Skip to content

Commit 3fb01f3

Browse files
mjabascal10mjabascal10
committed
feat: update update bit defender filter
1 parent be153b2 commit 3fb01f3

File tree

1 file changed

+266
-2
lines changed

1 file changed

+266
-2
lines changed

‎backend/src/main/resources/config/liquibase/changelog/20260211001_update_filter_bit_defender.xml‎

Lines changed: 266 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,9 +12,273 @@
1212
UPDATE public.utm_logstash_filter
1313
SET filter_version='3.0.2',
1414
updated_at = now(),
15-
logstash_filter = $$
15+
logstash_filter = $$ # Bitdefender GravityZone filter, version 3.0.2
16+
# Based on https://www.bitdefender.com/business/support/en/77212-237089-event-types.html
17+
# and the previous version of the same filter
18+
19+
pipeline:
20+
- dataTypes:
21+
- antivirus-bitdefender-gz
22+
steps:
23+
# Using grok to parse header of the message
24+
- grok:
25+
patterns:
26+
- fieldName: log.syslogPriority
27+
pattern: '\<{{.data}}\>'
28+
- fieldName: log.syslogVersion
29+
pattern: '{{.integer}}'
30+
- fieldName: log.syslogDeviceTime
31+
pattern: '{{.year}}-{{.monthNumber}}-{{.monthDay}}\w{{.time}}\w'
32+
- fieldName: log.syslogHostIP
33+
pattern: '{{.ipv4}}|{{.ipv6}}|{{.word}}'
34+
- fieldName: log.notDefined
35+
pattern: '{{.integer}}'
36+
- fieldName: log.0trash
37+
pattern: '{{.word}}\:{{.integer}}'
38+
- fieldName: log.restData
39+
pattern: '{{.greedy}}'
40+
source: raw
41+
42+
- grok:
43+
patterns:
44+
- fieldName: log.syslogPriority
45+
pattern: '\<{{.data}}\>'
46+
- fieldName: log.syslogVersion
47+
pattern: '{{.integer}}'
48+
- fieldName: log.syslogDeviceTime
49+
pattern: '{{.year}}-{{.monthNumber}}-{{.monthDay}}\w{{.time}}\w'
50+
- fieldName: log.hostId
51+
pattern: '{{.word}}'
52+
- fieldName: log.0trash
53+
pattern: '{{.word}}'
54+
- fieldName: log.processPid
55+
pattern: '\[{{.integer}}\]'
56+
- fieldName: log.1trash
57+
pattern: '{{.word}}\:{{.integer}}'
58+
- fieldName: log.restData
59+
pattern: '{{.greedy}}'
60+
source: raw
61+
62+
- grok:
63+
patterns:
64+
- fieldName: log.syslogPriority
65+
pattern: '\<{{.data}}\>'
66+
- fieldName: log.syslogDeviceTime
67+
pattern: '{{.year}}-{{.monthNumber}}-{{.monthDay}}\w{{.time}}\w'
68+
- fieldName: log.hostId
69+
pattern: '{{.word}}'
70+
- fieldName: log.0trash
71+
pattern: '{{.word}}'
72+
- fieldName: log.processPid
73+
pattern: '\[{{.integer}}\]'
74+
- fieldName: log.1trash
75+
pattern: '{{.word}}\:{{.integer}}'
76+
- fieldName: log.restData
77+
pattern: '{{.greedy}}'
78+
source: raw
79+
80+
- grok:
81+
patterns:
82+
- fieldName: log.syslogPriority
83+
pattern: '\<{{.data}}\>'
84+
- fieldName: log.syslogVersion
85+
pattern: '{{.integer}}'
86+
- fieldName: log.syslogDeviceTime
87+
pattern: '{{.year}}-{{.monthNumber}}-{{.monthDay}}\w{{.time}}\w'
88+
- fieldName: log.syslogHostIP
89+
pattern: '{{.ipv4}}|{{.ipv6}}|{{.word}}'
90+
- fieldName: log.0trash
91+
pattern: '{{.word}}\:{{.integer}}'
92+
- fieldName: log.restData
93+
pattern: '{{.greedy}}'
94+
source: raw
95+
96+
- grok:
97+
patterns:
98+
- fieldName: log.syslogPriority
99+
pattern: '\<{{.data}}\>'
100+
- fieldName: log.syslogVersion
101+
pattern: '{{.integer}}'
102+
- fieldName: log.syslogDeviceTime
103+
pattern: '{{.year}}-{{.monthNumber}}-{{.monthDay}}\w{{.time}}\w'
104+
- fieldName: log.restData
105+
pattern: '{{.greedy}}'
106+
source: raw
107+
108+
- grok:
109+
patterns:
110+
- fieldName: log.syslogPriority
111+
pattern: '\<{{.data}}\>'
112+
- fieldName: log.0trash
113+
pattern: '{{.word}}\:{{.integer}}'
114+
- fieldName: log.restData
115+
pattern: '{{.greedy}}'
116+
source: raw
117+
118+
- grok:
119+
patterns:
120+
- fieldName: log.cefVersion
121+
pattern: 'CEF\:{{.integer}}'
122+
- fieldName: log.restData
123+
pattern: '{{.greedy}}'
124+
source: raw
125+
126+
# Using grok to parse components of the cef_message
127+
- grok:
128+
patterns:
129+
- fieldName: log.productVendor
130+
pattern: '\|{{.data}}\|'
131+
- fieldName: log.product
132+
pattern: '{{.data}}\|'
133+
- fieldName: log.productVersion
134+
pattern: '{{.data}}\|'
135+
- fieldName: log.signatureID
136+
pattern: '{{.data}}\|'
137+
- fieldName: log.eventType
138+
pattern: '{{.data}}\|'
139+
- fieldName: log.severity
140+
pattern: '{{.data}}\|'
141+
- fieldName: log.restData
142+
pattern: '{{.greedy}}'
143+
source: log.restData
144+
145+
# Using grok to parse kv issued fields with space
146+
- grok:
147+
patterns:
148+
- fieldName: log.2trash
149+
pattern: '{{.data}}dvc='
150+
- fieldName: log.dvcToParse
151+
pattern: '{{.data}}{{.word}}\='
152+
- fieldName: log.irrelevant
153+
pattern: '{{.greedy}}'
154+
source: log.restData
155+
156+
- grok:
157+
patterns:
158+
- fieldName: log.2trash
159+
pattern: '{{.data}}request='
160+
- fieldName: log.requestToParse
161+
pattern: '{{.data}}{{.word}}\='
162+
- fieldName: log.irrelevant
163+
pattern: '{{.greedy}}'
164+
source: log.restData
165+
166+
# Applying grok to remove unnecessary data
167+
- grok:
168+
patterns:
169+
- fieldName: log.deviceIps
170+
pattern: '{{.greedy}}{{.space}}'
171+
- fieldName: log.irrelevant
172+
pattern: '{{.greedy}}'
173+
source: log.dvcToParse
174+
175+
- grok:
176+
patterns:
177+
- fieldName: log.requested
178+
pattern: '{{.greedy}}{{.space}}'
179+
- fieldName: log.irrelevant
180+
pattern: '{{.greedy}}'
181+
source: log.requestToParse
182+
183+
# Using the kv filter with default config, usefull in key-value logs
184+
- kv:
185+
fieldSplit: " "
186+
valueSplit: "="
187+
source: log.restData
188+
189+
# Renaming useful fields
190+
- rename:
191+
from:
192+
- log.spt
193+
to: origin.port
194+
195+
- rename:
196+
from:
197+
- log.src
198+
to: origin.ip
199+
200+
- rename:
201+
from:
202+
- log.sproc
203+
to: origin.path
204+
205+
- rename:
206+
from:
207+
- log.filePath
208+
to: origin.path
209+
210+
# Removing unnecessary characters
211+
- trim:
212+
function: prefix
213+
substring: '|'
214+
fields:
215+
- log.productVendor
216+
217+
- trim:
218+
function: suffix
219+
substring: '|'
220+
fields:
221+
- log.productVendor
222+
- log.product
223+
- log.productVersion
224+
- log.signatureID
225+
- log.eventType
226+
- log.severityLabel
227+
228+
- trim:
229+
function: prefix
230+
substring: '<'
231+
fields:
232+
- log.syslogPriority
233+
234+
- trim:
235+
function: suffix
236+
substring: '>'
237+
fields:
238+
- log.syslogPriority
239+
240+
- trim:
241+
function: prefix
242+
substring: '['
243+
fields:
244+
- log.processPid
245+
246+
- trim:
247+
function: suffix
248+
substring: ']'
249+
fields:
250+
- log.processPid
251+
252+
# Adding geolocation to origin ip
253+
- dynamic:
254+
plugin: com.utmstack.geolocation
255+
params:
256+
source: origin.ip
257+
destination: origin.geolocation
258+
where: exists("origin.ip")
259+
260+
# Reformat and field conversions
261+
- cast:
262+
fields:
263+
- origin.port
264+
to: int
265+
266+
# Removing unused fields
267+
- delete:
268+
fields:
269+
- log.0trash
270+
- log.1trash
271+
- log.restData
272+
- log.irrelevant
273+
- log.spt
274+
- log.src
275+
- log.sproc
276+
- log.filePath
277+
- log.dvc
278+
- log.request
279+
- log.dvcToParse
16280
$$
17-
WHERE id = 1524;
281+
WHERE id = 1514;
18282
]]>
19283
</sql>
20284
</changeSet>

0 commit comments

Comments
 (0)