From 0099bdf723ba6a42cbaaa23363d7321763155687 Mon Sep 17 00:00:00 2001 From: JocLRojas Date: Tue, 21 Jul 2026 21:34:31 +0300 Subject: [PATCH 1/2] fix(filters): normalize actionResult to canonical values (denied/blocked/failed/success) across ESET, Azure, Meraki, GCP, Linux, O365 and Sophos --- filters/antivirus/esmc-eset.yml | 23 ++++ filters/azure/azure-eventhub.yml | 25 +++++ filters/cisco/meraki.yml | 152 +++++++++++++------------- filters/google/gcp.yml | 2 +- filters/linux/linux.yml | 25 ++++- filters/office365/o365.yml | 20 +++- filters/sophos/sophos_xg_firewall.yml | 4 +- 7 files changed, 165 insertions(+), 86 deletions(-) diff --git a/filters/antivirus/esmc-eset.yml b/filters/antivirus/esmc-eset.yml index 24734dc95..b270dd182 100644 --- a/filters/antivirus/esmc-eset.yml +++ b/filters/antivirus/esmc-eset.yml @@ -63,6 +63,7 @@ pipeline: from: - log.event to: actionResult + where: '!regexMatch("log.result", "(?i)\b(?:denied|blocked|failed)\b")' - rename: from: - log.sourceaddress @@ -83,6 +84,28 @@ pipeline: from: - log.targetport to: target.port + + # Adding action result + - add: + function: 'string' + params: + key: actionResult + value: 'denied' + where: regexMatch("log.event", "(?i)\bdenied\b") + + - add: + function: 'string' + params: + key: actionResult + value: 'blocked' + where: regexMatch("log.event", "(?i)\bblocked\b") + + - add: + function: 'string' + params: + key: actionResult + value: 'failed' + where: regexMatch("log.event", "(?i)\bfailed\b") # Adding severity field based on log.severity - add: diff --git a/filters/azure/azure-eventhub.yml b/filters/azure/azure-eventhub.yml index bac4fa8ec..e11dcc129 100644 --- a/filters/azure/azure-eventhub.yml +++ b/filters/azure/azure-eventhub.yml @@ -797,22 +797,47 @@ pipeline: from: - log.properties.result to: actionResult + where: '!regexMatch("log.properties.result", "(?i)\b(?:denied|blocked|failed)\b")' - rename: from: - log.Properties.Result to: actionResult + where: '!regexMatch("log.properties.result", "(?i)\b(?:denied|blocked|failed)\b")' - rename: from: - log.properties.resultType to: actionResult + where: '!regexMatch("log.properties.result", "(?i)\b(?:denied|blocked|failed)\b")' - rename: from: - log.properties.userAgent to: log.propertiesUserAgent + # Adding action result + - add: + function: 'string' + params: + key: actionResult + value: 'denied' + where: regexMatch("log.properties.result", "(?i)\bdenied\b") + + - add: + function: 'string' + params: + key: actionResult + value: 'blocked' + where: regexMatch("log.properties.result", "(?i)\bblocked\b") + + - add: + function: 'string' + params: + key: actionResult + value: 'failed' + where: regexMatch("log.properties.result", "(?i)\bfailed\b") + # .......................................................................# # Adding severity based on log.level # .......................................................................# diff --git a/filters/cisco/meraki.yml b/filters/cisco/meraki.yml index 4751d7c52..66bb8d610 100644 --- a/filters/cisco/meraki.yml +++ b/filters/cisco/meraki.yml @@ -310,7 +310,7 @@ pipeline: - fieldName: log.pattern pattern: '{{.greedy}}' source: log.genericEvent - where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "src") && log.merakiGroup=="flows"' + where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "src") && equals("log.merakiGroup", "flows")' # Second variant - grok: patterns: @@ -339,20 +339,20 @@ pipeline: - fieldName: log.pattern pattern: '{{.greedy}}' source: log.genericEvent - where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "src") && log.merakiGroup=="flows"' + where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "src") && equals("log.merakiGroup", "flows")' # Adding action result - add: function: 'string' params: key: actionResult value: 'accepted' - where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "src") && log.merakiGroup=="flows" && (startsWith("log.pattern", "0") || startsWith("log.pattern", "allow") || startsWith("log.pattern", "Allow"))' + where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "src") && equals("log.merakiGroup", "flows") && (startsWith("log.pattern", "0") || startsWith("log.pattern", "allow") || startsWith("log.pattern", "Allow"))' - add: function: 'string' params: key: actionResult value: 'denied' - where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "src") && log.merakiGroup=="flows" && (startsWith("log.pattern", "deny") || startsWith("log.pattern", "Deny"))' + where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "src") && equals("log.merakiGroup", "flows") && (startsWith("log.pattern", "deny") || startsWith("log.pattern", "Deny"))' # ........................................ # Event: ids-alerts, ids signature matched in Meraki MX Security Appliance - grok: @@ -416,7 +416,7 @@ pipeline: - fieldName: log.spi pattern: '{{.greedy}}' source: log.genericEvent - where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "Site") && log.merakiGroup=="events"' + where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "Site") && equals("log.merakiGroup", "events")' # Second variant - grok: patterns: @@ -427,7 +427,7 @@ pipeline: - fieldName: log.irrelevant pattern: '{{.greedy}}' source: log.genericEvent - where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "Site") && log.merakiGroup=="events"' + where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "Site") && equals("log.merakiGroup", "events")' # Third variant - grok: patterns: @@ -446,7 +446,7 @@ pipeline: - fieldName: target.port pattern: '\[(\s)?{{.integer}}(\s)?\]' source: log.genericEvent - where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "Site") && log.merakiGroup=="events"' + where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "Site") && equals("log.merakiGroup", "events")' # Fourth variant - grok: patterns: @@ -463,7 +463,7 @@ pipeline: - fieldName: target.port pattern: '\[(\s)?{{.integer}}(\s)?\]' source: log.genericEvent - where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "Site") && log.merakiGroup=="events"' + where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "Site") && equals("log.merakiGroup", "events")' # Fifth variant - grok: patterns: @@ -484,28 +484,28 @@ pipeline: - fieldName: log.spi pattern: '{{.greedy}}' source: log.genericEvent - where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "Site") && log.merakiGroup=="events"' + where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "Site") && equals("log.merakiGroup", "events")' - trim: function: prefix substring: '[' fields: - origin.port - target.port - where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "Site") && log.merakiGroup=="events"' + where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "Site") && equals("log.merakiGroup", "events")' - trim: function: suffix substring: ']' fields: - origin.port - target.port - where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "Site") && log.merakiGroup=="events"' + where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "Site") && equals("log.merakiGroup", "events")' # Adding action result - add: function: 'string' params: key: actionResult value: 'accepted' - where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "Site") && log.merakiGroup=="events" && (contains("log.genericEvent", "queued due to no phase 1") || contains("log.genericEvent", "queued due to no phase1") || contains("log.genericEvent", "established"))' + where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "Site") && equals("log.merakiGroup", "events") && (contains("log.genericEvent", "queued due to no phase 1") || contains("log.genericEvent", "queued due to no phase1") || contains("log.genericEvent", "established"))' # ........................................ # Event: event spanning-tree guard state change in Meraki MS Switches - grok: @@ -527,26 +527,26 @@ pipeline: - fieldName: actionResult pattern: '{{.greedy}}' source: log.genericEvent - where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "Port") && log.merakiGroup=="events"' + where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "Port") && equals("log.merakiGroup", "events")' - trim: function: suffix substring: 'BPDU' fields: - protocol - where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "Port") && log.merakiGroup=="events"' + where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "Port") && equals("log.merakiGroup", "events")' - trim: function: suffix substring: 'so' fields: - origin.mac - where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "Port") && log.merakiGroup=="events"' + where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "Port") && equals("log.merakiGroup", "events")' # Adding action result - add: function: 'string' params: key: actionResult value: 'denied' - where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "Port") && log.merakiGroup=="events" && contains("log.genericEvent", "blocked")' + where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "Port") && equals("log.merakiGroup", "events") && contains("log.genericEvent", "blocked")' # ........................................ # Event: event blocked DHCP server response in Meraki MS Switches - grok: @@ -564,19 +564,19 @@ pipeline: - fieldName: log.vlan pattern: '{{.greedy}}' source: log.genericEvent - where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "Blocked") && log.merakiGroup=="events"' + where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "Blocked") && equals("log.merakiGroup", "events")' - trim: function: suffix substring: 'server' fields: - protocol - where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "Blocked") && log.merakiGroup=="events"' + where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "Blocked") && equals("log.merakiGroup", "events")' - trim: function: suffix substring: 'on' fields: - origin.mac - where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "Blocked") && log.merakiGroup=="events"' + where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "Blocked") && equals("log.merakiGroup", "events")' # ........................................ # Event: event 802.1X (all events) in Meraki MS Switches - grok: @@ -594,27 +594,27 @@ pipeline: - fieldName: log.identity pattern: '{{.greedy}}' source: log.genericEvent - where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "identity") && contains("log.genericEvent", "port")' + where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && equals("log.merakiGroup", "events") && contains("log.genericEvent", "identity") && contains("log.genericEvent", "port")' - trim: function: suffix substring: 'port' fields: - action - where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "identity") && contains("log.genericEvent", "port")' + where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && equals("log.merakiGroup", "events") && contains("log.genericEvent", "identity") && contains("log.genericEvent", "port")' - trim: function: prefix substring: '''' fields: - origin.port - log.identity - where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "identity") && contains("log.genericEvent", "port")' + where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && equals("log.merakiGroup", "events") && contains("log.genericEvent", "identity") && contains("log.genericEvent", "port")' - trim: function: suffix substring: '''' fields: - origin.port - log.identity - where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "identity") && contains("log.genericEvent", "port")' + where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && equals("log.merakiGroup", "events") && contains("log.genericEvent", "identity") && contains("log.genericEvent", "port")' # ........................................ # Event: event 802.11 disassociation in Meraki MR Access Points - grok: @@ -696,115 +696,115 @@ pipeline: - fieldName: log.aid pattern: '{{.greedy}}' source: log.genericEvent - where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")' + where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && equals("log.merakiGroup", "events") && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")' - trim: function: suffix substring: 'radio' fields: - action - where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")' + where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && equals("log.merakiGroup", "events") && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")' - trim: function: suffix substring: 'vap' fields: - log.radio - where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")' + where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && equals("log.merakiGroup", "events") && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")' - trim: function: suffix substring: 'channel' fields: - log.vap - where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")' + where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && equals("log.merakiGroup", "events") && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")' - trim: function: suffix substring: 'reason' fields: - log.channel - where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")' + where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && equals("log.merakiGroup", "events") && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")' - trim: function: suffix substring: 'instigator' fields: - log.reason - where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")' + where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && equals("log.merakiGroup", "events") && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")' - trim: function: suffix substring: 'duration' fields: - log.instigator - where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")' + where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && equals("log.merakiGroup", "events") && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")' - trim: function: suffix substring: 'auth_neg_dur' fields: - log.duration - where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")' + where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && equals("log.merakiGroup", "events") && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")' - trim: function: suffix substring: 'last_auth_ago' fields: - log.authNegDur - where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")' + where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && equals("log.merakiGroup", "events") && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")' - trim: function: suffix substring: 'is_wpa' fields: - log.lastAuthAgo - where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")' + where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && equals("log.merakiGroup", "events") && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")' - trim: function: suffix substring: 'full_conn' fields: - log.isWpa - where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")' + where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && equals("log.merakiGroup", "events") && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")' - trim: function: suffix substring: 'ip_resp' fields: - log.fullConn - where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")' + where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && equals("log.merakiGroup", "events") && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")' - trim: function: suffix substring: 'ip_src' fields: - log.ipResp - where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")' + where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && equals("log.merakiGroup", "events") && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")' - trim: function: suffix substring: 'arp_resp' fields: - origin.ip - where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")' + where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && equals("log.merakiGroup", "events") && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")' - trim: function: suffix substring: 'arp_src' fields: - log.arpResp - where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")' + where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && equals("log.merakiGroup", "events") && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")' - trim: function: suffix substring: 'dns_server' fields: - log.arpSrc - where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")' + where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && equals("log.merakiGroup", "events") && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")' - trim: function: suffix substring: 'dns_req_rtt' fields: - log.dnsServer - where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")' + where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && equals("log.merakiGroup", "events") && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")' - trim: function: suffix substring: 'dns_resp' fields: - log.dnsReqRtt - where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")' + where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && equals("log.merakiGroup", "events") && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")' - trim: function: suffix substring: 'aid' fields: - log.dnsResp - where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")' + where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && equals("log.merakiGroup", "events") && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")' - trim: function: prefix substring: '''' @@ -827,7 +827,7 @@ pipeline: - log.dnsReqRtt - log.dnsResp - log.aid - where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")' + where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && equals("log.merakiGroup", "events") && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")' - trim: function: suffix substring: '''' @@ -850,14 +850,14 @@ pipeline: - log.dnsReqRtt - log.dnsResp - log.aid - where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")' + where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && equals("log.merakiGroup", "events") && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")' # Adding action result - add: function: 'string' params: key: actionResult value: 'accepted' - where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")' + where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && equals("log.merakiGroup", "events") && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")' # ........................................ # Event: event 802.1X (all events) in Meraki MR Access Points - grok: @@ -883,31 +883,31 @@ pipeline: - fieldName: log.aid pattern: '{{.greedy}}' source: log.genericEvent - where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "vap") && contains("log.genericEvent", "identity") && contains("log.genericEvent", "aid")' + where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && equals("log.merakiGroup", "events") && contains("log.genericEvent", "radio") && contains("log.genericEvent", "vap") && contains("log.genericEvent", "identity") && contains("log.genericEvent", "aid")' - trim: function: suffix substring: 'radio' fields: - action - where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "vap") && contains("log.genericEvent", "identity") && contains("log.genericEvent", "aid")' + where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && equals("log.merakiGroup", "events") && contains("log.genericEvent", "radio") && contains("log.genericEvent", "vap") && contains("log.genericEvent", "identity") && contains("log.genericEvent", "aid")' - trim: function: suffix substring: 'vap' fields: - log.radio - where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "vap") && contains("log.genericEvent", "identity") && contains("log.genericEvent", "aid")' + where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && equals("log.merakiGroup", "events") && contains("log.genericEvent", "radio") && contains("log.genericEvent", "vap") && contains("log.genericEvent", "identity") && contains("log.genericEvent", "aid")' - trim: function: suffix substring: 'identity' fields: - log.vap - where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "vap") && contains("log.genericEvent", "identity") && contains("log.genericEvent", "aid")' + where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && equals("log.merakiGroup", "events") && contains("log.genericEvent", "radio") && contains("log.genericEvent", "vap") && contains("log.genericEvent", "identity") && contains("log.genericEvent", "aid")' - trim: function: suffix substring: 'aid' fields: - log.identity - where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "vap") && contains("log.genericEvent", "identity") && contains("log.genericEvent", "aid")' + where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && equals("log.merakiGroup", "events") && contains("log.genericEvent", "radio") && contains("log.genericEvent", "vap") && contains("log.genericEvent", "identity") && contains("log.genericEvent", "aid")' - trim: function: prefix substring: '''' @@ -916,7 +916,7 @@ pipeline: - log.vap - log.identity - log.aid - where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "vap") && contains("log.genericEvent", "identity") && contains("log.genericEvent", "aid")' + where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && equals("log.merakiGroup", "events") && contains("log.genericEvent", "radio") && contains("log.genericEvent", "vap") && contains("log.genericEvent", "identity") && contains("log.genericEvent", "aid")' - trim: function: suffix substring: '''' @@ -925,7 +925,7 @@ pipeline: - log.vap - log.identity - log.aid - where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "vap") && contains("log.genericEvent", "identity") && contains("log.genericEvent", "aid")' + where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && equals("log.merakiGroup", "events") && contains("log.genericEvent", "radio") && contains("log.genericEvent", "vap") && contains("log.genericEvent", "identity") && contains("log.genericEvent", "aid")' # ........................................ # Event: event splash authentication in Meraki MR Access Points - grok: @@ -955,37 +955,37 @@ pipeline: - fieldName: log.upload pattern: '{{.greedy}}' source: log.genericEvent - where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "ip") && contains("log.genericEvent", "vap") && contains("log.genericEvent", "duration") && contains("log.genericEvent", "download") && contains("log.genericEvent", "upload")' + where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && equals("log.merakiGroup", "events") && contains("log.genericEvent", "ip") && contains("log.genericEvent", "vap") && contains("log.genericEvent", "duration") && contains("log.genericEvent", "download") && contains("log.genericEvent", "upload")' - trim: function: suffix substring: 'ip' fields: - action - where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "ip") && contains("log.genericEvent", "vap") && contains("log.genericEvent", "duration") && contains("log.genericEvent", "download") && contains("log.genericEvent", "upload")' + where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && equals("log.merakiGroup", "events") && contains("log.genericEvent", "ip") && contains("log.genericEvent", "vap") && contains("log.genericEvent", "duration") && contains("log.genericEvent", "download") && contains("log.genericEvent", "upload")' - trim: function: suffix substring: 'duration' fields: - origin.ip - where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "ip") && contains("log.genericEvent", "vap") && contains("log.genericEvent", "duration") && contains("log.genericEvent", "download") && contains("log.genericEvent", "upload")' + where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && equals("log.merakiGroup", "events") && contains("log.genericEvent", "ip") && contains("log.genericEvent", "vap") && contains("log.genericEvent", "duration") && contains("log.genericEvent", "download") && contains("log.genericEvent", "upload")' - trim: function: suffix substring: 'vap' fields: - log.duration - where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "ip") && contains("log.genericEvent", "vap") && contains("log.genericEvent", "duration") && contains("log.genericEvent", "download") && contains("log.genericEvent", "upload")' + where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && equals("log.merakiGroup", "events") && contains("log.genericEvent", "ip") && contains("log.genericEvent", "vap") && contains("log.genericEvent", "duration") && contains("log.genericEvent", "download") && contains("log.genericEvent", "upload")' - trim: function: suffix substring: 'download' fields: - log.vap - where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "ip") && contains("log.genericEvent", "vap") && contains("log.genericEvent", "duration") && contains("log.genericEvent", "download") && contains("log.genericEvent", "upload")' + where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && equals("log.merakiGroup", "events") && contains("log.genericEvent", "ip") && contains("log.genericEvent", "vap") && contains("log.genericEvent", "duration") && contains("log.genericEvent", "download") && contains("log.genericEvent", "upload")' - trim: function: suffix substring: 'upload' fields: - log.download - where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "ip") && contains("log.genericEvent", "vap") && contains("log.genericEvent", "duration") && contains("log.genericEvent", "download") && contains("log.genericEvent", "upload")' + where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && equals("log.merakiGroup", "events") && contains("log.genericEvent", "ip") && contains("log.genericEvent", "vap") && contains("log.genericEvent", "duration") && contains("log.genericEvent", "download") && contains("log.genericEvent", "upload")' - trim: function: prefix substring: '''' @@ -995,7 +995,7 @@ pipeline: - log.duration - log.download - log.upload - where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "ip") && contains("log.genericEvent", "vap") && contains("log.genericEvent", "duration") && contains("log.genericEvent", "download") && contains("log.genericEvent", "upload")' + where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && equals("log.merakiGroup", "events") && contains("log.genericEvent", "ip") && contains("log.genericEvent", "vap") && contains("log.genericEvent", "duration") && contains("log.genericEvent", "download") && contains("log.genericEvent", "upload")' - trim: function: suffix substring: '''' @@ -1005,14 +1005,14 @@ pipeline: - log.duration - log.download - log.upload - where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "ip") && contains("log.genericEvent", "vap") && contains("log.genericEvent", "duration") && contains("log.genericEvent", "download") && contains("log.genericEvent", "upload")' + where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && equals("log.merakiGroup", "events") && contains("log.genericEvent", "ip") && contains("log.genericEvent", "vap") && contains("log.genericEvent", "duration") && contains("log.genericEvent", "download") && contains("log.genericEvent", "upload")' # Adding action result - add: function: 'string' params: key: actionResult value: 'accepted' - where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "ip") && contains("log.genericEvent", "vap") && contains("log.genericEvent", "duration") && contains("log.genericEvent", "download") && contains("log.genericEvent", "upload")' + where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && equals("log.merakiGroup", "events") && contains("log.genericEvent", "ip") && contains("log.genericEvent", "vap") && contains("log.genericEvent", "duration") && contains("log.genericEvent", "download") && contains("log.genericEvent", "upload")' # ........................................ # Event: event wireless packet flood detected in Meraki MR Access Points - grok: @@ -1050,49 +1050,49 @@ pipeline: - fieldName: log.interArrival pattern: '{{.greedy}}' source: log.genericEvent - where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "packet") && contains("log.genericEvent", "device") && contains("log.genericEvent", "state") && contains("log.genericEvent", "alarm_id") && contains("log.genericEvent", "dos_count")' + where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && equals("log.merakiGroup", "events") && contains("log.genericEvent", "packet") && contains("log.genericEvent", "device") && contains("log.genericEvent", "state") && contains("log.genericEvent", "alarm_id") && contains("log.genericEvent", "dos_count")' - trim: function: suffix substring: 'packet' fields: - action - where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "packet") && contains("log.genericEvent", "device") && contains("log.genericEvent", "state") && contains("log.genericEvent", "alarm_id") && contains("log.genericEvent", "dos_count")' + where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && equals("log.merakiGroup", "events") && contains("log.genericEvent", "packet") && contains("log.genericEvent", "device") && contains("log.genericEvent", "state") && contains("log.genericEvent", "alarm_id") && contains("log.genericEvent", "dos_count")' - trim: function: suffix substring: 'device' fields: - log.packet - where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "packet") && contains("log.genericEvent", "device") && contains("log.genericEvent", "state") && contains("log.genericEvent", "alarm_id") && contains("log.genericEvent", "dos_count")' + where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && equals("log.merakiGroup", "events") && contains("log.genericEvent", "packet") && contains("log.genericEvent", "device") && contains("log.genericEvent", "state") && contains("log.genericEvent", "alarm_id") && contains("log.genericEvent", "dos_count")' - trim: function: suffix substring: 'radio' fields: - origin.mac - where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "packet") && contains("log.genericEvent", "device") && contains("log.genericEvent", "state") && contains("log.genericEvent", "alarm_id") && contains("log.genericEvent", "dos_count")' + where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && equals("log.merakiGroup", "events") && contains("log.genericEvent", "packet") && contains("log.genericEvent", "device") && contains("log.genericEvent", "state") && contains("log.genericEvent", "alarm_id") && contains("log.genericEvent", "dos_count")' - trim: function: suffix substring: 'state' fields: - log.radio - where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "packet") && contains("log.genericEvent", "device") && contains("log.genericEvent", "state") && contains("log.genericEvent", "alarm_id") && contains("log.genericEvent", "dos_count")' + where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && equals("log.merakiGroup", "events") && contains("log.genericEvent", "packet") && contains("log.genericEvent", "device") && contains("log.genericEvent", "state") && contains("log.genericEvent", "alarm_id") && contains("log.genericEvent", "dos_count")' - trim: function: suffix substring: 'alarm_id' fields: - log.state - where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "packet") && contains("log.genericEvent", "device") && contains("log.genericEvent", "state") && contains("log.genericEvent", "alarm_id") && contains("log.genericEvent", "dos_count")' + where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && equals("log.merakiGroup", "events") && contains("log.genericEvent", "packet") && contains("log.genericEvent", "device") && contains("log.genericEvent", "state") && contains("log.genericEvent", "alarm_id") && contains("log.genericEvent", "dos_count")' - trim: function: suffix substring: 'dos_count' fields: - log.alarmId - where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "packet") && contains("log.genericEvent", "device") && contains("log.genericEvent", "state") && contains("log.genericEvent", "alarm_id") && contains("log.genericEvent", "dos_count")' + where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && equals("log.merakiGroup", "events") && contains("log.genericEvent", "packet") && contains("log.genericEvent", "device") && contains("log.genericEvent", "state") && contains("log.genericEvent", "alarm_id") && contains("log.genericEvent", "dos_count")' - trim: function: suffix substring: 'inter_arrival' fields: - log.dosCount - where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "packet") && contains("log.genericEvent", "device") && contains("log.genericEvent", "state") && contains("log.genericEvent", "alarm_id") && contains("log.genericEvent", "dos_count")' + where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && equals("log.merakiGroup", "events") && contains("log.genericEvent", "packet") && contains("log.genericEvent", "device") && contains("log.genericEvent", "state") && contains("log.genericEvent", "alarm_id") && contains("log.genericEvent", "dos_count")' - trim: function: prefix substring: '''' @@ -1105,7 +1105,7 @@ pipeline: - log.alarmId - log.state - log.interArrival - where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "packet") && contains("log.genericEvent", "device") && contains("log.genericEvent", "state") && contains("log.genericEvent", "alarm_id") && contains("log.genericEvent", "dos_count")' + where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && equals("log.merakiGroup", "events") && contains("log.genericEvent", "packet") && contains("log.genericEvent", "device") && contains("log.genericEvent", "state") && contains("log.genericEvent", "alarm_id") && contains("log.genericEvent", "dos_count")' - trim: function: suffix substring: '''' @@ -1118,7 +1118,7 @@ pipeline: - log.alarmId - log.state - log.interArrival - where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "packet") && contains("log.genericEvent", "device") && contains("log.genericEvent", "state") && contains("log.genericEvent", "alarm_id") && contains("log.genericEvent", "dos_count")' + where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && equals("log.merakiGroup", "events") && contains("log.genericEvent", "packet") && contains("log.genericEvent", "device") && contains("log.genericEvent", "state") && contains("log.genericEvent", "alarm_id") && contains("log.genericEvent", "dos_count")' # ........................................ # Event: flows, flow allowed by Layer 3 firewall in Meraki MR Access Points - grok: @@ -1150,33 +1150,33 @@ pipeline: - fieldName: target.port pattern: '{{.integer}}' source: log.genericEvent - where: '!equals("log.controlFlag", "Init") && (startsWith("log.genericEvent", "allow") || startsWith("log.genericEvent", "deny")) && log.merakiGroup=="flows" && contains("log.genericEvent", "src") && contains("log.genericEvent", "dst") && contains("log.genericEvent", "sport") && contains("log.genericEvent", "dport") && contains("log.genericEvent", "mac")' + where: '!equals("log.controlFlag", "Init") && (startsWith("log.genericEvent", "allow") || startsWith("log.genericEvent", "deny")) && equals("log.merakiGroup", "flows") && contains("log.genericEvent", "src") && contains("log.genericEvent", "dst") && contains("log.genericEvent", "sport") && contains("log.genericEvent", "dport") && contains("log.genericEvent", "mac")' - trim: function: suffix substring: 'sport' fields: - protocol - where: '!equals("log.controlFlag", "Init") && (startsWith("log.genericEvent", "allow") || startsWith("log.genericEvent", "deny")) && log.merakiGroup=="flows" && contains("log.genericEvent", "src") && contains("log.genericEvent", "dst") && contains("log.genericEvent", "sport") && contains("log.genericEvent", "dport") && contains("log.genericEvent", "mac")' + where: '!equals("log.controlFlag", "Init") && (startsWith("log.genericEvent", "allow") || startsWith("log.genericEvent", "deny")) && equals("log.merakiGroup", "flows") && contains("log.genericEvent", "src") && contains("log.genericEvent", "dst") && contains("log.genericEvent", "sport") && contains("log.genericEvent", "dport") && contains("log.genericEvent", "mac")' - trim: function: suffix substring: 'protocol' fields: - origin.mac - where: '!equals("log.controlFlag", "Init") && (startsWith("log.genericEvent", "allow") || startsWith("log.genericEvent", "deny")) && log.merakiGroup=="flows" && contains("log.genericEvent", "src") && contains("log.genericEvent", "dst") && contains("log.genericEvent", "sport") && contains("log.genericEvent", "dport") && contains("log.genericEvent", "mac")' + where: '!equals("log.controlFlag", "Init") && (startsWith("log.genericEvent", "allow") || startsWith("log.genericEvent", "deny")) && equals("log.merakiGroup", "flows") && contains("log.genericEvent", "src") && contains("log.genericEvent", "dst") && contains("log.genericEvent", "sport") && contains("log.genericEvent", "dport") && contains("log.genericEvent", "mac")' # Adding action result - add: function: 'string' params: key: actionResult value: 'accepted' - where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "allow") && log.merakiGroup=="flows" && contains("log.genericEvent", "src") && contains("log.genericEvent", "dst") && contains("log.genericEvent", "sport") && contains("log.genericEvent", "dport") && contains("log.genericEvent", "mac")' + where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "allow") && equals("log.merakiGroup", "flows") && contains("log.genericEvent", "src") && contains("log.genericEvent", "dst") && contains("log.genericEvent", "sport") && contains("log.genericEvent", "dport") && contains("log.genericEvent", "mac")' # Adding action result - add: function: 'string' params: key: actionResult value: 'denied' - where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "deny") && log.merakiGroup=="flows" && contains("log.genericEvent", "src") && contains("log.genericEvent", "dst") && contains("log.genericEvent", "sport") && contains("log.genericEvent", "dport") && contains("log.genericEvent", "mac")' + where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "deny") && equals("log.merakiGroup", "flows") && contains("log.genericEvent", "src") && contains("log.genericEvent", "dst") && contains("log.genericEvent", "sport") && contains("log.genericEvent", "dport") && contains("log.genericEvent", "mac")' # ........................................ # Event: event rogue SSID detected and SSID spoofing detected in Meraki MR Access Points # First variant diff --git a/filters/google/gcp.yml b/filters/google/gcp.yml index b096faedb..94d8d72c2 100644 --- a/filters/google/gcp.yml +++ b/filters/google/gcp.yml @@ -483,7 +483,7 @@ pipeline: function: "string" params: key: actionResult - value: "failure" + value: "failed" where: 'exists("log.protoPayloadMethodName") && greaterThan("log.protoPayloadStatusCode", 0)' # Adding geolocation to origin.ip diff --git a/filters/linux/linux.yml b/filters/linux/linux.yml index 554eae9c8..0384f866d 100644 --- a/filters/linux/linux.yml +++ b/filters/linux/linux.yml @@ -275,7 +275,7 @@ pipeline: from: - log.JOBRESULT to: actionResult - where: exists("log.JOBRESULT") + where: exists("log.JOBRESULT") && !regexMatch("log.JOBRESULT", "(?i)\b(?:denied|blocked|failed)\b") - rename: from: @@ -418,7 +418,28 @@ pipeline: from: - log.result to: actionResult - where: 'equals("log.type", "auditd") && exists("log.result")' + where: 'equals("log.type", "auditd") && exists("log.result") && !regexMatch("log.result", "(?i)\b(?:denied|blocked|failed)\b")' + + - add: + function: 'string' + params: + key: actionResult + value: 'denied' + where: regexMatch("log.type", "(?i)\bdenied\b") + + - add: + function: 'string' + params: + key: actionResult + value: 'blocked' + where: regexMatch("log.type", "(?i)\bblocked\b") + + - add: + function: 'string' + params: + key: actionResult + value: 'failed' + where: regexMatch("log.type", "(?i)\bfailed\b") # Map exe to origin.process (full path to executable) # Only if journald's COMM didn't already set origin.process diff --git a/filters/office365/o365.yml b/filters/office365/o365.yml index 2127a1783..41ebfa0e0 100755 --- a/filters/office365/o365.yml +++ b/filters/office365/o365.yml @@ -62,11 +62,6 @@ pipeline: - log.ClientIP to: origin.ip - - rename: - from: - - log.ResultStatus - to: actionResult - - rename: from: - log.UserId @@ -92,6 +87,21 @@ pipeline: - log.DestFolder.Path to: log.destFolderPath + # Adding action result + - add: + function: 'string' + params: + key: actionResult + value: 'success' + where: oneOf("log.ResultStatus", ["Succeeded", "Success", "Successful", "PartiallySucceeded", "True"]) + + - add: + function: 'string' + params: + key: actionResult + value: 'failed' + where: oneOf("log.ResultStatus", ["Failure", "Failed"]) + # Adding geolocation to origin ip - dynamic: plugin: com.utmstack.geolocation diff --git a/filters/sophos/sophos_xg_firewall.yml b/filters/sophos/sophos_xg_firewall.yml index feddeaad7..fbd6d1ff1 100644 --- a/filters/sophos/sophos_xg_firewall.yml +++ b/filters/sophos/sophos_xg_firewall.yml @@ -689,14 +689,14 @@ pipeline: params: key: actionResult value: 'denied' - where: exists("log.subType") && equals("log.subType", "Denied") + where: exists("log.subType") && regexMatch("log.subType", "(?i)\bdenied\b") - add: function: 'string' params: key: actionResult value: 'accepted' - where: exists("log.subType") && equals("log.subType", "Accepted") || equals("log.subType", "Allowed") + where: exists("log.subType") && oneOf("log.subType", ["Accepted", "Allowed"]) # Renaming "log.statusCode" to "statusCode" to add it to the event structure - rename: From db1a8870ec71e28812a38dbddc078c22260e37dc Mon Sep 17 00:00:00 2001 From: JocLRojas Date: Fri, 24 Jul 2026 16:32:01 +0300 Subject: [PATCH 2/2] fix(filters): normalize actionResult across 20 remaining filters --- filters/antivirus/bitdefender_gz.yml | 8 ++ filters/antivirus/deceptive-bytes.yml | 8 ++ filters/antivirus/kaspersky.yml | 15 +++ filters/antivirus/sentinel-one.yml | 20 ++++ filters/aws/aws.yml | 20 ++++ filters/cisco/cs_switch.yml | 62 +++++++++- filters/crowdstrike/crowdstrike.yml | 28 +++++ filters/fortinet/fortinet.yml | 20 ++++ filters/fortinet/fortiweb.yml | 8 ++ filters/github/github.yml | 18 +++ filters/ibm/ibm_aix.yml | 14 +++ filters/linux/linux.yml | 7 +- filters/mikrotik/mikrotik-fw.yml | 8 ++ filters/paloalto/pa_firewall.yml | 52 ++++++++ filters/pfsense/pfsense_fw.yml | 16 +++ filters/sonicwall/sonic_wall.yml | 16 +++ filters/sophos/sophos_central.yml | 38 +++++- filters/suricata/suricata.yml | 14 +++ filters/vmware/vmware-esxi.yml | 20 ++++ filters/windows/windows-events.yml | 164 +++++++++++++++----------- 20 files changed, 485 insertions(+), 71 deletions(-) diff --git a/filters/antivirus/bitdefender_gz.yml b/filters/antivirus/bitdefender_gz.yml index fa430da73..aed53eab5 100644 --- a/filters/antivirus/bitdefender_gz.yml +++ b/filters/antivirus/bitdefender_gz.yml @@ -264,6 +264,14 @@ pipeline: - origin.port to: int + # Adding action result + - add: + function: string + params: + key: actionResult + value: "blocked" + where: 'oneOf("action", ["blocked", "quarantined", "deleted", "disinfected"])' + # Removing unused fields - delete: fields: diff --git a/filters/antivirus/deceptive-bytes.yml b/filters/antivirus/deceptive-bytes.yml index c43ab48a5..c44723e0c 100644 --- a/filters/antivirus/deceptive-bytes.yml +++ b/filters/antivirus/deceptive-bytes.yml @@ -450,6 +450,14 @@ pipeline: valueSplit: "=" source: log.pidStatusToKv + # Adding action result + - add: + function: string + params: + key: actionResult + value: "blocked" + where: 'exists("log.action") && oneOf("log.action", ["blocked", "prevented"])' + # Adding severity based on log.severityLabelCharacter - add: function: 'string' diff --git a/filters/antivirus/kaspersky.yml b/filters/antivirus/kaspersky.yml index 1a369cb41..9ed7bcdb4 100644 --- a/filters/antivirus/kaspersky.yml +++ b/filters/antivirus/kaspersky.yml @@ -1102,6 +1102,21 @@ pipeline: destination: target.geolocation where: exists("target.ip") + # Adding action result + - add: + function: string + params: + key: actionResult + value: "Allow" + where: 'oneOf("action", ["Allow", "Allowed"])' + + - add: + function: string + params: + key: actionResult + value: "blocked" + where: 'oneOf("action", ["Block", "Blocked", "blocked", "Redirect", "terminate", "delete", "quarantine"])' + # .......................................................................# # Removing unused fields # .......................................................................# diff --git a/filters/antivirus/sentinel-one.yml b/filters/antivirus/sentinel-one.yml index 3a5ba3f58..e1cf94824 100644 --- a/filters/antivirus/sentinel-one.yml +++ b/filters/antivirus/sentinel-one.yml @@ -363,6 +363,26 @@ pipeline: - log.rt to: log.ruleTime + # Adding action result + - add: + function: string + params: + key: actionResult + value: "failed" + where: 'equals("log.threatStatus", "mitigation_failed")' + - add: + function: string + params: + key: actionResult + value: "failed" + where: 'equals("log.status", "failed") && !exists("actionResult")' + - add: + function: string + params: + key: actionResult + value: "failed" + where: 'contains("log.mitigationStatus", "fail") && !exists("actionResult")' + # Removing unused fields - delete: fields: diff --git a/filters/aws/aws.yml b/filters/aws/aws.yml index b25deca79..811ad01b8 100644 --- a/filters/aws/aws.yml +++ b/filters/aws/aws.yml @@ -217,6 +217,26 @@ pipeline: - log.tlsDetails.tlsVersion to: log.tlsDetailsTlsVersion + # Adding action result + - add: + function: string + params: + key: actionResult + value: "success" + where: 'exists("log.eventName") && !exists("log.errorCode")' + - add: + function: string + params: + key: actionResult + value: "denied" + where: 'equals("log.errorCode", "AccessDenied")' + - add: + function: string + params: + key: actionResult + value: "failed" + where: 'exists("log.errorCode") && !equals("log.errorCode", "AccessDenied")' + - delete: fields: - log.requestParameters diff --git a/filters/cisco/cs_switch.yml b/filters/cisco/cs_switch.yml index 52ef6b6c1..bb06b6def 100644 --- a/filters/cisco/cs_switch.yml +++ b/filters/cisco/cs_switch.yml @@ -133,6 +133,64 @@ pipeline: fields: - log.facilityMnemonic #......................................................................# + # Extract ACL action word from log.ciscoMsg for ACL log events + - grok: + source: log.ciscoMsg + patterns: + - fieldName: "" + pattern: 'list' + - fieldName: log.aclName + pattern: '{{.notSpace}}' + - fieldName: log.aclAction + pattern: '{{.word}}' + where: oneOf("log.facilityMnemonic", ["IPACCESSLOGP", "IPACCESSLOGDP", "IPACCESSLOGRP", "IPACCESSLOGSP", "IPACCESSLOGNP", "ACCESSLOGP", "ACCESSLOGDP", "ACCESSLOGSP", "ACCESSLOGNP", "IPV6ACCESSLOGP"]) + # Handle "access-list" prefix variant (some Cisco IOS variants emit "access-list" instead of "list") + - grok: + source: log.ciscoMsg + patterns: + - fieldName: "" + pattern: 'access-list' + - fieldName: log.aclName + pattern: '{{.notSpace}}' + - fieldName: log.aclAction + pattern: '{{.word}}' + where: 'oneOf("log.facilityMnemonic", ["IPACCESSLOGP", "IPACCESSLOGDP", "IPACCESSLOGRP", "IPACCESSLOGSP", "IPACCESSLOGNP", "ACCESSLOGP", "ACCESSLOGDP", "ACCESSLOGSP", "ACCESSLOGNP", "IPV6ACCESSLOGP"]) && !exists("log.aclAction")' + # Adding action result + - add: + function: string + params: + key: actionResult + value: success + where: equals("log.aclAction", "permitted") + + - add: + function: string + params: + key: actionResult + value: denied + where: equals("log.aclAction", "denied") + + - add: + function: string + params: + key: actionResult + value: failed + where: equals("log.facility", "DOT1X") && equals("log.facilityMnemonic", "FAIL") + + - add: + function: string + params: + key: actionResult + value: success + where: equals("log.facility", "DOT1X") && equals("log.facilityMnemonic", "SUCCESS") + + - add: + function: string + params: + key: actionResult + value: blocked + where: equals("log.facility", "SW_DAI") && oneOf("log.facilityMnemonic", ["DHCP_SNOOPING_DENY", "INVALID_ARP", "ACL_DENY"]) + #......................................................................# # Decoding severity - add: function: 'string' @@ -158,4 +216,6 @@ pipeline: fields: - log.switchHeader - log.irrelevant - - log.tmpFacilityMnemonic \ No newline at end of file + - log.tmpFacilityMnemonic + - log.aclName + - log.aclAction \ No newline at end of file diff --git a/filters/crowdstrike/crowdstrike.yml b/filters/crowdstrike/crowdstrike.yml index ab6bcd03d..560140d6e 100644 --- a/filters/crowdstrike/crowdstrike.yml +++ b/filters/crowdstrike/crowdstrike.yml @@ -667,6 +667,34 @@ pipeline: destination: origin.geolocation where: exists("origin.ip") + # .......................................................................# + # Adding action result + # .......................................................................# + - add: + function: string + params: + key: actionResult + value: "success" + where: 'exists("log.eventSuccess") && oneOf("log.eventSuccess", [true, "true"])' + - add: + function: string + params: + key: actionResult + value: "failed" + where: 'exists("log.eventSuccess") && oneOf("log.eventSuccess", [false, "false"])' + - add: + function: string + params: + key: actionResult + value: "success" + where: 'exists("statusCode") && greaterOrEqual("statusCode", 200) && lessOrEqual("statusCode", 399)' + - add: + function: string + params: + key: actionResult + value: "failed" + where: 'exists("statusCode") && greaterOrEqual("statusCode", 400)' + # .......................................................................# # Normalizing request method and renaming to action # .......................................................................# diff --git a/filters/fortinet/fortinet.yml b/filters/fortinet/fortinet.yml index e8c51bd97..54ecdb9bf 100644 --- a/filters/fortinet/fortinet.yml +++ b/filters/fortinet/fortinet.yml @@ -304,6 +304,26 @@ pipeline: - log.sentpkt to: origin.packagesSent + # Adding action result + - add: + function: string + params: + key: actionResult + value: "accept" + where: 'equals("action", "accept")' + - add: + function: string + params: + key: actionResult + value: "denied" + where: 'equals("action", "deny")' + - add: + function: string + params: + key: actionResult + value: "blocked" + where: 'oneOf("action", ["client-rst", "server-rst", "ip-conn"])' + # Type casting for numeric fields. - cast: fields: diff --git a/filters/fortinet/fortiweb.yml b/filters/fortinet/fortiweb.yml index faaadb56f..686a9356e 100644 --- a/filters/fortinet/fortiweb.yml +++ b/filters/fortinet/fortiweb.yml @@ -95,6 +95,14 @@ pipeline: - log.src_port to: origin.port + # Adding action result + - add: + function: string + params: + key: actionResult + value: "blocked" + where: 'exists("action") && equalsIgnoreCase("action", "Deny")' + # Removing unused caracters - trim: function: prefix diff --git a/filters/github/github.yml b/filters/github/github.yml index 4c3b9c188..7439a3d51 100644 --- a/filters/github/github.yml +++ b/filters/github/github.yml @@ -664,6 +664,24 @@ pipeline: - log.sender.user_view_type to: log.senderUserViewType + # Adding action result + - rename: + from: + - log.workflow_run.conclusion + to: log.conclusion + - add: + function: string + params: + key: actionResult + value: "success" + where: 'equals("log.conclusion", "success")' + - add: + function: string + params: + key: actionResult + value: "failed" + where: 'oneOf("log.conclusion", ["failure", "timed_out", "startup_failure", "action_required"])' + # Removing unused fields - delete: fields: diff --git a/filters/ibm/ibm_aix.yml b/filters/ibm/ibm_aix.yml index 49ec5fb4f..90c9c0bbb 100644 --- a/filters/ibm/ibm_aix.yml +++ b/filters/ibm/ibm_aix.yml @@ -538,6 +538,20 @@ pipeline: - log.objName - log.osUserID + # Adding action result + - add: + function: string + params: + key: actionResult + value: "success" + where: 'exists("log.returnCode") && equals("log.returnCode", "0")' + - add: + function: string + params: + key: actionResult + value: "failed" + where: 'exists("log.returnCode") && !equals("log.returnCode", "0")' + # Adding geolocation to origin.ip - dynamic: plugin: com.utmstack.geolocation diff --git a/filters/linux/linux.yml b/filters/linux/linux.yml index 0384f866d..78110c46f 100644 --- a/filters/linux/linux.yml +++ b/filters/linux/linux.yml @@ -420,26 +420,27 @@ pipeline: to: actionResult where: 'equals("log.type", "auditd") && exists("log.result") && !regexMatch("log.result", "(?i)\b(?:denied|blocked|failed)\b")' + # Adding action result - add: function: 'string' params: key: actionResult value: 'denied' - where: regexMatch("log.type", "(?i)\bdenied\b") + where: regexMatch("log.result", "(?i)\bdenied\b") - add: function: 'string' params: key: actionResult value: 'blocked' - where: regexMatch("log.type", "(?i)\bblocked\b") + where: regexMatch("log.result", "(?i)\bblocked\b") - add: function: 'string' params: key: actionResult value: 'failed' - where: regexMatch("log.type", "(?i)\bfailed\b") + where: regexMatch("log.result", "(?i)\bfailed\b") # Map exe to origin.process (full path to executable) # Only if journald's COMM didn't already set origin.process diff --git a/filters/mikrotik/mikrotik-fw.yml b/filters/mikrotik/mikrotik-fw.yml index aaad776a6..411cd1242 100644 --- a/filters/mikrotik/mikrotik-fw.yml +++ b/filters/mikrotik/mikrotik-fw.yml @@ -205,6 +205,14 @@ pipeline: destination: target.geolocation where: exists("target.ip") + # Adding action result + - add: + function: string + params: + key: actionResult + value: "blocked" + where: 'exists("log.action") && equals("log.action", "drop")' + # Removing unused fields - delete: fields: diff --git a/filters/paloalto/pa_firewall.yml b/filters/paloalto/pa_firewall.yml index cb27985d3..8503e8cde 100644 --- a/filters/paloalto/pa_firewall.yml +++ b/filters/paloalto/pa_firewall.yml @@ -6847,6 +6847,58 @@ pipeline: - log.dstmac to: target.mac + # ................................................# + # Adding action result + # ................................................# + - add: + function: string + params: + key: actionResult + value: "allow" + where: '!exists("log.status") && equalsIgnoreCase("action", "allow")' + + - add: + function: string + params: + key: actionResult + value: "denied" + where: '!exists("log.status") && oneOf("action", ["deny", "Deny"])' + + - add: + function: string + params: + key: actionResult + value: "blocked" + where: '!exists("log.status") && oneOf("action", ["drop", "Drop", "reset-client", "reset-server", "reset-both", "block-url", "block-ip", "random-drop", "sinkhole"])' + + - add: + function: string + params: + key: actionResult + value: "Succeeded" + where: '!exists("log.status") && oneOf("log.result", ["Succeeded", "Submitted"])' + + - add: + function: string + params: + key: actionResult + value: "failed" + where: '!exists("log.status") && oneOf("log.result", ["Failed", "Unauthorized"])' + + - add: + function: string + params: + key: actionResult + value: "success" + where: 'equals("log.status", "success")' + + - add: + function: string + params: + key: actionResult + value: "failed" + where: 'equals("log.status", "failure")' + # ................................................# # Fileds conversions # ................................................# diff --git a/filters/pfsense/pfsense_fw.yml b/filters/pfsense/pfsense_fw.yml index 338f642d3..0cb8fa42c 100644 --- a/filters/pfsense/pfsense_fw.yml +++ b/filters/pfsense/pfsense_fw.yml @@ -319,6 +319,22 @@ pipeline: - log.dstPort to: target.port + # ................................................# + # Adding action result + # ................................................# + - add: + function: string + params: + key: actionResult + value: "pass" + where: 'equalsIgnoreCase("action", "pass")' + - add: + function: string + params: + key: actionResult + value: "blocked" + where: 'equalsIgnoreCase("action", "block")' + # ................................................# # Fileds conversions # ................................................# diff --git a/filters/sonicwall/sonic_wall.yml b/filters/sonicwall/sonic_wall.yml index 05ab41c48..80b37971e 100644 --- a/filters/sonicwall/sonic_wall.yml +++ b/filters/sonicwall/sonic_wall.yml @@ -333,6 +333,22 @@ pipeline: - log.gcat to: string + #......................................................................# + # Adding action result + #......................................................................# + - add: + function: string + params: + key: actionResult + value: "forward" + where: 'equals("action", "forward")' + - add: + function: string + params: + key: actionResult + value: "blocked" + where: 'equals("action", "drop")' + #......................................................................# # Define Syslog Group Category (gcat) Values #......................................................................# diff --git a/filters/sophos/sophos_central.yml b/filters/sophos/sophos_central.yml index 43fc744f6..d915b2fc5 100755 --- a/filters/sophos/sophos_central.yml +++ b/filters/sophos/sophos_central.yml @@ -48,4 +48,40 @@ pipeline: - rename: from: - log.sourceinfo - to: log.sourceInfo \ No newline at end of file + to: log.sourceInfo + + # Adding action result + - add: + function: string + params: + key: actionResult + value: "blocked" + where: 'exists("log.action") && equals("log.action", "blocked")' + + - add: + function: string + params: + key: actionResult + value: "blocked" + where: 'exists("log.type") && contains("log.type", "Prevented") && !exists("actionResult")' + + - add: + function: string + params: + key: actionResult + value: "blocked" + where: 'exists("log.type") && oneOf("log.type", ["Event::Endpoint::HmpaApplicationHijacking", "Event::Endpoint::HmpaPrivGuard"]) && !exists("actionResult")' + + - add: + function: string + params: + key: actionResult + value: "blocked" + where: 'exists("log.type") && contains("log.type", "HmpaCred") && !exists("actionResult")' + + - add: + function: string + params: + key: actionResult + value: "failed" + where: 'exists("log.type") && contains("log.type", "AuthenticationFailure") && !exists("actionResult")' \ No newline at end of file diff --git a/filters/suricata/suricata.yml b/filters/suricata/suricata.yml index a35499f4b..5635ebcaa 100644 --- a/filters/suricata/suricata.yml +++ b/filters/suricata/suricata.yml @@ -151,6 +151,20 @@ pipeline: (equals("log.eventType", "dhcp") && exists("origin.ip") && exists("target.ip") && !equals("log.dhcp.assignedip", "0")) + # Adding action result + - add: + function: string + params: + key: actionResult + value: "allowed" + where: 'exists("log.alert.action") && equals("log.alert.action", "allowed")' + - add: + function: string + params: + key: actionResult + value: "blocked" + where: 'exists("log.alert.action") && equals("log.alert.action", "blocked")' + # Adding geolocation to origin.ip - dynamic: plugin: com.utmstack.geolocation diff --git a/filters/vmware/vmware-esxi.yml b/filters/vmware/vmware-esxi.yml index a415d2e1f..b2f58acc1 100644 --- a/filters/vmware/vmware-esxi.yml +++ b/filters/vmware/vmware-esxi.yml @@ -131,6 +131,26 @@ pipeline: fields: - log.moduleIdentifier + # Adding action result + - add: + function: string + params: + key: actionResult + value: "failed" + where: 'exists("log.message") && contains("log.message", "authentication failed")' + - add: + function: string + params: + key: actionResult + value: "failed" + where: 'exists("log.message") && contains("log.message", "authentication of user") && contains("log.message", "failed") && !exists("actionResult")' + - add: + function: string + params: + key: actionResult + value: "denied" + where: 'exists("log.message") && contains("log.message", "permission denied") && !exists("actionResult")' + # Removing unused fields - delete: fields: diff --git a/filters/windows/windows-events.yml b/filters/windows/windows-events.yml index a8dcceb73..07050d7bd 100644 --- a/filters/windows/windows-events.yml +++ b/filters/windows/windows-events.yml @@ -2344,49 +2344,49 @@ pipeline: params: key: log.failureReasonDescription value: 'The specified user account has expired.' - where: equals("log.eventDataFailureReason", "%%2305") && equals("log.eventCode", 4625) + where: equals("log.eventDataFailureReason", "2305") && equals("log.eventCode", 4625) - add: function: 'string' params: key: log.failureReasonDescription value: 'The password for the specified account has expired' - where: equals("log.eventDataFailureReason", "%%2309") && equals("log.eventCode", 4625) + where: equals("log.eventDataFailureReason", "2309") && equals("log.eventCode", 4625) - add: function: 'string' params: key: log.failureReasonDescription value: 'Account currently disabled' - where: equals("log.eventDataFailureReason", "%%2310") && equals("log.eventCode", 4625) + where: equals("log.eventDataFailureReason", "2310") && equals("log.eventCode", 4625) - add: function: 'string' params: key: log.failureReasonDescription value: 'Account logon time restriction violation' - where: equals("log.eventDataFailureReason", "%%2311") && equals("log.eventCode", 4625) + where: equals("log.eventDataFailureReason", "2311") && equals("log.eventCode", 4625) - add: function: 'string' params: key: log.failureReasonDescription value: 'User not allowed to logon at this computer' - where: equals("log.eventDataFailureReason", "%%2312") && equals("log.eventCode", 4625) + where: equals("log.eventDataFailureReason", "2312") && equals("log.eventCode", 4625) - add: function: 'string' params: key: log.failureReasonDescription value: 'Unknown user name or bad password' - where: equals("log.eventDataFailureReason", "%%2313") && equals("log.eventCode", 4625) + where: equals("log.eventDataFailureReason", "2313") && equals("log.eventCode", 4625) - add: function: 'string' params: key: log.failureReasonDescription value: 'An Error occurred during Logon' - where: equals("log.eventDataFailureReason", "%%2304") && equals("log.eventCode", 4625) + where: equals("log.eventDataFailureReason", "2304") && equals("log.eventCode", 4625) # Decoding the "AccessMask" field when the event code is 4663 and adding the "accessType" and "accessDescription" field - add: @@ -2605,91 +2605,91 @@ pipeline: params: key: log.statusDescription value: 'Account locked out' - where: equals("log.eventDataStatus", "0xC0000234") + where: equals("log.eventDataStatus", "3221226036") - add: function: 'string' params: key: log.statusDescription value: 'Account expired' - where: equals("log.eventDataStatus", "0xC0000193") + where: equals("log.eventDataStatus", "3221225875") - add: function: 'string' params: key: log.statusDescription value: 'Clocks out of sync' - where: equals("log.eventDataStatus", "0xC0000133") + where: equals("log.eventDataStatus", "3221225779") - add: function: 'string' params: key: log.statusDescription value: 'Password change required' - where: equals("log.eventDataStatus", "0xC0000224") + where: equals("log.eventDataStatus", "3221226020") - add: function: 'string' params: key: log.statusDescription value: 'User does not have logon right' - where: equals("log.eventDataStatus", "0xc000015b") + where: equals("log.eventDataStatus", "3221225819") - add: function: 'string' params: key: log.statusDescription value: 'Logon failure' - where: equals("log.eventDataStatus", "0xc000006d") + where: equals("log.eventDataStatus", "3221225581") - add: function: 'string' params: key: log.statusDescription value: 'Account restriction' - where: equals("log.eventDataStatus", "0xc000006e") + where: equals("log.eventDataStatus", "3221225582") - add: function: 'string' params: key: log.statusDescription value: 'An error occurred during logon' - where: equals("log.eventDataStatus", "0xc00002ee") + where: equals("log.eventDataStatus", "3221226222") - add: function: 'string' params: key: log.statusDescription value: 'Password expired' - where: equals("log.eventDataStatus", "0xC0000071") + where: equals("log.eventDataStatus", "3221225585") - add: function: 'string' params: key: log.statusDescription value: 'Account disabled' - where: equals("log.eventDataStatus", "0xC0000072") + where: equals("log.eventDataStatus", "3221225586") - add: function: 'string' params: key: log.statusDescription value: 'Authentication firewall prohibits logon' - where: equals("log.eventDataStatus", "0xC0000413") + where: equals("log.eventDataStatus", "3221226515") - add: function: 'string' params: key: log.statusDescription value: 'Incorrect password' - where: equals("log.eventDataStatus", "0xc000006a") + where: equals("log.eventDataStatus", "3221225578") - add: function: 'string' params: key: log.statusDescription value: 'Account does not exist' - where: equals("log.eventDataStatus", "0xc0000064") + where: equals("log.eventDataStatus", "3221225572") # Decoding the "eventStatus" field when the event code is 4771 and adding the "statusDescription" - add: @@ -2697,322 +2697,354 @@ pipeline: params: key: log.statusDescription value: 'Customer database entry has expired' - where: equals("log.eventDataStatus", "0x1") && equals("log.eventCode", 4771) + where: equals("log.eventDataStatus", "1") && equals("log.eventCode", 4771) - add: function: 'string' params: key: log.statusDescription value: 'The server database entry has expired' - where: equals("log.eventDataStatus", "0x2") && equals("log.eventCode", 4771) + where: equals("log.eventDataStatus", "2") && equals("log.eventCode", 4771) - add: function: 'string' params: key: log.statusDescription value: 'Requested protocol version not supported' - where: equals("log.eventDataStatus", "0x3") && equals("log.eventCode", 4771) + where: equals("log.eventDataStatus", "3") && equals("log.eventCode", 4771) - add: function: 'string' params: key: log.statusDescription value: 'Customer key encrypted in old master key' - where: equals("log.eventDataStatus", "0x4") && equals("log.eventCode", 4771) + where: equals("log.eventDataStatus", "4") && equals("log.eventCode", 4771) - add: function: 'string' params: key: log.statusDescription value: 'Server key encrypted with old master key' - where: equals("log.eventDataStatus", "0x5") && equals("log.eventCode", 4771) + where: equals("log.eventDataStatus", "5") && equals("log.eventCode", 4771) - add: function: 'string' params: key: log.statusDescription value: 'Client not found in Kerberos database' - where: equals("log.eventDataStatus", "0x6") && equals("log.eventCode", 4771) + where: equals("log.eventDataStatus", "6") && equals("log.eventCode", 4771) - add: function: 'string' params: key: log.statusDescription value: 'Server not found in Kerberos database' - where: equals("log.eventDataStatus", "0x7") && equals("log.eventCode", 4771) + where: equals("log.eventDataStatus", "7") && equals("log.eventCode", 4771) - add: function: 'string' params: key: log.statusDescription value: 'Multiple principal entries in database' - where: equals("log.eventDataStatus", "0x8") && equals("log.eventCode", 4771) + where: equals("log.eventDataStatus", "8") && equals("log.eventCode", 4771) - add: function: 'string' params: key: log.statusDescription value: 'The client or server has a null key' - where: equals("log.eventDataStatus", "0x9") && equals("log.eventCode", 4771) + where: equals("log.eventDataStatus", "9") && equals("log.eventCode", 4771) - add: function: 'string' params: key: log.statusDescription value: 'Ticket not eligible for postdating' - where: equals("log.eventDataStatus", "0xA") && equals("log.eventCode", 4771) + where: equals("log.eventDataStatus", "10") && equals("log.eventCode", 4771) - add: function: 'string' params: key: log.statusDescription value: 'Requested start time is later than end time' - where: equals("log.eventDataStatus", "0xB") && equals("log.eventCode", 4771) + where: equals("log.eventDataStatus", "11") && equals("log.eventCode", 4771) - add: function: 'string' params: key: log.statusDescription value: 'KDC policy rejects request' - where: equals("log.eventDataStatus", "0xC") && equals("log.eventCode", 4771) + where: equals("log.eventDataStatus", "12") && equals("log.eventCode", 4771) - add: function: 'string' params: key: log.statusDescription value: 'KDC cannot accommodate requested option' - where: equals("log.eventDataStatus", "0xD") && equals("log.eventCode", 4771) + where: equals("log.eventDataStatus", "13") && equals("log.eventCode", 4771) - add: function: 'string' params: key: log.statusDescription value: 'KDC has no support for encryption type' - where: equals("log.eventDataStatus", "0xE") && equals("log.eventCode", 4771) + where: equals("log.eventDataStatus", "14") && equals("log.eventCode", 4771) - add: function: 'string' params: key: log.statusDescription value: 'KDC has no support for checksum type' - where: equals("log.eventDataStatus", "0xF") && equals("log.eventCode", 4771) + where: equals("log.eventDataStatus", "15") && equals("log.eventCode", 4771) - add: function: 'string' params: key: log.statusDescription value: 'KDC has no support for padata type' - where: equals("log.eventDataStatus", "0x10") && equals("log.eventCode", 4771) + where: equals("log.eventDataStatus", "16") && equals("log.eventCode", 4771) - add: function: 'string' params: key: log.statusDescription value: 'KDC has no support for transited type' - where: equals("log.eventDataStatus", "0x11") && equals("log.eventCode", 4771) + where: equals("log.eventDataStatus", "17") && equals("log.eventCode", 4771) - add: function: 'string' params: key: log.statusDescription value: 'Clients credentials have been revoked' - where: equals("log.eventDataStatus", "0x12") && equals("log.eventCode", 4771) + where: equals("log.eventDataStatus", "18") && equals("log.eventCode", 4771) - add: function: 'string' params: key: log.statusDescription value: 'Credentials for server have been revoked' - where: equals("log.eventDataStatus", "0x13") && equals("log.eventCode", 4771) + where: equals("log.eventDataStatus", "19") && equals("log.eventCode", 4771) - add: function: 'string' params: key: log.statusDescription value: 'TGT has been revoked' - where: equals("log.eventDataStatus", "0x14") && equals("log.eventCode", 4771) + where: equals("log.eventDataStatus", "20") && equals("log.eventCode", 4771) - add: function: 'string' params: key: log.statusDescription value: 'Client not yet valid - try again later' - where: equals("log.eventDataStatus", "0x15") && equals("log.eventCode", 4771) + where: equals("log.eventDataStatus", "21") && equals("log.eventCode", 4771) - add: function: 'string' params: key: log.statusDescription value: 'Server not yet valid - try again later' - where: equals("log.eventDataStatus", "0x16") && equals("log.eventCode", 4771) + where: equals("log.eventDataStatus", "22") && equals("log.eventCode", 4771) - add: function: 'string' params: key: log.statusDescription value: 'Password has expired' - where: equals("log.eventDataStatus", "0x17") && equals("log.eventCode", 4771) + where: equals("log.eventDataStatus", "23") && equals("log.eventCode", 4771) - add: function: 'string' params: key: log.statusDescription value: 'Pre-authentication information was invalid' - where: equals("log.eventDataStatus", "0x18") && equals("log.eventCode", 4771) + where: equals("log.eventDataStatus", "24") && equals("log.eventCode", 4771) - add: function: 'string' params: key: log.statusDescription value: 'Additional pre-authentication required' - where: equals("log.eventDataStatus", "0x19") && equals("log.eventCode", 4771) + where: equals("log.eventDataStatus", "25") && equals("log.eventCode", 4771) - add: function: 'string' params: key: log.statusDescription value: 'Integrity check on decrypted field failed' - where: equals("log.eventDataStatus", "0x1F") && equals("log.eventCode", 4771) + where: equals("log.eventDataStatus", "31") && equals("log.eventCode", 4771) - add: function: 'string' params: key: log.statusDescription value: 'Ticket expired' - where: equals("log.eventDataStatus", "0x20") && equals("log.eventCode", 4771) + where: equals("log.eventDataStatus", "32") && equals("log.eventCode", 4771) - add: function: 'string' params: key: log.statusDescription value: 'Ticket not yet valid' - where: equals("log.eventDataStatus", "0x21") && equals("log.eventCode", 4771) + where: equals("log.eventDataStatus", "33") && equals("log.eventCode", 4771) - add: function: 'string' params: key: log.statusDescription value: 'Request is a replay' - where: equals("log.eventDataStatus", "0x22") && equals("log.eventCode", 4771) + where: equals("log.eventDataStatus", "34") && equals("log.eventCode", 4771) - add: function: 'string' params: key: log.statusDescription value: 'The ticket is not for us' - where: equals("log.eventDataStatus", "0x23") && equals("log.eventCode", 4771) + where: equals("log.eventDataStatus", "35") && equals("log.eventCode", 4771) - add: function: 'string' params: key: log.statusDescription value: 'Ticket and authenticator is not match' - where: equals("log.eventDataStatus", "0x24") && equals("log.eventCode", 4771) + where: equals("log.eventDataStatus", "36") && equals("log.eventCode", 4771) - add: function: 'string' params: key: log.statusDescription value: 'Clock skew too great' - where: equals("log.eventDataStatus", "0x25") && equals("log.eventCode", 4771) + where: equals("log.eventDataStatus", "37") && equals("log.eventCode", 4771) - add: function: 'string' params: key: log.statusDescription value: 'Incorrect net address' - where: equals("log.eventDataStatus", "0x26") && equals("log.eventCode", 4771) + where: equals("log.eventDataStatus", "38") && equals("log.eventCode", 4771) - add: function: 'string' params: key: log.statusDescription value: 'Protocol version mismatch' - where: equals("log.eventDataStatus", "0x27") && equals("log.eventCode", 4771) + where: equals("log.eventDataStatus", "39") && equals("log.eventCode", 4771) - add: function: 'string' params: key: log.statusDescription value: 'Invalid msg type' - where: equals("log.eventDataStatus", "0x28") && equals("log.eventCode", 4771) + where: equals("log.eventDataStatus", "40") && equals("log.eventCode", 4771) - add: function: 'string' params: key: log.statusDescription value: 'Message stream modified' - where: equals("log.eventDataStatus", "0x29") && equals("log.eventCode", 4771) + where: equals("log.eventDataStatus", "41") && equals("log.eventCode", 4771) - add: function: 'string' params: key: log.statusDescription value: 'Message out of order' - where: equals("log.eventDataStatus", "0x2A") && equals("log.eventCode", 4771) + where: equals("log.eventDataStatus", "42") && equals("log.eventCode", 4771) - add: function: 'string' params: key: log.statusDescription value: 'Specified version of key is not available' - where: equals("log.eventDataStatus", "0x2C") && equals("log.eventCode", 4771) + where: equals("log.eventDataStatus", "44") && equals("log.eventCode", 4771) - add: function: 'string' params: key: log.statusDescription value: 'Service key not available' - where: equals("log.eventDataStatus", "0x2D") && equals("log.eventCode", 4771) + where: equals("log.eventDataStatus", "45") && equals("log.eventCode", 4771) - add: function: 'string' params: key: log.statusDescription value: 'Mutual authentication failed' - where: equals("log.eventDataStatus", "0x2E") && equals("log.eventCode", 4771) + where: equals("log.eventDataStatus", "46") && equals("log.eventCode", 4771) - add: function: 'string' params: key: log.statusDescription value: 'Incorrect message direction' - where: equals("log.eventDataStatus", "0x2F") && equals("log.eventCode", 4771) + where: equals("log.eventDataStatus", "47") && equals("log.eventCode", 4771) - add: function: 'string' params: key: log.statusDescription value: 'Alternative authentication method required' - where: equals("log.eventDataStatus", "0x30") && equals("log.eventCode", 4771) + where: equals("log.eventDataStatus", "48") && equals("log.eventCode", 4771) - add: function: 'string' params: key: log.statusDescription value: 'Incorrect sequence number in message' - where: equals("log.eventDataStatus", "0x31") && equals("log.eventCode", 4771) + where: equals("log.eventDataStatus", "49") && equals("log.eventCode", 4771) - add: function: 'string' params: key: log.statusDescription value: 'Inappropriate type of checksum in message' - where: equals("log.eventDataStatus", "0x32") && equals("log.eventCode", 4771) + where: equals("log.eventDataStatus", "50") && equals("log.eventCode", 4771) - add: function: 'string' params: key: log.statusDescription value: 'Generic error (description in e-text)' - where: equals("log.eventDataStatus", "0x3C") && equals("log.eventCode", 4771) + where: equals("log.eventDataStatus", "60") && equals("log.eventCode", 4771) - add: function: 'string' params: key: log.statusDescription value: 'Field is too long for this implementation' - where: equals("log.eventDataStatus", "0x3D") && equals("log.eventCode", 4771) + where: equals("log.eventDataStatus", "61") && equals("log.eventCode", 4771) + + # Adding action result + - add: + function: 'string' + params: + key: actionResult + value: "success" + where: 'oneOf("log.eventCode", [4624, 4648, 4672, 4720, 4722, 4728, 4732, 4756, 4767])' + - add: + function: 'string' + params: + key: actionResult + value: "blocked" + where: 'oneOf("log.eventCode", [4725, 4726, 4740])' + - add: + function: 'string' + params: + key: actionResult + value: "failed" + where: 'oneOf("log.eventCode", [4625, 4771])' + - add: + function: 'string' + params: + key: actionResult + value: "success" + where: 'equals("log.eventCode", 4776) && equals("log.eventDataStatus", "0")' + - add: + function: 'string' + params: + key: actionResult + value: "failed" + where: 'equals("log.eventCode", 4776) && exists("log.eventDataStatus") && !equals("log.eventDataStatus", "0")' - delete: fields: