-49c1-8e4d-b08758c35a09", + "nestedLegend": false, + "numberDisplay": "percent" + } + ], + "shape": "donut" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "58bbda58-7c31-44e1-8568-d37c2c585e53", + "w": 13, + "x": 35, + "y": 0 + }, + "panelIndex": "58bbda58-7c31-44e1-8568-d37c2c585e53", + "title": "Event distribution by sub-type", + "type": "lens", + "version": "7.17.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-5dc18b67-2c60-44c0-b3b5-7dd507bd4c3d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "filter-index-pattern-0", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "filter-index-pattern-1", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "5dc18b67-2c60-44c0-b3b5-7dd507bd4c3d": { + "columnOrder": [ + "66ede758-6532-443e-834d-a847c964682f" + ], + "columns": { + "66ede758-6532-443e-834d-a847c964682f": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "No. of rogue SSIDs detected", + "operationType": "count", + "scale": "ratio", + "sourceField": "Records" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "filter-index-pattern-0", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "cisco_meraki.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "cisco_meraki.log" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "filter-index-pattern-1", + "key": "cisco_meraki.event_subtype", + "negate": false, + "params": { + "query": "rogue_ssid_detected" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "cisco_meraki.event_subtype": "rogue_ssid_detected" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "accessor": "66ede758-6532-443e-834d-a847c964682f", + "layerId": "5dc18b67-2c60-44c0-b3b5-7dd507bd4c3d", + "layerType": "data" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 5, + "i": "8baff03a-7860-4fcc-90ff-3d5534e70845", + "w": 9, + "x": 0, + "y": 5 + }, + "panelIndex": "8baff03a-7860-4fcc-90ff-3d5534e70845", + "title": "Number of rogue SSIDs detected", + "type": "lens", + "version": "7.17.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-bcffdee9-d006-4e9c-abcc-081ac4739d02", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "filter-index-pattern-0", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "filter-index-pattern-1", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "bcffdee9-d006-4e9c-abcc-081ac4739d02": { + "columnOrder": [ + "86b75fce-daae-4725-8de4-6bcd5c7cc80a" + ], + "columns": { + "86b75fce-daae-4725-8de4-6bcd5c7cc80a": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "No. of SSID spoofing detected", + "operationType": "count", + "scale": "ratio", + "sourceField": "Records" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "filter-index-pattern-0", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "cisco_meraki.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "cisco_meraki.log" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "filter-index-pattern-1", + "key": "cisco_meraki.event_subtype", + "negate": false, + "params": { + "query": "ssid_spoofing_detected" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "cisco_meraki.event_subtype": "ssid_spoofing_detected" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "accessor": "86b75fce-daae-4725-8de4-6bcd5c7cc80a", + "layerId": "bcffdee9-d006-4e9c-abcc-081ac4739d02", + "layerType": "data" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 5, + "i": "bcfe3eee-750d-476f-b7c1-afec41803720", + "w": 9, + "x": 0, + "y": 10 + }, + "panelIndex": "bcfe3eee-750d-476f-b7c1-afec41803720", + "title": "Number of SSID spoofing detected", + "type": "lens", + "version": "7.17.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-9a165bef-572a-44fb-9285-70d75530b799", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "filter-index-pattern-0", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "9a165bef-572a-44fb-9285-70d75530b799": { + "columnOrder": [ + "9df0ec49-bc15-494a-8ca7-437cd63ee7cd", + "aca7f561-3ca9-4705-bf6e-e470d1fb0536", + "5a195aa9-a6fa-45cd-94a7-89f782c9a638" + ], + "columns": { + "5a195aa9-a6fa-45cd-94a7-89f782c9a638": { + "dataType": "number", + "isBucketed": false, + "label": "Unique count of event.action", + "operationType": "unique_count", + "scale": "ratio", + "sourceField": "event.action" + }, + "9df0ec49-bc15-494a-8ca7-437cd63ee7cd": { + "dataType": "string", + "isBucketed": true, + "label": "Top values of event.category", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "5a195aa9-a6fa-45cd-94a7-89f782c9a638", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "event.category" + }, + "aca7f561-3ca9-4705-bf6e-e470d1fb0536": { + "dataType": "string", + "isBucketed": true, + "label": "Top values of event.action", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "5a195aa9-a6fa-45cd-94a7-89f782c9a638", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "event.action" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "filter-index-pattern-0", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "cisco_meraki.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "cisco_meraki.log" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "groups": [ + "9df0ec49-bc15-494a-8ca7-437cd63ee7cd", + "aca7f561-3ca9-4705-bf6e-e470d1fb0536" + ], + "layerId": "9a165bef-572a-44fb-9285-70d75530b799", + "layerType": "data", + "legendDisplay": "default", + "metric": "5a195aa9-a6fa-45cd-94a7-89f782c9a638", + "nestedLegend": false, + "numberDisplay": "percent" + } + ], + "shape": "pie" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 24, + "i": "e359d544-a8d6-4019-9756-74519a9d3335", + "w": 27, + "x": 0, + "y": 15 + }, + "panelIndex": "e359d544-a8d6-4019-9756-74519a9d3335", + "title": "Events by category and action", + "type": "lens", + "version": "7.17.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "layerListJSON": "[{\"sourceDescriptor\":{\"type\":\"EMS_TMS\",\"isAutoSelect\":true},\"id\":\"09082ad3-0055-461d-bf69-2b69a5dfb298\",\"label\":null,\"minZoom\":0,\"maxZoom\":24,\"alpha\":1,\"visible\":true,\"style\":{\"type\":\"TILE\"},\"includeInFitToBounds\":true,\"type\":\"VECTOR_TILE\"},{\"sourceDescriptor\":{\"indexPatternId\":\"logs-*\",\"sourceGeoField\":\"source.geo.location\",\"destGeoField\":\"destination.geo.location\",\"id\":\"ce84cee6-da49-4261-beaa-628ca03abc52\",\"type\":\"ES_PEW_PEW\",\"applyGlobalQuery\":true,\"applyGlobalTime\":true,\"applyForceRefresh\":true,\"metrics\":[{\"type\":\"count\"}]},\"style\":{\"type\":\"VECTOR\",\"properties\":{\"icon\":{\"type\":\"STATIC\",\"options\":{\"value\":\"marker\"}},\"fillColor\":{\"type\":\"STATIC\",\"options\":{\"color\":\"#54B399\"}},\"lineColor\":{\"type\":\"DYNAMIC\",\"options\":{\"color\":\"Green to Red\",\"colorCategory\":\"palette_0\",\"field\":{\"name\":\"doc_count\",\"origin\":\"source\"},\"fieldMetaOptions\":{\"isEnabled\":true,\"sigma\":3},\"type\":\"ORDINAL\",\"useCustomColorRamp\":false}},\"lineWidth\":{\"type\":\"STATIC\",\"options\":{\"size\":3}},\"iconSize\":{\"type\":\"STATIC\",\"options\":{\"size\":6}},\"iconOrientation\":{\"type\":\"STATIC\",\"options\":{\"orientation\":0}},\"labelText\":{\"type\":\"DYNAMIC\",\"options\":{\"field\":{\"label\":\"count\",\"name\":\"doc_count\",\"origin\":\"source\",\"type\":\"number\",\"supportsAutoDomain\":true}}},\"labelColor\":{\"type\":\"STATIC\",\"options\":{\"color\":\"#000000\"}},\"labelSize\":{\"type\":\"STATIC\",\"options\":{\"size\":14}},\"labelBorderColor\":{\"type\":\"STATIC\",\"options\":{\"color\":\"#FFFFFF\"}},\"symbolizeAs\":{\"options\":{\"value\":\"circle\"}},\"labelBorderSize\":{\"options\":{\"size\":\"SMALL\"}}},\"isTimeAware\":true},\"id\":\"8dec8632-de8b-43df-9731-5c6c45ecb45f\",\"label\":\"src-dst-ip-p2p\",\"minZoom\":0,\"maxZoom\":24,\"alpha\":0.75,\"visible\":true,\"includeInFitToBounds\":true,\"type\":\"VECTOR\",\"joins\":[]}]", + "mapStateJSON": "{\"zoom\":1.61,\"center\":{\"lon\":0,\"lat\":19.94277},\"timeFilters\":{\"from\":\"now-2y\",\"to\":\"now\"},\"refreshConfig\":{\"isPaused\":true,\"interval\":0},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[{\"meta\":{\"index\":\"logs-*\",\"alias\":null,\"negate\":false,\"disabled\":false,\"type\":\"phrase\",\"key\":\"data_stream.dataset\",\"params\":{\"query\":\"cisco_meraki.log\"}},\"query\":{\"match_phrase\":{\"data_stream.dataset\":\"cisco_meraki.log\"}},\"$state\":{\"store\":\"appState\"}}],\"settings\":{\"autoFitToDataBounds\":false,\"backgroundColor\":\"#ffffff\",\"disableInteractive\":false,\"disableTooltipControl\":false,\"hideToolbarOverlay\":false,\"hideLayerControl\":false,\"hideViewControl\":false,\"initialLocation\":\"LAST_SAVED_LOCATION\",\"fixedLocation\":{\"lat\":0,\"lon\":0,\"zoom\":2},\"browserLocation\":{\"zoom\":2},\"maxZoom\":24,\"minZoom\":0,\"showScaleControl\":false,\"showSpatialFilters\":true,\"showTimesliderToggleButton\":true,\"spatialFiltersAlpa\":0.3,\"spatialFiltersFillColor\":\"#DA8B45\",\"spatialFiltersLineColor\":\"#DA8B45\"}}", + "title": "", + "uiStateJSON": "{\"isLayerTOCOpen\":true,\"openTOCDetails\":[]}" + }, + "enhancements": {}, + "hiddenLayers": [], + "hidePanelTitles": false, + "isLayerTOCOpen": false, + "mapBuffer": { + "maxLat": 85.05113, + "maxLon": 180, + "minLat": -85.05113, + "minLon": -180 + }, + "mapCenter": { + "lat": 19.50912, + "lon": -10.59576, + "zoom": 0.61 + }, + "openTOCDetails": [] + }, + "gridData": { + "h": 12, + "i": "beacf090-799a-415a-bbad-302cd02d50be", + "w": 21, + "x": 27, + "y": 15 + }, + "panelIndex": "beacf090-799a-415a-bbad-302cd02d50be", + "title": "IP Flows", + "type": "map", + "version": "7.17.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-04c98418-d7c7-4552-9ed3-d0380795febd", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "filter-index-pattern-0", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "04c98418-d7c7-4552-9ed3-d0380795febd": { + "columnOrder": [ + "1e47d004-4347-46ee-aed2-280f64e8888d", + "4c2300ef-9033-45bd-8b0e-06deea3996f1" + ], + "columns": { + "1e47d004-4347-46ee-aed2-280f64e8888d": { + "dataType": "string", + "isBucketed": true, + "label": "Top values of url.original", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "4c2300ef-9033-45bd-8b0e-06deea3996f1", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "url.original" + }, + "4c2300ef-9033-45bd-8b0e-06deea3996f1": { + "dataType": "number", + "filter": { + "language": "kuery", + "query": "" + }, + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "scale": "ratio", + "sourceField": "Records" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "filter-index-pattern-0", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "cisco_meraki.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "cisco_meraki.log" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "accessors": [ + "4c2300ef-9033-45bd-8b0e-06deea3996f1" + ], + "layerId": "04c98418-d7c7-4552-9ed3-d0380795febd", + "layerType": "data", + "position": "top", + "seriesType": "bar_horizontal", + "showGridlines": false, + "xAccessor": "1e47d004-4347-46ee-aed2-280f64e8888d", + "yConfig": [ + { + "axisMode": "auto", + "forAccessor": "4c2300ef-9033-45bd-8b0e-06deea3996f1" + } + ] + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "bar_horizontal", + "title": "Empty XY chart", + "valueLabels": "hide", + "yLeftExtent": { + "mode": "full" + }, + "yRightExtent": { + "mode": "full" + } + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 12, + "i": "58d65007-15fc-492f-a8db-f509b7d28aad", + "w": 21, + "x": 27, + "y": 27 + }, + "panelIndex": "58d65007-15fc-492f-a8db-f509b7d28aad", + "title": "Top URL access", + "type": "lens", + "version": "7.17.0" + }, + { + "embeddableConfig": { + "enhancements": {} + }, + "gridData": { + "h": 20, + "i": "a7fc4a8a-954f-4fc0-acfc-2d358c89b2c6", + "w": 48, + "x": 0, + "y": 39 + }, + "panelIndex": "a7fc4a8a-954f-4fc0-acfc-2d358c89b2c6", + "title": "Log stream", + "type": "LOG_STREAM_EMBEDDABLE", + "version": "7.17.0" + } + ], + "timeRestore": false, + "title": "[Logs Cisco Meraki Syslog Events] Overview", + "version": 1 + }, + "coreMigrationVersion": "7.17.0", + "id": "cisco_meraki-4832a430-af22-11ec-a899-6f7e676e0fb4", + "migrationVersion": { + "dashboard": "7.17.0" + }, + "references": [ + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "372a6801-2e52-4c4c-a674-746eec7f7e09:indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "372a6801-2e52-4c4c-a674-746eec7f7e09:indexpattern-datasource-layer-9f3c668f-fec6-4125-ae7b-fcb073df79c1", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "372a6801-2e52-4c4c-a674-746eec7f7e09:filter-index-pattern-0", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "03bf41fe-673d-4f95-9d6e-510d8dc46ba6:indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "03bf41fe-673d-4f95-9d6e-510d8dc46ba6:indexpattern-datasource-layer-511effff-5682-4cfa-a2de-739bbefa93ea", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "03bf41fe-673d-4f95-9d6e-510d8dc46ba6:filter-index-pattern-0", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "475cb47c-34d7-4c56-b57d-e27d25678fc8:indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "475cb47c-34d7-4c56-b57d-e27d25678fc8:indexpattern-datasource-layer-abda3ec0-db97-4e02-a42e-45e716110de2", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "475cb47c-34d7-4c56-b57d-e27d25678fc8:filter-index-pattern-0", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "58bbda58-7c31-44e1-8568-d37c2c585e53:indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "58bbda58-7c31-44e1-8568-d37c2c585e53:indexpattern-datasource-layer-d8f74b4f-a83b-47bc-b862-2bc47ee790eb", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "8baff03a-7860-4fcc-90ff-3d5534e70845:indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "8baff03a-7860-4fcc-90ff-3d5534e70845:indexpattern-datasource-layer-5dc18b67-2c60-44c0-b3b5-7dd507bd4c3d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "8baff03a-7860-4fcc-90ff-3d5534e70845:filter-index-pattern-0", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "8baff03a-7860-4fcc-90ff-3d5534e70845:filter-index-pattern-1", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "bcfe3eee-750d-476f-b7c1-afec41803720:indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "bcfe3eee-750d-476f-b7c1-afec41803720:indexpattern-datasource-layer-bcffdee9-d006-4e9c-abcc-081ac4739d02", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "bcfe3eee-750d-476f-b7c1-afec41803720:filter-index-pattern-0", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "bcfe3eee-750d-476f-b7c1-afec41803720:filter-index-pattern-1", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "e359d544-a8d6-4019-9756-74519a9d3335:indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "e359d544-a8d6-4019-9756-74519a9d3335:indexpattern-datasource-layer-9a165bef-572a-44fb-9285-70d75530b799", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "e359d544-a8d6-4019-9756-74519a9d3335:filter-index-pattern-0", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "beacf090-799a-415a-bbad-302cd02d50be:layer_1_source_index_pattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "58d65007-15fc-492f-a8db-f509b7d28aad:indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "58d65007-15fc-492f-a8db-f509b7d28aad:indexpattern-datasource-layer-04c98418-d7c7-4552-9ed3-d0380795febd", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "58d65007-15fc-492f-a8db-f509b7d28aad:filter-index-pattern-0", + "type": "index-pattern" + } + ], + "type": "dashboard" +} \ No newline at end of file diff --git a/packages/cisco_meraki/manifest.yml b/packages/cisco_meraki/manifest.yml index 94b3cdd958d4..82b34c4a6e3b 100644 --- a/packages/cisco_meraki/manifest.yml +++ b/packages/cisco_meraki/manifest.yml @@ -1,34 +1,50 @@ format_version: 1.0.0 name: cisco_meraki -title: Cisco Meraki +title: Cisco Meraki Integration version: 0.5.0 license: basic -description: Collect logs from Cisco Meraki with Elastic Agent. +description: Collect events from Cisco Meraki. type: integration categories: - network - security release: experimental conditions: - kibana.version: "^7.16.0 || ^8.0.0" + kibana.version: ^7.17.0 || ^8.0.0 +screenshots: + - src: /img/cisco-meraki-dashboard-1.png + title: Cisco Meraki Dashboard + size: 600x600 + type: image/png + - src: /img/cisco-meraki-dashboard-2.png + title: Cisco Meraki Dashboard + size: 600x600 + type: image/png + - src: /img/cisco-meraki-dashboard-3.png + title: Cisco Meraki Dashboard + size: 600x600 + type: image/png icons: - - src: /img/cisco.svg - title: cisco - size: 216x216 + - src: /img/cisco-logo.svg + title: Cisco logo + size: 32x32 type: image/svg+xml policy_templates: - name: cisco_meraki - title: Cisco Meraki logs - description: Collect logs from Cisco Meraki instances + title: Cisco Meraki logs or events + description: Collect logs or events from Cisco Meraki inputs: - type: udp - title: Collect logs from Cisco Meraki via UDP - description: Collecting logs from Cisco Meraki via UDP + title: Collect syslog from Cisco Meraki via UDP + description: Collecting syslog from Cisco Meraki via UDP - type: tcp - title: Collect logs from Cisco Meraki via TCP - description: Collecting logs from Cisco Meraki via TCP + title: Collect syslog from Cisco Meraki via TCP + description: Collecting syslog from Cisco Meraki via TCP - type: logfile - title: Collect logs from Cisco Meraki via file - description: Collecting logs from Cisco Meraki via file + title: Collect syslog from Cisco Meraki via file + description: Collecting syslog from Cisco Meraki via file + - type: http_endpoint + title: Collect events from Cisco Meraki via Webhooks + description: Collecting events from Cisco Meraki via Webhooks owner: github: elastic/security-external-integrations