Skip to content

Commit 0d296ca

Browse files
mjabascal10mjabascal10
committed
feat: add sophos, m365 and aws filters
1 parent ed49f2f commit 0d296ca

5 files changed

Lines changed: 48 additions & 45 deletions

File tree

‎backend/src/main/resources/config/liquibase/changelog/20240403003_adding_aix.xml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -197,8 +197,8 @@ AS
197197
if ![dataType] {
198198
# The log destination is already identified by the agent so, don''t need an entry point
199199
#......................................................................#
200-
201-
#......................................................................#
200+
201+
#......................................................................#
202202
#Generating dataType field required by CurrelationRulesEngine
203203
mutate {
204204
add_field => { "dataType" => "ibm-aix" }
@@ -225,7 +225,7 @@ AS
225225
if [msg_all]{
226226
#...................................................................#
227227
#Checking that the message contains TTY= or PWD= or COMMAND= or USER=
228-
if (("TTY=" in [msg_all] and ";" in [msg_all]) or ("PWD=" in [msg_all] and ";" in [msg_all]) or ("USER=" in [msg_all] and ";" in [msg_all]) or
228+
if (("TTY=" in [msg_all] and ";" in [msg_all]) or ("PWD=" in [msg_all] and ";" in [msg_all]) or ("USER=" in [msg_all] and ";" in [msg_all]) or
229229
("COMMAND=" in [msg_all] and ";" in [msg_all])){
230230
#......................................................................#
231231
#Using grok to parse msg_all
@@ -328,15 +328,15 @@ AS
328328
}
329329
}
330330
}
331-
331+
332332
}else{
333333
grok {
334334
match => {
335335
"msg_init" => "%{WORD:eventType}: %{DATA:irrelevant}\[%{INT:PID}\] %{GREEDYDATA:msg}"
336336
}
337337
}
338338
}
339-
339+
340340
}
341341
#.....................................................................#
342342
#Generating dataSource field required by Correlation Engine

backend/src/main/resources/config/liquibase/changelog/20250527001_update_filter_sophos_central.xml renamed to backend/src/main/resources/config/liquibase/changelog/20250528001_insert_filter_sophos_central.xml

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,14 @@
11
<?xml version="1.0" encoding="utf-8"?>
22
<databaseChangeLog
3-
xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
4-
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
5-
xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-3.5.xsd">
3+
xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
4+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
5+
xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-3.5.xsd">
66

7-
<changeSet id="20250527001" author="JocLRojas">
8-
9-
<sql dbms="postgresql" splitStatements="true" stripComments="true">
7+
<changeSet id="20250528001" author="JocLRojas">
8+
<sql>
109
<![CDATA[
11-
12-
UPDATE public.utm_logstash_filter
13-
SET filter_version='1.0.0',
14-
logstash_filter='# Sophos_Central filter, version 1.0.0 using "SF syslog file guide 20.0"
10+
INSERT INTO utm_logstash_filter (id, logstash_filter, filter_name, filter_group_id, system_owner, module_name, is_active, filter_version, data_type_id)
11+
VALUES (1527, '# Sophos_Central filter using "SF syslog file guide 20.0", version 1.0.0
1512
1613
# See: https://docs.sophos.com/nsg/sophos-firewall/20.0/pdf/sf-syslog-guide-20.0.pdf
1714
# and https://docs.sophos.com/nsg/sophos-firewall/20.0/Help/en-us/webhelp/onlinehelp/AdministratorHelp/Logs/TroubleshootingLogs/LogFileDetails/index.html#https-ftp-waf
@@ -61,9 +58,12 @@ pipeline:
6158
- rename:
6259
from:
6360
- log.sourceinfo
64-
to: log.sourceInfo'
65-
WHERE id=1527;
61+
to: log.sourceInfo', 'sophos-central', null, true, 'SOPHOS', false, '1.0.0', 30);
62+
63+
INSERT INTO utm_group_logstash_pipeline_filters (filter_id, pipeline_id, relation)
64+
VALUES (1527, 52, 'PIPELINE_FILTER');
6665
]]>
6766
</sql>
6867
</changeSet>
69-
</databaseChangeLog>
68+
69+
</databaseChangeLog>

backend/src/main/resources/config/liquibase/changelog/20250527002_update_filter_m365.xml renamed to backend/src/main/resources/config/liquibase/changelog/20250528002_insert_filter_o365.xml

Lines changed: 14 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,20 @@
11
<?xml version="1.0" encoding="utf-8"?>
22
<databaseChangeLog
3-
xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
4-
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
5-
xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-3.5.xsd">
3+
xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
4+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
5+
xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-3.5.xsd">
66

7-
<changeSet id="20250527002" author="JocLRojas">
8-
9-
<sql dbms="postgresql" splitStatements="true" stripComments="true">
7+
<changeSet id="20250528002" author="JocLRojas">
8+
<sql>
109
<![CDATA[
10+
INSERT INTO utm_logstash_filter (id, logstash_filter, filter_name, filter_group_id, system_owner, module_name, is_active, filter_version, data_type_id)
11+
VALUES (1528, '# Microsoft 365 filter, version 1.0.0
1112
12-
UPDATE public.utm_logstash_filter
13-
SET filter_version='1.0.0',
14-
logstash_filter='# Microsoft 365 filter, version 1.0.0
1513
# Based on Official documentation
1614
# See https://learn.microsoft.com/en-us/compliance/assurance/assurance-microsoft-365-audit-log-collection
1715
# https://learn.microsoft.com/es-es/office/office-365-management-api/aip-unified-audit-logs-best-practices
1816
# https://learn.microsoft.com/en-us/purview/audit-log-activities
17+
1918
pipeline:
2019
- dataTypes:
2120
- o365
@@ -95,9 +94,12 @@ pipeline:
9594
# Removing unused fields
9695
- delete:
9796
fields:
98-
- log.AppAccessContext'
99-
WHERE id=1527;
97+
- log.AppAccessContext', 'o365', null, true, 'O365', false, '1.0.0', 4);
98+
99+
INSERT INTO utm_group_logstash_pipeline_filters (filter_id, pipeline_id, relation)
100+
VALUES (1528, 54, 'PIPELINE_FILTER');
100101
]]>
101102
</sql>
102103
</changeSet>
103-
</databaseChangeLog>
104+
105+
</databaseChangeLog>

backend/src/main/resources/config/liquibase/changelog/20250527003_update_filter_aws.xml renamed to backend/src/main/resources/config/liquibase/changelog/20250528003_insert_filter_aws.xml

Lines changed: 13 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,15 @@
11
<?xml version="1.0" encoding="utf-8"?>
22
<databaseChangeLog
3-
xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
4-
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
5-
xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-3.5.xsd">
3+
xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
4+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
5+
xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-3.5.xsd">
66

7-
<changeSet id="20250527002" author="JocLRojas">
8-
9-
<sql dbms="postgresql" splitStatements="true" stripComments="true">
7+
<changeSet id="20250528003" author="JocLRojas">
8+
<sql>
109
<![CDATA[
1110
12-
UPDATE public.utm_logstash_filter
13-
SET filter_version='1.0.0',
14-
logstash_filter='# AWS filter, version 1.0.0
11+
INSERT INTO utm_logstash_filter (id, logstash_filter, filter_name, filter_group_id, system_owner, module_name, is_active, filter_version, data_type_id)
12+
VALUES (1529, '# AWS filter, version 1.0.0
1513
1614
pipeline:
1715
- dataTypes:
@@ -1523,9 +1521,12 @@ pipeline:
15231521
- log.requestParameters
15241522
- log.responseElements
15251523
- log.userIdentity
1526-
- log.additionalEventData'
1527-
WHERE id=1527;
1524+
- log.additionalEventData', 'aws', null, true, 'AWS_IAM_USER', false, '1.0.0', 2);
1525+
1526+
INSERT INTO utm_group_logstash_pipeline_filters (filter_id, pipeline_id, relation)
1527+
VALUES (1529, 53, 'PIPELINE_FILTER');
15281528
]]>
15291529
</sql>
15301530
</changeSet>
1531-
</databaseChangeLog>
1531+
1532+
</databaseChangeLog>

‎backend/src/main/resources/config/liquibase/master.xml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -218,10 +218,10 @@
218218

219219
<include file="/config/liquibase/changelog/20250516001_udpate_sophos_name.xml" relativeToChangelogFile="false"/>
220220

221-
<include file="/config/liquibase/changelog/20250527001_update_filter_sophos_central.xml" relativeToChangelogFile="false"/>
221+
<include file="/config/liquibase/changelog/20250528001_insert_filter_sophos_central.xml" relativeToChangelogFile="false"/>
222222

223-
<include file="/config/liquibase/changelog/20250527002_update_filter_m365.xml" relativeToChangelogFile="false"/>
223+
<include file="/config/liquibase/changelog/20250528002_insert_filter_o365.xml" relativeToChangelogFile="false"/>
224224

225-
<include file="/config/liquibase/changelog/20250527003_update_filter_aws.xml" relativeToChangelogFile="false"/>
225+
<include file="/config/liquibase/changelog/20250528003_insert_filter_aws.xml" relativeToChangelogFile="false"/>
226226

227227
</databaseChangeLog>

0 commit comments

Comments
 (0)